{ "Event": { "published": true, "date": "2022-06-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-06-25", "timestamp": 1656201782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8a11abbb-c95e-44c3-9cfc-22aa0dc642dc", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321e8142-f46c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656150607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "f39762e0-530a-4ca4-96b0-b09bc3f12485", "comment": "Malware payload (Mirai)", "value": "f890b9b36a4199fafc54af550b04cd8d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "7072eb16-41f0-417b-8ad9-b0026057bae3", "comment": "Malware payload (Mirai)", "value": "01403faaa890ebf8bd1f41b81f49bc633f642516b9b466c14cbcb197bce16bbe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "ad8bc778-3147-41c6-ba25-c96a9b87d8fa", "comment": "Malware payload (Mirai)", "value": "36c3202bfbe02c28c795e55185f8ba53203e2378", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "96e11245-b9b5-4eb8-831b-f7ee85337d8b", "comment": "Malware payload (Mirai)", "value": "f378aa5a98a90ab8446c5ac3b33affd79bf75c6bf5e7f014105ff9286243bcd6350e8a476a9b5dc0569c560478bab51e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150607, "uuid": "7d6df407-c14d-4696-941c-ac81547a526a", "value": "T1263302726B6E6AE291B05777FC33AC19529C17F89C6730DA3CF4A51967C18024EF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150607, "uuid": "f2be006b-e952-41fd-9f40-6d1114ce373a", "value": "1536:s9O/ZMAXIxNUk02nLcPqF1aBexo4opKZbp:s9O/ZNKyWLGqFUFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656150607, "uuid": "9b448576-7822-45a6-905a-9452bdf93c58", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656150607, "uuid": "8eb0c779-8cda-4c6a-b5a0-50c4774a24f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150607, "uuid": "9c608de7-26c8-4e6b-ae2b-2b76240df4b7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5675e4f6-f485-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656161406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161406, "uuid": "71d32ff6-9925-4bc2-a574-93fa004f28e9", "comment": "Malware payload (Mirai)", "value": "702bca9bc243387d8b50af7e77c032cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161406, "uuid": "6779dec6-0b83-45cf-93cc-ee41c42a5198", "comment": "Malware payload (Mirai)", "value": "01b3e1f7d2694c10c3ef9af293295943f7d0bde2bcab4dbc75863c99ade238f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161406, "uuid": "ecd654f2-bb9d-4959-9afa-53c9c929f91d", "comment": "Malware payload (Mirai)", "value": "70a39c9c0cecc4a82320d982f3f56c2f5d1d8f48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161406, "uuid": "01707b56-a84f-4501-9244-bb5bc0fc59af", "comment": "Malware payload (Mirai)", "value": "2b4938f103db40ff1be1c87b6e622f9ab63e9b325c4e900af9a7d0a24075acc585be01ba9236da80fa979ce95eb9c18b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161406, "uuid": "947c2e0e-061b-4722-a352-6db5a1846009", "value": "T12F32D8668683E5FCCCAAC3B8416FF93A9132F42E2267B6457798F727DD5EC21661D000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161406, "uuid": "fc5f06da-df19-47e1-8a08-580e7a120ac3", "value": "192:GGTZYpbPeLZWkq+eu0l+052gIcD3cuisbyDIAQfOWwb:/TZYpT2ZWkq+D0lx2BchiF8AKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161406, "uuid": "e4c178a0-bc5d-4739-967c-70adda5d28b9", "value": 11496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161406, "uuid": "f93fb0b2-6164-40c7-a75b-b766c419c013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161406, "uuid": "08a0f0a9-d8f8-475c-8237-634ecad10db2", "value": "leo.x86-20220625-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae78d54b-f457-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1656141796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141796, "uuid": "c6ceae38-a86a-4250-b1d8-3c19fc7b1245", "comment": "Malware payload (Vjw0rm)", "value": "b4d2f443f05f58a96cb91b6d49f3a94e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141796, "uuid": "b5d66bbf-3a09-4bcd-b1ba-bd766baadd97", "comment": "Malware payload (Vjw0rm)", "value": "04a29f2129342754634281d655ea4d01ee9197fdb25698a3683bf724e95af3e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141796, "uuid": "4f233ead-4ef4-414b-8321-8229bce4c366", "comment": "Malware payload (Vjw0rm)", "value": "f91885a8a8c5acb059a33a9a2f6b137aafac117c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141796, "uuid": "b6763946-13f1-44e7-a713-0dae9b679abc", "comment": "Malware payload (Vjw0rm)", "value": "2e759586de376cb619536d7004a2d0cedb6d10c4f30d518a18ffaaec2143b74c2b612ae232a9d6e8c1155701f4d2f64e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141796, "uuid": "56057c74-3b39-4975-8096-68e306e4dfbe", "value": "T1AE727CC83E8581F3F75C6DD38C75A98C627096F7D10A606BB79ABE8406B12039C0795E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141796, "uuid": "bec95462-b52d-4ff6-b1aa-787d83c73e21", "value": "384:GouKjszhAdiTfJGoRmsmnuF9oEo+vgJ6isD19CsWV9/MRJ/DsTytHkCCqMe:sQKQozuCgLCQs+MQTxqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141796, "uuid": "6e06ab52-1b51-4150-8665-b1b6ce5b28e1", "value": 16177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141796, "uuid": "db596bb9-b2e0-498d-b6d6-5912bada23da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141796, "uuid": "f3a782e6-edc5-4488-87c4-3fc2a4d2cb2a", "value": "eVoucher.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064da431-f429-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656121757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121757, "uuid": "b1927084-cb67-48f8-8d16-1fdd0e0eb4fb", "comment": "Malware payload", "value": "467721f93f996e9cd32aa5934cdf6dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121757, "uuid": "0c9e5a86-cc0b-4526-9c39-e95680b5f283", "comment": "Malware payload", "value": "06a8a0cdefdff7c5fea9e0597c88458b16165963a9b0e2a3ae6c6920148b077d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121757, "uuid": "42e17c5c-a5bc-413d-bf9e-36478580cb3a", "comment": "Malware payload", "value": "a451ae23bf7d4920bbe9b58172469e6f817b6aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121757, "uuid": "c8f1d323-d625-49d1-bca4-1984de7fccf1", "comment": "Malware payload", "value": "8cdcd29fde90209dbe951ff70988e36904eb8b0a25c3ea14cda80d5908090a6878f4b9315d3642938637acffbb6bea5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121757, "uuid": "6ba8e404-9154-4f0e-9d90-9af1f7073349", "value": "T142B54609A187E27BFCEC08A3455080D0C2AC7FAA7B528DCDE97AD586541F442F7B6D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121757, "uuid": "e017e04d-97b8-44fb-82a8-a7a8219648dc", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121757, "uuid": "ab3625d4-5cb3-4e6d-b219-2725514985ed", "value": "24576:I/XEXjJSFHUK2/mXVwp7QYR5WVrmUz3Lo3mJbsXHsokrhbrAGP1AOgEqVqd/i5jv:I/oSupO2mJJok5HqOgEqVqhi5N/CTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656121757, "uuid": "7ce53de9-efe4-48ea-85f9-8999c8a859ac", "value": 2290343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656121757, "uuid": "302bc58b-ebed-439c-a44d-45c9261148e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121757, "uuid": "67d3cac5-be91-4f70-8eb0-7ea611e88c42", "value": "SecuriteInfo.com.Variant.Fugrafa.249470.8167.8990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a43f9f2-f4a7-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656176015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176015, "uuid": "bc37ac75-29b6-4c7e-8720-91a588aadafd", "comment": "Malware payload (AgentTesla)", "value": "987b973779ac4c5b4d8f30a8d433ca75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176015, "uuid": "f251b4c3-665a-44e0-b5a9-5d83f54fbed9", "comment": "Malware payload (AgentTesla)", "value": "087481c31ea671aab551b2ff92a5415b606679a0813846e36f7b0708dc26ed6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176015, "uuid": "7f8c0a2e-0750-4722-a0e6-e691bbe1ee33", "comment": "Malware payload (AgentTesla)", "value": "9d6ec5ad0f05484477cc9dd08aaeef38989756ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176015, "uuid": "0f604b70-8da3-474f-8597-736a874bfdfc", "comment": "Malware payload (AgentTesla)", "value": "2b1e49e02e9f8f8312225c1d4b7b5cd825980b6ce1c1afd8b96e495c7e740d8c4a306d75f86f5823f80fedd1e9031a5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176015, "uuid": "2adc8864-6550-46e2-a6fa-dbf3a966716e", "value": "T1B6F4D69C721871DED967C175CA741C68EA607C6F931B4107A01B35ADAE3CA83EF264F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176015, "uuid": "9cfeb87f-4968-4a10-92c0-600f9c799b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176015, "uuid": "91b5d12d-91b1-4b0f-88a1-d7596f85ccea", "value": "12288:3Y2iNzMJR/Q0rc4t+ECQzVTgIdcg/nuh8WbyLJrS8zwGd6F/fzXqWP8bzU4CdjuZ:I1wRI4+ECyV0IluS5LJDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656176015, "uuid": "87cc9367-5e5f-4e1f-b135-2c4a561f2c3e", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656176015, "uuid": "68bd3f2b-95a8-40f7-8b32-744bfd8cdb07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176015, "uuid": "3d94399e-a186-43ec-a200-187bfb386a0f", "value": "SWIFT COPY $159,000.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f306d2-f430-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656125027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125027, "uuid": "b8bf8ac5-45c2-47da-ac07-8e4748963377", "comment": "Malware payload (Mirai)", "value": "ca80fb4dded360a7d46ddfb821493a2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125027, "uuid": "cdab26df-0875-4562-b68c-6af9f3f65fe4", "comment": "Malware payload (Mirai)", "value": "089f819dfd2f1fecc5f028e7a5d93f32f3f11c3eecb97393f8aed826d2d9c319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125027, "uuid": "d317a21b-b6ad-48c7-bce5-f4195e6a8cf5", "comment": "Malware payload (Mirai)", "value": "00b8f5b6463bd58e82e634786e3b0b265233f862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125027, "uuid": "b8941aec-8fb7-4ee0-b561-bf83eb65c621", "comment": "Malware payload (Mirai)", "value": "2e3fffddd75dc0bcd22bfa022aad71e9a8f541c16d6c13584dfa207c6664718e36638b3ad590dfccce993e49ba366596", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125027, "uuid": "93d49390-ca10-41ed-9437-d3f4c098e98b", "value": "T1F2C2E12382D7DD30E0B10932FDF78A82679B17F8E3EB361652484FB8664401E65FD295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125027, "uuid": "a2ef4dc1-a822-495b-a847-52b234fed37e", "value": "768:phAkhLqA05ZRnbLEv8bC7AztwVIl8s3Uoz+:phNhLq9LE0Z3l5z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656125027, "uuid": "bb192008-502f-4307-a1d9-fdafa00274d5", "value": 26856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656125027, "uuid": "fb47cdd5-6105-4799-84f8-fbada8f46f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125027, "uuid": "877d913f-7062-4a7b-b994-22a4e47d342a", "value": "SecuriteInfo.com.Linux.Mirai.2698.19412.17424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc8b8a0-f4b2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656180906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180906, "uuid": "003c9856-bf21-4e97-9af5-363721990b9c", "comment": "Malware payload", "value": "9c84650b47f8a63ee611ee2482b4c2e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180906, "uuid": "091aaebe-f067-42b7-a01d-9d9e570c6b66", "comment": "Malware payload", "value": "094e430bdd1596a8aa7db9b1d7f2fd2707d134aa1fe9df492e28a0dbf6be29b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180906, "uuid": "71711a21-51df-4aa8-8311-99eec71b3ec0", "comment": "Malware payload", "value": "90b0477b12b3c29a94f1a9dbb0f965cdd764cd3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180906, "uuid": "d20debaf-d90e-42af-9a6f-0f9c81dfdad3", "comment": "Malware payload", "value": "72fca4a39b23cffdb3182828ffc3f3d67a64627c81e955fd845a4a1596fc7a5b9d514e8111fd293a46d508510d4768b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656180906, "uuid": "e40d3207-90c9-41b1-a13d-f5a59a79740a", "value": "T153E2D606B6BC8F26DC7C87FD6522104917F0716BB691E7854DCBB1D72936F200A21EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656180906, "uuid": "e9e235d3-d8df-4e81-b6e5-fd631ac54fb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656180906, "uuid": "05417e07-34da-46df-b33e-ff2fcbb102d4", "value": "768:gHZLbt+GuxK1kyXc74Zqn9cYJDWjGuglEO4g:sRckCFJDG5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656180906, "uuid": "af59e9ff-ac8c-4c79-9e67-bdb64854e3aa", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656180906, "uuid": "2deb022c-4a42-4633-b8cb-dae3cf1a13ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656180906, "uuid": "4cabf8b9-f5de-4a70-bedd-f32ef13b6ed9", "value": "06-21-2022 Order _8678498578378598489304885909394899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361fd80c-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "b15648cb-3a3c-44ea-af65-0bda912554d1", "comment": "Malware payload (Mirai)", "value": "b853748d7bb977f45ee71ecf6c02470f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "73580efd-21d2-473f-b7e7-b51c626133dc", "comment": "Malware payload (Mirai)", "value": "09817ee5f9e80be72c57e1817d8e2af9a96a0d4522e47ce04e5db26fff50fca4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "8c03bb50-3d0b-4d92-a20d-33a710f03e0b", "comment": "Malware payload (Mirai)", "value": "f1aed719056fed7902adfbac209c1701e0fa3def", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "8d788ab1-2354-40f3-9585-9adeadb50a96", "comment": "Malware payload (Mirai)", "value": "938cb433091a7ce200886711943ba5c6351f3923d4de52c325c95ae74df57dfc6654de91d2a0c621c53cafa98229d6c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "a4097fec-82ac-4041-b2cc-1a7505d99887", "value": "T18892DF308B4DED718A150CF4F63AC6864BABE2BE61F815C4508D2328B71792FA5B0587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "34128378-c199-471d-b1bf-e10e8536ca80", "value": "384:m2auMstBLHGF2SEDZp5uDI2xCrYNA54fbpmCJYxOnsXJtrAhymdGUop5hrs:m29fLmFJE7AxNAmp4xrXJJAs3Uoz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147607, "uuid": "3f874388-2f6c-4ffa-9141-8af7c8a12082", "value": 20896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147607, "uuid": "5cfe4302-48bd-488d-92e0-16fc352fd113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "6c66f874-8444-4f78-9ec2-a78066ac1aac", "value": "irc.arm-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e8e577-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656168974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168974, "uuid": "38a0d085-fcce-4c16-8b32-9f26c723df29", "comment": "Malware payload", "value": "2d7005fe61109562d9120faf73d7bb30", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168974, "uuid": "76066ece-ec33-4c12-b5a3-d285e37f7879", "comment": "Malware payload", "value": "0a691dd817c406c96b9ef836d1e7875ac9b41cb0c657f7154a5bde3fa4374342", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168974, "uuid": "b471529c-2d38-4ed6-ba39-0284637072bf", "comment": "Malware payload", "value": "9fe1f390c2ce872f57806ccda2236171558fab1e", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168974, "uuid": "d3afe4a3-6f08-4bf5-ae48-36bd0c8e1ed2", "comment": "Malware payload", "value": "0fe75934f30cff448e7bf232b249f830edaf018768e6f8e380d9e8996488fc66cfce343390ff256f27daef33b24208eb", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168974, "uuid": "8179ed2c-d130-4dad-aafc-690d5bdab39c", "value": "T119324C8BFA5188FBD32D4335883B465FF071B622672213CF13B909152F623E466263C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168974, "uuid": "529534e9-74b6-48bb-9540-84d82ac0e28a", "value": "d92d823daf15b4d41b95ecae5e759c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168974, "uuid": "cf85b4b3-b861-4ddd-8398-5847e981123d", "value": "96:oif3nOMu5jZWdkNJGUNcvhuTuJqzQbIbesksvjPGelMaME2y0m755tfAsDJZ3yk0:oMmQqhNcvhuvQboekNFMEdN55tfBDf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168974, "uuid": "b37000dd-2677-473b-a43a-48651e04cf84", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168974, "uuid": "38fc089e-d94c-41a9-a616-e952447e324b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168974, "uuid": "3b75c00f-dada-43d4-bff9-fb27018c119b", "value": "KillMbr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74b405a-f45e-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1656144844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144844, "uuid": "6e748e34-8eba-4f6f-863c-52fee3d0da4b", "comment": "Malware payload (SnakeKeylogger)", "value": "75fdaa8adc42d44dc9691d1dc00f872f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144844, "uuid": "0ea47693-2c0c-4945-b6c6-b2c90d443241", "comment": "Malware payload (SnakeKeylogger)", "value": "0bd1f83ba96cb77163d93ddcc2bcc7b09859688d1d7dc50d5440b438cbe12425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144844, "uuid": "1ddbc48b-2e1c-4e72-875a-4ea13aaeeed2", "comment": "Malware payload (SnakeKeylogger)", "value": "fd8207d9ac7a10122c0096e1f520629e1e337402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144844, "uuid": "e18bab2d-bebb-452a-bd99-7fb497ae586d", "comment": "Malware payload (SnakeKeylogger)", "value": "6f72898fc408e68ee2c66b5e65af3c0a0e822a1b18ca3d0219e237e2b382a2a3d15034e91d84ef5b9ae665aad349a659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144844, "uuid": "283217f8-f491-4311-ad6e-c3b481a17570", "value": "T10D040FD7F848986DF93750F90CB793599CDA29B28F014ED9AF473A8902B2DDD640C90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144844, "uuid": "09b15612-e545-4565-b5ce-ba126122819b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144844, "uuid": "2af234ed-3ba7-4ae2-aa27-04b13ab09a4d", "value": "768:NxpO0XDuLA8pqrcAORb225pZsf/vt5UsLbgg58JgfK:N/jKb1Rblpqvt5vl586fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656144844, "uuid": "06d086fb-5983-4faa-8f8e-d1ea2246c62d", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656144844, "uuid": "e4a17ad0-fc3b-4433-8a6e-e3c515bce2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144844, "uuid": "acdc0d46-748f-4916-9458-762caf856077", "value": "MV BULK VENUS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a956be5f-f4bf-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656186455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656186455, "uuid": "2eaf57a4-0865-434e-a8f2-800bceb5d887", "comment": "Malware payload", "value": "99d9c9e266da5d77418c211cd301a314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656186455, "uuid": "8112239a-5e5f-4982-b92c-f51f65ac9b6b", "comment": "Malware payload", "value": "0c46f2fad5038ccb3507ad0a549b0a7e2f5683a9079c1512a8b96ffe4bd9fdaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656186455, "uuid": "7fbdb5ab-be5a-4d29-bd2e-eb4684bed14b", "comment": "Malware payload", "value": "68bedef676167379c3de307fec486136658d8012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656186455, "uuid": "64bd18f9-c614-46c2-8a1f-6379ffe4d74a", "comment": "Malware payload", "value": "234bb5702628f5e0c524d5e352c64b730de03e47e1aa01b11ee547ed5812bd781cdd94e8c83e14b6414e3efe895a5e43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656186455, "uuid": "0c81b301-3851-44ef-8032-58eaa306b450", "value": "T19C74AFB8B5047DD6E67E537BDA99ADDD13B6272289CBA4CD40A4BBC30563371FE02804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656186455, "uuid": "5a3aa2d8-4f41-4dac-b825-f8800c319c68", "value": "f9f6081297aa41ac70321f2eddd306be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656186455, "uuid": "ad10a517-f033-41e6-a1cc-1d69908a59b9", "value": "6144:4i6CAPF0IVqcbMQmJU+GkJXzgNLyKTknXKVp5/yQLGG/z2mpS8PUzdJd:4CEqcbMQCU+n9zgNOKTRp59jimY8PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656186455, "uuid": "b6fe084a-2b54-49c4-b0a0-d03e3d0c992e", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656186455, "uuid": "7a67971d-11e4-4735-8464-aba98b7adc5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656186455, "uuid": "6276b5e1-c8e8-489a-9e7e-ae1bba18d4eb", "value": "sol3nia.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283921ce-f4ae-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1656178937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178937, "uuid": "0014f25d-a029-4bdc-9f04-e1bf16f78956", "comment": "Malware payload (NanoCore)", "value": "74014427b135871d2597e75e67c57200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178937, "uuid": "232603d4-c24a-4b4e-9dd6-e2019a5f7b0b", "comment": "Malware payload (NanoCore)", "value": "0d68c0b7843fa97aa4a8820ee1c7a8de70d2f1b36d1150a3af9dfd19bb70e888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178937, "uuid": "102b0b9b-c476-4a69-b8cc-407d23a6f479", "comment": "Malware payload (NanoCore)", "value": "6a69db7d0e6eff14400b497da1a3a38f3183e753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178937, "uuid": "6bc0910f-060d-4baa-9b90-c9b224dcd82e", "comment": "Malware payload (NanoCore)", "value": "2ffc4b73fc212ad1c18b0843860baabb42b330d8e7571fe4c92191efc17a3ce3114cdfdb2350be5eafffbfc5e878eced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178937, "uuid": "a6fb24a8-bd15-44c7-8306-c53f332c96be", "value": "T121855D637D90D7B8C6BCF5FE0168C018EAE338A1C791553C7078B182A840597ABE27F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178937, "uuid": "00654c2c-42e7-402f-86e9-d57720dd28e4", "value": "a6e54289f74326322739c1cea7bb1065", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178937, "uuid": "6e2c3bb9-6207-4345-b078-a896e8574bdb", "value": "12288:Mtb2wBZ0IAGlM8tAVkqiCrQ2zWNJMt7gxWDCs5ai:0BZjqsAECrhIJc7tDCs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656178937, "uuid": "bde85758-a052-40b3-bf3e-aebe8cfea8d1", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656178937, "uuid": "76b5523c-0f8a-407a-9279-043bc6d945da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178937, "uuid": "3a4e3312-e5a1-449c-baac-edf8db6973f1", "value": "0D68C0B7843FA97AA4A8820EE1C7A8DE70D2F1B36D115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1349b69-f471-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656152941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152941, "uuid": "1263e6e5-9107-4eb7-8df8-bd7f675c1518", "comment": "Malware payload", "value": "cdd9e17f8a7a3f2b0849c00aeea66a01", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152941, "uuid": "fd70b061-70da-47c7-b452-f52ed8c1c2c1", "comment": "Malware payload", "value": "0d73505f996bb77f391c764ce2d15f8c099806dc0509d3a8d72fb00ee86181af", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152941, "uuid": "27bfe70e-ff84-4c5f-8d99-6ce26e278bac", "comment": "Malware payload", "value": "b171bd7483893ea21d076756befdd10e89f7666b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152941, "uuid": "fd643dfd-05dd-4cde-807b-41d921999603", "comment": "Malware payload", "value": "7c571b9e4024a7bf708b5e3f9cf37ed37a1dd462e2931d61b94ff833466e9dee1224cb2eddb165f241a2972a1e59bf1e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656152941, "uuid": "32e003c4-8a37-4801-8af6-f333e4317dd2", "value": "T19F616C217C28523FD9B17964D95E004077BB62B77831AF8197C95225942BCFE823D3DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656152941, "uuid": "b30122a0-cadc-4271-a267-c8b0befa1404", "value": "96:Cz0HjxizezRz2NuIlio2PnbnAIX1ki7k44:x64x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656152941, "uuid": "5413de58-d8bc-41af-863d-5d5f1fa10353", "value": 3264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656152941, "uuid": "2b543276-ff19-4b28-8ac2-92ac3443fe97", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656152941, "uuid": "7728afc7-4ae1-497c-8ddd-48055b46a20b", "value": "dc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68066c0-f4b2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656180867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180867, "uuid": "9d0d3dbc-31d7-443d-a7ea-1cc1156a3418", "comment": "Malware payload", "value": "fb4898a2a6ca5672244d4fd16b8d1869", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180867, "uuid": "f4782b17-0403-4bc4-9495-b2cd765f95fa", "comment": "Malware payload", "value": "0e3d8ae4fd04358bb48ca062925e8d607bd62c423c8b83435febd4e5a6e28b08", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180867, "uuid": "620c54eb-9569-4ca0-8698-00a040328f9b", "comment": "Malware payload", "value": "d76eaa7cf5ecadd8f7eccfd653ba83aacd511737", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656180867, "uuid": "61020595-edbe-489b-a64d-f42226029920", "comment": "Malware payload", "value": "862f72a7e784e08d13bbe2f67fb89cb343bd9770c5f15ffee045417b812d24751539018a4d29a7c0b39a8d5f498a80b7", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656180867, "uuid": "4c9d3e08-442a-4c78-ac3c-c00a263e20cd", "value": "T1B942C066CC65FB1935050811AFD503D6938279E12D811FE6AB30D0F6BD8BCAB9A73CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656180867, "uuid": "a13d66a1-f871-42bd-9d32-495ae675c28e", "value": "192:Igulr9KMEnBkEVimZmTcMkg9JBNk9gFz/94Cx7Anep1p+Qztf3/txmUqBJLxAxL:oohBlFZmPkgM+Fz/94Cx7Aepe5DGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656180867, "uuid": "5cf09487-6d0c-474e-a792-8082b3458c03", "value": 12297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656180867, "uuid": "bfca9949-28cd-4f2b-8f43-d4345596a08e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656180867, "uuid": "9bd78a21-5cc3-42a0-81ad-ea8d10f2cb7b", "value": "06-21-2022 Order _8678498578378598489304885909394899.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d3ca74-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "b187f9d8-06a0-4e19-8d1a-892cb2c54f7b", "comment": "Malware payload (Mirai)", "value": "dc1a65bb2e5d24548a7ba8b7a59bebc6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "e66bfd6f-e42f-4eac-813c-79f47dd809c2", "comment": "Malware payload (Mirai)", "value": "0ee2bbf558a138df99a179a2a9b4b19da06a3cf0724dd2a893c31eff0f92e82d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "1bb4c729-a114-4580-9a65-5e8a0dd62487", "comment": "Malware payload (Mirai)", "value": "9e903ec1380b47ec4adf6b8ca3b3e1df9eb56876", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "f00f1a2e-9755-457a-9253-0b8681c8da49", "comment": "Malware payload (Mirai)", "value": "a01a2d5016e9a86651e8e08b89865ed84bfa2e165d552da17f1434ca2ed7dc782fcb3acd0230572dfbc671d1fa1891ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "3a5b3a45-ac26-4409-b054-609d5d7de5c0", "value": "T1C793B44CFA64AB29C7E232FEFB49028E332B1BACB7E67015CD315B4533C9A965535121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "efde46ea-7e78-4363-85d0-cf83a98256e7", "value": "1536:sgnUezxh6ptqTBOhOlpuyRnO1HEiMTrHBdelVyARiu4+kHqEi:cOh6rqEUlp9FO1HEiMTrcF4XKEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147605, "uuid": "e2ed30b8-be39-4120-bc56-ead5791dd868", "value": 90048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147605, "uuid": "c56b46cb-1e49-4614-a17b-372c7dbce4cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "d5d10506-1849-408d-bcb6-3f4df477fd98", "value": "miori.arm7-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d59ae6-f46c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656150608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150608, "uuid": "d868f49e-87a3-4943-b02c-c5af4f2df6ec", "comment": "Malware payload (Mirai)", "value": "ce0cfcf91279d47229d7a6272f43c797", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150608, "uuid": "d2658fe7-75cd-4e3f-9137-28333a6ed7d8", "comment": "Malware payload (Mirai)", "value": "0fd234dbb524fdb9cc79bf5e621495673fab2541ddb37bed372391de6a54ab75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150608, "uuid": "33c028b5-23b9-43de-8fb1-614d723bbc66", "comment": "Malware payload (Mirai)", "value": "05f5f698626395e74c6427a2bda5338428f1c018", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150608, "uuid": "ee7fc3d6-b064-45c5-81c2-4570e4f326d3", "comment": "Malware payload (Mirai)", "value": "33b34f22747167181e9bf5fe1c18b9c8a2d08ec3fb21578d12f6a7dbbddb4d82fca36f3dbcce749a1c52ddbec8978260", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150608, "uuid": "833486d7-9a9f-43b6-8dd4-32af82e2fc7e", "value": "T19BA34B857C41A622C6D9227BFA2F028C336523D8D1EE3317CE215F61778B92B0DA7756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150608, "uuid": "afb08e02-8fb6-43c0-a190-6403555a4d57", "value": "1536:g6c3cbhJwFyYUOisngMt3qKlMtzuDZTk1nAZ4a0k2f7OnIYAdi6x+v1j:g6s0JwFyYJlqwy1q4a0RW081j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656150608, "uuid": "b1cb05e9-6b3d-4009-8b2b-0babdc71d0c5", "value": 100832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656150608, "uuid": "2b34fdec-b989-4f15-a8da-112b667a8453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150608, "uuid": "1400a01c-666a-432d-ad96-e59c1369ae67", "value": "garm-20220625-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b939c34e-f48d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656165007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165007, "uuid": "d1ad58bb-aee0-48b0-94cf-9e080f260290", "comment": "Malware payload (Mirai)", "value": "a248ae9a8b8cec0564f6fe0c69db6fd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165007, "uuid": "e1b958d8-bdab-4661-b83f-8d228456ecaa", "comment": "Malware payload (Mirai)", "value": "1058143974c71606ead362d7d9d8fffe3012da4f6188efe27ea5df39091be0ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165007, "uuid": "294d091a-ffb3-4c9e-b3d9-f0ad549f9023", "comment": "Malware payload (Mirai)", "value": "b988a2da2710d16d7de4eb53e45a1b6b93229fe4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165007, "uuid": "43213d3d-1e69-4f9a-8467-a178ec92b66c", "comment": "Malware payload (Mirai)", "value": "8c3d9d3d82ed3eb280107df8c00ba16dc2bbff07f87e0a48256da4f7438a38b7aa3586106acc6fb695c64a1183395e22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165007, "uuid": "578e276e-ba30-4073-b20a-473b7bedf457", "value": "T10A03F1641D16A9F2C1A41278FBA7E71B022F37B4D1E13112E61153E0EBC6A0A57B6B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165007, "uuid": "8165b598-2684-4a84-8f28-013466548a1d", "value": "768:EWksjAHAoJAwl1/XdJlfArq5DSa8w6wQJcE8xjmaihDqG75s3Uozb:KsjADJl7Z876sim6GIzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656165007, "uuid": "068898ca-fc06-4a9e-afa9-816f19520b5c", "value": 38500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656165007, "uuid": "34cf24ab-64f2-45d5-b398-57bf98f0e101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165007, "uuid": "0581a378-deb4-43f7-9aa5-f6f310922adb", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5838eff3-f485-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1656161408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161408, "uuid": "b67a0c3d-5e09-42dd-a5d1-683ff86a90f4", "comment": "Malware payload (Gafgyt)", "value": "3ff92568de1c07653c48204328dab2fd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161408, "uuid": "266ef59b-13d1-4ff0-8893-0d946d00f79b", "comment": "Malware payload (Gafgyt)", "value": "12f7150b9bcb9bef3a0f9fe276e3ec8965b756498a80922df2b920ba59e924ce", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161408, "uuid": "4c66baea-fe7a-40b9-a79b-fbe2aeb919e3", "comment": "Malware payload (Gafgyt)", "value": "f2381e4813f3c792cb65bda844c78ec6be66edeb", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161408, "uuid": "a6a91d1c-3645-4b47-bb33-965ddf86e76a", "comment": "Malware payload (Gafgyt)", "value": "e700e1c39845bfb46d54b126ed4ab33ca041e997a7ba01e7eb3f20db41092cb0d95f521f5444cae1d4ec655d58b55e72", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161408, "uuid": "c689ef36-542a-4dd5-b931-fbd63e5cc240", "value": "T1CD632B56E7808E13C4A217355BEB83513323DB11A797630B562CAFF83F437E86E5291A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161408, "uuid": "dc78d5ca-d7db-4f2b-adfc-3b287a7348ca", "value": "1536:kRnB9FyFOiYXD7YClfCiqlE+Gndb+DdKzw/9UyJXoC:CWOnXD7/GS+Gn0DYM/9d1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161408, "uuid": "3a7cef01-0943-494a-9867-d2fe6c7c77dc", "value": 71311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161408, "uuid": "3436b331-faf0-4bb0-96b2-78cef645930c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161408, "uuid": "7197f61e-18a9-4670-a3ad-8e4c304ad5d9", "value": "leo.arm7-20220625-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987e6abf-f46d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656151208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151208, "uuid": "a55d4e24-02b6-4388-831e-54e6a112c183", "comment": "Malware payload (Mirai)", "value": "b018b344e018613ccc714296d2e6607b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151208, "uuid": "90f74c59-122f-4307-8c31-a610feeb2f74", "comment": "Malware payload (Mirai)", "value": "136852842ad2b2c54ec3c8b60d9bee594251d8cb97db552286165c896a1251e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151208, "uuid": "93b86ea9-13fd-433f-b84f-3c6e99ad5d3b", "comment": "Malware payload (Mirai)", "value": "81fbf76acc6fb68b26a1d6e8e8f16f2518f85849", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151208, "uuid": "8f72bc28-0ace-4e62-9e14-2a4e67f56873", "comment": "Malware payload (Mirai)", "value": "0d75fb060140910147a7d77dd2e51b5f4b301c48bb975513982b5f67ff5dd32e18d7e0079aead159fd01870a5c7f6428", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151208, "uuid": "9e138ad6-1699-40fe-ae47-60852f7f6a6a", "value": "T1DAD2E1F88A83AE70F5B0DC78C7799522B3069AB385EE78388DB51560724347F0376647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151208, "uuid": "9f85bd18-8589-4422-9cc9-9e4aa6a11a6c", "value": "768:CbIJFTZMuQiLs0b/tBH+Ldi+kAts3UozN:Ci6MdFBe5iBzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656151208, "uuid": "8db12197-8751-4e52-83d8-398bacaae791", "value": 28800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656151208, "uuid": "2a9b7ae5-4211-4142-af5f-e2126ad99a5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151208, "uuid": "1f8432f4-31d7-4cae-ace8-41eb21f0bedd", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c81c5f-f42a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656122285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122285, "uuid": "07bf4309-e492-4f8b-b1bc-cfbb911ed3ff", "comment": "Malware payload (Heodo)", "value": "56523b08a5cd8718cc96ff2e5f6d313d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122285, "uuid": "a95e79dc-6eb5-4a3d-99a9-c9b48781ad63", "comment": "Malware payload (Heodo)", "value": "1556e78d30077a673daf611933480af8beda38b5084652337cee72f85583d275", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122285, "uuid": "77464b61-3a0d-4609-8ed4-c572166d49c0", "comment": "Malware payload (Heodo)", "value": "fcf117f9ac7689e48eec6a3e937c0c99bc43022b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122285, "uuid": "97f9abc1-7c9e-4579-935e-8c29fd5b551a", "comment": "Malware payload (Heodo)", "value": "59fa5b2641dd678f71d98a1c112ec97ca416ae408934957b61eb68ce5e655bc945dbb8d734a8003312911d8eb75ec2d6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122285, "uuid": "0b748afb-ab7a-40d9-abe0-8305bf00bbe0", "value": "T1CEE4AE06B3A442B9F0779238C4974653E7B1B4865630E78F13E4437E6F27BA16A3E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122285, "uuid": "58f5638f-6a06-4893-b54a-6c7cecedbe87", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122285, "uuid": "863f2ac7-13c6-416f-9a7e-10301f7b1eed", "value": "12288:i6ga9aSRQTSq4RxN46G6463za48ukW+0+HOZ26u3SaYuUVDJe07zEHCa8xCNI9pm:Zga9aSRQS2bSB33e1NOREYxyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656122285, "uuid": "be66dbb9-c0bc-42a1-8789-668b5281ecb6", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656122285, "uuid": "fac43580-af81-41a6-bce1-46b4c089c39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122285, "uuid": "e54c4f0e-91c8-458a-a096-5d14088cae5e", "value": "56523b08a5cd8718cc96ff2e5f6d313d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd976f4-f481-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1656159942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656159942, "uuid": "0acd866a-59b6-4126-936c-31120bf7ee82", "comment": "Malware payload (RedLineStealer)", "value": "1e4516d19b827dad2ad1b74d5136ec7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656159942, "uuid": "9f98a56e-6e50-4f68-a836-8698bb92c8db", "comment": "Malware payload (RedLineStealer)", "value": "15b6fbf0b1b094118df330e048bf4c4af3cb1d75e3b2707a94ea6974fe88b10c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656159942, "uuid": "f67ee210-0648-4dc1-85f6-1a7d4f1af33a", "comment": "Malware payload (RedLineStealer)", "value": "aec8e719ac3ddac96b7b3efd1a8fa1193ef49961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656159942, "uuid": "dcafccb5-e889-43cc-abc7-9c93c9fc8d1f", "comment": "Malware payload (RedLineStealer)", "value": "a96c29a9aba5486393d4c4f02a5c3be63c7a1913b580a9e4fdf83e288b7c61c4904c6e72fec214d74c6440150ce222cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656159942, "uuid": "416e11cb-6801-43d5-a8d8-f694f639bb6f", "value": "T16E651246F23DC86EE44341B16873F9E45924E82325F52A2636C4335F1A76FB48E172EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656159942, "uuid": "edf62b19-5ce0-47a3-92b0-41add6369f0f", "value": "7b160b0b666ad3eb59d3c49410287af6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656159942, "uuid": "67df03df-0e09-4bfb-942f-aa0a1b1ce25f", "value": "24576:vpdx8r47RuRJqWpeXJvL4FVoRnoXbA6OVnNjJf5Jf11Gz7bYIDB0C/g0uso88GKp:RduU7srpeW3vXxUJfbnMfYIDGsg0us2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656159942, "uuid": "cd320939-870c-4caa-9c2d-b3bba0d81a60", "value": 1481168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656159942, "uuid": "8892b1c4-77c2-4b9a-b7c0-5ec5a45e8a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656159942, "uuid": "4664c688-2e2b-46da-8a27-f4c166ec7618", "value": "eySNvfyS1M33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc01c7f8-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656168985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168985, "uuid": "ffd5f97d-f6cf-4e48-aed4-d6f6333f142e", "comment": "Malware payload", "value": "a3ee54634041aefc73b3dd003c2d7276", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168985, "uuid": "19b6e800-d231-4442-ad1c-e3aab9ab2bd2", "comment": "Malware payload", "value": "170041158177f1bc7e802341b2c0cc5ed037f04409cd755551118dfe3c0a7bf1", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168985, "uuid": "e3d0ed09-8aa5-4521-a838-9dd95551e874", "comment": "Malware payload", "value": "ea591ed28b64cb55cade55a03548149a1fdc8e41", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168985, "uuid": "f886f397-9fa8-4ca1-b03e-c92f4836fc7b", "comment": "Malware payload", "value": "3b3418ab754bd736aa907a7b752371c124df9a8e77473a8b651659e1992ec84dc528ca050a9691ffb1feda7a12528760", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168985, "uuid": "3913fc87-6b17-4b50-96b7-8cd2027c5ade", "value": "T161336D227A51D032CC0554B1087AC2B39A7F743116F9D687BFD91BBD4FB13D0AA2A369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168985, "uuid": "803863b5-8571-4a5f-86e5-54230c5f0854", "value": "6cc9a736a6792d75e39bb45e5928322e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168985, "uuid": "4550af5b-2fd4-4ac0-ae3e-ab4ca9d27334", "value": "768:WBaNKsgiRUpnnKlHm6RzyVD9gTYEtyC4MPTIt9Gm6r/dP5lf:6czRjlHm6UVD9TEZHPTY9yh5lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168985, "uuid": "13a4d372-0e3e-4fd7-bfe6-40dcfe39a74e", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168985, "uuid": "cc45055d-b0f2-4501-9b3c-4660dcb36136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168985, "uuid": "24148297-2261-4f6f-a693-5b688d986a5b", "value": "MbrLock..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3530cae6-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147606, "uuid": "fdd893af-5843-4669-a8b2-2b92bc93e276", "comment": "Malware payload (Mirai)", "value": "50333e8384422af1565069e1dc7c333f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147606, "uuid": "1109c537-5dde-4098-ae24-f1c7911347df", "comment": "Malware payload (Mirai)", "value": "172dfabcd0b47702f61efae67dfdf9e79508b90dd86486948b5048e3ded2f859", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147606, "uuid": "11cad33c-593b-4105-a59e-c40c46aaaa7b", "comment": "Malware payload (Mirai)", "value": "be9d4b50fb417c90a5052487f220211b5c6fde53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147606, "uuid": "09a851f9-8db3-479e-a9c0-e4b4cc6730aa", "comment": "Malware payload (Mirai)", "value": "28f09b448336a32439a7bea44b0a7382ceb2cae0cadb2f966d18039114d769eee4603835be23c185144325f154236e42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147606, "uuid": "a315631d-e9bb-4b3b-9992-42bb1b5a4e99", "value": "T13C3302B2276D29E151B09777BC33FC16A69C17F85CA730DA2CF0661977C48064EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147606, "uuid": "2bfb79c7-4dd8-4c47-8301-2ef4042723e4", "value": "1536:s9O/ZMAXIxNUk07tLcPqF1aBexo4opKZbX:s9O/ZNKyXtLGqFUF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147606, "uuid": "dd39c2c4-0852-4049-9d96-e6e0884e3108", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147606, "uuid": "e97593bb-482b-46b8-8a88-7663fdb2ddb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147606, "uuid": "069c2b96-816b-4520-b1d3-9a85c5b5c76f", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a874bcd-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656168606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "614d2ebd-e71d-4019-a7ca-46a3e9b15c83", "comment": "Malware payload (Mirai)", "value": "ef4f7e959a04f7ecf25e16db3efb8b0b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "454368fd-8dc3-418a-bbcd-7a30db1b1133", "comment": "Malware payload (Mirai)", "value": "175566cc1c73a1a317de9716360f9b5ad8482223d9f8c28b71476333c6beb29f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "45b126c4-4aa9-4e8e-953b-a9c73d9693e8", "comment": "Malware payload (Mirai)", "value": "de0a22cc2063e4d265faa58ad44242e3040f41dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "30a334b3-590c-4327-a243-c6c3b5128640", "comment": "Malware payload (Mirai)", "value": "0fca06ce1d75fc01c72beeedb9f2527aeb0cb37cefb4eec793faf6bbd155ea4690b7abf69db90662bbe29e8bd2a99d57", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168606, "uuid": "ff45313e-1ad8-4af4-9369-4dee78cb2fc5", "value": "T13AC2E17062AA2CF1C7500532F7B855C97A130FBDEAFE3890124047FA3945D156DEA9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168606, "uuid": "55573b61-c57f-45b8-abe5-1178e1adbc83", "value": "384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEwJqpAhymdGUop5hb:ESsoTAZ3alkXLvFh8nNEy2As3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168606, "uuid": "8fa294f5-aaa5-4aac-b0ce-f532228b6296", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168606, "uuid": "6df12f3d-4357-43cf-b75b-f5ac43d21d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168606, "uuid": "179664e1-839f-4338-8a75-f6da6bd27cda", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9097c2d1-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656146041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146041, "uuid": "53363304-b027-4ec3-bcf2-5f4e10eb75ae", "comment": "Malware payload (AgentTesla)", "value": "26544009ebf9e1e4bdedb0f02015e61e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146041, "uuid": "79a2f96a-61c7-4cae-8e7c-bdf36b3fbce7", "comment": "Malware payload (AgentTesla)", "value": "1a95d0e2d25ba79f57f6a53fa63a57756a0c591ccf9e8e287d86b23bebccc130", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146041, "uuid": "4a51f070-8a54-4e61-9dd5-a906798452c7", "comment": "Malware payload (AgentTesla)", "value": "6089c575ea3166fa445354498fba73c100f12ee2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146041, "uuid": "57b924f8-bce1-40c5-8560-22771440eef8", "comment": "Malware payload (AgentTesla)", "value": "276dfc4e6fa8555ad064040b277dad50a1c67958e09d754fb2879193cb47dcffe40d4b22c05fcfc63bb5fb46e0fd30e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146041, "uuid": "b30200b1-7580-463c-9aa4-7149f7781151", "value": "T1FBC41B1C3E055B6AED1DD13049118AF4BB660F132A40E98677FB36CA8FBF3651D358A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146041, "uuid": "6c685d83-dec8-4795-b64d-8737bfd5bd6b", "value": "12288:K4/amPQRw7Q/nHe3RpdaDvaDmZ6HnLUky0uu2VVyrKRoHf/6Waf6gNwk46K34v1X:xFPH/YQ4IE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146041, "uuid": "3607ba08-b250-4c43-8c5e-2475dec5d09b", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146041, "uuid": "a358f411-eac4-4cff-a913-376d426cc59b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146041, "uuid": "0562bb22-1c86-43cc-95b4-1d8095e48232", "value": "MV. PLATINA TBN_Vessel Particulars.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0041c3-f460-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656145683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145683, "uuid": "2090a997-00c0-4dfd-afda-89c8ff5253a1", "comment": "Malware payload (AgentTesla)", "value": "363e27064c2804081426be97024411d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145683, "uuid": "491fe0f4-0674-4925-b2f3-19db31532c23", "comment": "Malware payload (AgentTesla)", "value": "1c67ef3971167010dd5ab1d7297ca61b59f8a2b8d92871c44bcd7f9deeceef85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145683, "uuid": "f5409b98-f24d-44b7-b7a8-a615b3770358", "comment": "Malware payload (AgentTesla)", "value": "650155aa684d55484b8e3c50e1870782bb67cad5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145683, "uuid": "bf90cf77-9038-4c60-a8d0-c6bdb5642a8d", "comment": "Malware payload (AgentTesla)", "value": "6b9260c907b9bd7ce22e8bc9a23229db92b8516275cf68f63c1c45237abb103718cb0960a051244984636f78e3adb299", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145683, "uuid": "2a6e4398-753a-4bd2-b30f-36fc42185754", "value": "T1EFB46D1C3E219B7AED0DD1B08501CA54BB660E537A80D98377FB3AC8979E1662D35CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145683, "uuid": "71018d27-a7ac-456b-8eef-2fa15b37cb83", "value": "12288:4kKocHcnwI2lpS1yZUBlfCjAoYB6VgpiSwNswES8JpPe4XYInL98HZV4Cg1YoO3A:GgsaLfcnMpzTjsVvg9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145683, "uuid": "ab7b6dc2-de8b-48a8-8604-7881c07eec6f", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145683, "uuid": "23f82c81-8f29-4812-baaa-88d5f3f47137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145683, "uuid": "df61b99e-ba4c-4038-9976-fdbbfcddbce7", "value": "MV Ocean Banquet - Vessel Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34197c00-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "92db0e42-ed64-4be5-93b1-0b102325f72e", "comment": "Malware payload (Mirai)", "value": "5b5e5ba6f8abe04e3d815edcb6f2a703", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "40dc068b-deac-42d7-bfc0-da81f4b4b2ec", "comment": "Malware payload (Mirai)", "value": "1dc4d56b6c6b35913349ac38792db589c5f7bbec6dd8607cfc0ec37022d30629", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "31ebeb32-edf2-47ed-985e-4e6b2623d703", "comment": "Malware payload (Mirai)", "value": "df8994212f0502dc4edfdbc8abb853248cf103f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "df1fd40b-dfa7-4c93-83ae-5a8365f396e4", "comment": "Malware payload (Mirai)", "value": "418d0ee7f6a3dbaed654c465b8ddd236e89a288e316de3c6b0308b230d07dc51a8ce96642e95b4a050973f5d598a8c84", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "bdc33894-3406-4580-a08a-8f8cab97ba14", "value": "T19CC2E0E53E77399BEE25113D34ACDE3782B5E052D79EAB13A240920820071BCBB759DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "5d2ef0af-f2ce-49be-80f6-7b2f7760292b", "value": "384:Mn1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QN+yZlNy0NP:CMwoDZLFbBy6HQHRYfeAxdd8PyQ0NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147604, "uuid": "bf625504-566d-44ac-9a32-cf2a120418b7", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147604, "uuid": "990f8f5a-845f-4832-942a-26ec3b36be1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "7f08fdc6-915a-42b7-9ddc-dead109f8a65", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0324434-f470-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656152617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152617, "uuid": "709bee50-181b-4bbb-a8e5-413a5586f69b", "comment": "Malware payload", "value": "0ef88b2ccbd4cec1924b17276a8f3cab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152617, "uuid": "d39c5ec4-709f-4b6e-b7e4-671117d507c1", "comment": "Malware payload", "value": "1f317337cd1b4e76ff53c737ecf39159c59becdcfc9ae4e1e744d04f5dda4f91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152617, "uuid": "78485866-e5c3-4bb9-b0b5-3d8d23583f39", "comment": "Malware payload", "value": "edf143387eaf6680d447343ebe34b70aa398aff6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656152617, "uuid": "f460b892-af3e-4b10-b185-3ea71e79b108", "comment": "Malware payload", "value": "ba7833c6b9e9b61da0740003b918231d8e6901e689715d3875edb5c1cd9bd43f67e963e0585ae52e54231b2956487378", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656152617, "uuid": "23a5727d-e347-4d50-be0a-d0d31b762a3e", "value": "T176E30C0679DAB168F7F32EB7416715C0857FF4E27DF189DC8214494A8982B01EAFAB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656152617, "uuid": "9b0b6055-f1e3-40c7-9f57-51073948f0ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656152617, "uuid": "93f314bc-bbdf-4bd7-ba0f-f893b7435cbe", "value": "384:61ELXqsgJlwL/tpMN39Bz1xlOIv+qns3CutZrj1Asrd:R7qssl0+znlOIv+lXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656152617, "uuid": "dca04576-1849-4868-959e-984d8f61a6a5", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656152617, "uuid": "770d426b-f536-4101-bea8-a982d0169791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656152617, "uuid": "38bd8d34-66d0-4e23-bf02-585e71b759cd", "value": "0ef88b2ccbd4cec1924b17276a8f3cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f357f8bd-f47c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656157803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157803, "uuid": "b89a85bd-e460-4dba-8292-d45303e3e92e", "comment": "Malware payload (Mirai)", "value": "694c1b025956a1f2ae4682f949e5c276", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157803, "uuid": "5f4db791-0fed-4cd7-8564-b3cf3e501246", "comment": "Malware payload (Mirai)", "value": "1f5cc8338f5e85ee948584dc09ff4cb970f4adc7456c0ac1e8fd2ace8d6d0634", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157803, "uuid": "980cf4ec-39af-43b1-98f8-5391adcf43ce", "comment": "Malware payload (Mirai)", "value": "1804d4fed8e9a03b3d7bdaa6670002dd5ed74dd5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157803, "uuid": "5fc786bb-8a6e-499a-8a36-d05c22e04e85", "comment": "Malware payload (Mirai)", "value": "9698169e07b134beed99571260b6fe61ec4a585f7ca377731b9fbf30e39de297f1198ceb1e203dc4e18a40133ef1bc94", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157803, "uuid": "a2e21702-bf6e-4b44-9b69-4adc99e5efb6", "value": "T1A933F1A3676E29E191B05737FC33AC1AA69C17B99C6730962CF06A1573C58054FF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157803, "uuid": "d302217e-a6b2-4812-a015-f2da9f3c0c5f", "value": "1536:s9O/ZMAXIxNUk0bLcPqF1aBexo4opKZbh:s9O/ZNKy3LGqFUFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656157803, "uuid": "b356e811-529f-40e7-8edc-633dc3139810", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656157803, "uuid": "351d54f8-064e-4691-a90d-1fa64a736c8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157803, "uuid": "5af8b14f-12e6-481c-a7cc-fa44989221f6", "value": "sora.arm7-20220625-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3628591d-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "12344a9d-860c-4962-bac3-769220e9c086", "comment": "Malware payload (Mirai)", "value": "5e5ebfe6d4f527154304ee0d40a74f6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "9a94b8c0-25a4-40f0-ae58-7a73a6812a2a", "comment": "Malware payload (Mirai)", "value": "21109732342249c4a12f36bcd41646a0fc61f298f7794026c0e36d970caea685", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "df86f01c-64d5-4c84-b9e2-c82f3b541414", "comment": "Malware payload (Mirai)", "value": "e651c3209127da0fb7edf591d1958c5b783e6a19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "51668de3-6d99-414b-a2f9-be4d36d46eb1", "comment": "Malware payload (Mirai)", "value": "df09a6370e59943e2797b5779ccd8641b5cdabc586ef6a526ad99beb7d14140b75c5378648b96594fe16c5fbeed28dbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "39ef82d6-3f05-49ec-bd9e-f40c405e9dba", "value": "T12AC2D070A6A91CB186500532F7B856C5BE530F7EFBFD3C90214096BB3981D0679EA9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "379c0895-b5ee-4ee8-987c-12f5567aaf6f", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEUwlYhymdGUop5hc:A7soTAZ3alkXLvFh8nNE3lYs3UozG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147607, "uuid": "5abfc85d-63df-4c6a-8834-5a9e8b2af380", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147607, "uuid": "c2b5c483-d27c-4890-9f65-a80f24387d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "77f53a17-f422-4946-80a0-b93bf0da2d1d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20ea59b-f4e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656201153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201153, "uuid": "dff98084-a437-47fa-8dcd-089ca0be3182", "comment": "Malware payload (Mirai)", "value": "b4d8ca2446b364cf7306f94372ed4297", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201153, "uuid": "501e5c40-5331-4232-a68d-afa8c999316c", "comment": "Malware payload (Mirai)", "value": "226d9ffe95b38e0419a04bd1832ce0ac65027207c3aad944b73374997302e660", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201153, "uuid": "daa4e02f-b58b-4842-8e38-bcf99efd45d9", "comment": "Malware payload (Mirai)", "value": "040a1a796f955d01066368c408a431c509e8b27c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201153, "uuid": "898ff64a-7259-44cd-a0ce-b8b76b379cf5", "comment": "Malware payload (Mirai)", "value": "46976617e5a63ca2608a826b3da8030fdc59b718e44f1357a189f84753ef725927e02ae72246d7ed2f3ee5755bd3d276", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201153, "uuid": "ba37534a-7b51-4500-bfd7-dafacb113e0a", "value": "T1EDC2E17096A92CB1C3500532F6B467C6BF524F7DF6FE2890124057BB79819092ADD9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201153, "uuid": "3fc4153c-2e42-452a-ac1c-73d084ac664c", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEWRUhymdGUop5hD:A8soTAZ3alkXLvFh8nNEMUs3UozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656201153, "uuid": "a624591b-72fd-4c9c-92f2-1b4e407f5a15", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656201153, "uuid": "b15ec230-9fc0-4279-948a-99c4985860d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201153, "uuid": "37a5cee1-1f6f-4f03-8c38-7f4b23d75ffc", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4c5609-f4b6-11ec-93bb-42010a9c0043", "comment": "Malware payload (DanaBot)", "timestamp": 1656182358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656182358, "uuid": "3fd01660-ee2e-453e-a31d-d90f7e645799", "comment": "Malware payload (DanaBot)", "value": "9c350ccd29f23ffa49bf7fa022ff57bd", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656182358, "uuid": "ee8ed715-d898-4e6e-b7c8-1530621155d1", "comment": "Malware payload (DanaBot)", "value": "2440bcfc9d60ee999043cb9d569f64770bb2f34c7b306f76f77c0dc081a435e3", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656182358, "uuid": "3dfca749-edac-4833-b317-51a37766c152", "comment": "Malware payload (DanaBot)", "value": "ae63c2a670e3b1e8338f10585d13caf08a5e8b1b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656182358, "uuid": "06ff803b-4845-4e6b-ad3b-9fa6399b790e", "comment": "Malware payload (DanaBot)", "value": "362f4724a946c15acfd226f761d0f22a03fe27b9c5bc5f0692398f2b3644db3f489e8c89f9057f5e67b6178fb630f5cc", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656182358, "uuid": "2938e88e-b544-4a5e-b132-4256c5a15e95", "value": "T1440633378BE48938C1EA16340A756E44483FFD15A276844DABE13ABFDD353D29410AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656182358, "uuid": "dbce7fed-c739-42fc-918b-b09aa6338385", "value": "c25c9ba614845e77a110de46f8dba5d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656182358, "uuid": "534f34ac-5504-4665-8654-309e7370a9c3", "value": "98304:oOz7tKdVbbUMPiMikxGFYNGJwoH09ypMUScNE:o+7sdVb4M1GaNG6n6VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656182358, "uuid": "277016d8-b678-48ae-b388-4b24cf46ea27", "value": 3923968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656182358, "uuid": "f972e27a-78a3-4444-8000-1e9e8f8ef081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656182358, "uuid": "1b4d6fd0-c791-40e9-8ef9-ff22d8c91b23", "value": "2440BCFC9D60EE999043CB9D569F64770BB2F34C7B306.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6384daf-f4b8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656183524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183524, "uuid": "eb492361-9e9f-4d58-9682-d0bff5975f2c", "comment": "Malware payload", "value": "2d11290e8688756c32442f9b36b93ea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183524, "uuid": "13e43015-8592-4787-a750-3d3b00e28254", "comment": "Malware payload", "value": "268b7db43dfc537310d2bde97c67b9477c17e485262d94a49ca48d8bcb0fe9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183524, "uuid": "95f3c1dd-f74b-4322-9b36-e7d1f052aa43", "comment": "Malware payload", "value": "b7d9201ec4be388bafdcab0500744d3c6fe86f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183524, "uuid": "58ccacf4-4286-4418-976c-ff1a04d6e5c2", "comment": "Malware payload", "value": "fc720736fa8999927152a85e25b7161915880a12c01b765267914cb14928d6928ddee9f71eb6228ab695cc704852e177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656183524, "uuid": "1f25a04d-4f9d-42fe-a102-18363263a571", "value": "T157261242F3D28072E4BA267056B7573689B9BE115331DAC79BC06C49ADB17F0AE39343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656183524, "uuid": "fee308e4-2790-483a-89cf-60a4c5d12d2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656183524, "uuid": "45e1e8c1-66e6-4ddc-b512-3e10bfc2d05c", "value": "98304:JQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:EzUcwti7TQlF3ZxxWJSUnDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656183524, "uuid": "dfdb014b-1015-4781-ab2f-7bcae4dd637c", "value": 4683264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656183524, "uuid": "bca285cc-1957-4a15-80cc-d9946934c7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656183524, "uuid": "ed087da8-2561-47b9-a9c4-ef9a48fe6779", "value": "Start.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e1a943-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656168605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "ef62c38b-770f-4d3e-a064-c3c59261bd32", "comment": "Malware payload", "value": "16f875f76c134bb8cb74be0993bcfb63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "8dcc1b27-bcaf-4a8f-9cdd-01615fbae701", "comment": "Malware payload", "value": "2693f06004cdd7493f4d5d5fdbc9c7a5812c9480cdd0dc2ee7184f8622d3df29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "ed8479f0-35bf-4795-9f41-0b0a5b7f6270", "comment": "Malware payload", "value": "c54daaf2330607584c7eed3cfec583e47d2f5181", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "42c115b3-2eff-4d5e-bc19-ef591dd0b4f6", "comment": "Malware payload", "value": "17e2a65fd4a8814de7b19ae51b47e44d54aeb7eb8dd166dc792729fb9b975cc814288a56fef792f5e4845ebbe190d367", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168605, "uuid": "26cc4d28-6458-4789-a2a4-9489a4441395", "value": "T11312852A9491E5FCCD6DC2BC119BFA399132B41D2296B04573A4F737DDEEC221A2D011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168605, "uuid": "2a00d4b1-a43a-4504-b701-48607faeb354", "value": "96:GJpD9tVdKoUVnuQFtMcx5h+/Hxh/z4YNeLvaBXv4+GVLcVNcEYu5nkyr4mDJ64lG:GbJtV/UVnuQZXAph/z4m8LO3PrY4lWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168605, "uuid": "bac1c484-00cb-405c-b7a3-b579f87b6ee1", "value": 9208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168605, "uuid": "e4f14920-399c-4aed-bc57-3f4209349a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168605, "uuid": "a0a79564-93be-48db-b788-6214c5d62a3c", "value": "Saru.x86-20220625-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489c5bf0-f42a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656122298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122298, "uuid": "c338ee76-f0f5-4c73-8569-77e3f2180a98", "comment": "Malware payload (Heodo)", "value": "e7e5eef79fc47e2083e2dc0f06aa7f39", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122298, "uuid": "f1deb020-b633-4cf3-b93e-201d65a4db75", "comment": "Malware payload (Heodo)", "value": "27dc5a76de1122a55aa1a5927cc336e462389949a5465a674c33c507f4eed0c4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122298, "uuid": "fed4635a-1e52-4d49-9aa9-29a13e7bf843", "comment": "Malware payload (Heodo)", "value": "914a749498afa19b769680ad8a46b4a4aa4d495c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122298, "uuid": "6bae3c7e-d726-42f6-9185-3aba98c67cfb", "comment": "Malware payload (Heodo)", "value": "90c8c3d583768d8e01e723af870815ba5641b8d2a678688423bc4fb46c8b0b110bc50167da6f686da6e02e8824bb5ac3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122298, "uuid": "0ec845e7-e1e5-4368-a360-68d5469c932b", "value": "T16BE49D05B7A402B9F0778238C9934653E7B1B4865A30D78F13E5467E6F27BA16A3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122298, "uuid": "d37eea60-075c-4b2d-9ff4-444393082406", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122298, "uuid": "8edd4ad9-b486-453d-8c57-23aad0723e62", "value": "12288:6Y7wgZv6SO4xxd49GK4qnzK4Mekn+U+HOmqomcpBSFYq9VxRTloUzpGGZ6sSAj8C:r7wgZvqqom0SfTC24GZyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656122298, "uuid": "555f4115-d1f7-459e-ae21-a87f08f81aa2", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656122298, "uuid": "f6bddc33-d162-48e9-bdfc-5fd95445f63c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122298, "uuid": "a9c0d5ae-cc0c-4ca3-b794-d86c4475443a", "value": "e7e5eef79fc47e2083e2dc0f06aa7f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd23132a-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656162007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162007, "uuid": "37bec214-d15c-4ae4-9ec5-74d33349d4cb", "comment": "Malware payload (Mirai)", "value": "c7c58cd795241f76f7ec7f54ae0d4525", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162007, "uuid": "07018162-dddf-4c25-b900-e65fd1a4ae1c", "comment": "Malware payload (Mirai)", "value": "284f0bdbd7dc8020cc6cec21c98a932fa9ee64b8e02d65ac7d0d6fa719768a08", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162007, "uuid": "95723a64-1130-4f79-998d-1c812fb464ad", "comment": "Malware payload (Mirai)", "value": "2d923d293f19cb6ce8c578752456cee81d998c5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162007, "uuid": "47929b9b-31ee-4052-8766-617bf7d796d2", "comment": "Malware payload (Mirai)", "value": "e771d9a70803ec721eb1604030ca936e566c943a4a6d41a5a0e54edafc799a56f507964ab92111fa29536b19074fab83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162007, "uuid": "144ba79d-bf1d-42cf-84f8-42297c7448b2", "value": "T1F903E1D8A6EBC303D197A6354D7B7A8B8D1C8E06578CA55EFABC20726060E347EC5346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162007, "uuid": "bd522c42-5bd0-4315-945c-78d2dbb55263", "value": "768:28VcoeW/lBAhJB0pg6QxK0PtGKFEeudkFdNvDnbcuyD7U4/2M://lBiJRJLPNudkFdZDnouy8PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656162007, "uuid": "317b62d9-6dd2-4995-81e7-5be7847f4c3d", "value": 39116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656162007, "uuid": "f5ed390b-4c63-4f3d-bb8b-3583ce951502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162007, "uuid": "8cdd0c0d-1057-43c2-a06a-53e6e51313ef", "value": "ZG9zx86-20220625-1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1bb2fd-f497-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656169205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169205, "uuid": "24b000f4-50be-4d14-8da1-3403cee2d26e", "comment": "Malware payload (Mirai)", "value": "5be4af27984a0aa295fd96f6fd4c21ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169205, "uuid": "5eb6b5a6-4479-4f9c-8c25-c0fdcaa66212", "comment": "Malware payload (Mirai)", "value": "2927e9ed17da6c0f08f0d86c901d7c6bbf974a14ec8ab7c825f1f0621c58d485", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169205, "uuid": "595c58d0-1958-43ba-b501-593f05ab6c42", "comment": "Malware payload (Mirai)", "value": "108803c9b2e8429e9f3a323c56bf8cf16ebf6c5f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169205, "uuid": "df65d96e-a7d2-478c-a742-c250c7667df7", "comment": "Malware payload (Mirai)", "value": "e874eaa8c498daa718f8f1b3b575c798f970429df3f1ea14e2e64847fadda878487ea35d5b0cf5301b9be5ed626a275e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169205, "uuid": "c1d537a3-80b4-47c7-b358-6a3acdbb9c1c", "value": "T1952302A2815AD436E8321839566058F223C916F0F56CAB2BD37ED78C77127183B35BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169205, "uuid": "9ba6c609-449a-44cf-92de-f14af91b0ad2", "value": "768:M2mQ+/DkZr3UN1Xh7aCfUHe/TwirWEcXBWAOjjXQRz4ELEY9q3UELex8QVnd4juZ:M2tDUN1RMyT7iNOjcz4ELEBLeGu58nlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656169205, "uuid": "f9049be8-e5c6-4181-9027-a603f3b19f9d", "value": 48540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656169205, "uuid": "9c4c7522-e4ca-4497-a835-c5a99361b330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169205, "uuid": "4a9e8224-384c-4a2d-9566-c2cfba7aa66e", "value": "b3astmode.arm7-20220625-1500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522f1d74-f4a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656176431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176431, "uuid": "57b10c5e-b27c-40c8-8fdb-9167c9653664", "comment": "Malware payload (Mirai)", "value": "64a57d762191530acaf379379eefcb90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176431, "uuid": "9332f138-4f82-4be1-9e84-09662747c7b4", "comment": "Malware payload (Mirai)", "value": "293299232c65eb493404dbebd23aca711ae8b4d05725389e753942a8e0922467", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176431, "uuid": "ec946fc5-bf2d-4d3d-b9c9-91aa57461805", "comment": "Malware payload (Mirai)", "value": "ebcd4c14c33830841f152ec54b5f6ee563349dbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176431, "uuid": "bb2f4455-bccf-47ef-bbc9-0578d3a0849f", "comment": "Malware payload (Mirai)", "value": "c99a6c41a70604da965796531f2aabceec9dc573d876240030371987a9ba2f5e60a14c42af6ffe2c9d0ec7855a7c2e00", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176431, "uuid": "a4b3db9f-6c9f-48bd-bcf9-c4cbc3b6b200", "value": "T11D3318C4B083A9F2DC41057C306EEF365E73F0B66139ED9BDBD45933A855702AA09A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176431, "uuid": "9f670f6d-3693-439a-b942-debad2fd25cf", "value": "1536:AgQpOfqys3tA5ZvMJFcWN2WoPKdiYueii+HNc:3QpOfqys3tADgxoPSiKi3Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656176431, "uuid": "7fe92e9b-212d-4ea0-84a7-c294b02712e1", "value": 50620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656176431, "uuid": "a3ae16d6-6b5f-4db3-9cf4-27a62608abc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176431, "uuid": "29c1aee2-9fa7-456b-8c6a-dc54ec80107a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64fa222-f4a9-11ec-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1656177055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177055, "uuid": "50e67d9e-9ae4-445b-a3ee-a52a70b15c32", "comment": "Malware payload (DarkComet)", "value": "a2bbc72ffc43ccfe0a135ef6a811410b", "object_relation": "md5", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hack", "colour": "#919DF4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wallhack", "colour": "#C431D2", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177055, "uuid": "e132b089-0c44-4ac2-8902-238775f5eea3", "comment": "Malware payload (DarkComet)", "value": "2e3876317e556f1e27c78f6a8e9448b6bda99f203f0b2ef219c52aa5a368d73a", "object_relation": "sha256", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hack", "colour": "#919DF4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wallhack", "colour": "#C431D2", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177055, "uuid": "540301e1-8f6f-4580-bff3-e74096051a87", "comment": "Malware payload (DarkComet)", "value": "d2ce8ce43498be04d8f563a8f2828bf38b7c39af", "object_relation": "sha1", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hack", "colour": "#919DF4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wallhack", "colour": "#C431D2", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177055, "uuid": "c8efc01f-31a5-4916-abbc-9b408c090197", "comment": "Malware payload (DarkComet)", "value": "f21a4a3d0c0c25473d7b7265d2332ff36c38f2d77e1523ae98a71df8c789741c2cf8835d08043d8faf8604679f85397a", "object_relation": "sha3-384", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hack", "colour": "#919DF4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wallhack", "colour": "#C431D2", "exportable": true, "hide_tag": false }, { "name": "zula", "colour": "#B785B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177055, "uuid": "336a03d6-5ddb-4500-8bde-3efb252bd9b2", "value": "T143E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177055, "uuid": "c65a1af1-7b86-4c60-9657-86fd504cea77", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177055, "uuid": "78601022-db58-4941-9231-4b51cb0a602d", "value": "12288:W9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hR:yZ1xuVVjfFoynPaVBUR8f+kN10EBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656177055, "uuid": "a046c47d-f9e7-4a7a-9901-cbed235f7b28", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656177055, "uuid": "4d340d74-2375-4b9b-8dd6-c5d78aab1edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177055, "uuid": "5707a48a-7659-41ed-a371-66866d3a654b", "value": "MultiHax_Zula.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65899a75-f44f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1656138238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138238, "uuid": "0468c233-4bec-4d5e-b473-a3bc6a77bced", "comment": "Malware payload (AsyncRAT)", "value": "78a3c2d849cbf038fb1a575103300c91", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138238, "uuid": "40f1894a-064b-4ae2-a8b8-174c85297e3e", "comment": "Malware payload (AsyncRAT)", "value": "315ea8af1371ec210937876305db47f1116a5e75b8a74ffab043267d55c9a46b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138238, "uuid": "da4504d1-a30f-4b0f-af41-3134da708b8d", "comment": "Malware payload (AsyncRAT)", "value": "ddbd9c191e528f86f0174424cd57cb608a0f4df5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138238, "uuid": "249d7e13-d55d-4b44-903b-b1b93aa8f105", "comment": "Malware payload (AsyncRAT)", "value": "71fce63479b5f776dbdd99dc9de6c0ac6f8af2c7ff894b1af37ae9690ec670dc48d16b3f72d4e0e1fb393c51b62d931e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138238, "uuid": "7da3255d-ebec-492e-b061-78475faf1aa7", "value": "T1E805028C8E748636CAA54F38B8F75564E171BCD79C7ED3BE045920660DDB2F08226F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138238, "uuid": "0a9809f5-f133-42b5-976f-e02fb69498b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138238, "uuid": "7cdad8c3-06f2-4da4-9637-c3830b991bd5", "value": "12288:edN3z9kFCVMBlovOYGseNjk3+//yCZF3TR26BZ1M:0N3oCVMDoWThi+/bbTc6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138238, "uuid": "8bdcb028-ec51-48d0-a514-46c18386c0de", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138238, "uuid": "3dfd4364-380d-4dbe-b039-f35e60d074e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138238, "uuid": "aa27bb19-0553-4530-acec-04e73a95ecc3", "value": "78a3c2d849cbf038fb1a575103300c91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af3e4ed-f462-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656146354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146354, "uuid": "a2d5717a-018c-4ab7-8b7e-2344e30d52f3", "comment": "Malware payload (AgentTesla)", "value": "eb24dfd7826cb32ccbf8a9d757167235", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146354, "uuid": "296269c9-0ef6-4319-a4a6-3241e5b55bb9", "comment": "Malware payload (AgentTesla)", "value": "329430630421c6ea8ac279e06d7c44e9922d6cd4c8903de35054624da912ffc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146354, "uuid": "af25b450-2680-4f5e-82dd-f6c85b4aa176", "comment": "Malware payload (AgentTesla)", "value": "2361f815c49a72f7d8dee93b1d68a26c2c28692e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146354, "uuid": "8c87ea24-f314-459b-9c92-074bfbded5e7", "comment": "Malware payload (AgentTesla)", "value": "6bb059cc75ff5d1bbe04c850382e40de56a5d22d3bc052584722cc26d3c740336cdc18bef163db274b6462599ca4942f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146354, "uuid": "64814233-2430-40b5-ad4d-e70eafc8a1ef", "value": "T1D00512126B7F8507E15E43B6E8D10C1817B66719E5A3EBAF18902ECE5B023C64CC6B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146354, "uuid": "b799d223-d99a-4fa5-9dd5-b8f8ea69fcc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146354, "uuid": "1e853366-aae4-4f96-87f3-68276a1ca052", "value": "24576:tDRdGdkLsmx7FxvRBzQJqYEglrSfL84W:tVcdkNBFJRBOqYRlu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146354, "uuid": "f049ffef-5e48-4445-bb6e-57353018c7f1", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146354, "uuid": "d213a482-6401-4246-b8c9-6e72a9164452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146354, "uuid": "bc4cdfe4-b065-4531-a21b-87efe5b56c83", "value": "New Bank Details_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e800c846-f457-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1656141893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141893, "uuid": "bddbeb0c-89b4-4ba9-9187-e2cc6a10d535", "comment": "Malware payload (Smoke Loader)", "value": "19c79cc0474e09f34989f3d8447303ae", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141893, "uuid": "02141716-e07b-4119-b446-3041188b90e1", "comment": "Malware payload (Smoke Loader)", "value": "3304124917f11a1403fa3d45855fb6c6ede480ab4092365e21a554757737425b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141893, "uuid": "43019ebe-9d15-43d0-8b98-a9d1cc357247", "comment": "Malware payload (Smoke Loader)", "value": "c4b95f6ca7f04d2f95cd74615258dc97963cfb7b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141893, "uuid": "c58ee963-5bb9-4500-900f-967f2887501e", "comment": "Malware payload (Smoke Loader)", "value": "b7734d3d26c024c87725ee73d47e5d31423a6f83fe98eecbc5718130891991bd5419b757ee26568010784ed5e8f98612", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141893, "uuid": "756ea9e2-1559-4d2a-b4a7-73e364ce14d9", "value": "T1E7549E00BA60C035F5F711F849BA966CB92D7AE1973455CF62E51AEE5B386E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141893, "uuid": "edb0c618-aa78-47ff-8318-a36ed66a9755", "value": "8aa5d6264da1e437be4b2f2dccc9a830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141893, "uuid": "21f27b0e-ae1d-4f3f-ab24-44f6892842a3", "value": "6144:50SdfcjsP8BJYnoeoCL9PlzptRgIsndmw9fm3umuzyDA/Q:9N4BB6oeoCL9ntSIsnd7c3o7/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141893, "uuid": "46244c49-cbe2-47a5-8db6-b5d1a33fa1b3", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141893, "uuid": "cf3f4aa3-28ed-4d44-9ca7-c9918dcf15da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141893, "uuid": "39bebaed-8bb8-4836-b3fc-51bb2f430811", "value": "19c79cc0474e09f34989f3d8447303ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed30752e-f460-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656145767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145767, "uuid": "77f74876-29a0-4758-b5bd-717d1e604118", "comment": "Malware payload (AgentTesla)", "value": "49396ba32347c8b61f41e584d1142969", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145767, "uuid": "6b29bb7a-ea9e-4bc7-a2d1-0a7916a65acc", "comment": "Malware payload (AgentTesla)", "value": "332e8783a833db143e5643dbab099ffed5644156580f89aa4f1e0265217ce6c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145767, "uuid": "b1c56f08-74d2-4043-9e4c-62f6dac99d80", "comment": "Malware payload (AgentTesla)", "value": "080f66339bd19ee7a3d549507553d22dfd1c69a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145767, "uuid": "d95f8b82-86db-4f39-a15a-9c8bb6314195", "comment": "Malware payload (AgentTesla)", "value": "ecbb13741eac3bfa948c352a01de5ae5d9006dae02234da9322c9e9f926c82e9a1e2c8809f9c2d536414d74d493694bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145767, "uuid": "8d2ff7d0-0722-40a2-bedc-831a8397ae5c", "value": "T10CB460DD7A410A72ED2DD03D46030A04BB660F332E80999657DF5DC987CEAEE1F15E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145767, "uuid": "a3a22c7a-7c25-4ba7-89a2-86dfb2f518b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145767, "uuid": "c20ac1b3-10d4-4f67-a4b2-9f5def76833c", "value": "6144:j9ZYV6AXzc8C63t0rR4mJiY9hc6PWsHUFIpyPHDW0qLeMRBQfQobxPZu5NK:5ZM6AXV9A4wTGGUFWAC0qLeAqPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145767, "uuid": "2e6b986d-0d91-4a58-9756-a466d19eee11", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145767, "uuid": "a7288c7e-7314-4c8c-a402-d19f3407923d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145767, "uuid": "c97de3a3-3a40-4f30-a90e-e51fc8197335", "value": "MV. AVENIR TBN VESSEL DETAILS.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f4bbcc-f478-11ec-93bb-42010a9c0043", "comment": "Malware payload (SoranoStealer)", "timestamp": 1656155769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656155769, "uuid": "69be9ff3-c1e4-4d98-a484-e7bdef41318f", "comment": "Malware payload (SoranoStealer)", "value": "76373eae8cd01c6d323763f61938d009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656155769, "uuid": "b24579b3-aec6-4433-ab29-512d3cdf1d55", "comment": "Malware payload (SoranoStealer)", "value": "337d919716b9a42e616a5f1361b48c08c3a9d5d85887d79522cf2a21698b9ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656155769, "uuid": "f18b4112-2439-43db-85f4-b0acdae76d4d", "comment": "Malware payload (SoranoStealer)", "value": "9a53b76bf21d8a9885745c808e317f9ae1ae2828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656155769, "uuid": "77e66f6b-82ac-426c-b41a-9d341c081d63", "comment": "Malware payload (SoranoStealer)", "value": "7758a1804ac161857ef69fec045257eb2f077a07deabe8acafad53777779772930c08726f52030235d8e4dffb3e3109c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656155769, "uuid": "50a2b3a6-bed9-4328-9786-b894170f5f63", "value": "T11B261242F3D28072E4BA267056B7573689B9BE115331DAC79BC06C49ADB17F0AE39343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656155769, "uuid": "88db15ca-fce6-453b-9b73-a2effcf516cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656155769, "uuid": "f559c3d2-cad7-4e98-8261-205d59be2b28", "value": "98304:YQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:tzUcwti7TQlF3ZxxWJSUnDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656155769, "uuid": "d8a54c2a-7cb1-4d1a-95b1-4c2756e70fe4", "value": 4683264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656155769, "uuid": "bff6c46a-e174-45cf-8f40-07aad8edb721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656155769, "uuid": "46464124-93cd-43c8-9ef2-1c6bd99e04e3", "value": "Nitro Gen 6.6v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff12581-f4a7-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1656176024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176024, "uuid": "ee8deab3-ae60-4022-a285-97b8b888de9b", "comment": "Malware payload (DCRat)", "value": "564c11e87d38c04b9272e59a996609f9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176024, "uuid": "85c151bd-6efa-43fe-8840-2b935a4bc77a", "comment": "Malware payload (DCRat)", "value": "358703038c3b93090c0b16fa4faae92a82661893ebc41027cccde34338009e26", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176024, "uuid": "65350e84-245e-4e3e-9feb-5004a6f164e9", "comment": "Malware payload (DCRat)", "value": "189121a8edbd37a6070a273a5c7b5fe711a23c2f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176024, "uuid": "7fb737a2-d0e5-438d-88ae-fee9880b5905", "comment": "Malware payload (DCRat)", "value": "29fe70692fc3117fef819c5b07ec118f441c10f561f061fd9b6782f314c67487cbb539086b893137595ce5b3fa99ae26", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176024, "uuid": "77424e35-e329-4b4a-837a-5cef235b7d5f", "value": "T10C3539017E44CA12F0191673C2FF490847B4AC506BA6E72B7EB9776D55223A3BC1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176024, "uuid": "1ecb237a-2d5f-46ce-b801-1976f9850efb", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176024, "uuid": "7d0c09b6-8a98-4fc7-a048-9cd2667d0701", "value": "24576:h2G/nvxW3WwSsvyINwrLphvrSadAphUkaKwPddj:hbA3fv/cpgaihpMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656176024, "uuid": "3dd93b64-900a-4be4-b91b-7fb061a819c9", "value": 1136282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656176024, "uuid": "7915323c-a61d-4950-9694-4c1195077b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176024, "uuid": "1302eee8-880c-439c-9a22-0fb309b7d3ae", "value": "564c11e87d38c04b9272e59a996609f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5eba9e-f478-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656156045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156045, "uuid": "6ce748b2-f49e-43bd-8e81-0e62856faed5", "comment": "Malware payload (Mirai)", "value": "a00a3f1ba4307632094607451f56f79e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156045, "uuid": "53a5e316-95c1-46fb-9747-84948fe243f9", "comment": "Malware payload (Mirai)", "value": "37148536dd5c495bb913a74be8dc2c6aeef34aca60a16629e4033bb248c8efe0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156045, "uuid": "cf28054f-a18e-4b43-9f53-95dda08f0d52", "comment": "Malware payload (Mirai)", "value": "5b810880a5323d394fa814dc9f54b76d4f46d523", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156045, "uuid": "8c31dc32-9a47-4c58-93c2-381cc60452f9", "comment": "Malware payload (Mirai)", "value": "0a1c915a03ccd5b7b0661d2c5a74000e4837502d2e1f5fd19300788303b6d21131d6deca7104f230563a357b0dd7c607", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156045, "uuid": "e38d99c6-503b-4580-8450-8bad3123db8e", "value": "T1DD03F11CF4716E97CC2C3C7A559E07A9D516F054B25F0ACDAF024DCAA9E89DB34810FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156045, "uuid": "12f1189e-e587-44d6-9064-3d23489b6f37", "value": "768:LWept27VtIIiJ3AFoHJgEGSG5EK4TVoMp6eFkM+8xZwBWUmp:LWeP27U3AypgRgHV/gq+8xOFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656156045, "uuid": "02037bb2-4526-4368-bdb9-a68e1a79db5b", "value": 40280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656156045, "uuid": "9d362ebe-0b9b-4b70-851e-094d8da0c57a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156045, "uuid": "f61ef72b-677c-476f-812c-dcbd32188185", "value": "a00a3f1ba4307632094607451f56f79e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85d406c-f4a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (MimiKatz)", "timestamp": 1656173703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173703, "uuid": "ba72079d-a645-492c-bbc6-97ae51f2fb27", "comment": "Malware payload (MimiKatz)", "value": "5810069331b3d5f8bbd840c26ac35776", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173703, "uuid": "8753c0e2-b90d-480c-9234-89d9dd9638c4", "comment": "Malware payload (MimiKatz)", "value": "374ae90a613bd61ae357f2ad0a0c61250787d1b2134f5b3dad7946ded5785f54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173703, "uuid": "46b4c53a-972b-45dc-a18c-1c48ee763f69", "comment": "Malware payload (MimiKatz)", "value": "7ae8f7de4887f853186a40e90aedbb820b4139f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173703, "uuid": "aa85e38a-e0e0-43fb-93d4-db13d81d5a10", "comment": "Malware payload (MimiKatz)", "value": "a20b0bb33d874900ce710bf9a646e115b6d0ba6508a267a2acac948cedd0d606f59e1c9381386af3df2a8174c5ed34b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173703, "uuid": "3dd09645-92ad-495c-baea-e0ccdb985e74", "value": "T1944506A367D0F48CD7D3ADB8D9DD6063D61D374B0259250F8E48CE1C5A998DB888B33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173703, "uuid": "6227da38-2fa0-4072-8080-48ef87d67e45", "value": "8ab0d1e0a0dcad6afdfc570728663cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173703, "uuid": "d3045419-5b00-43cc-96ad-dac1ad8c0ac3", "value": "24576:N8ig6TcB+LoqSZQRbw+NAybxJFClvn6IIYMflJZsQ:Ciy+LoqGQRbCIIPMflJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656173703, "uuid": "5fa84d35-f740-4389-9e1c-5cc69cf3b9c6", "value": 1222756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656173703, "uuid": "26199efa-c6ad-470c-b844-1760f0426964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173703, "uuid": "1cb015a0-d762-4003-aaa2-dd74731b3b85", "value": "5810069331b3d5f8bbd840c26ac35776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19380fb5-f462-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656146270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146270, "uuid": "078d9891-27be-4292-84da-d36207ce8ba5", "comment": "Malware payload (AgentTesla)", "value": "2e3ebbd60495fb56a0698ccff53b3cea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146270, "uuid": "eab673b2-e669-4832-81f0-e995866b4483", "comment": "Malware payload (AgentTesla)", "value": "38683c1f50d0f4077a4123aea53ecd096b7d11e08ad7e6d35ca73a59420b7c29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146270, "uuid": "e4026e6f-a6b0-4511-8ab8-f69d0128fc92", "comment": "Malware payload (AgentTesla)", "value": "6e28eaded0086a17a18b66a9534cb3baa45ff7d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146270, "uuid": "f8cf0181-a7d9-47d5-acbd-21a14f71fbc3", "comment": "Malware payload (AgentTesla)", "value": "7d8c8571fa298d917d120802120f03a77ea1c8db25d1ca59c24ed659190ba4a2331c2751b0563c64899197c0eeae0b47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146270, "uuid": "e333bd17-b89e-47a3-8e53-28444ca5ac56", "value": "T145A5812C3B051A76FD0F9130CD110AC5BB660B637381A99667EF5BCA8B4F0657F05E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146270, "uuid": "ea17a599-3ac9-4585-a57d-befe50cd4d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146270, "uuid": "1f04dba3-26fd-4215-a2e9-119b1d4d424e", "value": "6144:qaOICIaLg6t/woxZqqk7ROUY48iYzCUUdLNKuHJ05xNr4c/knB5J95ZP1/:qaxiw0wHlYwYzBUPKu0f2bF1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146270, "uuid": "5f381133-2a76-4c1d-ba35-36d103a67a73", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146270, "uuid": "ceba2efa-39e2-498e-9279-724370d4efd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146270, "uuid": "2d7735e3-4d6f-4233-bd58-ee8d5c941174", "value": "MV JUNE XIN_SHIP PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8807de3-f48d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656165006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165006, "uuid": "10557329-da5a-4032-8afc-55071240bcf9", "comment": "Malware payload (Mirai)", "value": "e01c18bacdf528e36d7c24ed4ac28222", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165006, "uuid": "ff3cb004-af30-4a19-83c7-b8cc14ae80d9", "comment": "Malware payload (Mirai)", "value": "387938122732e4cba92c5dfb0f1383745c5f2e1229a3ef6ea7a3ccd9167b03d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165006, "uuid": "f83591e0-bc5f-487c-bc11-582d8274b9fb", "comment": "Malware payload (Mirai)", "value": "4aeb829cb91ee528721d6a9275247e6e7d2f0541", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165006, "uuid": "c320ff1e-827d-4c7d-a81d-59d6eb4e1fd8", "comment": "Malware payload (Mirai)", "value": "01dc8a418cc713c7a3c4aca198561ecd59a4c9a0416fa3d158203c75a9a8daaf1e7d3583c8fd14672746291bb7ae044f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165006, "uuid": "9eeb0ecf-8ffe-4596-87fc-08b77ec5ba39", "value": "T1C45302D7466844A2D7C952B4AE82D9C5A33F613CF1B5F066A7608FB5F61260907FB083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165006, "uuid": "681b9193-6c16-4da1-bc09-acd589660719", "value": "1536:9yeVHaRS5DYj6E8wZu/kereRRKz0dLGJrfTaW4MI8fTpi:9xno6E8wJWDALGJrli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656165006, "uuid": "cfab361b-fa5e-4a5a-a690-78346a1852f7", "value": 63816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656165006, "uuid": "3c37fef5-0c2b-44a7-86af-34c50b028dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165006, "uuid": "39df55b3-39f3-4549-8ad3-52c5e161f722", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cb9483-f438-11ec-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1656128224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656128224, "uuid": "00c61976-c415-439a-a14b-ea1389b3ad99", "comment": "Malware payload (Vjw0rm)", "value": "9ff3f8b2a79461f56f556c07da8a6edc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656128224, "uuid": "bd4c7441-67b3-4ad3-bdda-c41830a95e36", "comment": "Malware payload (Vjw0rm)", "value": "389c2bae043162836a18e55bfbbd3a4c93c50c35fb28aadd611bd57bf476585f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656128224, "uuid": "fd6d2ec3-b554-422c-a7a5-5dc79412e41a", "comment": "Malware payload (Vjw0rm)", "value": "37e6eba316422ed75a6fb45bec097ef1dd8af483", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656128224, "uuid": "4841531e-e567-4696-80ee-3c3123cdca99", "comment": "Malware payload (Vjw0rm)", "value": "069c120e9fe3f1ab75b6ebcbbfedc72b6671d6c6e88a534569e59e496f7b15503a66bbd9eef4d18c9a5b584c7d6d9241", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656128224, "uuid": "8e3b205a-5b72-44e8-a041-9d34eaf6e849", "value": "T1D011C04491456A738087B73E4CEB98EAA530634993A0E14925B0F1B0812F5F08BCA682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656128224, "uuid": "cd1220ec-df2c-4da6-a9f3-a199871979dd", "value": "24:kZfgVbLTTQRjh2weX8geO4A7cPC99644L:klgVbLTE25X8tO7c6qHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656128224, "uuid": "829df22e-418d-4555-bff4-3a6a203e64b8", "value": 880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656128224, "uuid": "7bd5bee1-f7f7-4bb1-a182-e9f6d19ddb0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656128224, "uuid": "7eb13268-cbf5-446d-8f9b-2b20e7b8d446", "value": "ReleveID0021558606.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccf9b78-f42a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656122305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122305, "uuid": "dc3fce19-3161-4462-8540-38bc43fc70d2", "comment": "Malware payload (Heodo)", "value": "7cac52da8b9b5c094e4ca3f0c3a88f46", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122305, "uuid": "d0580a01-12a1-436b-9aa2-f8fa3f37295a", "comment": "Malware payload (Heodo)", "value": "393278902ee070c9667a2f83bcb34bfbf5194623c54253d0c4eeb8d3891022f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122305, "uuid": "18310f2e-84a9-4e4c-a683-1b8ea223c172", "comment": "Malware payload (Heodo)", "value": "b18365c334e9fe74a16e89793a0725739f989d70", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122305, "uuid": "9b032cab-163c-4ffb-bd1f-f43efb1cc38b", "comment": "Malware payload (Heodo)", "value": "19241ead3b95817db91342892b2776a07aceab17b490fecb808b65b87a36df6b6628c4ef88c24e09c0513f23faea0b5a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122305, "uuid": "fa69520a-5ac9-4714-88a2-3e2d4f6b5a94", "value": "T123E49D05B7A406B9F0778238C9934653E7B1B4865A30D78F13E5427E6F27BA16A3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122305, "uuid": "a0275043-e4fa-48b7-88ef-2b66a93a1307", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122305, "uuid": "4880497c-1077-4d6b-9198-11b666d7f098", "value": "12288:6Y7wgZv6SO4xxd49GK4qnzK4Mekn+U+HOmqomcpBSFYq9VxRTloUzpuGZ6sSAj8C:r7wgZvqqom0SfTC2kGZyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656122305, "uuid": "962c353e-981a-4647-a245-3099460eda73", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656122305, "uuid": "3ca03b3d-13bc-4eb5-9e2e-de4ecc12e644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122305, "uuid": "bf228111-aeb2-4a05-a9fc-4312da12342f", "value": "7cac52da8b9b5c094e4ca3f0c3a88f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b27d1c9-f4ab-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1656177654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177654, "uuid": "21cfe981-1651-4565-bb8e-718b32134e48", "comment": "Malware payload (SnakeKeylogger)", "value": "073e2f5a5d04c59f0bcc96318803d6c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177654, "uuid": "7ef71e02-5996-40dc-9269-c763cb3e5151", "comment": "Malware payload (SnakeKeylogger)", "value": "397748e3db6b5ef78a0e8a2d870f237d610f0c5688a744904c0d1d6c750a2a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177654, "uuid": "693577ad-dcb8-4251-991b-81de817fe22d", "comment": "Malware payload (SnakeKeylogger)", "value": "58989075f328b7738935c1ab42a89f53ebcceffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177654, "uuid": "02b77247-a29c-45ea-996b-4e2b8efe5e13", "comment": "Malware payload (SnakeKeylogger)", "value": "872d7b468d63063ec3314f24f33dab59959c0aae282e60fe0ede1f93d173be515d71339ac3c6f51da07166fd1b511eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177654, "uuid": "786febc1-a732-46b6-98fe-c8002b6c3d60", "value": "T1B3D4A59C722C31DEC967C175DA681C68EAA07C6F931B4117A027359D9E3CA83EF254F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177654, "uuid": "5b4d8bc3-06fb-4cec-95c8-73317f59e00d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177654, "uuid": "dd9f7e3b-f495-4160-85d2-e08ece51ef5b", "value": "12288:DY2iN7p+XoS7VKOxluaQ0PgMrWlejUIeyvB696bSCk5p5NXe+H4bhEy/mQkCdroo:M1dp+f8Ox6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656177654, "uuid": "666e96b2-cf5c-4ae8-b528-527f48cbdd4b", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656177654, "uuid": "67e3cad1-6cf5-40ae-9ef6-d9a401b1e20a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177654, "uuid": "460da2f5-1c89-49ee-ba9c-ea3f82cbe722", "value": "Import shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f64e2d-f478-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656156028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156028, "uuid": "514f8c5e-6af8-41bc-9e85-f07eea804550", "comment": "Malware payload (Mirai)", "value": "d64ad123a646fb89dc6aa65c868d0f54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156028, "uuid": "6c883d42-e231-4aa6-9ef1-10d9f746ae78", "comment": "Malware payload (Mirai)", "value": "3a122ac9488129da2219413fa156adfb19bab5c9605bcaa0da8e31893f7345c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156028, "uuid": "e25f7af1-36f9-4f71-9259-ba1a72068c49", "comment": "Malware payload (Mirai)", "value": "766b3a870f18a1ccf7ece014a5526e82729d2323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156028, "uuid": "015fd6c6-caa7-4c4c-9a24-939d202152df", "comment": "Malware payload (Mirai)", "value": "73de24c18934a78d1719f8c261cb23672c4fe251dc78109cc22c4d90c5eb62bde9111fb9f9d2831161c5352322eb8e70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156028, "uuid": "0ee964f7-f98b-4032-8cab-6ceb26414f70", "value": "T121D2E092A0A59B9D86DDE2745EDFB48F0900C16D0A94E8DFF9CC313A9904BA4331C6DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156028, "uuid": "b078aaff-0574-4377-9488-cee54b069b49", "value": "768:KB0CfF4qWUnYa42a1NQ4vzpPGJtAlSTSWLSZnbcuyD7U/QRjc:KB0Cd4qForpPGJaDRZnouy8/yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656156028, "uuid": "250183a2-6a0f-4c24-b5bc-7a22a88e7b1e", "value": 30668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656156028, "uuid": "1d0d608b-2725-49c0-a92a-2983edbf20a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156028, "uuid": "1cae7fea-dd01-4910-bb82-9d608f39af97", "value": "d64ad123a646fb89dc6aa65c868d0f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ee9df2-f42e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656124064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124064, "uuid": "092ced20-8c71-4466-ac63-72b6c938f3eb", "comment": "Malware payload (Heodo)", "value": "ac08be31a812173c397721765db968d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124064, "uuid": "506b4690-95cd-490c-942d-6f9442576f26", "comment": "Malware payload (Heodo)", "value": "3a68f56f014721f990b04a7e30652f0c0b80a95ea93559026f2989e2d83e9985", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124064, "uuid": "dc922fb8-4703-45f4-b0dc-0136001e6ffa", "comment": "Malware payload (Heodo)", "value": "436fe32aca56cef16013c117734a688796674b86", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124064, "uuid": "7b3874a3-ebb3-4389-ab94-55304e852098", "comment": "Malware payload (Heodo)", "value": "9ecff110927be13616af6e787c1cf1c71ce3db665b6b20a159233eb8274db617a78bd59d25eb24d3277eba1041bc1efa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124064, "uuid": "902e0f7c-1acd-4ef4-8446-5ad0202f7889", "value": "T178E49D05B7A406B9F0778238C9934653E7B1B4865A30D78F13E5427E6F27BA16A3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124064, "uuid": "0a73becf-8473-459f-8c94-a7c3454f79cb", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124064, "uuid": "fa31686c-efc1-4749-9e85-aaafb8acdd56", "value": "12288:6Y7wgZv6SO4xxd49GK4qnzK4Mekn+U+HOmqomcpBSFYq9VxRTloUzp5GZ6sSAj8C:r7wgZvqqom0SfTC2zGZyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656124064, "uuid": "792fe1b5-5e44-4805-8159-6bd996685864", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656124064, "uuid": "5bb58fe7-02f5-4c05-abd0-9b1826cd745c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124064, "uuid": "f4868fad-c054-40c5-b5b3-bf9931df84e1", "value": "ac08be31a812173c397721765db968d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74b0a60-f4a3-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetSupport)", "timestamp": 1656174507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174507, "uuid": "798b0a6b-9c34-4581-ba92-2c51bca8ce33", "comment": "Malware payload (NetSupport)", "value": "47d55a8e504509f4bdb034c3f0068e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174507, "uuid": "d574842f-7f28-4c54-a34e-a7e84f24fdcc", "comment": "Malware payload (NetSupport)", "value": "3d47aa3f5d36514cf264d75f75774318f4a00f8258c73f61631f995613f7290d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174507, "uuid": "53f7c216-53b1-4090-89bb-a2b46cac1e64", "comment": "Malware payload (NetSupport)", "value": "d9eefb58b5e3e08055d1f42a3bae138c2c39a23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174507, "uuid": "f2f8b12d-3965-4fc1-82ab-fdfa67c3a498", "comment": "Malware payload (NetSupport)", "value": "90b09302d3a8781177e22342588e6a2eb55e41b352024cceafd661b644ddcc7af9924243e123e8599afb51e0adbf86e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174507, "uuid": "6cfa9e7c-bb89-42f3-8ba9-b9c9b1c7abf6", "value": "T14195332236D11835D5260E322B7EAE41D2B5BF7578B7F21FE74A462C3630982FA59703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174507, "uuid": "2c3728db-9fe6-4b4b-8150-da5d951325fd", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174507, "uuid": "6b6f8303-2d8b-4d87-9095-663c54ec59fa", "value": "24576:RFszWS5iPxzpRHYWc3LzMH7f9w4A1uSjxRI0720pbmD/XvfPlWdEllDU4bqkVDzv:RVRtfrUcSjE07Pp+nPUqJUeLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656174507, "uuid": "2596772b-3206-4be9-8e3c-11b23c52748c", "value": 2001832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656174507, "uuid": "995ce3d7-9b62-471d-8ecf-cccfba9ca29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174507, "uuid": "3788ba49-7e85-4ac1-8d29-c029d4a730ea", "value": "47d55a8e504509f4bdb034c3f0068e61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311b6b60-f46c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656150605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "5b4ad629-b1bf-41c7-8bb7-3d596c54bef7", "comment": "Malware payload (Mirai)", "value": "83c119444f55d03da3ea5f6039c6adfb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "4e98926d-7721-4dd7-ac52-6d6df6550a4c", "comment": "Malware payload (Mirai)", "value": "3e0a5eb9584789b8af30e4d24205474cde7d10c096b3cea9b838897e2e9708a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "e9f8ad26-436f-4674-bacc-4211d4d5dab8", "comment": "Malware payload (Mirai)", "value": "abfc7e15fa6b8af98684c9ee8df23e4f92a64eb8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "67155db0-a30c-4813-9d26-e9862e4dd6b7", "comment": "Malware payload (Mirai)", "value": "4c94b381fef015349360bb1770ddb2e50f8ab77851e792ea9451953c42534c1ddc7ff7abb8c16e8208b9d1c155c26f73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150605, "uuid": "fa779a1b-36c6-405e-a7aa-d8eb218d9f67", "value": "T149C2E1E53FB77A5BDA251039785DCE3381B5F062D36EB713A240924820071ADB7359DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150605, "uuid": "ef11e7da-878c-4d7e-be61-06f9bf68ad7d", "value": "384:Mn1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8Q+33bRF3Nyk:CMwoDZLFbBy6HQHRYfeAxdd8V3bRG0N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656150605, "uuid": "813c85a0-cf00-4c5d-9ba3-bee450f6f9e0", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656150605, "uuid": "5802cbdf-046e-4561-afae-f5d77d23f599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150605, "uuid": "6694038f-6d92-4cbd-bdaf-bab15c2de23a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ecae32-f4a6-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1656175440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656175440, "uuid": "4d8a1654-9088-4969-8e1e-06550817149b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "49849ea730c690df970bb542dbd18e95", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656175440, "uuid": "255f5c35-3477-4025-8cb6-69d6a25c4910", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3f947f5a849f11be9079a5c2418240e2faf7e53b63662c85b92fad8f47ea4d09", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656175440, "uuid": "697e15ff-1daf-4838-8422-36a413419435", "comment": "Malware payload (CoinMiner.XMRig)", "value": "24063f28fa7dee0e0c54236bac0ab6d9a5b1e31f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656175440, "uuid": "8a36fdac-2b61-4913-a65c-db0d9183d105", "comment": "Malware payload (CoinMiner.XMRig)", "value": "29c72e5d10148c93bbbfb8eff50ccf791348bd82eba6a206cd6a5127f7a48462a19094b47a54408fd11c0ac13687d465", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656175440, "uuid": "97edb195-99e3-49a7-8e79-e9222b6e1e5c", "value": "T1018633954BEB6046D73CBA7629E3DE294F0134218529AD720361ABC0E47D6533CBE1FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656175440, "uuid": "e7888fea-def7-4a22-bd4b-7b36bbcc4709", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656175440, "uuid": "f5a7681d-f6fd-4de8-a4b1-04da8a39d4df", "value": "196608:JWLqEnZMIImZP/6N+ylO9MOchY35XhF35oTGxUh:J4qIZRImpCoyI35XhFpE0Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656175440, "uuid": "f37be4a1-f55f-4365-89f6-ed29529f5dbc", "value": 8194852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656175440, "uuid": "f9240d15-7a9b-4733-a37f-a14fc4c1da6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656175440, "uuid": "72c199a7-d629-414b-90f4-e0a408e8b8ab", "value": "3F947F5A849F11BE9079A5C2418240E2FAF7E53B63662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c05db70-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1656145872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145872, "uuid": "d9f73ec2-d273-40a7-8c00-c0c329646f2b", "comment": "Malware payload (Formbook)", "value": "04fd333e92e941b5341ac41d1294b257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145872, "uuid": "00d24e4a-749a-4394-a79d-d06491f277c7", "comment": "Malware payload (Formbook)", "value": "40c4346a171db5d06a7e6002ff7307b559403662fc749c0f1de4d246f29dd411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145872, "uuid": "f9792d89-188d-43d2-acec-7a83e02bd7f0", "comment": "Malware payload (Formbook)", "value": "830f862302eb7cd728807169f55737fc8d65c4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145872, "uuid": "0309879d-7a31-4a26-888a-763a6ce68450", "comment": "Malware payload (Formbook)", "value": "3bac35b168bf063eb55bfa55be241366781ac48dd3702414b2eb3f44f5911be3c89dc780619ec1911aded6388ec54366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145872, "uuid": "74716ddd-273c-48fa-ab9a-d89053ea6f80", "value": "T101943B2C7B061A76FF1F817049510A08BBE72F237280A99357EB19CA874F4677F05D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145872, "uuid": "c50001ac-5854-465a-a52e-e2707a95233e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145872, "uuid": "72ffd596-3cd7-4997-aa78-9ac0d4e289f1", "value": "6144:QE4jtyFtLmt6m3FcBrRZt3oGS63/LSKcoGlHLTcVMK:rWyFdJtBrHZHSfvlHL8MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145872, "uuid": "fb98a2f9-7518-4c0f-9948-9c870456b085", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145872, "uuid": "ac7cbb9f-83a3-4419-9bc0-d33779d095fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145872, "uuid": "e3add75e-2f97-4fd3-a5a7-580b6a299988", "value": "Vessel Specs_ Port Call.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d190df2-f479-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1656156182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156182, "uuid": "96808646-6c94-4fcc-a7b3-94c572b5c8cb", "comment": "Malware payload (NanoCore)", "value": "abf49ede16a79ae2e6d9177d30ba908d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156182, "uuid": "58843abb-0764-4a02-88b6-b0c4ddc5c777", "comment": "Malware payload (NanoCore)", "value": "40ea46cacf1e9f577aef45eb1cd3f611cb9293e48859a6165ec839dffe9fec5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156182, "uuid": "850df9fd-059b-425d-b90c-8fdbad3ccd1e", "comment": "Malware payload (NanoCore)", "value": "54f15f7228bb084ff5a81c6cf620efb441ed8026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156182, "uuid": "501b1305-53cd-4355-b3f1-b9461b58737d", "comment": "Malware payload (NanoCore)", "value": "858d5832336e63f53dcd1d742d22e8dfd41fb422f3d8d83ff6ff3681f504caee161262f5371aece54f0a41b410ca8c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156182, "uuid": "8e570002-eaf6-49da-81ca-aae7c1b90651", "value": "T14414CF2677A84A2FE2DE86B9712251038779C2E798C3F3DA1CD465B38F267E446070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156182, "uuid": "7b86524a-5ede-44b8-a1ea-093702a6b26c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156182, "uuid": "e1485955-3665-4a94-8899-9d5d99346476", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI+jUHnWi8DnkE/pnQD/2uDEm+A:sLV6Bta6dtJmakIM5roSDnkEuCuI1X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656156182, "uuid": "50496594-2c09-4486-afd0-4134c0ea5b98", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656156182, "uuid": "6791ba1d-cbd8-4290-bc82-b47559c22c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156182, "uuid": "65a5c4bd-2e2e-4170-83fb-3c06160b9090", "value": "abf49ede16a79ae2e6d9177d30ba908d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19272195-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656168604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "9207f449-f049-4fff-8656-a97c5d37a88d", "comment": "Malware payload", "value": "6530c6b99d597636c89787f3c8b34c10", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "c5c4d983-a6e6-475d-9c08-4387f898bd2e", "comment": "Malware payload", "value": "4146461e099e92243b511e9b182c24fa1ed9443910c6e06dbc6bf85dde1e44f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "8604c8d6-3d16-43c6-9790-5228e70460e4", "comment": "Malware payload", "value": "93011d353685fc385d2559b301162eafbdfb2393", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "1e23486b-bd2e-4ce6-ad5a-f32126a10745", "comment": "Malware payload", "value": "c0609cc4b03e4dc44598605ad8157d9248373f9917203b4b352b5410bb9d6ca48c277b2d408c033c3dafbc9dbe97dec2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168604, "uuid": "e9f4e982-1e43-44fd-9045-465d98bf6da6", "value": "T188C2F75AFD416F05E4E4217AFF5F124933135F28F3FB72025A215B25678AE2A0F3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168604, "uuid": "4e0aaac0-e6a8-4338-8962-ee8439c1a05e", "value": "384:S9npyK/cDdkdXTtqlitxjiENQU9A5VQgXx4ekwefqf5rQIeu1Q:S9ntER8XBqlittiABm5s7Zger", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168604, "uuid": "7eff386d-fdee-47a8-94d6-6df36d1996c6", "value": 25896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168604, "uuid": "155edc4a-264f-4ee6-9ace-2ce20bf09eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168604, "uuid": "52238acf-7a44-4a46-ba69-fef1ad30b617", "value": "Saru.arm7-20220625-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78a91e6-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656146187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146187, "uuid": "24c49399-4874-40c8-8ca8-eab76f2e4745", "comment": "Malware payload", "value": "2431c591b4bda1a7a26546fbb05f6291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146187, "uuid": "9442bf94-f2f4-4904-ba2f-a080379f0eb1", "comment": "Malware payload", "value": "414a732a37df5098801c50e501dff15257bac46e23f04dd41c17d625077afec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146187, "uuid": "7f7f6ee1-a650-40d5-9c22-706515e17c69", "comment": "Malware payload", "value": "4622b741c8e0babff74bd249b0a5794fbcb3db3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146187, "uuid": "cd340329-9c2c-4219-8c54-ad702f2405ed", "comment": "Malware payload", "value": "5fe61dffb386429302e8f105aabb0f6b22c6a08d46e1ad1dde8cde820e5ae6db48f2b29a08e563de0615efd4c6d1a099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146187, "uuid": "31e45245-00fa-40cd-b5b9-30442453de00", "value": "T11804A323B47CC5E2F89C3DF45A0997642AB42E920639F14BE90FBDD6E8B3223C2445D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146187, "uuid": "1fc1b80a-d0ad-434b-9896-b16576fa622b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146187, "uuid": "8539e8d3-b7ff-4b98-b40b-6042cc7be447", "value": "384:SXe+bU6VGyKPkw9dP0cvbjVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalfalfalk:SO160ZBbvDvFZtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146187, "uuid": "5d950c40-93a1-43e9-9454-7a2c7c319251", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146187, "uuid": "3916f98d-2dfe-4e63-a1e1-b7818696ed87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146187, "uuid": "8eec60e0-2963-4657-b2e6-119be88e9aaa", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4feafe-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656161924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161924, "uuid": "30dcf0a5-47d2-4a37-8a00-712fa4b8345c", "comment": "Malware payload", "value": "c51b0878ecb22f676d61631189227f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161924, "uuid": "7b383d6f-b843-40e4-90d7-d146733d5f08", "comment": "Malware payload", "value": "422bf24f87bba4408c2110debf5aec9ed24538446b7ca1aaf0bb75fe29670351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161924, "uuid": "607649fb-31fc-479b-9d9a-8eb4accacf3e", "comment": "Malware payload", "value": "b467b8a3ab0fc3d9471e1f85081d6fea83529894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161924, "uuid": "c503b89b-7d6c-4c99-9643-7bd22cda0b3d", "comment": "Malware payload", "value": "d0aaffcd28425f108dd897047054fb11669851a0ec82f258884b5f0ef121154ac9ff92b9e9b8a300e75cb8038000f65f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161924, "uuid": "d9652e14-e822-4e94-a276-0e5cb239aee8", "value": "T1F8D59E51B7C680F5EA9356B8047AA73B5D3AB25143389DC7D3602F4E5D313E1AE3828B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161924, "uuid": "134d76e5-570b-4769-a813-0c4d38d9f2ae", "value": "8f6f1f583f020f2288c0eac510f964b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161924, "uuid": "f6e9a79c-b245-4aa2-a430-133a8db23249", "value": "49152:8/iROwjnFDpbICzqPsFTn/i81H7B3cCTnr/5itBaT:iwr86qEVK857B3cqqBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161924, "uuid": "4140ce7d-7f6f-4eb5-b2b4-dceea00dd000", "value": 3000832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161924, "uuid": "6c2aad17-9f4d-43ab-858f-fe557b2efebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161924, "uuid": "205bfe57-4a77-4b43-9d9a-98227edd880a", "value": "422bf24f87bba4408c2110debf5aec9ed24538446b7ca1aaf0bb75fe29670351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6e561f-f49e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1656172344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172344, "uuid": "392895a8-857a-478a-ac4e-416fa4711c5a", "comment": "Malware payload (Gh0stRAT)", "value": "52f03d5c8e3c1101dc75a680b88cf3d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172344, "uuid": "1e2c6974-f4e3-4e9c-9441-0ff3d04830e5", "comment": "Malware payload (Gh0stRAT)", "value": "4581b207fad8080c3fca81cbfbd831b5d2c4801a8e82783553e7fc8393b12269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172344, "uuid": "436153fe-76da-44dd-91f7-7b146b641325", "comment": "Malware payload (Gh0stRAT)", "value": "2547b4e67e5e9db407e4d8b05895f1861f4be15b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172344, "uuid": "e92bc517-80e2-4c06-99f5-4920baeeb803", "comment": "Malware payload (Gh0stRAT)", "value": "d7d473c140d081adfe56ce52daef86b88015cfc2be6465e4e42a84dd85c622715d503809c377ec5fac3e3460bc79ce73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172344, "uuid": "a1bd52e7-f800-4c2a-b04e-d15d6d9c209c", "value": "T17C85F11176A2C076C15E2132595EC7396AE5AE311B2486F37AE23FBC1FF02D25D3826D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172344, "uuid": "b2195693-7691-439f-b0e9-7976b9e67e57", "value": "1b9d86e642d2cd2aeea922c286b2fc95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172344, "uuid": "ab848d40-47da-4a6c-8f75-fc037a69d8ce", "value": "49152:804xqTfqrjz3xqHTPCzAehZ+upENcqrNeDDp0o:80k6fqD3xGPCzZ+uON5rNeDDp0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656172344, "uuid": "d3b3bdf0-f5a0-4f14-a2c4-d57e85576cd0", "value": 1705984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656172344, "uuid": "2782760f-6694-46c4-82e2-a1c32167092e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172344, "uuid": "03b1193b-bac5-44ba-a7e8-ffb9faa9eb9b", "value": "UniMod+.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2015af70-f458-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1656141987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141987, "uuid": "e35b7b72-383b-4586-bd84-51099f4e35e9", "comment": "Malware payload (RedLineStealer)", "value": "e62f8b2b2e58cc69bcf78c2de8950632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141987, "uuid": "4d69d66a-f014-4594-9fbe-6379eefc32a9", "comment": "Malware payload (RedLineStealer)", "value": "45df9995510ec401fdd4de1d83fa56096e9c28fd97d07c5f44f80cf7acf78458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141987, "uuid": "d0207c30-b2e8-44cb-ac58-77af1c5d8e8e", "comment": "Malware payload (RedLineStealer)", "value": "ef4793e3cc8c7c1f372f4e3a31692da37d056dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141987, "uuid": "b6f4d7c5-875c-48a3-977f-ca090bd03596", "comment": "Malware payload (RedLineStealer)", "value": "da8c58076939be41733f33267da6e1329ff2e1ce1a05d24487a5a2b6b4af38a020b9adc5514ad1cb015d2ea07f5ccec0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141987, "uuid": "4a1bc192-806b-47aa-8aab-9ff007952619", "value": "T165C2E7D832B4FE76F10A0B379552E2311738AF094827D63E67E45F4BBD262E10B94D62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141987, "uuid": "584bc36e-d9ba-4de2-9ada-a592e7e0f2df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141987, "uuid": "e4a668e8-35b0-46d9-b533-8803cd9212f9", "value": "192:gRPtpsDTlxV6g7BYI1YHTprpdnIPgF8k9T/EjZa2YVeCp4mRukveH9:QPtGTlxdBrYHlpdnIPKN9afgeCtuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141987, "uuid": "7772d94d-1d56-4a62-9588-7b182545f6ae", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141987, "uuid": "63f5aaad-2e46-4658-8e64-fe2794b9b4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141987, "uuid": "2124fb25-044f-42d2-9d07-55e1f4eb7c35", "value": "e62f8b2b2e58cc69bcf78c2de8950632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82afabc0-f42e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656124113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124113, "uuid": "bb74b546-62d9-485a-929f-fc974f607bb5", "comment": "Malware payload", "value": "f5d91bbb276a18910e6a0aa235136279", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124113, "uuid": "9249083a-6eb6-4742-a750-e077dbd9c117", "comment": "Malware payload", "value": "46381f6540a0a0075a17fb9747e5cf09dbcdd69b5509b1f4beced1c13d1deec2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124113, "uuid": "3871ab65-8477-48c5-b113-682dab4f0a22", "comment": "Malware payload", "value": "28c5fe4661cacaa8e0de5c260fbb1cd773965d46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124113, "uuid": "67c8066c-9f1e-42e0-a383-b00525144201", "comment": "Malware payload", "value": "66f6862f23f61744e470ff779e926468a9748397d54dc42d08ff71c9cbe4f277d024762236d73333de829a75936a6cc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124113, "uuid": "ad90eec2-f689-4ce1-b0b7-907f319060f6", "value": "T1C325AE02B3D1D036FFAB92735B69F20596BD7D250123852F13982D79BE701B2273E662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124113, "uuid": "21595583-b3c1-43a1-8483-fc7383834005", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124113, "uuid": "f327d92c-3b25-43fd-87cf-d9c54cb98ce8", "value": "24576:HAHnh+eWsNbskA4RV1Hom2KX4mGashhPYMPA/:6h+FkldoPKIBashhPYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656124113, "uuid": "bb80ff71-40d4-4d15-82c9-629c5e956211", "value": 1046320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656124113, "uuid": "5da865e7-0cec-4d8b-a800-17835f0ed214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124113, "uuid": "c8249722-1d4a-477b-8f2a-61520225df77", "value": "f5d91bbb276a18910e6a0aa235136279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb20a7c4-f429-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656122061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122061, "uuid": "57f2b717-f845-425f-8348-e3c2160a7974", "comment": "Malware payload", "value": "d6820eebad95a97541bca3b6e0a898e6", "object_relation": "md5", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122061, "uuid": "9df87af5-8d0f-4a56-877f-0b0187492f34", "comment": "Malware payload", "value": "467a2a514d8a52ddf01ffb3f14818a4ffd8c76b2f0d944a6854ae478d62cc348", "object_relation": "sha256", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122061, "uuid": "ad401f41-9912-423a-b791-9757d2e291a5", "comment": "Malware payload", "value": "69b0a980ae632e5618daa7775876b48ceead1c81", "object_relation": "sha1", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656122061, "uuid": "4a1abef9-f213-447a-a77b-fbc2b34c83a7", "comment": "Malware payload", "value": "d2f0b2d72c50c197d8981335a3b633c5f7bb493567ec64d76bafb547ba11b2a74f3f05c77098322e89d9ba71fae31339", "object_relation": "sha3-384", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122061, "uuid": "0c528d79-7603-4b0a-a2fd-6074733cbb82", "value": "T1D8163307B2D25B79D08B51358A4F9367D675EC3086230A132398685D3EF3264BBF72E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122061, "uuid": "6919c438-4698-469d-8abf-9769102f3a68", "value": "98304:YYMAk/NyrV8fCeyPCvm8sMbhdztct3DKqqAxkC5VXGV2RnfWUGOWwIye:w17fCDKuK9NSpKqqAxkepOUkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656122061, "uuid": "190cbd2a-8090-4737-a02d-8f6316b24b52", "value": 4078592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656122061, "uuid": "7ec5f735-3120-42e7-adc3-2448d937be0e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656122061, "uuid": "3c2bbc1a-4bfe-43c0-bf53-f0a2bacf4ce0", "value": "vfat.195x91285z5yi15hw jst6zr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b267669-f41b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656115753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656115753, "uuid": "f0a777d7-3d1b-4ec1-b05b-55a8cd6421ba", "comment": "Malware payload", "value": "e6eb772cdabde2f87373aa7bcd387d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656115753, "uuid": "cb84e3a1-f32b-43f6-bf55-9117b0948f02", "comment": "Malware payload", "value": "4f452da2126dcc7e7936b78a47785ab44deee92d0eb46223dee092bcc8120335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656115753, "uuid": "e44e7344-9251-4585-b19f-30fcf9908ca3", "comment": "Malware payload", "value": "49b6face09b00d55bb0809de8fbcc7f9ddccfda4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656115753, "uuid": "a3d91bea-3524-49f3-8bb7-44147dd74a17", "comment": "Malware payload", "value": "beea4bb0bb11b83b41b26dc966be15572239c6901fb3cda0301008d1788511c2716ef75a675da6566a95b114d2f213a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656115753, "uuid": "04009706-78f0-43eb-84dc-3c15beb589ea", "value": "T1EDB54609A147E27BFCFD08A7445090D4C29C7FAA7B128DCDE93AC59A141F482B7B6D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656115753, "uuid": "ce9cc748-05b3-461f-bac8-f826082be69c", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656115753, "uuid": "3496aaa5-a968-4052-902a-307d58531b1d", "value": "24576:YOfNkuu6oLsSwHamh4R3vY17cSHTOhZSJC2ezN1Bt8q5/lvUU50xJpWWrZB2pWPs:H6s6NPSHTcF2eXBxvL0Hrj2lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656115753, "uuid": "2ebb2c23-57b5-4471-9a7e-88daa4458953", "value": 2287768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656115753, "uuid": "769c85d7-65c5-41f8-bc10-fa484475fb57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656115753, "uuid": "861f303a-f520-44d4-b2fd-7da71fc2284a", "value": "SecuriteInfo.com.Trojan.Uztuby.4.14494.27777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340ed224-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "f92cc977-70cb-408a-905b-83290632139b", "comment": "Malware payload (Mirai)", "value": "b52f81f2d9fa068c477e996574af9099", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "28575f30-bfc2-466a-a640-6f05ad528eb2", "comment": "Malware payload (Mirai)", "value": "4fc8d63b195b2648a03e1bdd248dc2cc89d262203dec2cea4b18e138fc964fd1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "c93294e2-fa6f-476f-ad05-e799c048e26a", "comment": "Malware payload (Mirai)", "value": "ec4f5f0e3db91b22f4222acdcb14a5d4d11440dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "5bfbe7b0-fd5d-44fd-b40e-8c122d8c65f8", "comment": "Malware payload (Mirai)", "value": "72e16a72f2b632bc670c7bbb07169a19240ee581770c8035c8b4bc615ca0de61b6258c3c7723a529af36cce5296b6462", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "81323875-14d5-4414-87af-45410fa92a30", "value": "T1D20339431550C2FCC909D2B05B7FBA27DE33F47E1235A69E33947E266A1AE312E1B149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "ea5c5014-af70-4c00-8ffd-799b2fed6805", "value": "768:ued05H30hDK1v/9Qkf8Bv7co30HBSHnv5E1:xA32DKyvv7cq2BM5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147604, "uuid": "37441568-c9e1-4e2d-9629-8c07bda4a9e1", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147604, "uuid": "bbd7eef8-b107-45e3-b9f2-b649afad4a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "9cc22cd7-c4a4-449d-aa4f-b4a4234b8c61", "value": "miori.x86-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a570e2-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1656161970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161970, "uuid": "55bb8bdb-c9b0-4c4c-a256-7b5fecbaf206", "comment": "Malware payload (Gh0stRAT)", "value": "2c0e8f3529e6eb4a912d901777ef4df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161970, "uuid": "7ed20d25-b959-4dc6-b157-6ee7ab414ed8", "comment": "Malware payload (Gh0stRAT)", "value": "5711a4639701eb168e018996243959f282f99f5caa4730cbf4c7a581d5ddc4b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161970, "uuid": "e02abfad-e5e7-4e9a-a3fd-c9b844a97cc4", "comment": "Malware payload (Gh0stRAT)", "value": "b70ef3acf3b9ebed601a49aff48d322dedcab150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161970, "uuid": "1643f27d-ad51-4687-be29-76e4e575b229", "comment": "Malware payload (Gh0stRAT)", "value": "514e12fe66df707a5177d2d1e59f7b93a5507dc5c3c18365a8d8c6fb7836ebe31a5ee93ecc61b332b57742cc05d7da09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161970, "uuid": "6a6f0729-0d95-4221-a2ce-bf73764c0fa6", "value": "T19666F25DEB26BCE4F91E53BE3531583A3F419D26D8BE186E219666271C3424310ABCCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161970, "uuid": "3d4bbeed-d920-400f-af7e-d44369c5db07", "value": "32dc0348b8e625443b5e70f8fd621604", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161970, "uuid": "5ac07291-dc03-4ac5-901a-cca6b3cf5252", "value": "6144:soHW3MRPEXIJ7TsQla1N0YntMQyQsz86BJnk:so23wuT31jnBOz864", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161970, "uuid": "ae0bf514-8ea1-4c9a-9f1c-2148c0640547", "value": 6979708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161970, "uuid": "d083c9ad-d69a-489a-8c72-fd474be116b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161970, "uuid": "b751b78e-875b-4431-acc1-04b220504f78", "value": "5711a4639701eb168e018996243959f282f99f5caa4730cbf4c7a581d5ddc4b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee25a6f5-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656168961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168961, "uuid": "6904dca2-fc02-4880-87b5-aedda7c9a8f0", "comment": "Malware payload", "value": "570103b57dd2b79f565636a4cf841ef8", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168961, "uuid": "32069c74-d28a-4466-b120-1ca2f38e05f7", "comment": "Malware payload", "value": "59313867c36631da9d32e5a898a35a919ed0e6a5d0f3d698138308d82f1b82b7", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168961, "uuid": "d83411f4-c48a-4468-8948-38744323abe4", "comment": "Malware payload", "value": "167747c2188c6c2551d52a8b138922447b018a76", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168961, "uuid": "afdde9d0-2ac5-4e6e-a7f0-151893911f40", "comment": "Malware payload", "value": "05c0e535b5d494a6a3c9fff851073b109f01b20ce0b94d53ab06835178604534b8bbb0077da1f3b618cb60f1e2c1b2d4", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168961, "uuid": "cceb35a8-5f16-40be-a399-0cbdeb4c59b8", "value": "T197122A03FE550A63CF6887F8253355EAC9B972330B01B252B7BBAA654E67140E01215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168961, "uuid": "e0207317-e912-4876-9940-c73adfe3e7ff", "value": "59261a06d3b7f82dbdd6b0b7da872a88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168961, "uuid": "93cc9fdd-1be6-4677-841b-435ee5910889", "value": "192:L4ICxiHEDfTerAouyWJbvjOptdmMCptINJ5pz6rJo86rR:GfqrtuHJ7jKZNz8SR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168961, "uuid": "be6a7454-ab13-4c8f-b4f7-f19490ad1575", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168961, "uuid": "f040c04d-4047-41b1-aad6-d770cb9a0256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168961, "uuid": "1d5be0b3-fe77-414a-a9be-655108d994b5", "value": "KillMbr..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6474fe1b-f460-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656145538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145538, "uuid": "6b643779-e689-4034-b99b-b1d2fce90f93", "comment": "Malware payload", "value": "e98f5ad0adfb66ab54c1599d79c8356b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145538, "uuid": "ee323839-88a8-4dc2-aad5-b6e3abfd31b0", "comment": "Malware payload", "value": "5936592660877a19029d97b2c94119b75bc6fa0d54c45c14006293bf46114872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145538, "uuid": "76792052-9573-4232-b828-d8161c312a5b", "comment": "Malware payload", "value": "a924965469cdf340a0ddcbaf46768aee578f441c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145538, "uuid": "97ea3beb-57d0-4007-95fb-51841564fb54", "comment": "Malware payload", "value": "edba05c6bdb1cf3c40c4735876f2c9c64a03ebbd845a2c1217fda2c4746cefb776296752bb38a2bc04d32a2e7bcf34cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145538, "uuid": "be97de30-ac60-48dd-81a3-def2899c09dc", "value": "T122B2C66E324696B5E4B90E7A864F128407697C31FF416A9E3395759F2C332A0CB2333D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145538, "uuid": "560d5f89-9e3d-4a76-aca5-ac59b3725d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145538, "uuid": "d82108d6-dd5b-4ef4-8208-119216289c16", "value": "768:I4oUx0V7R81XhVph4PhQyGoGniHbvD9pKi033f6c3AlohKRuf:I4PeV7R81XhVph4PhQyGBniHbvD9pKbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145538, "uuid": "e70ba2a6-ba11-462d-a0c5-432edb4ee6ab", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145538, "uuid": "fd7bd871-aad6-4eda-acea-6540c8c5a7af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145538, "uuid": "90c31f69-f7f3-479b-8f11-71a34f1de065", "value": "Cnxsc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbeffa9-f462-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1656146543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146543, "uuid": "4422992b-0baa-4225-bbeb-e8e0906f6768", "comment": "Malware payload (Formbook)", "value": "9c1a21dad3b224e452ed4e76be6b916d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146543, "uuid": "c939d0b4-fe95-4114-af29-720dc4729cf8", "comment": "Malware payload (Formbook)", "value": "598f6a197785846295000434721eede352fc5bea22fe3faef352f64770d06909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146543, "uuid": "37520240-addf-4d9e-8326-a2120699fd16", "comment": "Malware payload (Formbook)", "value": "723702f2f7369f56a976f9bc1fa07c3aab502d69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146543, "uuid": "5fb2d0d9-8a07-4758-abd8-0c72ba89d570", "comment": "Malware payload (Formbook)", "value": "d33cb79d9c8c1791ef4a383ed97bb9b6c25c78fb3c475cfeb4804ce2379a8d1cb8b0494be829b38704b800273b7cfd55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146543, "uuid": "642bb3ed-b0e4-40d8-b3fb-a4f13f9eb29e", "value": "T103A44C3CBA014A72FD0E81B4CD111ED9BB660F133391A98267DF17DAC74F2A52E25D98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146543, "uuid": "1ffef951-27d4-48f5-9ced-8b99e133aba2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146543, "uuid": "aaac7269-6190-493c-8f9c-a968ccbee1ce", "value": "6144:hOl/Hsx3LrfYqiRjIdTv0pk+6p9S6kCruBxbe1Y0:AlUARjICVN6k4aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146543, "uuid": "f40de643-60a4-45bc-be93-6933f8ffdc57", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146543, "uuid": "ba1d16d3-ba9d-4fe9-916c-0e780afa6ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146543, "uuid": "0c649994-37ae-47f6-ba6a-c2f76356df5b", "value": "MV PROPEL TBN - VSL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1460b40c-f458-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1656141967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141967, "uuid": "7601e687-fb06-493b-921c-2706fb499557", "comment": "Malware payload (ArkeiStealer)", "value": "c243a200edf6abd1ae46fc49755b233b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141967, "uuid": "747a5d2b-d1e4-4c51-aa2d-7cd3b533edc1", "comment": "Malware payload (ArkeiStealer)", "value": "5d8db1c98a189543c90fdbe2f6d4abb831510b1176c045a9588b6f5c95cc5e43", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141967, "uuid": "8a88f137-fc73-44a4-872e-4c31f071438f", "comment": "Malware payload (ArkeiStealer)", "value": "f58d0adf16e54c6220da3cc26dd898ceefd026b3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141967, "uuid": "0fdc5b27-5915-49a9-a88f-cab166b6db51", "comment": "Malware payload (ArkeiStealer)", "value": "a40041d1e025e0db0753b935718102a86a936213bdca12f2b8f79e28513c8e987c9660c5a4b39d07302a6e103ce0b8b8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141967, "uuid": "80d72fa7-bcee-4193-b96d-44ca076cac74", "value": "T1F294D000BBA1C035E1F756F85AB69368B52E7AE15B3550CF62E016EE56386E0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141967, "uuid": "6e7f3795-fe95-4577-8726-efc9ac024bd5", "value": "8aa5d6264da1e437be4b2f2dccc9a830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141967, "uuid": "8475e8bd-45e8-425d-ab19-0ad89be24699", "value": "6144:kSd7e2s6oYRY0byE29QuucKUTLAzJDH9+n1txsHzr6VW+etOPFrS7OI3z3:TpDWYCWyE29Q1UYBCPGHzrU3eMS713", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141967, "uuid": "66cd870b-1205-4082-9eb6-b1e55dfa528e", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141967, "uuid": "412c3fe0-ca58-421a-998e-caac639249c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141967, "uuid": "e3587ed1-597a-4809-85a4-b8c9a1a0850f", "value": "c243a200edf6abd1ae46fc49755b233b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac2b88f-f458-11ec-93bb-42010a9c0043", "comment": "Malware payload (GCleaner)", "timestamp": 1656141951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141951, "uuid": "62e2fee6-bbb1-4011-b8a5-6461469b7045", "comment": "Malware payload (GCleaner)", "value": "b2a66f09ff73d1015a256ed490c967e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141951, "uuid": "946d453a-d51a-4320-95b2-8a2b7e6b6343", "comment": "Malware payload (GCleaner)", "value": "5ec64b926c9e2f1d2c69f92b69b5c9169b23d533f327ac944776e8e266eaab99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141951, "uuid": "8ab7129e-2854-4591-91b5-5ae64a8a5d5c", "comment": "Malware payload (GCleaner)", "value": "9f157201c69a40ee86435eb19e0dcda9ac9df6de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141951, "uuid": "774b6e1d-3d5a-4e0a-956b-f8e41334ca03", "comment": "Malware payload (GCleaner)", "value": "53d3c0008d3cde8e324bef9b1988c4093dc63867bee2dbf273d97c3017945952b4b48f1073aad29dae3ac66404842293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141951, "uuid": "4cb09e31-ccd2-4d11-801b-62af60e688d3", "value": "T18F84DFD17AE0DC31D4153E308862CBB12B3BB812E530954BF7B8972E6E727D06A75396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141951, "uuid": "14214097-b020-426c-8a8d-139cdd7e922a", "value": "45058ecd06beaccbee1d34d8e48564cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141951, "uuid": "928e52fd-8bef-4fd0-9a5a-8bccff9d7ce4", "value": "6144:Mj41dOfA8VTahxLIFecBWuxXaQEyT3eDR0YK3i0YY4lRqHyS0p7ITsq2I2sigabT:Mj4fOrVeI7BWKdNu/YYYsRqS7p7VIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141951, "uuid": "7b7b8bb8-6db9-4bd3-8040-db30c4b90b0e", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141951, "uuid": "53806174-2084-49b8-975f-61b090f0cf65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141951, "uuid": "ac97ef26-5d7e-4565-a32d-460079b598fb", "value": "b2a66f09ff73d1015a256ed490c967e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d143a7-f49b-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1656171092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171092, "uuid": "6a98a769-ad6b-4e06-a96b-7e6be18f5add", "comment": "Malware payload (IcedID)", "value": "15909876d5b6303d1d13a2553a57a789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171092, "uuid": "e91178fb-3893-4460-a6fc-94d0fe7cf461", "comment": "Malware payload (IcedID)", "value": "600a21358e2cc2d5d50b014c4a4df03435b136bec0ee7903eb88d4368fe37647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171092, "uuid": "2ed62f6b-9e52-4e5b-bed2-a02d9db4bdc1", "comment": "Malware payload (IcedID)", "value": "6f23da32a732804f3cdc31d44a459dab27ebdfa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171092, "uuid": "468e4fa0-3e39-4adf-bf43-b89fcc694c08", "comment": "Malware payload (IcedID)", "value": "690e595670c7dc00471d7d9174e121416d919c24d21ca74d9d14a8ddd7ba6bd166a50c3971362f2e2a87ace58e3d7c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171092, "uuid": "bfccf4aa-9db3-40d7-86fb-8fdacc1293fb", "value": "T106A46C5AE7A844E4EA768238C9768206D772BC550FB5C74F33B8621F3F336905D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171092, "uuid": "e7f90ec6-9482-4c55-876b-d5cfd00a680a", "value": "cbe00e3243c8d739d8c4e2c82bbc345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171092, "uuid": "4745bd12-ee9d-4e54-b6ae-303d642613d5", "value": "6144:aWlc7BuuqhWKKyexN29RcpRLVGL902+gvy8nuIF/p/uwONct43j92UDYt:aWliurhWKNosfcASMvaI9pGHNu4B2UDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656171092, "uuid": "3829bd98-70e8-48d6-9b9f-91a01a8eea7e", "value": 466928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656171092, "uuid": "a210a713-4d97-4776-8b00-72ce324655ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171092, "uuid": "c7c07b0f-552f-43ca-b864-48f20fb5fe73", "value": "600A21358E2CC2D5D50B014C4A4DF03435B136BEC0EE7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb4c567-f497-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656169206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169206, "uuid": "15da8199-6de3-4901-b3c5-28f83e06dbd7", "comment": "Malware payload (Mirai)", "value": "2729ac31d7ed118750c2f36bc3673a7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169206, "uuid": "04cc2322-24ec-4bde-a336-4ad939c7435f", "comment": "Malware payload (Mirai)", "value": "617032af30d171482b73123b33f20036d8fdde6f4d54f5d767d1a729ade8cd75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169206, "uuid": "2fb7463f-1506-4fa0-ba5c-6ad2b2c877e3", "comment": "Malware payload (Mirai)", "value": "03d0803eec694b30b8afc0debf347daf4b24695e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169206, "uuid": "109a3634-87b0-4903-ae96-fbbfac299bdf", "comment": "Malware payload (Mirai)", "value": "9b661eea76fd64b50ab0a59ef4b4357223008430493cf1b36ff442a5cd2e255f4f3ce15d178860449db0508aeb1ea678", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169206, "uuid": "5fe7e4c6-cf5e-44a3-8e02-2081c9227e25", "value": "T105B2E1B0687D5E74C7B05439EA645E1717076BF5A0FE345A06280364B1D180EAFF7EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169206, "uuid": "01cba83d-a4dd-4106-ba27-70ebf7373edd", "value": "384:QWx1eCqJEpYdUvMwj7Ued/DU5jzVDNOY/o4uz1wz4ShymdGUop5hk:psCqMYIMwj7U4/6jzVvmBG4Ss3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656169206, "uuid": "790bcd62-cf38-4200-811c-3b453b34413a", "value": 23792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656169206, "uuid": "d2a81ebd-3bd4-48e8-aec5-949b5d1339d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169206, "uuid": "f07ffbfd-851c-4ed5-adec-a07c6f3b7483", "value": "b3astmode.arm-20220625-1500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e9713d-f430-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656125028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125028, "uuid": "8464c654-3e8e-46cd-97f6-eae8fb9f15d7", "comment": "Malware payload (Mirai)", "value": "f64ca0aa501cbfff856177b86c0342d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125028, "uuid": "448011ad-d622-4c75-9aef-2a8bc9d25401", "comment": "Malware payload (Mirai)", "value": "61a05566a119d506c307e63b8785de6aa6249da9541e6109e7293750bf18f22a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125028, "uuid": "2a5d2e86-42d5-4c35-814b-b880c6db8018", "comment": "Malware payload (Mirai)", "value": "214721c6984e1fe1363d0ae350276820a10f5018", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125028, "uuid": "ce7d97ef-7119-488d-acbf-c6a285b07db5", "comment": "Malware payload (Mirai)", "value": "ffda2806046233390d6fc51439b5ccf35b37ed43f81f0c7b67323a18da7a93776e92baf10c9c4911f79d6f801f32f851", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125028, "uuid": "8e73670f-735c-4460-a6a4-e02cf6f9a6b4", "value": "T115735BC4D983E9F5DD5706B260B7E733CA36F5391118EA93D7CCAA23AD42A11C60728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125028, "uuid": "aa3d297a-671c-441f-8d38-7059427b8025", "value": "1536:dC5cZnPJ16ZFnlEtbCJDbeLgBjw9nvueJ+aRLNObdeVgw/PPNOghlzxldqHEGRVI:8UnPJ16LnlMbC9eLgJwBxJ+aRzP/PlPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656125028, "uuid": "1d47ad5d-4eaf-4841-8209-e18ffeb1e03a", "value": 80148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656125028, "uuid": "27ba7478-f08f-4017-98b7-183ba1dfbcfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125028, "uuid": "c10f9435-73d8-498b-a745-cbb3a0d66244", "value": "SecuriteInfo.com.Linux.Siggen.9999.9339.3269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9a9ec5-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1656146145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146145, "uuid": "49992948-89cb-4542-ae90-41c3d9aa74b6", "comment": "Malware payload (RemcosRAT)", "value": "05ee18eaa56a1ab7ecc2829771cfef5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146145, "uuid": "e2422916-0ecf-4dfe-83e5-e439259abf5a", "comment": "Malware payload (RemcosRAT)", "value": "658447ed1377c79b71808aa9bb150e5fe65f0318c59294e9dbea2d1d9d6fc28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146145, "uuid": "fa8260a2-d554-46dc-8263-9ae26d932b3d", "comment": "Malware payload (RemcosRAT)", "value": "3cc9c45e8328f94725bde7b2445d344c824380b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146145, "uuid": "a3873aea-e01b-450c-a233-9956633f9fd5", "comment": "Malware payload (RemcosRAT)", "value": "b6cb11a25bd905dd8518c2023c19dc8300240116bcf104bb8d8bda8ca63226f8c883fcca75baa87dddfee7e1730cfa59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146145, "uuid": "87dc7580-7423-4e7e-b928-ab2f4f62ddc3", "value": "T1DB848890AF6494B4E921FCB12799E734D25B6CA636206F526DC0339B75F36D0BF03268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146145, "uuid": "5c6dfe3b-ec2b-493e-a348-04519066dbb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146145, "uuid": "671f341a-7adf-48d7-8162-0127b26550d0", "value": "768:SPcKSg3bGC4bnyAWkaHRQ2wdzd4H4447iiL1C:pvg3b34byAWNHRdmzd4H444lC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146145, "uuid": "91e3aa75-0de1-4b06-86e0-a572126bdbba", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146145, "uuid": "34ecab3e-cccb-4ccf-ae05-cc925e984b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146145, "uuid": "74f79f16-6807-4f75-a4e3-55a10ae6758f", "value": "Air & sea Freight Forwarding List_& document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962cae1d-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobalstStrike)", "timestamp": 1656161942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161942, "uuid": "572b73f9-25ff-4d67-95ca-22d2b4bcecad", "comment": "Malware payload (CobalstStrike)", "value": "eed62c55e852a2647fb9ea6950b54e23", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161942, "uuid": "c362a23b-c468-4d31-a6c3-2bb91af16a1d", "comment": "Malware payload (CobalstStrike)", "value": "65adea8d70b03b6876a18740c61940dd4d5507c1e92a6308357f477d9e3001d9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161942, "uuid": "a9bdbc8d-e89e-4526-bc9b-cb185d265b8c", "comment": "Malware payload (CobalstStrike)", "value": "76b61b7e832df52f1861df63aed5fcde37b1b1cc", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161942, "uuid": "b0b9e30f-7a94-47d0-92ac-236283113c54", "comment": "Malware payload (CobalstStrike)", "value": "13caa741e2441316ae71604d5542d6a3106d9483150073ba9b6ac8e8739324bced4eaa47cad41429c9a5a3e0f06a404b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161942, "uuid": "fd321252-7754-4e52-bf21-12daab501ac5", "value": "T109522B4773874CFFE2348277C0731918A17AB92287728BCF1BB5521A1EE26C17C39609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161942, "uuid": "d15ae905-175c-47ba-bc69-6214391725b8", "value": "af58a11286a1e4ce59e4335c169c80f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161942, "uuid": "0f8b0559-5bc8-486e-8cfa-39e8b90e02fe", "value": "192:m8QLRUeLQyWYpabhOX/FeXuCYkYNeA58jC5H4H5s5MtS:m8iLQpKabhOX9i9YdNj8jaHeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161942, "uuid": "1d0be395-45ca-46f5-829b-bf55e883cc8f", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161942, "uuid": "1b8fba12-5ba7-4907-b2a3-c5df1f4401f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161942, "uuid": "1fc61ab9-9c4e-4ad4-9008-a24659f98cd5", "value": "2022\u5e74\u6df1\u5733\u5e02\u516c\u804c\u4eba\u5458\u75ab\u60c5\u8865\u8d34\u53d1\u653e\u901a\u77e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512c778f-f4a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656176429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176429, "uuid": "eb0daf4c-92b2-4b69-85b9-18dbb2b4f064", "comment": "Malware payload (Mirai)", "value": "22f7272f12c2fe1fd8ef3ce88e731f96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176429, "uuid": "944cf569-6a34-4236-a5b1-bedc74d7a266", "comment": "Malware payload (Mirai)", "value": "66365fcf642d089423fb2aa9cebce7362892467bdfdcc971f22b70cb041eb0a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176429, "uuid": "dec31164-e988-4bf4-a19f-10319fe26506", "comment": "Malware payload (Mirai)", "value": "e04de0df305826b88f9b054841f03990e95c5c1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176429, "uuid": "922acd17-64f0-4a7e-97ba-a3db489ed45f", "comment": "Malware payload (Mirai)", "value": "54f81cfb38e38ba60213254e54bbf285a91812ae39ff53d3ad4842434cf40528d46f63e4220a5c663c697a1492f70e5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176429, "uuid": "89f6cc21-813a-4a6c-898e-66f13a2a39b7", "value": "T12FC32A46FA408B27C1D61777FAEF41463322DB9493DB730699285BB43F8669F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176429, "uuid": "ad6ec6a1-c71a-4013-aa84-5a5da3e176ed", "value": "3072:BSoR5Nje18dNIXNla0ewC6pVkmXtUX2GhM/92op:BSoR5Nje18grewC6pamyX2sM/92op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656176429, "uuid": "060e0729-649d-4c5b-b274-6b38f2827af5", "value": 129108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656176429, "uuid": "8782a09c-be7a-47f2-87a2-13824f0b6a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176429, "uuid": "310ffae5-aa3c-4d27-99ae-c8cc1a075105", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6b3d47-f49e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656172203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172203, "uuid": "ae3f0f6f-0fc5-4fff-a87c-a18d0c0dc7df", "comment": "Malware payload", "value": "846dfb92a343cca74d5a46cb5945e066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172203, "uuid": "120f46ef-a4fe-45ad-86c4-30fdfabcc57d", "comment": "Malware payload", "value": "66a81db9dfc1d9d87af410997332b8b0529cdabe027e6924b4d1c17cfaddf35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172203, "uuid": "fe97f2da-d606-4bf8-b163-4a02ffd6d678", "comment": "Malware payload", "value": "b5915a0fdb6de8796d193f05a91bc15744977aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172203, "uuid": "9bea729b-3eba-490b-9349-95d8431455c4", "comment": "Malware payload", "value": "501128aa18258c7ed14c735e82c1c181bde92764567e6ee0310723cfe31214bfab96e270d6a62515020cf4714b094d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172203, "uuid": "ba45fce4-b6ab-46c8-a116-658006c3d2bf", "value": "T11804394A73A840F9E0579238C9964A06F372742B4B7653CF1364837A6F27BD15E3E362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172203, "uuid": "1059c4f4-8fe3-4729-b512-8cefd96a881b", "value": "878df6e1ac5529ea72b61c420e1a6d69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172203, "uuid": "c7f733e0-1a5a-4f71-a685-aedd95592c85", "value": "3072:gGd2AJTpuHVtR/6hiac4q2T9uWg7X9aXD+xilr9i3xdQ:gWp9puHVtRSsH2T9uWg7XMXi8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656172203, "uuid": "de5865f8-a325-4fa0-9ef7-61a0f0e05fec", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656172203, "uuid": "2e445983-64c1-4e51-90a6-002e817cef75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172203, "uuid": "ac6e2722-a30d-4d2c-a443-6fe1bd3191c0", "value": "\u70b9\u51fb\u5b89\u200d\u88c5-\u7eb8\u98de\u200d\u673a\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c221ab8-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1656161952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161952, "uuid": "c0ef2410-8f06-4523-b169-f5e5c317cdc3", "comment": "Malware payload (CobaltStrike)", "value": "dccfd68987ce91d717d488f62c5b411d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161952, "uuid": "2801e8a6-f3b1-42e6-8c78-1d97804abdc0", "comment": "Malware payload (CobaltStrike)", "value": "67274ae1d8449908223e72b5f6678dbbb7c24affea15a75065dcc27e61ff114c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161952, "uuid": "206a6c37-c594-42b1-949e-fbb5c0aa5def", "comment": "Malware payload (CobaltStrike)", "value": "00616d4437d833892507d7173363d1ede54e471e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161952, "uuid": "e4a9d8f7-1938-40e2-bde4-cf75995d5dfe", "comment": "Malware payload (CobaltStrike)", "value": "9de2fe4286d14708167662b4f15936058f19bfe86ac6892371ae9f0910ddc3fa7b7e92ba94fa9d8486fc59387cff191c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161952, "uuid": "0fceac4c-4c1a-4c65-85f7-13d1351c3e2e", "value": "T106D59E51B7C680F5EA9356B8047AA73B5D3AB25143389DC3D3602F4E5D313E1AE3928B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161952, "uuid": "db9f5dbc-a36a-44ba-a0a1-d2d4d3896037", "value": "8f6f1f583f020f2288c0eac510f964b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161952, "uuid": "bf8d9900-bd11-45a1-a200-927b1c693f84", "value": "49152:2/iROwjnFDpbICzqmsFTn/i81H7B3cSTnr/5iQaT:cwr86qNVK857B3c6va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161952, "uuid": "29369067-6c84-44c0-b622-1db542f469c6", "value": 2998272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161952, "uuid": "50d7080e-8cac-4289-bdf0-7a4bfb7e5bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161952, "uuid": "f329a1b7-f98c-4a4a-8786-a8a10fdce580", "value": "67274ae1d8449908223e72b5f6678dbbb7c24affea15a75065dcc27e61ff114c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e9a2d0-f463-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1656146959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146959, "uuid": "fe7ca7ef-e88a-4d34-b33b-7a81ae4c1543", "comment": "Malware payload (Formbook)", "value": "4ba41e6b26d44d92dcfd33374017a113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146959, "uuid": "daa735bf-1f89-48c9-bcbc-8823d9a0a231", "comment": "Malware payload (Formbook)", "value": "67af71fb0f05689aeca3a7ad228178ba5b1e5cf99a8b6f830c3c3f79ec1d056a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146959, "uuid": "5dbca9a9-ae3f-4911-a8e1-4d1355c233ac", "comment": "Malware payload (Formbook)", "value": "9d6ab361f44153f5dfbc0145fc1e3e7eff46e15c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146959, "uuid": "43135f79-bdc5-4dcc-9058-b97d1824f345", "comment": "Malware payload (Formbook)", "value": "74dbd62a69c7f88e9c66418b0e319a881b77c16581753ed19014e476780119f166062dc1e682dd3905ddbd527c6b8974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146959, "uuid": "5cf0a77c-b7af-4473-82b4-6ebea63e29e3", "value": "T1F5A43D9C3B051A66FF1FD07886130A44BBE22F233280998357EF29C9975E5677F05D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146959, "uuid": "ecb4d18d-3b93-4052-9876-68cc70b53bec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146959, "uuid": "9e097092-bf29-4e7e-bea9-6f32545da361", "value": "6144:c933zCIb4R3huac1kDUofIRqRcHQ2KVMTwHqZuUJ/Rf4BHtna:CzCIkBc6DJIa0TwrUdRg5tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146959, "uuid": "5ad16952-72f4-4001-954e-6210fdee462d", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146959, "uuid": "b90dbaed-9b13-4f5e-9b43-7587e54487b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146959, "uuid": "7f30e088-be82-4835-96d1-3afc4e6383b1", "value": "MV SEA CREDENCE_VENDOR-TEMPLATE_FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00ed3fd-f4aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (DanaBot)", "timestamp": 1656177420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177420, "uuid": "e0889d9e-1b05-48e8-bdae-17936b3015fb", "comment": "Malware payload (DanaBot)", "value": "62b0fc496f6adea7a67a190ad894860e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177420, "uuid": "12396cc4-6a45-427e-84c8-01ecc10642cf", "comment": "Malware payload (DanaBot)", "value": "68ee7ee7983f90bcbae20fb9ea3a46dd25bed22a89f8b21515a3460bbd8cb78e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177420, "uuid": "652b92bf-860d-4c6b-93c8-cc2ab0633b41", "comment": "Malware payload (DanaBot)", "value": "de684df44e9cb64985ecdb18a2f6dd99c87b0862", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656177420, "uuid": "ed377180-6fc5-43a8-a978-5430e5070b88", "comment": "Malware payload (DanaBot)", "value": "935f09f0c49954929f22e4a70e129d53ae199145138b989db5519ec46da07aee715ed6822e33111fbe0c688761a92585", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177420, "uuid": "4eb9912a-a14e-46bc-9c37-ebf962817c5f", "value": "T12916331276EEC076E28225715800D7600B6EAA266E2596CB3BCF07BD5F356E1573F30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177420, "uuid": "fdfc4ebe-302a-4502-99db-01b918bf0b78", "value": "e4e8c0cbcf665f2527d7a1b9dd2631d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177420, "uuid": "f2239f72-91fb-47f0-9122-9e9bb73e5808", "value": "98304:Pe788JiJ4rJTuEITg6dyWjdvc5x9gDrrvIDTtuCy:m788CeBuEIBvc50rrvgTcCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656177420, "uuid": "8b764022-ac02-4d19-9df7-ff62f82eef70", "value": 4141568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656177420, "uuid": "53c4a115-c4e0-456d-a5a0-63427c8c3e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656177420, "uuid": "45047cd2-023e-4904-a4e7-d147be4dd5de", "value": "68EE7EE7983F90BCBAE20FB9EA3A46DD25BED22A89F8B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a824696-f436-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1656127348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127348, "uuid": "bcc5d274-af88-4a92-a5c5-2edab1b96d74", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7ef47ce5238923be830c9ca9fa9f1f0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127348, "uuid": "1fbbf86e-afc8-4504-9674-d66106450e7a", "comment": "Malware payload (CoinMiner.XMRig)", "value": "6b8a860c4dea3b6bc711483d87121af85d135b45ebe94ae482f3b41cd4f88a7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127348, "uuid": "cc1a37c6-792d-4ead-9004-81bd2ae8d00e", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0942cfa39c42e0d00d268526b1e4d61f599d5ab3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127348, "uuid": "225d67ff-0fd1-4336-98b5-a85fa5ba660c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "dcb184710a44bde859e687492339720eced7eb394b4bd03ec0df23314ac0c1d5b75c6e3eee650af2d6be032dac269e7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127348, "uuid": "598712ec-6a52-4c51-80fd-9acfb30646a7", "value": "T140442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127348, "uuid": "f65cfe40-1ecd-4984-82a5-0aafa9620ee2", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127348, "uuid": "7bf333ef-624b-4138-8967-c3069411c829", "value": "6144:IBABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:ImB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656127348, "uuid": "445ddb69-6a40-47ff-a84c-fcf89c014b40", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656127348, "uuid": "b9a45d14-fa7e-4103-8649-6b6b5cd4c2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127348, "uuid": "dac3d58b-d285-40bc-aaf5-dbb0b2962bcc", "value": "7ef47ce5238923be830c9ca9fa9f1f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e52760-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "94dee1b6-f736-4312-8d1e-91ae2f524995", "comment": "Malware payload (Mirai)", "value": "599bb729cafbf997ad9768e81d9e66b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "2a9e3290-f719-43c7-876d-c15e2059189b", "comment": "Malware payload (Mirai)", "value": "71590921c56dc0d1d17fd95f32ecaaea02e5b0a4b278f940c78e7c4395ecff22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "d75cb678-6034-4871-8482-227af71e60a2", "comment": "Malware payload (Mirai)", "value": "9aa90aae09d5facf07224594ebdccbad9f4d1bab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "7f7a05df-5ddf-4abe-8bfc-8174ddcfa9ff", "comment": "Malware payload (Mirai)", "value": "20774035c990f8d1f6ca0ab10bdb7b3b169c75ff415c5abfba82a4990ae06f15b570409f38879918ea8f0b372fc1099f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "ba0df87c-d836-4e25-8e7a-c0ae5bb93f12", "value": "T11A13E1F1228D54F7CA703D338B30479EBAA70F38A1E23867151A4714F55698A75FA383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "c220dce1-5e58-43f1-bd69-659455c0deff", "value": "768:/SvSioUSlXDRl3Uyo7cKr5kbSKTnF9q3UEL8GorsvJvoHNtOZYqOn6VFc/:qXoUS3RowK+SDL8GoIvJvoHBqOn6nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147605, "uuid": "7e4692a3-36f8-4e62-a09c-7784fbd7e97a", "value": 45536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147605, "uuid": "114f00ad-dd72-4d53-949c-b0eefdb0e5d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "e3f7e072-637a-4105-ba46-f39fd8713cdb", "value": "irc.arm7-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f96420-f450-11ec-93bb-42010a9c0043", "comment": "Malware payload (GCleaner)", "timestamp": 1656138863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138863, "uuid": "9b0a2a2f-b564-4404-8437-779f1e538f99", "comment": "Malware payload (GCleaner)", "value": "2673efe66e1a7f5ab81203613e1e5750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138863, "uuid": "d52aab84-a91b-488c-ab84-705110ef54e5", "comment": "Malware payload (GCleaner)", "value": "727604235d87d8ac04f5367f53db563b2afa2e2f6aecd258d053f2682e910ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138863, "uuid": "4a98f18d-9313-4e0a-8671-70a914b8c02a", "comment": "Malware payload (GCleaner)", "value": "b0a309ac7bc88a688d857695ab132899f680c6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138863, "uuid": "30c8177d-54f3-4a0b-b1e9-e53c460d11d1", "comment": "Malware payload (GCleaner)", "value": "4049d442ebc83fc4da6edf759d9d3ffb98e603762b5736380b71234c9bb44f744b6bf350a1f5c0478f54a5187e28216b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138863, "uuid": "74ea056b-4ecd-4d8d-b4dc-f805fa7df9d2", "value": "T1D584E0E17AA0DC71D4153E309462CBA12B7BB861E9709647F3B4A72F2E737C05A71386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138863, "uuid": "5453f4bd-3618-4c32-8b39-2f5be7d66c7d", "value": "e8fc5c770d6decb78cb40e901e7c0371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138863, "uuid": "c214920b-c8a8-46b9-8471-0f9565138c32", "value": "6144:IbRK/RgorQj+OciVpLIqgFCZj+JzR/1FuhG60p7ITsqnpV1igabwVfw:IbRKL8+Oc27qpR9IQTp7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138863, "uuid": "ead0cd03-b665-44df-ab48-3ccb43d567ae", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138863, "uuid": "8c711426-ae20-4387-bc24-4b2185c6b825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138863, "uuid": "7f2d7657-66ea-44e4-8b22-f75f14ba99ce", "value": "2673efe66e1a7f5ab81203613e1e5750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b31e84-f46c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656150606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150606, "uuid": "bf7f89e8-f6e2-4801-9650-268375695269", "comment": "Malware payload (Mirai)", "value": "3d21c0e8311a80a552b85cf1819b872d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150606, "uuid": "0939c904-5721-4187-bf26-5f91dcbc76e5", "comment": "Malware payload (Mirai)", "value": "72e15cc5dc2863bb6e0f6d1713f76fbac4f9c4abd037c082ccbb5f70999b5194", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150606, "uuid": "8a966248-1b44-4391-aa96-874965edd2d2", "comment": "Malware payload (Mirai)", "value": "7a223ad3e31db7cb2d8fb05539ee954a70d72bca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150606, "uuid": "269b63b9-7dd3-4ecc-a308-6413399be966", "comment": "Malware payload (Mirai)", "value": "e8b77552911ee0de600f1b5361bca0cc65d30f7eceaeb96d7363cb6037bd5ff92cf08686e771c3c81697a24d892b867a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150606, "uuid": "3e04aeaa-7056-45af-8cd9-1163f3de3194", "value": "T158044C56AA418B13C4D727BAB6EF02453332A764D3DB730699246FB43F8679F0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150606, "uuid": "1409e06d-c480-419b-a875-9c7e7bfe3ba8", "value": "3072:JfpOqetmkrjUFs+d7aCyHpIrauXC5290Am84dJJSdL9M/9bhRdx9MU:JfGkkrjUF97aCyHpIra0CTNdJJSdRM/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656150606, "uuid": "a46e40c1-774b-46c5-8a0f-25f23a690861", "value": 178201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656150606, "uuid": "30833617-3901-46a1-9fec-8b2daf8853ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150606, "uuid": "77bfb651-1d87-4532-9c0c-74daba0d75da", "value": "ZG9zarm7-20220625-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293fe094-f45d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656144150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144150, "uuid": "e704263d-2f56-47c0-8162-65cd64154372", "comment": "Malware payload (AgentTesla)", "value": "74d278cb0fb2d365a370327d425fb17a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144150, "uuid": "81bf4dde-ca3f-46e8-a742-42d34c973496", "comment": "Malware payload (AgentTesla)", "value": "74c9f05868437392db6356ab254331199b34d670bc1abd1bb11c65ff3205fae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144150, "uuid": "a84b1c0c-af46-45a9-a67c-128d261ff9f1", "comment": "Malware payload (AgentTesla)", "value": "168e6960a0db5cdfb3c785e1407c7012b7ef57da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656144150, "uuid": "44c6d9a3-ff94-4658-94fc-9b693f009296", "comment": "Malware payload (AgentTesla)", "value": "6febcb1c98e8aada0a3de230e17a8e7fa844ba929ff62b4ec8682f5b749a9c08056dc3c8f719eb26eed6ce1ae8390ada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144150, "uuid": "5a8378fe-d09c-4f81-afd5-04db5dfe1277", "value": "T1B3240A7E13C55C51C6EE41BD90B6815811F19703836AB38F6EE348EE1B172CEFA2A9D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144150, "uuid": "1d94116f-5db9-443c-8744-a8d2861ebd6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144150, "uuid": "cdfebabb-5c9c-414f-b7a7-2fb60d3878b1", "value": "3072:OqBIWgDNwFyloOwPasrWAiFKnS/wGUte8dve1g1uSfFVsxK2yXg9OrYE:HB7+2asr1icIUte8db3fFVsxVyX8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656144150, "uuid": "4a70c78a-5d2e-49d2-8074-8681c247e816", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656144150, "uuid": "0283b414-eaf8-4707-9e55-f2725fd6b30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656144150, "uuid": "a1dbde54-a09d-4137-8fe7-763e617dde17", "value": "74d278cb0fb2d365a370327d425fb17a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3b62d7-f450-11ec-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1656138759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138759, "uuid": "4e0ba035-0aaa-4e88-acf0-bebf7daa6750", "comment": "Malware payload (Socelars)", "value": "479e6a45a08e74c6d0141c5f6d107574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138759, "uuid": "cee6b715-5715-4140-80ec-871754a9dbd5", "comment": "Malware payload (Socelars)", "value": "75cad21c1fd17e0c6206688dade2c78ad51a16336ea8f3bb0201dd163ad4b123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138759, "uuid": "9070a52f-acb5-4f70-8dd2-9f6c71521baa", "comment": "Malware payload (Socelars)", "value": "254af78357032f1e7f7659eda0ff22ffc7900b12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138759, "uuid": "b9fdb5e5-c8ff-4ba9-999f-f0e6ef4e28e6", "comment": "Malware payload (Socelars)", "value": "22b343b4fdd6a648c3a64355180d4042cb2b5135b94a6e24a27ebe2c72ce74243f61c279a098a55c832fb501473b40eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138759, "uuid": "2572d748-c3f2-42f2-b9a2-6aa177472720", "value": "T1C6855A40A2C1523FD8A201F542BAA6AF9D6C6D521B4743CFD3B03D99DA30AEF753251B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138759, "uuid": "73310a16-7836-4793-a534-4b57a81a0979", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138759, "uuid": "bfb5f739-91ca-4ae1-85d6-78a28f10ecdb", "value": "49152:lpMRGe/4ebLPv1lxUwN888888888888k8888888888888888888888888888888h:H+bLPS8888888888888k88888888888H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138759, "uuid": "833820e5-b75d-4a20-bed8-1d9a2ef00c4a", "value": 1793024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138759, "uuid": "9b1d961c-5027-48b6-8f53-9754d2592dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138759, "uuid": "2499c9e6-5c10-4a31-988d-a87f69fa1ea2", "value": "479e6a45a08e74c6d0141c5f6d107574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b87593-f4c2-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656187520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656187520, "uuid": "fa77603a-5805-44a7-807f-3830264128b2", "comment": "Malware payload", "value": "fab844f64a60f24b27097d3b7b93cc11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656187520, "uuid": "35958733-5fb9-4a96-bee2-15bc8125d878", "comment": "Malware payload", "value": "78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656187520, "uuid": "e029d14f-5d86-4f53-8b88-e86100d9be58", "comment": "Malware payload", "value": "668e08011689b809bc231a6bc31ddd6ea576942d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656187520, "uuid": "6c9a8a78-9cbe-4655-b155-bc4eb274f1fc", "comment": "Malware payload", "value": "51d04394e2178c5b8cd8230720f77230e17fc699bd149e6f9aa35cefdbf8eb706477246cc25b1c5d5a586f67de9cf41f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656187520, "uuid": "f24a402e-b78a-4efc-833c-1a388efe6e5d", "value": "T13A855C60C1648389FE1D7B38A43D0A2F47BF2F9D2568930D9565F0FA3FAA783D528590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656187520, "uuid": "e2280ee3-b49b-46fb-8dcd-78a98f3e11cc", "value": "0961e57709158541d151ca3f45b82efb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656187520, "uuid": "7a3e0726-ab00-4b12-a515-b410ea832033", "value": "24576:Qtf9NAUsrCADj6jns63ntdskTAEwL+/j/QnFR/ZVWd+G2l9b55oF74zU:Qt1NNsrHDMf2FxbDfl9b55oFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656187520, "uuid": "89d30c61-ca5e-449e-867d-d0abf8132290", "value": 1777152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656187520, "uuid": "6b87b0d6-0718-405c-8d4b-7c2cb0e901c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656187520, "uuid": "c651e30d-eb4a-4a52-9a21-0781430540a3", "value": "toso3l.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06561687-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1656145809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145809, "uuid": "67ac7de2-0bfe-40dd-87f2-6fbd02494924", "comment": "Malware payload (QuasarRAT)", "value": "c39f80d17ba53be94cebcf9ef1a4d8dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145809, "uuid": "8d07d1f0-f834-4e8f-b373-65ad63a5880f", "comment": "Malware payload (QuasarRAT)", "value": "7fa160e2ee00bd1ace890c6761f0bb81ea43a8937dffb003229dd4b232027a6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145809, "uuid": "f6a91cc6-e1f3-4877-8a65-1e452e9a10d4", "comment": "Malware payload (QuasarRAT)", "value": "65f4ddd304a43c62e6953c5cd907eeee9366dd0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145809, "uuid": "93a52a4f-0aa7-43ed-a6b2-763b4b6e30e5", "comment": "Malware payload (QuasarRAT)", "value": "17a7f68d4a93a1674dd7794d0ea3b9428ec5b9b6b72d6b3da9113fd02798fe876f464b963c0ac88c2c6ba49fb7818444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145809, "uuid": "951e9009-bbb0-48a2-b113-4bb38873e76f", "value": "T1E5459D2D7B054A62FC1EE03168010A447B660F5372B8B98697DF14CAA74F169FFD4FA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145809, "uuid": "45fa7f15-af27-456f-8b66-e52ccbf95027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145809, "uuid": "dff248a2-7b41-4ac7-a96d-5c60503ca18c", "value": "24576:58marRayH3RldBSIPzzDxh52Nxp0vGYs:CD3dBrz52N30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145809, "uuid": "55a52829-7c70-4743-9c1e-dbd1ba7e9371", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145809, "uuid": "7d421850-b3c3-42f3-a809-c9bed602fb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145809, "uuid": "63d39060-0818-4462-91b2-5d9cec3f8dd0", "value": "MV.JUNE XIN_PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17a6232-f478-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656156055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156055, "uuid": "ca1ec30f-f73a-4c1b-b8c0-5b0f964071db", "comment": "Malware payload (Mirai)", "value": "04c5450ffe3df2f25ac51f9d5e8d9468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156055, "uuid": "1bcb3450-4717-45cc-a565-f80dbb735a7c", "comment": "Malware payload (Mirai)", "value": "80e4bc3d7350b9322dbf7fb6fa5b754d03ee617261837ff7b0e260fa88c9ae2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156055, "uuid": "b1808aad-63a5-4e31-98eb-4abbaaba6250", "comment": "Malware payload (Mirai)", "value": "474fdc26e2d923c0bed8256565a608998c6d37cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156055, "uuid": "c916e531-c701-4e29-aca3-74c1b62120b0", "comment": "Malware payload (Mirai)", "value": "8c150c4b6e112c958b019676832c7cfdb0c70cb636f24db427f53f4aea066f5257289b50a16d397e3855af7a0dba8c7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156055, "uuid": "6f883fc5-06d1-4122-b9b6-04498b70b0ae", "value": "T18A23F23EDE63A49AFB160AB08BD14F315E150F52EC22D40CD2526EE2DEDB5A4F8C9580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156055, "uuid": "62a025d0-c39b-42f3-bd4e-c987690c90a3", "value": "768:Amoj9skgQaCQM7cEqSy6UwDziblhHtgvtuVzjX7knSSuCzxJTl86yFaR6Xj1EJgu:29yQ/QwTynRZ8AVjIBxxJTlQamyVJuti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656156055, "uuid": "6160079a-c756-4e52-bdb2-affe11850745", "value": 49032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656156055, "uuid": "5582cfd0-0fe1-4d11-8405-32f63c722806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156055, "uuid": "6fa7b27e-f43d-4a0f-a6d4-6d8a8aca507e", "value": "04c5450ffe3df2f25ac51f9d5e8d9468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3113695b-f46c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656150605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "27c58909-c293-4139-b123-de441f1146cc", "comment": "Malware payload (Mirai)", "value": "34cd87b0362b554f998e87f557a7587a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "536844a3-19cb-4ee9-b487-5a7049390b6b", "comment": "Malware payload (Mirai)", "value": "8475b366630e213b981d4b58408ecdf7cc53f243c0b90ca7687ebcf9ca3c0315", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "75f91830-d0a2-4a33-966d-7f9116888d76", "comment": "Malware payload (Mirai)", "value": "85e6357f28ae5d003af98799cefebf6670c999e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150605, "uuid": "cdd7df77-1f1e-4d0a-bcf9-a5800b968568", "comment": "Malware payload (Mirai)", "value": "09e92e3200d118b09592304dfa3bfb1f4160a1911afde24d1b36ef7e16d6eb8256e877a38b4a20d4c8789f4c34ddd774", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150605, "uuid": "4a576ded-dd95-4a05-9d54-92ae5a2220d2", "value": "T13B835CC0E583E8F5E8034938607BE7734E32F57B5539EA9BD7C8AA239D51A01C60729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150605, "uuid": "4e9190ad-e2ac-4e23-b4b9-1629955b01b0", "value": "1536:CLY/9Cvldr9acxc8HFI3ebx0ts51QeMSWQrt5XtTO0Mh5Aw8c3oEioM4+c5CS9i5:CLKAvldr0cxxlI2x0tsrQ3zY5Xt4h5bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656150605, "uuid": "da2a52a3-c6ff-46bb-80ff-af77ded2016e", "value": 88212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656150605, "uuid": "543cfe43-6355-403f-a4d1-fb0c9a13891c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150605, "uuid": "e9bad42c-9f06-4da8-abae-c9cda743b834", "value": "gx86-20220625-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cce840-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1656161960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161960, "uuid": "2e9f79a2-7aa0-4d62-9126-4bd0f935b089", "comment": "Malware payload (CobaltStrike)", "value": "d4a95fae94dfc0c23073768d8cde73ac", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161960, "uuid": "d5570789-8743-4ca5-8547-e9eed05ccb9c", "comment": "Malware payload (CobaltStrike)", "value": "873857791715820f0b61e07757679a570372140281f8031e8942e5af7a501254", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161960, "uuid": "5dadd9e6-b7ff-4fc2-adf0-b2f96729aada", "comment": "Malware payload (CobaltStrike)", "value": "4399808eb513c8ed15338b60af097827de74ec40", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161960, "uuid": "92bacacf-3abc-4487-89ae-4be2d3331fd8", "comment": "Malware payload (CobaltStrike)", "value": "acdcdbe18258d4cf8a0b01660a2ce30f8093f3c750370fa3e9c24936510ac30fadb942c0eb5df5c4110234783760948a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161960, "uuid": "4a9f074c-0f7f-45ee-8afe-add993f97bf5", "value": "T121A4B6A569A8D8BDF01F717CA66C29335BA57F210290FB5A8368633D1E32B704F97710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161960, "uuid": "830316af-8cae-43c7-807d-ad0937d9ae71", "value": "09035ba5e14397fc6d5eee195ddad320", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161960, "uuid": "959504bf-25ad-4d0e-a40f-043a8cef76ea", "value": "6144:2eRNg8pdgtOc57bfHY/nux3h2fDSgZ3/o3BxLrJ0A+48:2eNd2OG4/iySFP+48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161960, "uuid": "bb3f9bdf-7f38-42b1-be00-186764bfcd41", "value": 468584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161960, "uuid": "f0b435ab-5787-4582-ad75-65db49f65b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161960, "uuid": "73a0bfa1-21c4-4e1e-86cd-684bbae2eb9a", "value": "\u6e29\u5dde\u5f3a\u5f3a\u8d22\u5bcc\u5173\u4e8e\u91c7\u8d2d\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u9700\u6c42\u4ee5\u53ca\u8eab\u4efd\u9a8c\u8bc1\u7b49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33062d0b-f46c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656150609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150609, "uuid": "75e2713b-f61f-4b77-8233-af7f10816d38", "comment": "Malware payload (Mirai)", "value": "4c123721fd4ee7ac007ff42242f49b6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150609, "uuid": "32097702-2dfe-4bd6-a65d-2b716cffa7ef", "comment": "Malware payload (Mirai)", "value": "8780fa01890a3356a739b425db89ad175bdd35452408357c6588d9f08be32b5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150609, "uuid": "ab12a30c-0ed9-4da1-ac84-aa88cd5874d3", "comment": "Malware payload (Mirai)", "value": "018b2cac709f6d9b4973376acc9c4d86dcffc8dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150609, "uuid": "674151fb-df4f-4335-96ba-b8aaafeb654a", "comment": "Malware payload (Mirai)", "value": "ed5188fe5f7e147db8adebf203dd840c297dbcd6454acc6b1cdbd2a29225e31e57e3bf002a9d9a8544027cd843a13e4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150609, "uuid": "4398e819-056f-4d84-ad90-308ce3656f61", "value": "T147C2D13096FD1CB1C6500673EAB856C9BE534F7DF9FE2890124052BA3981D066EEE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150609, "uuid": "76ddcc0c-58cc-4615-b5da-0207a97ff985", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEuZt/4lWnhymdGUop2:ERsoTAZ3alkXLvFh8nNEuZWles3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656150609, "uuid": "2eff0d07-b754-46a9-b937-52bda2b5e060", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656150609, "uuid": "bb639180-fedb-43f6-ba83-016194a4298c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150609, "uuid": "a4801758-41aa-408f-a2b5-0b00442d720b", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff2da2d-f4b7-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656183165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183165, "uuid": "4ed06d8d-18ac-400d-942d-bfd292d440c4", "comment": "Malware payload", "value": "a9543d8cb6a3b55a021d8245d6825e35", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183165, "uuid": "764d4f02-58c6-43a7-862b-d74ce4aa3da7", "comment": "Malware payload", "value": "88fb098082801414b5eff3310b6d44de10a1753ce737607859c61546824b2836", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183165, "uuid": "5bd01d14-8db7-4d92-b172-713e5824fdbc", "comment": "Malware payload", "value": "440f1abdd8760af9737cb3af98261ec87069bbea", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656183165, "uuid": "0883b900-04dc-49bd-ba90-ee94381dcc83", "comment": "Malware payload", "value": "0e8069ff7bdc1d148f4fba27409a34cbfef78f99fe0a9211fd2913e51018b90437fe34273c1e6b14f09ac94338c448ae", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656183165, "uuid": "be108577-973f-4021-b37b-3f4019f86262", "value": "T1CA85331C92F9211F0C57332E1E9D939A4E69A2C7473AEEEDA36834C7190CDE154EE478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656183165, "uuid": "38d67409-42e9-4efd-bb1e-9c1bfd1d0d1e", "value": "49152:4uZaLrrqZV1eTtQAu1/XLwxum+yQc4LP/REH:4uZaLry1eyAuVwYm+yQvLnREH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656183165, "uuid": "f2de45db-cc13-483c-a6d4-284d1aabe61b", "value": 1741966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656183165, "uuid": "ad6146e4-ee86-4236-8374-aaff0486b579", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656183165, "uuid": "e037f4b1-edcf-4077-ac5d-49bb052ec8dd", "value": "Kaspersky crack.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d52dc6-f48d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656165005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165005, "uuid": "ee7bb334-637e-4ea3-bc61-e7dbd9a0d30f", "comment": "Malware payload (Mirai)", "value": "60eaf838d0d1e843e2221b33d88cf525", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165005, "uuid": "01fc3ff1-573f-44e8-b241-49282662e853", "comment": "Malware payload (Mirai)", "value": "8985a8c93fcc33b9667e98989a5cec9f5eea14910ae088aa329fb6229f627042", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165005, "uuid": "e900913f-d998-4c4c-ae00-bbc546b13b21", "comment": "Malware payload (Mirai)", "value": "6c238695c34b83157388992d3849c70057da17b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656165005, "uuid": "66784cb8-a0c1-49da-b77e-2e0ef333a6a0", "comment": "Malware payload (Mirai)", "value": "97c6190a4687d5e6a181479fa432332f3282432f5edd7840b2ff64c2ff24e7b8cb2be3abd776e9106fe2652ad75ee443", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165005, "uuid": "8a2c5b4a-f094-4841-82a5-a65e33759f98", "value": "T10A03F14ED4D75204E0AF817757CF6D4C8862C70A9478BB6259A0323F6BFBEA51324B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165005, "uuid": "b2b4f19d-2809-4a84-9ce3-b8d7157a68db", "value": "768:qo2UTXCvrMe88YyexajQxkR/k7RGwZ1mxaE73EGWVJzdU/5yfdnbcuyD7UGQRjt:7xCvrffeWRs1luxXrEvVvU/5yfdnouyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656165005, "uuid": "b76dabf9-324b-4585-88d1-05cf153cd506", "value": 38588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656165005, "uuid": "b8f62f7b-ee5d-48f4-b353-ae86aacdec6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656165005, "uuid": "15e53edd-2e15-4d25-8ba4-c2c56d0e60ca", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b39129-f46d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656151207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151207, "uuid": "cca7a452-43f4-4c63-b3bd-19caeeae5f43", "comment": "Malware payload (Mirai)", "value": "a6da81b626424ae7a0187ffe0b1ec6a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151207, "uuid": "f9441dc1-48db-4d86-a00a-a4dd2f0253d6", "comment": "Malware payload (Mirai)", "value": "8a9879b2ada67b6f7ee78500fc6b9b5f886cfaf26d3c4b2925d7f163625c319e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151207, "uuid": "5814d711-99cd-4030-9077-fba83d36ac24", "comment": "Malware payload (Mirai)", "value": "4814ba27b62e9abae652a7b05f67d2fc7f34a416", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151207, "uuid": "ce9cfa02-7df3-41c1-b309-2bb636bf3456", "comment": "Malware payload (Mirai)", "value": "acfe7cdf2abd0c59b80ec2c9f6eb1c29ba24eaa0ef5fa372d723f038764a3a09c9889f425a5df757b80fb43f940216b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151207, "uuid": "1417f5ae-6ded-4614-9fdb-b8b67d2600a8", "value": "T17DD2E1337E525DDAD3512B394FE98C7BA0AC689B43AD613B1306804713AE55CB93B723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151207, "uuid": "6456fe38-e26d-473d-91ba-5221023bda3a", "value": "384:M7m4WdkhWL6PmYwJJBbPBRhX0LHbbUR3/b4jFtMjskdWEvVNScDqjNy/:OwL6Pmtdbp3MHUF856sGldNSc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656151207, "uuid": "458d848f-797b-4eb1-bae7-61fd7f428925", "value": 28724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656151207, "uuid": "5bc8e794-cc7b-4e58-a123-d44760e9a208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151207, "uuid": "c5b63a25-5c76-4b0b-8b6a-bdb71074a483", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6617d5a7-f4a2-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656173887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173887, "uuid": "74d7a5ca-7448-4ead-a117-5fe8ec7e9f1e", "comment": "Malware payload (AgentTesla)", "value": "45a756886bf43b1a442a50d7b1a71eac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173887, "uuid": "b00665bb-c5cf-469a-a623-f52db1c48c6c", "comment": "Malware payload (AgentTesla)", "value": "8ef9074516fb1eaee89e376fe0acafe78fc04cf0077d089c8f0e47fd1744dafc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173887, "uuid": "5c1d46ff-1cdc-497f-bb4e-c3165ba3390f", "comment": "Malware payload (AgentTesla)", "value": "4d5cbe609dc8d04c177101ef9acc2ee1f073211a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656173887, "uuid": "ac106256-4443-424c-bb74-1d7200925e49", "comment": "Malware payload (AgentTesla)", "value": "ed99a00d6a27d07ed57edc8b5c80369a514b40e3413f08cb4f810c28373785e2eaac92e5d21bd4a4f29212031bb94533", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173887, "uuid": "169c29a9-d077-4f08-9f64-078f864d3a24", "value": "T168F4E79C722C71DEC96BC275DA641C68EA603C6F931B4117A027359D9E3CA83EF254F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173887, "uuid": "324ed4e4-64eb-44ac-8fa4-399b2623eb37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173887, "uuid": "b2d5548c-56c8-4951-89f1-cafc529be963", "value": "12288:ZY2iNsNFaBodlN5OOfB5rYgv7vCmu1R5+SIMphhpmWcq8+ZVVBrmwR5KohGlBOdS:q1iNgmXvvTO1TlpLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656173887, "uuid": "7e96fbb2-ca56-4e39-bbf5-9a15e58f24f5", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656173887, "uuid": "3cbc8a6e-a8bf-4ce1-a72b-c4e63e7b3aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656173887, "uuid": "6268ec50-0997-419d-9227-dae735c3370d", "value": "PO-5018722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8a8101-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656168606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "05b2481e-e082-49d6-9926-a78d6160b9ad", "comment": "Malware payload", "value": "ce5f07166deeed797bdaf2e83b488bd8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "44177acd-ab2a-4973-a5fb-1c1f170ad6f9", "comment": "Malware payload", "value": "91f1600dadd939d400e9a4eb72aefc9d0bcb4a942bc41e8ed2441a74bd4d95ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "2cd70e8f-d39a-4274-a719-fa96b929fd45", "comment": "Malware payload", "value": "1ca4dabf7cf92ce1fd6df93244096f8973c7b7dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168606, "uuid": "a79ec091-872d-4bb6-b968-3d6e08d81c3d", "comment": "Malware payload", "value": "c1e5669f73c78414a0b0fb73629648fa25389bd2a2b3cfab1dd5693ed98930aae198710ea2c84b95cadc9782e16ab88e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168606, "uuid": "6faf12c3-559e-415f-9a74-3eea60baeb35", "value": "T14E22A4C5B956AA07CA848132B70E839DBF325749F2DF3303A7277F50694B9370A6B059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168606, "uuid": "45075f7d-15dd-428f-9420-f7ecc7c78cee", "value": "192:PQx8kg2u6ZAorFW02wOs5waS6HXxgD+NvBhGgJvO1kEZx4eb0:PQx8kg21ZAF08R6HXxgDYngFx4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168606, "uuid": "fa2d4d1a-398b-4f27-bc41-4ab1583dbe39", "value": 10376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168606, "uuid": "b65e618a-4759-441d-8960-98ebea86a926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168606, "uuid": "7b79ced9-8475-42d1-bbac-ccddf5d19ddd", "value": "Saru.arm-20220625-1450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac8c75c-f426-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656120745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656120745, "uuid": "81021843-fb59-4bb1-9990-12e8b55431f3", "comment": "Malware payload (AgentTesla)", "value": "4e25614c1d733f0b6cf5e41f663acccb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656120745, "uuid": "773580fa-ea2a-4709-aa56-9ce73a2da1fd", "comment": "Malware payload (AgentTesla)", "value": "923d5230f8a2049305382197bb5209fa9dac355b3b3836973fc0426dceca17f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656120745, "uuid": "cc4106bf-f10b-4ed3-8b8a-c20fbf5ca294", "comment": "Malware payload (AgentTesla)", "value": "16cfdacfcdff22cfe22b4d4e93ef638f1aeac3a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656120745, "uuid": "9a10dab5-ff54-4bb9-b9fa-fedf6dfeddfa", "comment": "Malware payload (AgentTesla)", "value": "268d3e3f8127459a6e113e48c144d2c5c54297564ee8f2dfde5a5fa0c774b23a72d7b0c13e5fbf45933f4279d93d310f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656120745, "uuid": "43833bef-ad2e-4ea3-a2f3-ffb0461ebc84", "value": "T146A5E00233248E81E374BF796579865127E0F8F93B00C61A6BE6E33C566B3E6395D349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656120745, "uuid": "314684c0-05a7-47e3-a9b3-3e3e225eb98e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656120745, "uuid": "df268878-d673-441b-ad16-1c6a2fec12f7", "value": "24576:6rftbSuvk+EfBZTjXRAWW8ORKrVqySuvk+EfBZTjXRAWW8PtRKr1:6rft24kbXRI/KcX4kbXRIMKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656120745, "uuid": "6f6bafd2-bf1d-4a7b-a834-9edec81cfe6e", "value": 2208224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656120745, "uuid": "16e60349-4988-401f-9486-617a8ae0773a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656120745, "uuid": "6b55fc79-8da6-491f-b558-3bcb94115283", "value": "4e25614c1d733f0b6cf5e41f663acccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a2fbcb-f47c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656157805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157805, "uuid": "7f393d23-5eda-493d-abc2-9f0c42e18688", "comment": "Malware payload (Mirai)", "value": "e62bd2d9abb1f7ef78e0542c1dcfb007", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157805, "uuid": "62072e4d-1225-4da4-8dcf-0bae2a00ebfa", "comment": "Malware payload (Mirai)", "value": "9350304dc2ce22d97b56670a2d5b915131fd888a9c4b0b31db16224ae7da0f78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157805, "uuid": "82470c8c-9dc2-4091-8753-d0ba14673002", "comment": "Malware payload (Mirai)", "value": "4be6eb51922a298a636231c860e3cfa60b42d8cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157805, "uuid": "33e42918-dd74-4509-ad98-86e9bcd6e913", "comment": "Malware payload (Mirai)", "value": "440deef720280cacbddeaa7032cef09e6e804ffd73c36fbf38b7ead5f83f764cf6a9b394a5b6eb8b1e3e21201a9a1089", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157805, "uuid": "0c1ebfc1-a5d4-423b-baf6-9b19cb220163", "value": "T1F6C2E130A6A91CB286500572E7BC96CABF430F7DF6FE3880124197FA3941D1639D99C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157805, "uuid": "6377acc5-b6bf-4faf-b991-47a8a82b3f56", "value": "384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE4+XhymdGUop5hy:ESsoTAZ3alkXLvFh8nNELXs3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656157805, "uuid": "6fdbf412-ab9f-48fc-88a8-24e7b90cb092", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656157805, "uuid": "bbbb8ad2-6402-4d50-9553-e72fa8e9751a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157805, "uuid": "3a9edfe0-c60b-4148-9f15-888192b247a6", "value": "sora.arm-20220625-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104c0d89-f458-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1656141960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141960, "uuid": "0bbd5428-7534-4b9f-9026-1d4a49d5c385", "comment": "Malware payload (Amadey)", "value": "a53302b1af649a122b7dbd1cf6151cd0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141960, "uuid": "e32e212f-96e9-43cb-be6f-561c8dab6483", "comment": "Malware payload (Amadey)", "value": "94015e195dd2f58a822793f0ed249596459e8e3b3a5642943b988045f7bbf9e7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141960, "uuid": "a5eca5d3-ec2d-4282-b6e8-1db717a4320d", "comment": "Malware payload (Amadey)", "value": "409644c0a1dab9fec2641585c9fd2cd4f0a2a55e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141960, "uuid": "8dfbe075-6903-4d24-819b-5b3d64c012ca", "comment": "Malware payload (Amadey)", "value": "dea880dee2caed15f3cebb847c5c0e990e5356cf1167396750c0e49005590e2c1d85b9691e8629cdde119108c1b27e4f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141960, "uuid": "26797d15-445d-420e-821d-8cf0ff65a027", "value": "T14774BE10BB50C035F1B711F85ABA8668B92E7EE15B3450CF62E56AEE57386E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141960, "uuid": "687ee889-f8c6-4a85-b544-6a695bcb3d45", "value": "8aa5d6264da1e437be4b2f2dccc9a830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141960, "uuid": "4e0371ec-3643-40e5-ada7-36d8c5548667", "value": "6144:2SyfRKs7MleMNYJloktGpATQW2Mbb6vaGUFhu4ZLL+nWk2qjDJOw:5aA1leMuHoktGpW2qG2XL+7jDAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141960, "uuid": "ee40cddd-a327-4da6-8f4a-47b252d0aa85", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141960, "uuid": "9d00a3df-8cf5-4033-b88f-3c84be6fe573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141960, "uuid": "020a0782-e2ca-4ccc-81e6-4e884130b868", "value": "a53302b1af649a122b7dbd1cf6151cd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c12157-f436-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1656127331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127331, "uuid": "fe4dae3a-0895-470a-ae15-07b84af91a70", "comment": "Malware payload (CoinMiner.XMRig)", "value": "32cf4036d915359d1e4957ddc790a216", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127331, "uuid": "123a5d5e-e622-4843-bf6b-6c6f911028f5", "comment": "Malware payload (CoinMiner.XMRig)", "value": "96ae0d3b14f36565ce4ab9cb9be5ec25a79235b58d637fed89d4ddb7a11597fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127331, "uuid": "fb02fde1-6fa1-4cc2-81b5-b8778f93aee5", "comment": "Malware payload (CoinMiner.XMRig)", "value": "45034fe70ab434b00243ee741a7a7d1411d1ebdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127331, "uuid": "26a9c23b-bbc2-4cbb-8e8d-d40e9ee01083", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0dd084a014e252836fbc53c859090526658348738a1e393935315809847da909217c8a2d14bc416d2d370e187d42ba11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127331, "uuid": "edae2181-7bea-441f-a0a3-5a4156e7d20f", "value": "T1CE442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127331, "uuid": "fad9ecf3-6cdb-4860-a3b6-c75cd411abbe", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127331, "uuid": "bced5d46-5261-43f1-b900-f01b9d9eefcd", "value": "6144:EBABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:EmB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656127331, "uuid": "caf1d59b-c005-414f-bb32-b2bfab3d53e1", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656127331, "uuid": "9d4bd717-8849-4e45-9750-9630771bcfce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127331, "uuid": "2edba357-f39f-4b98-b6e0-0d0344430096", "value": "32cf4036d915359d1e4957ddc790a216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d4fe09-f42e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656124070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124070, "uuid": "63d47b31-739d-49a0-8f75-7086bdbc0f92", "comment": "Malware payload (Heodo)", "value": "a7e6c2effa40002aec16c1e37d520cd0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124070, "uuid": "8d3a0cbb-95b4-43f8-b928-2966701f7ee7", "comment": "Malware payload (Heodo)", "value": "96d436965d2c539a5886582baaa42e28438b8b8087f4111ca09993561c17b56d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124070, "uuid": "789c4cf0-e005-469c-a45a-28f2fbb45044", "comment": "Malware payload (Heodo)", "value": "8e2f0d838161e8377a3cd5d1bd7273676be112d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124070, "uuid": "3fb6de22-d8e5-4ec6-b7a2-4acd4731aa58", "comment": "Malware payload (Heodo)", "value": "a7e5b54f99eeb8dbc934f9aa2262cbaae478f9c2a51d0a89f75081236052aa8e4f7fa59fc878741f0f00adbd096fc2f8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124070, "uuid": "eaab7c83-ed49-4040-9d12-4ca77a497a4a", "value": "T16AE4AE06B3A442B9F0779238C4974653E7B1B4865630E78F13E4437E6F27BA16A3E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124070, "uuid": "07cfcdc4-56d5-4784-b2c1-6170eb8ae653", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124070, "uuid": "0f5678fb-6b78-4d14-9a76-0fb974a11523", "value": "12288:i6ga9aSRQTSq4RxN46G6463za48ukW+0+HOZ26u3SaYuUVDJe07zEHCs8xCNI9pm:Zga9aSRQS2bSB33ePNOREYxyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656124070, "uuid": "84fa6cef-4180-4e9a-bf3e-65ffe0a279d5", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656124070, "uuid": "b5a8c64a-bd07-4fcc-a258-e2b048beb3d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124070, "uuid": "7ca8f1ab-188f-407c-824e-b4b7e11994c1", "value": "a7e6c2effa40002aec16c1e37d520cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0251f0c8-f450-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1656138501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138501, "uuid": "fafe4c8d-4b92-4bad-89cc-a7464b9d5a56", "comment": "Malware payload (AsyncRAT)", "value": "1203268e742213feb94d621e4018ce70", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138501, "uuid": "2ca4d1c9-11a8-4a3a-b35c-f2c0a18f349f", "comment": "Malware payload (AsyncRAT)", "value": "96e94a03578fa308cbbe77d8be15c457db4b26e0460c4206d1a7799f24da4a65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138501, "uuid": "110a8e86-8ba2-4b92-81c2-36eda7a5ba0a", "comment": "Malware payload (AsyncRAT)", "value": "8697bab05f86ccd754abdcb1e3812990f50460fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138501, "uuid": "e68a4e9f-d918-42dd-ac27-db2f2a88500b", "comment": "Malware payload (AsyncRAT)", "value": "e2073ffea960b99859180bb67da2278f22ce1d9f1f6282710ed647d885be732ab36e96fced5d8193dedc10136375434f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138501, "uuid": "fce6a972-8f48-4f29-8fac-ef14dbdc2348", "value": "T1E161DD2417E61608F7B3CE35DAFEB1268EBBBA56DC11C78D0045120959B1740EC63B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138501, "uuid": "b2f7e656-dd98-4d6a-8f5c-5c60a3e8e7cf", "value": "48:8zCEpkqCDYYquxG+1NlTmr86h1K/cNMVN64jRTjxf3xl6NwCyCFriHApaa5QW:8zvk3r/A4TmrX1K9n6mjpywCrWHApa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138501, "uuid": "d8c8463d-719e-471b-b699-2e0017b0f2ca", "value": 3308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138501, "uuid": "7c8b42c3-6c14-4505-96a5-1f22334d280c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138501, "uuid": "34aebd5e-334c-414c-a1bd-fd2b9cc52c01", "value": "Reservation Details.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd4af02-f48c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1656164530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656164530, "uuid": "58aee6b8-ed46-4b82-8857-dd0d3d8585af", "comment": "Malware payload (Formbook)", "value": "d40224e4aac99cba5b845f08de0729c7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656164530, "uuid": "d0ffcfc2-7e91-4167-8499-2598e5d6843b", "comment": "Malware payload (Formbook)", "value": "970dbc1093b5263297ab89f95cace05a88587b977789be0a72b53be3776280b4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656164530, "uuid": "fc9b1118-e986-4845-b140-723be82f8d71", "comment": "Malware payload (Formbook)", "value": "33c44f91843df7e828746fe725f42c2189dd9f09", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656164530, "uuid": "a553b32f-0af2-458b-9d4c-5cd9d035a305", "comment": "Malware payload (Formbook)", "value": "5fc486cfad20d11ee7f39fe0ef355eb6176b1d7665b19f12ef2fa7ac717bcb3b2ba65a26b407835cc48ad2667196ac45", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656164530, "uuid": "157e0974-b4dc-4859-8cbd-d30f7aa51770", "value": "T1F4D4337F60B882BE867D837724C8987378CE6615E6D264DDDE949CCEB3B25E00DD8412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656164530, "uuid": "1bea33ec-4403-449a-8e1b-29d596c58459", "value": "12288:tLXaCS4KDaem9eKGy81y1H3OVGw8z0oOCyl2jAkX/scjrwhawAMHCe:tLBZya99YEteMwDl2R/dr7wUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656164530, "uuid": "9b54676b-2d80-4839-91ff-eae29147b2db", "value": 648119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656164530, "uuid": "3fc3b40c-bdbf-4be3-916b-36ba53a3603a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656164530, "uuid": "6800cd6a-2d11-433a-8e8a-f26f41eaa9cc", "value": "Remittance_90523_03.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03166be-f478-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656156080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156080, "uuid": "275696dc-d57a-4876-9669-8742f15bf6b8", "comment": "Malware payload (Mirai)", "value": "e3b10d3bf515c9d227e00af49f58057e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156080, "uuid": "e874b789-4bf7-4b8b-9c1c-ccad2b015d58", "comment": "Malware payload (Mirai)", "value": "9a667d966e1d11fdd97fe22071f6572c579409556cc5daf1e87d0ee464ced76a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156080, "uuid": "ae6b3cbf-5441-418b-91db-bc14a02f6d22", "comment": "Malware payload (Mirai)", "value": "f46423e6f93de41f1b4862b4d809fdc85870890d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156080, "uuid": "bd758e85-8d1f-4424-a349-37b6db9b7573", "comment": "Malware payload (Mirai)", "value": "1336427ea23ba9699102099e9435f40c2c8aa1a66250cd212ac0ff73e9aaaee74b79f6a6b4ba375eecaa5560fabb3737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156080, "uuid": "b93ef550-e589-4da3-9cd8-e7fc4b9a00f6", "value": "T10C23F1ECD42CA409CAEF5D78A2CB2E54D9C27151375A2288172DA95C6EB524BF89C0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156080, "uuid": "f8d040c9-71b9-45c4-8ddf-787f99a2fc91", "value": "768:7NTNJkUC8e7MWwW4URvSocI4hJmxJupuxv128C4z9dsJ1DIFGWVjMHEBIHg/Ybg9:7NZJAX75wIFSoEQ4joocDwFHqYba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656156080, "uuid": "11117a1c-f444-4650-9747-d839ea19d85c", "value": 49464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656156080, "uuid": "eecaa684-fd81-4425-98b6-d209fb9f1af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156080, "uuid": "daceadd6-00f4-48c1-a83b-033223f7b0c1", "value": "e3b10d3bf515c9d227e00af49f58057e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1333f62f-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1656145831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145831, "uuid": "f2a40d38-76ba-44a4-a414-3dd85f169b37", "comment": "Malware payload (Formbook)", "value": "3b61a8f8919eae3a6f89241c630ec932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145831, "uuid": "cb4f48c5-5eed-4d8b-a5ff-e47a93cbbe4a", "comment": "Malware payload (Formbook)", "value": "9cbf58842ab2082dfb22e1f53939cd2d1dd66b551a4d9ec397ae558f35e5475f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145831, "uuid": "87522dcf-daa3-4d73-aae0-e95f04a53abb", "comment": "Malware payload (Formbook)", "value": "838decdb745bc4586c31dc3c2257a3a4c759c183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145831, "uuid": "7bb6b06f-fba4-400e-b8c9-8d5bd04dd218", "comment": "Malware payload (Formbook)", "value": "a5a8aeec7cf4371a19de76e41f34e3bd4697f4511271558476b7dc5a32c3dea69cffbd32be3d135a754737f4023ee011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145831, "uuid": "2ff7cb0d-8190-42f8-8bc5-3b63749460c2", "value": "T159B45D2C3B010E66FD1F9130CD010AA9BB660AA37381999657EF1FC98B4E4F56F45D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145831, "uuid": "809709b9-e1a0-4d17-b21b-548659dd6cf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145831, "uuid": "85838b70-e11c-4d89-8ebe-3128cd8f67df", "value": "6144:bcoKllTXKhRxMRKiT14pSDmSKUZwzl0KKv5wQqL//0CKtX1b7ZWpmYCXBi:otlRSA/4pSDlKUZwaKHjtKtXVGis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145831, "uuid": "2256bbea-a761-47eb-a562-4d1be348096c", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145831, "uuid": "6d2cb1c1-9a39-4bea-b8f1-877d92888c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145831, "uuid": "157d7da9-761c-4c73-8987-4d69ec033bb2", "value": "MV OBORISHTE_VSL_DESC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb5c7fd-f4ab-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656178010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178010, "uuid": "3eb18e49-3ff5-4646-8bc6-95437e844440", "comment": "Malware payload", "value": "42c343feaf743f28b41a4db0a99057e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178010, "uuid": "bfc3f6b6-4640-4b64-a8e9-266b0ed7c832", "comment": "Malware payload", "value": "9d584eaf41308cbdcf0a120be56b2eb1f2d78eca0df54a7c50b3cf945390b8cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178010, "uuid": "2201e40a-4a69-4928-a2db-5b0798c15130", "comment": "Malware payload", "value": "9143f376ddf774103337468efc0704e508c4f804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656178010, "uuid": "c048ba8d-b36e-4464-9f2a-27976d970fd9", "comment": "Malware payload", "value": "14b50bd6abaf5ab3936a86be464f77c7ed343f8eaab5aea9e8a08a551744352ec7697eb289bfca1c66446eed821f929c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178010, "uuid": "b2c773fa-0990-4d69-9e2e-cb26a1ecf667", "value": "T186E4A49C722C71DEC957C275DA681C68EAA07C6F931B4107A027359D9E3CA83EF254F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178010, "uuid": "ce4e0bb7-9f5d-4f26-8abe-01ccf89591a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178010, "uuid": "ed46dd8c-f1e0-4cb4-8546-50bb5eea5d70", "value": "12288:gY2iN88WkwwkxPF5Qc6/k6FlpbG1iAfKU2Waw5SCuovwevysnJbf8uQnouDcWMo4:r1EkkxPNEdRG3r2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656178010, "uuid": "631074a6-5c95-4d10-87de-46fed85a34ef", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656178010, "uuid": "dded8061-8bce-446d-a43c-39c2da73709b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656178010, "uuid": "10a7c76a-511a-4e00-ba7c-b3dfa2ec3acb", "value": "MV CHINALAND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee7bd07-f4cf-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1656193149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656193149, "uuid": "e3292d25-970f-49a2-9e0a-738311c9d4f5", "comment": "Malware payload (njrat)", "value": "b0746a1ed7ba403a3a73630f3770994d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656193149, "uuid": "05b7300b-691f-4d73-bd72-fed7d1cc8773", "comment": "Malware payload (njrat)", "value": "9ff3c1a1c7b4ad59622c37e03f1798f1b0302834c86d9fb200bb7931a47637e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656193149, "uuid": "53bc4233-f634-4a9f-b1a4-5a592f438dab", "comment": "Malware payload (njrat)", "value": "c8e888c078ccc512b714c8a79f46b988c94bf8f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656193149, "uuid": "1108cb8d-b6cb-42d7-bd1f-aed9610836b4", "comment": "Malware payload (njrat)", "value": "5a63fdb0dedd3685a2179cbeb2a3f52f94d4c34fcfe47339db5e3b5e370acb19f2cf3f1eb37878a915cfbb8c522f16f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656193149, "uuid": "d4148b1f-8485-4bfb-96ad-18eca26caf29", "value": "T16225D7116056A0609D8FF79171667391E827EEEC9B27C7CF128C6FB81339E6379A5203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656193149, "uuid": "a1a16a78-ac61-4cdb-afe2-713592e6a2f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656193149, "uuid": "482ebaf4-fe4e-4370-aab6-066f01072edc", "value": "6144:FxoF004FZ9mdBuTY0M4v5+9PJ8v7aFmwTsIYpc3z2QInYF0lRPqF/+IFVaA+qMQM:F1hmIRSyvRAIYFfwZ3QDDHXQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656193149, "uuid": "a8469183-9cf8-4867-b9cb-742fee9fd45e", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656193149, "uuid": "6aa55b20-288f-4447-b2fa-a88516bc0705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656193149, "uuid": "4c69540b-c0e9-4e37-80e2-2e57ffe493d3", "value": "9FF3C1A1C7B4AD59622C37E03F1798F1B0302834C86D9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a93844-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656146019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146019, "uuid": "c6fd05a8-1f91-465e-bcb9-c793ffbdb46b", "comment": "Malware payload (AgentTesla)", "value": "6ba2dfb859c193dc94a86e73907df051", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146019, "uuid": "79b1fbe5-edf2-4dfd-bfb0-8fdaa877b16b", "comment": "Malware payload (AgentTesla)", "value": "a10e7b2908599a528f9b04f6e1dd46476e0e80d1f7e8e19db72e580be9ed6e57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146019, "uuid": "dc78e8c0-f773-46c4-a2d1-50cd98a2fca7", "comment": "Malware payload (AgentTesla)", "value": "507c633b687c614649bbb700a2cbcbb0561d186a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146019, "uuid": "ef93fc03-8216-44bc-9ae7-0902739fe340", "comment": "Malware payload (AgentTesla)", "value": "a8677716798be39c8f9bf5ab7cf2013945c6d24ceb43535e492fbfa51f056f97f0d48cad8e315b1dbd4662c13d46fe79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146019, "uuid": "7b143bf2-ae59-4426-8ae4-a268328c30c8", "value": "T1E6C2B701F5809370E3AA527778EDB14CF2AADD2C060BAA92F8947D5C1B722D11EF653D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146019, "uuid": "501d062e-43c1-4a5a-bc8a-98fe6638ee86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146019, "uuid": "4b36d9d0-460c-46ff-98d9-5b55e3978a0c", "value": "384:oXctv9RGT3Tu2FEyj0PxPj6NEvNesOj+:Sw8f2PRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146019, "uuid": "3113ac1e-b5eb-4a85-b1e8-18177178eee3", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146019, "uuid": "ed88ffe3-c26e-4979-addf-4c6509d2491b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146019, "uuid": "9f09a644-43cc-4ede-9cd6-95b5bb89a041", "value": "MARITIME.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdca2a15-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656162008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162008, "uuid": "cd5482f6-560a-47ef-97a7-924bf54f062e", "comment": "Malware payload (Mirai)", "value": "0b1e426b74d2ae5ec42cb4d44146564e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162008, "uuid": "6dbaf375-3d61-43b2-b750-ea6409babc96", "comment": "Malware payload (Mirai)", "value": "a1af1f9731b73eec68140969d46a4dcf03dcfd2c35fb104eca758fc459291cea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162008, "uuid": "cb8a7341-96b9-49bc-97f2-39558c87b0aa", "comment": "Malware payload (Mirai)", "value": "d82216f61296befe366ff6f07557ef456d6363c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162008, "uuid": "253fa4ef-4e96-47ab-8be4-cac0736018b6", "comment": "Malware payload (Mirai)", "value": "4a4561c68311d6d92e6ec06878f0d359cdf8923c6249871119f32d7267925ec77b7da7a8aa6ec7ef52489e79ccaf37ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162008, "uuid": "daf67b2a-790d-4c6e-b96f-891014d988ef", "value": "T1F803E122CD1820A9E731E8727839FF52BD450F94B237B3965287C615CB84D4A9AFC49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162008, "uuid": "9790fa2d-c063-4a0c-b4b9-57d01056f6d6", "value": "768:fc4/11H0GZ8hXCJQFrfJv7N/YqyTdaFu7Dl+gP3U8:fc4/HH9Zy9Jv7pYqyT887Dl+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656162008, "uuid": "10ccaa4c-404c-40ce-9cce-ef31cc828e9f", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656162008, "uuid": "debce613-2f17-4d72-ad56-ce11f2639e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162008, "uuid": "9118694d-7141-4c93-9e48-6f257b5c6334", "value": "ZG9zarm-20220625-1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b039e6-f460-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656145704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145704, "uuid": "dd4e0feb-5309-4cc2-a4db-3513f685ff7f", "comment": "Malware payload (AgentTesla)", "value": "359da80c0a25640012f1641009ee7b81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145704, "uuid": "06a3feb7-88ea-4c0e-ad35-d86f4dcbb234", "comment": "Malware payload (AgentTesla)", "value": "a770cd8f4ec41d3290a95fdaa633bc328c877584cefec93ce6d67654b77c9614", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145704, "uuid": "a876d40d-ba11-46a3-94fd-0b3ba2bf6d75", "comment": "Malware payload (AgentTesla)", "value": "83bb2efeb7f14560fbf302ce046942c63273fb96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145704, "uuid": "e00f9589-efd0-4ce2-8012-1a3e9201a14a", "comment": "Malware payload (AgentTesla)", "value": "43e59c5f5db80f1e5fa79aa7a0bdac7fbbd619600758119f4c08fb766d502d2395145db1d88e7be37392155a10d1c25d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145704, "uuid": "9c41a4e8-e27f-466f-87b5-4de0baffb85e", "value": "T11CB45F1C3E019B7AED0DD0308D518A58BB670F536A80E98377FB26CA979F1652D35CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145704, "uuid": "84342186-d2ec-479c-aa5e-e3a7e77fcc9e", "value": "12288:7Fc90uLb/QMakfWUCY2GYGib5bLirByN3Cvwrnp2Unr2zjtUtstoL67sRqIIXgo0:Y5iEOsIUsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145704, "uuid": "8a78c9a4-7aa6-4f4a-bdc0-c96f42caecd8", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145704, "uuid": "4acb9973-a572-4b3b-9e7f-564e7f6715b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145704, "uuid": "67adbcf1-3fb4-43d2-89af-9a86cce30d6b", "value": "MV. TBN - PERFORMING VESSEL PARTICULARS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec76597-f450-11ec-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1656138871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138871, "uuid": "1bf16725-a095-4147-8490-67c41e69465a", "comment": "Malware payload (Socelars)", "value": "de0036f5f754892ae9862ccdf5aca36d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138871, "uuid": "83fbb809-5eca-48ee-a034-5bb3ef163d8b", "comment": "Malware payload (Socelars)", "value": "aa64d94666e09513a1c96748e4bdf014b77e00c084ffea4f1685cb72983b6e74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138871, "uuid": "db7e7e49-453f-4cdd-a68d-5ff2ba590033", "comment": "Malware payload (Socelars)", "value": "77e75320b5eccc029c485e8336f2590f50e36551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138871, "uuid": "bd7cf6be-42e0-4746-a545-180a6a80bf07", "comment": "Malware payload (Socelars)", "value": "1fb09e532083060abc4d0848ada520ee336ee19fd8d5360b73664c3721f0c1b5259116575bf2355becd1f9e2697355db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138871, "uuid": "682ce9d6-ed23-4899-a951-3592ed407740", "value": "T169855A40A2C1523FD8A201F542BAA6AF9D6C6D521B4743CFD3B03D99DA30AEF753251B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138871, "uuid": "fd2b36b6-1660-446c-a00f-35964eea4c5f", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138871, "uuid": "f319a4df-fd21-4109-aa62-acdc3fe7aa4b", "value": "49152:XpMRGe/4ebLPv1lqUMN888888888888k8888888888888888888888888888888h:N+bLPTw888888888888k88888888888H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138871, "uuid": "7fc51fa2-7a07-4661-9fd4-5c74e85dbcf9", "value": 1793024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138871, "uuid": "47114e23-aa37-42eb-a820-bb6e7f8fb86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138871, "uuid": "4c2da466-480c-48f0-8955-ce642bff9a14", "value": "de0036f5f754892ae9862ccdf5aca36d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b73add3-f457-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1656141764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141764, "uuid": "fd75a3bf-2b32-4246-8c1b-830c3e7dd400", "comment": "Malware payload (Loki)", "value": "a36e397ce9fdb81d06af2075e4c28db0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141764, "uuid": "dd5c5c28-65a0-4111-a19c-5e20589bf8dc", "comment": "Malware payload (Loki)", "value": "aae1d30b6e431b5fa284272da4131eb5a9297d71d36e33fce9fc4d8fd9f0f408", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141764, "uuid": "63e4a8c0-21e5-4cf6-a6a6-81baa29679fe", "comment": "Malware payload (Loki)", "value": "f5d2aefa2adc2937fe82b5bed591a3b82ada12c5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141764, "uuid": "fff7faa4-8458-4825-9fb9-c738cdf6e0bd", "comment": "Malware payload (Loki)", "value": "f965544d34e1ca382473d1c255c2b50afa2b03c36c687177c1f013555214f59e0060a81fc96e65bed33d1c7136190fff", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141764, "uuid": "997e3b01-3a4e-4122-9cfa-16013c769756", "value": "T10994019863F80229F6FF57FA14F852012B32B51989B4E30E79D0229EFE617EC8550B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141764, "uuid": "d70dc716-b91d-4883-9d91-6dff3cce4b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141764, "uuid": "cfee3b63-6512-4f08-a509-62fb827b0493", "value": "12288:icSkPRxliW1FRVo8vR3WEa9hs6HB5+r8ZEPW2Kdd:icSkPRrhFfjvRIJB5EMs9Kdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141764, "uuid": "c4495860-c7ba-4e2f-8a4a-bb284e23bdaf", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141764, "uuid": "a0841f12-0539-4a6b-af66-3c8e980bf4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141764, "uuid": "d9550f89-04da-4df1-a438-7b1d93bbab51", "value": "DHL-27-6-2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c5fbef-f46c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656150607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "4af1b880-ef2b-4cdd-af44-4ba88e3aff47", "comment": "Malware payload (Mirai)", "value": "afb79ec8c290c236c62ded88af97eb51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "10ac1f3e-8d92-462a-9ca6-361c185a31a5", "comment": "Malware payload (Mirai)", "value": "ac1cd895bf4816fe4c81ec9eebea6410237a2fd47bd283fbaed124dbf870db01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "fec7ed8d-b8ca-47a7-9ba0-56ed7ed27c2b", "comment": "Malware payload (Mirai)", "value": "18c1c117a269fb0819eebc5e7d1ca4b6f8af8d16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656150607, "uuid": "9b824022-ea8b-4a89-8a29-116272724486", "comment": "Malware payload (Mirai)", "value": "65898a03111968f64eae85d80b77d82ce16d79921b8383ffbd4294b620dd42ba819f2fc021ed5366c4261e4209677b13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150607, "uuid": "ab18edfd-925c-42df-b6db-0121991c31d0", "value": "T132043B46AA409A13C5D7177BFAAF02453332AB54D3DB730A89286FF43F8675E0E53606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150607, "uuid": "9d2e1c4c-b4ac-460b-802d-3dc3c13a95a4", "value": "3072:jndkFp5Qi25wKMGsV6/dea9dy1gajUhIX7Yt6r3dfJFxM/9s/azkPQM:jdW29P+6lea9dy1gajUI+udfJjM/9si4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656150607, "uuid": "93797a16-b535-4ad4-91a5-d2e611a89231", "value": 181199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656150607, "uuid": "c578ad2e-73c7-409f-9c41-b246ec21056a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656150607, "uuid": "b57da5f3-8094-4d26-90d7-9cc77b1ce777", "value": "garm7-20220625-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bc6b78-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656168605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "9d08b63b-d666-4d04-b5ea-ddcd2eeea611", "comment": "Malware payload (Mirai)", "value": "27ee4e096e628c87e3db526cfa3a3f20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "ce1610bb-2907-4e9b-88a6-89ef75c56db3", "comment": "Malware payload (Mirai)", "value": "ac6758f2c139d8ee65bf55ff047259de68b047011447d46fc9169b98452fd79f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "9c6dcae0-84cf-42a0-b88a-3e1d6698762f", "comment": "Malware payload (Mirai)", "value": "19638088d965fa29c69c08c4d6e7254c136865de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168605, "uuid": "fabf44b1-8ad1-4e8e-b0fe-c1e3c68b4d7e", "comment": "Malware payload (Mirai)", "value": "39bf11c2dd61e6c854b22e4edcff796a30aa5a5d6fcb35937e29752987904baca95e27209c997178c20ef10fc7e351bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168605, "uuid": "e2bfa7e2-142c-4aca-a01c-d6c27c241ff5", "value": "T107C2E0F67E773D9BDA2510393899CE3792B0E062D7AEA613A241414D20071BCB7369DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168605, "uuid": "f5f10c45-1821-4daa-8b32-d0968148dbcf", "value": "384:Mp1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8QK/wvmDO3B:EMwKDZOFbBy6sSHRYfeAxdd8NiSOE0NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168605, "uuid": "99f14d72-cc58-46ea-9ee1-8ed3e605f8a6", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168605, "uuid": "7c57f868-819d-4547-9d94-ad99827404a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168605, "uuid": "3cc3b7ae-8de7-4441-a668-95e15440d189", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08452f39-f49e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656172012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172012, "uuid": "74ad8e69-0d9b-4e87-a546-1e2b5df8c380", "comment": "Malware payload", "value": "ebc7518a37765892fd2985525f34bbf8", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172012, "uuid": "b999afb3-f55a-4c59-8820-2acd6dac9ca2", "comment": "Malware payload", "value": "af5fdea3e28974c60d7a29b39086000bb522bebea9d3255ac95d63074d3e76f8", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172012, "uuid": "b63f3684-7db2-495a-a637-bf1abc676d63", "comment": "Malware payload", "value": "44cc387863e5f93593896a9ae22d516c004e74da", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172012, "uuid": "3ba906cc-f173-4794-96cc-3fbcb2b90a21", "comment": "Malware payload", "value": "1bc6f1f02728d4b9ba3edad2f01321a79d8a3d0469e4d346254b4bc9df165a493d3403c0e1b7a121a5c86af01c507400", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172012, "uuid": "730cb0ff-6200-4348-a656-3711779bac11", "value": "T18FC602570C104E5EE8D4511CC6BA7B3D2A2AC909B202827EF5C86D0F7BE6FA446C735B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172012, "uuid": "6c11f0d4-19c3-4227-9c5f-4bece14e6431", "value": "768:JRGOdZmkDFuhnkd2tSpLMgeWSAnlpkZdcXYjZAv2Z6yf22PZHXH5XP/bpJdtTTNY:JRGlIaIPn2/vzjBZ6yf2fss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656172012, "uuid": "3a08abd2-7952-4239-8bf7-2220b1748cbf", "value": 12038144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656172012, "uuid": "903133b6-ba9d-4e58-899f-52fb5aff6e70", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172012, "uuid": "9ef4b004-88d5-468e-a44a-0b909bc36c65", "value": "MS.Upgrade.Database.Cloud.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d7723c-f4a3-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1656174239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174239, "uuid": "94e8c531-81a2-4b2e-af0a-69a99190efff", "comment": "Malware payload (SnakeKeylogger)", "value": "7083459e96530ac7a837f10a1ea22cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174239, "uuid": "a42a5659-fff7-4902-95dd-5963697e258b", "comment": "Malware payload (SnakeKeylogger)", "value": "af9005931d894424acc7f6cba4ea4bc31ebcfe738e5616fc74deef2c551cccd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174239, "uuid": "744a4e9c-6e4f-4c60-b74d-ad5749f06d9d", "comment": "Malware payload (SnakeKeylogger)", "value": "a9cc5104e74c7a03a48f3a2aafc3fdca620da794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174239, "uuid": "e520137a-963b-441e-89da-b1197b2a9af6", "comment": "Malware payload (SnakeKeylogger)", "value": "d031b7f19b1e2bf626d2597abd4b050cea6a547bd98fae2216391f94431b232a11ffb27b0c8232b7ef2234aca27bbec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174239, "uuid": "8bf53cc5-43b5-4c3c-b62f-37e5b0318e30", "value": "T1CEE4B59C722C31DEC967C175DA641C68EAA07C6F931B4107A027359D9E3CA87EF264F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174239, "uuid": "6eab9ebb-7aa4-4fc2-a279-7f276befb565", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174239, "uuid": "dd63affd-41b4-4001-914e-6cb2e2f62add", "value": "12288:eY2iN/V7yNjO6JrnqwEvEFpDUaYukc/0LWDFzEx4a8yVbYbZ/4023VwpSYIEBjwJ:J1hVWY6JkMKddc/05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656174239, "uuid": "dd602c7b-fd22-440c-be3e-49293f77a73c", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656174239, "uuid": "3c44de41-be5f-45d3-bdf6-71e6f477c16a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174239, "uuid": "e95f8984-045d-463e-89ff-ccc4e75c6c12", "value": "MV SEA EVERGOLD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ca35f7-f462-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656146585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146585, "uuid": "3e79a6b4-0437-4a0a-8697-c624cbadb04a", "comment": "Malware payload", "value": "62a8716df6456aa39497db7039bce878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146585, "uuid": "29c4660a-5633-49eb-8aa4-50095b75395e", "comment": "Malware payload", "value": "aff503d26ebef020ea7992ce3ab48bdaa9376c31742c283b97382265d11ae142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146585, "uuid": "72ce7765-dd69-4c91-9d7a-bf701b2e33d9", "comment": "Malware payload", "value": "cdbcb4b390e06366232e850e7b6faab9ad76e74e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146585, "uuid": "bfcd689f-34e0-4a8a-b260-d14a16e4438b", "comment": "Malware payload", "value": "cbacca8ce8c4cc66672ccaa7f26b6a00aa09f91d25f0fb23d519cc50ad2fc3d9def430260e997c80f2122249330f2860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146585, "uuid": "0ceb0a11-6b88-4818-af4a-4212975641f9", "value": "T14855D85DAE618217CC3CC6F44893FF7432F68EC3A962D481AAE5BEC9877E7111813169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146585, "uuid": "be64f435-1206-4d6d-ac64-799a6524219e", "value": "12288:+vb+UbADMK5xyNXt+MFiH+9bEh1La/xSco+M460zKtsTXZi9LqVUbu5QmbqHQR6p:a4UrdPv3kJim0JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146585, "uuid": "5c4789a5-bfb7-48dc-8bb9-48e8988fee36", "value": 1339392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146585, "uuid": "03a57ba0-21b3-4d07-b88e-e4ec076cd433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146585, "uuid": "d6ddb931-ae55-4bfd-bcf2-16cb93f56a6a", "value": "MV PLATINA TBN_Vessel Particulars.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70821efb-f462-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1656146417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146417, "uuid": "9c5e9f1d-ff10-4632-91e1-324528d260a7", "comment": "Malware payload (Formbook)", "value": "b082e79d873b053f1b60ea966f0ceefe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146417, "uuid": "5256015d-d52e-4c2b-85a6-466a8920b15c", "comment": "Malware payload (Formbook)", "value": "b20ad6c8dd8844751924260b1fdf4527d6ca6629d8df09140733e88a7eae9db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146417, "uuid": "4839d7d2-222d-4418-baaa-b1780da13d76", "comment": "Malware payload (Formbook)", "value": "e9de2c6ad529029f0fc626740ead3fe8108d2b5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146417, "uuid": "05b26a91-0876-4187-aaeb-273a01262c48", "comment": "Malware payload (Formbook)", "value": "77508a7406a46db58cfacc3e2aae79e766c3d3e256b3d64145930580397348ea32eb469e2b682e77b7591594c15bf608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146417, "uuid": "fed2bab3-475e-4114-95a8-0b7ddaad5817", "value": "T171C4906C7A010AB2FC1E91B0DC450EE87B660F477391A98627DF27CBC78F6661D25D88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146417, "uuid": "a5fdd219-8075-4805-af1a-3c6f1e03707c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146417, "uuid": "11df99a5-015a-490e-bd54-bde7962318c1", "value": "12288:k6VsRDDZvpjbYd+y8PZa5b8yuKIFnYM2BiEpn8dPLIDGGy3CPzazeREkW:Ov5AFRPzya/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146417, "uuid": "5415477b-9ad9-456a-832d-507317bd5c63", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146417, "uuid": "55d908e6-6862-4658-96bd-4314ff6cb420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146417, "uuid": "f4f061e5-22c1-474d-acb0-9e2ac5979517", "value": "MV BBG HECHI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988504cc-f49c-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1656171395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171395, "uuid": "9fd09159-beff-4776-ba12-2c6f24a097c8", "comment": "Malware payload (DCRat)", "value": "051e0bcb4c01fde2fdc4214fccb6b758", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171395, "uuid": "f8f2a34d-900a-4dc0-bae4-ccfa042b0b1e", "comment": "Malware payload (DCRat)", "value": "b249923b273da20030e0f8d8aae90e749c3743ab8f4881c70234bc9b412269a1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171395, "uuid": "4c455837-aaf1-4061-828e-0adbcb10ad62", "comment": "Malware payload (DCRat)", "value": "eee8f4598b06888d2efdee9372888fb68da31002", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656171395, "uuid": "86124ecd-de90-4d4a-b88b-c71ebf9e084e", "comment": "Malware payload (DCRat)", "value": "4e98701951beeefe6925cbea8394c723e5433f6e843be9033f71fe6b656202e2c976eaca33f0d320d61c67c5b747f194", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171395, "uuid": "a7e5a757-26eb-4a25-9010-f1656112963f", "value": "T160846B1823EC5E15E1FFABB9D0B358A683B1B457AABAE70F4DC110D91922341DD04FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171395, "uuid": "8418a03e-a919-4a17-a6fa-a63b9435ae83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171395, "uuid": "f24fbc66-e126-4899-8cc6-1d893190682d", "value": "12288:aqnO7SzKT/LKKoM/nrEZ8hM+Zqm61ASWU:a+OOzK3KNMvsCaVA/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656171395, "uuid": "1b0285f4-5d9b-4a5d-80c7-ab3fd2571e6b", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656171395, "uuid": "c36b1bf9-950b-4a79-8b31-7922cf2356b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656171395, "uuid": "86be23c6-8533-4ca0-b51e-57d2bb87687c", "value": "B249923B273DA20030E0F8D8AAE90E749C3743AB8F488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b586454-f463-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656146730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146730, "uuid": "04a8e1d0-2ce1-4f16-9a59-451776802bd1", "comment": "Malware payload", "value": "7bfe73a151f10c510304fa58ee0fe42d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146730, "uuid": "6419ab46-2e45-470c-888c-c98af056f458", "comment": "Malware payload", "value": "b447f348d8847967b21a007d385ce25aca868b5a1eb2a6a1fcf8d7a2b4fd25df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146730, "uuid": "99185e04-1967-4c0b-8d46-4e7dcd7f64c7", "comment": "Malware payload", "value": "bf3ab453b8f979ad7a2bf7236fb7b1b6dba20515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146730, "uuid": "0039f1ce-7099-4159-88dd-e5d942f0dad2", "comment": "Malware payload", "value": "d63dd28279f55266b78feba73f1cf070a79e421303e83a02ef70bb0f7f91784cce2102a77210643ffa0cc65b84171bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146730, "uuid": "169b9721-03c6-4bf6-8939-fd64716a537a", "value": "T17BA43A2C3B051E66EF1FD17085110A24BBE62EA33280998757EB2DC9975E5B33F05D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146730, "uuid": "3c8ee72b-ca5e-4aa1-ac6d-c2f1e7e4021d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146730, "uuid": "39d342ec-8aa9-470c-ab65-db362747212c", "value": "6144:ylODnecKTQ75731VzwqH233WyY4GC3dnSBG+LSWGqmW9w8:y8DecKTQh1VzfH23/G8dnSBGgm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146730, "uuid": "a805c143-f6df-4f71-9f74-c4e6ccd25e0c", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146730, "uuid": "34a0561f-246d-4374-b8ee-b9eb579b5ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146730, "uuid": "9398577c-2dd3-40f7-be59-1f57fbd5a306", "value": "MV TBN1 VESSEL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc385ed0-f486-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656162006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162006, "uuid": "545c110a-86be-47e3-9292-8d283aa14bdc", "comment": "Malware payload (Mirai)", "value": "68a650b5f32d17a34284d8846f3c147f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162006, "uuid": "d4926a14-9dd3-443e-8004-2b975e56a118", "comment": "Malware payload (Mirai)", "value": "b5f287ab66d365de72a30c432716c6365605df5acdd28469e976e639e8458ad5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162006, "uuid": "1e3274f4-f3b0-4db4-bfca-406804a5f5fe", "comment": "Malware payload (Mirai)", "value": "2a7af94ce0f5b491c0f9bc1b603e54cf2e713068", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656162006, "uuid": "9eb0262e-383f-4565-9951-3cb052c24ffa", "comment": "Malware payload (Mirai)", "value": "74e55beb0741c40d03b2611aa70ce7aad1df85ee5d930661925929283cc206091c32c43bfa9f1a897ff82bd7190ca415", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162006, "uuid": "0beea571-68a7-434c-b761-724d6e4edf58", "value": "T1ED5301F0866688D6C7B01A71DE95048176D95BFCC3DF72D2382E55FAFE8086295EC142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162006, "uuid": "129b62b5-e9bb-405d-a82b-6e451accd363", "value": "1536:5mpb+T5agCzBY8lqG9jPn3RcTHkgljGI4CZBQ7l3C9iA:6DgCOBC3RcT5jGI40BQtC95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656162006, "uuid": "53615d7e-1e82-4707-b0ba-e88bc7272b12", "value": 65600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656162006, "uuid": "3de6f4e4-8063-4d79-b920-5c7a51d3f730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656162006, "uuid": "0d08392d-d8cc-4666-86b0-b6cea8ce42e0", "value": "ZG9zarm7-20220625-1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e29ddd-f4e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656201004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201004, "uuid": "6d4fd2d2-3730-4a6d-b0ea-09759d7c57c1", "comment": "Malware payload (Mirai)", "value": "a9ca495fc4324f2b58cda07372a7d23d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201004, "uuid": "5a98ffed-5497-4731-843a-72ab767696f1", "comment": "Malware payload (Mirai)", "value": "b6bcceaa9f4bea275c503298e848ad7ca3044ca0f15fe279447a929c677d4d74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201004, "uuid": "2b4c03ef-5fc2-4694-9a56-470387aecc28", "comment": "Malware payload (Mirai)", "value": "27cacd44f594022e57dd4c8e2f3f2fd044a73983", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201004, "uuid": "6f72e14d-3f40-4b18-8e82-a64993ca47c3", "comment": "Malware payload (Mirai)", "value": "9b0e0fe786989e7f234c2ff4c9a344795b6017fc4fcf82cccb39a63972143047b2447d80c20406f5e222674870e41023", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201004, "uuid": "fb45f92c-b862-4175-b792-30e5dd4de114", "value": "T1C5C2E1E63EB7795BDE250039785CCE3692B4E122C3AFA2539340524860171BDBB729DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201004, "uuid": "de53fe04-e74c-466a-8c14-95b327de2515", "value": "384:MG1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QQjXCsONy03:HMwoDZLFbBy6HQHRYfeAxdd8JjXBv0N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656201004, "uuid": "83a54cb7-c83d-4e82-ba91-00c36e58f7e4", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656201004, "uuid": "62687a0d-f0fa-4915-a9e4-abd66c79dbd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201004, "uuid": "b55c3b89-d586-4d8c-a91a-1f6d48684f25", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd3a1d9-f462-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1656146627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146627, "uuid": "908980f4-de07-46f4-a9c8-fabaf08d680a", "comment": "Malware payload (QuasarRAT)", "value": "52cf2b523f2b0ede0c1940612b1c04a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146627, "uuid": "d2774d85-70b8-4a3a-93d1-45aa847d2d96", "comment": "Malware payload (QuasarRAT)", "value": "b988c0f23891eb55f3c66c0409aa327da666d9b084d309e1d8907976c36027ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146627, "uuid": "63fd3006-49ae-422a-a886-50890170c07d", "comment": "Malware payload (QuasarRAT)", "value": "7cd30f7f27f5e79d87470fe011f9b0f47ab053bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146627, "uuid": "63518498-6e4c-4b75-9667-4525a35d321e", "comment": "Malware payload (QuasarRAT)", "value": "8b3207d9a45f0e9ba5a1569f74aa6d698ef9f9e63d782ebd9ba6db212210882a9a1e8186dc38dcad1e8503a359d5e40b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146627, "uuid": "d4677443-ac62-4d3b-82cd-e06032bfbca4", "value": "T1C7A56A2D6A071B76FD0E9030DD120A08BB660B176383B9D59FDB92CA874FDEDED15884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146627, "uuid": "1fa48f3c-3723-4510-bf68-ab35eb9b2fb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146627, "uuid": "fbd54a07-7fa7-4ddc-8337-277266ab2d4d", "value": "24576:TNq0KUc11pOH80jLVtVxBKSXjgnyo3SSWhMTQqJJXanQg:YjLb6VLxrXjjhMUmaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146627, "uuid": "3fd60f8d-f783-4584-b677-8cc0367b07cc", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146627, "uuid": "8cfda69b-819a-4cf9-85f7-a017d3a2ddb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146627, "uuid": "24077302-8325-40d0-a724-9bb1bd9316ea", "value": "MV_TBN_SHIP PARTICULARS.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3e7b16-f43f-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1656131535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656131535, "uuid": "09eda7a9-0d37-4670-bc46-1d3c22b1dfe7", "comment": "Malware payload (DCRat)", "value": "a56c3a24f03f9253c210c5088e04225f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656131535, "uuid": "89df95f5-7297-4375-87f2-d901b199e705", "comment": "Malware payload (DCRat)", "value": "b9f670192c44eca53861884e7a6ce9d0e06d4e1dc5543d1d441c69ea542a5d9a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656131535, "uuid": "3d654142-9d3f-4719-8bc7-cdbe29eacecb", "comment": "Malware payload (DCRat)", "value": "57cefa4c96d004ef943dec64f0af8e1c3ecb13ad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656131535, "uuid": "8e227167-378a-42c7-8e82-eb14ff220f1f", "comment": "Malware payload (DCRat)", "value": "a0bc79f74b0a792a56fe3ce5683be1bd3873c6e7f45f7c4675ba216ba884c5fc813fe9df1f64a2c76a67b107591b9b0c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656131535, "uuid": "985e0dda-e36e-4406-a981-0770ef591f94", "value": "T15AC5DE027E44CA02F8191777C2EF464887B0989167E6E72B7DBA736D54123A73C8D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656131535, "uuid": "f6d0fd95-eaa6-4018-920c-5c6a7af53f20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656131535, "uuid": "65abe780-fb88-40df-a979-27b540fcda1d", "value": "49152:WhUPGfrE/FKdHkUhGrjJE4oFuItagLRez/6ioYrKJDQmhmwDnADSPZ+NKM:Wh9QgKJEnuIogLYuY+zUwLXcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656131535, "uuid": "075e5306-92a0-4347-827f-440d3f844e92", "value": 2627072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656131535, "uuid": "b6637aac-bcd6-42d2-82e0-772e18d0777b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656131535, "uuid": "daa246ba-185f-4955-8bcf-5b341a369a6f", "value": "a56c3a24f03f9253c210c5088e04225f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae5cff1-f448-11ec-93bb-42010a9c0043", "comment": "Malware payload (Matanbuchus)", "timestamp": 1656135428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656135428, "uuid": "ee48ae37-80ea-4605-aa92-86281ea93906", "comment": "Malware payload (Matanbuchus)", "value": "8fc15b030254c0d49f18d06c696d6986", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656135428, "uuid": "fe376b13-7ccd-4943-939b-c7ebf0de6418", "comment": "Malware payload (Matanbuchus)", "value": "bd68ecd681b844232f050c21c1ea914590351ef64e889d8ef37ea63bd9e2a2ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656135428, "uuid": "5eb45cfe-7e78-49c4-9775-9dc445fcbfe2", "comment": "Malware payload (Matanbuchus)", "value": "75f62f4d419b921bc081b5e8387665ac3cffd0d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656135428, "uuid": "a9a2d3a9-54c4-4fbb-88d1-bca660830ee7", "comment": "Malware payload (Matanbuchus)", "value": "c554a8cba5b9f0da570a7567c52dab164050a27c1ca21c6c9aa095202e6c477bbe60e58fdd55f77952cb43c126d97a9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656135428, "uuid": "25bb68cb-f3b7-4686-901e-3ce405e2bdf8", "value": "T12CD42924DB01A117F8FF00B9856C6A69A02C7730675818DBB3C46E7E9A79AD0E730F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656135428, "uuid": "1d4f2511-1e40-4709-97b9-09e24144304b", "value": "9494b7e6170333e0a69b378fe5eb3255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656135428, "uuid": "2dc2b8d2-6e15-4129-bd02-13e718ab0405", "value": "12288:FQn+nnbc3Mn3/RuiOshUoFHKqBzpmng/qNluyPjnpTQ1IJ7B3RSzLLoZRj7Gd:Cn+nbc3MK+HxB1mnTNluy9V7B0H8ZRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656135428, "uuid": "e54d148b-b583-4fde-bb8f-d0ec1ab0e4a7", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656135428, "uuid": "2890ba17-f462-4174-adcd-fbba9390b86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656135428, "uuid": "ef3279ad-cbcf-460c-b52b-437a162e2f61", "value": "bd68ecd681b844232f050c21c1ea914590351ef64e889d8ef37ea63bd9e2a2ec.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e87ae19-f427-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1656121073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121073, "uuid": "29384c76-b482-4b8a-b28c-da9fc6bdf05a", "comment": "Malware payload (CoinMiner)", "value": "67bd7555d34340be8ba5ce07489332ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121073, "uuid": "d5b7c9fe-1d3e-42fe-bd47-e4e4c6bc59cd", "comment": "Malware payload (CoinMiner)", "value": "be9497ee6942602149bce132239b797ac9c9735fa9ef2d980bea6ea6376a8801", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121073, "uuid": "5410b6f3-81d1-4097-b249-66a3087d6493", "comment": "Malware payload (CoinMiner)", "value": "b71d124ecb373833fded2b392aee2fb9d853019c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121073, "uuid": "1526aeb8-625d-49b9-80a1-c6543129c0ce", "comment": "Malware payload (CoinMiner)", "value": "235120e4b833dfe278808bb8cf642a02dcc31b9370851afbde92e1c3a58a97502f7785af5e175e4a573edd82e41b99ce", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121073, "uuid": "7f6edad5-d263-45e0-92d4-53ca5558dbca", "value": "T1A3B2F6657258DA94C6A84FBEC8DBE6900FF0E9519B12CB5B75E1670F2F22391FE20301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121073, "uuid": "18f38829-dd38-4d5c-8718-fd7e93443e21", "value": "384:tYNS1sxQDV+onEMhhDVBoO+jPR9bDarTd9Qb6s9hc5SG2vH7:tBYMEWnA9bDarTd6zI0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656121073, "uuid": "f4bb83f4-8717-4757-a368-0f5839607dfe", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656121073, "uuid": "13e0ee3d-9b91-4a11-904c-22d9f4a3a2e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121073, "uuid": "2c6426ca-6d1b-4684-ae2e-1a023ae949e3", "value": "67bd7555d34340be8ba5ce07489332ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cef5fb-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "425aa0c6-ecbe-448d-9935-723832c25bd7", "comment": "Malware payload (Mirai)", "value": "d041b203d297a24a9f847dee755db4d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "72b855ee-38fb-4a33-825a-9e3baa229f62", "comment": "Malware payload (Mirai)", "value": "bef6f54c4cfc3219002dfb6e68ef9ec7a17ebde297b367a4416e9a8b5b3e3e95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "3b004a2e-22bf-45df-8156-1411bcfef58b", "comment": "Malware payload (Mirai)", "value": "a56343158aeadebd25f19ca67171145e502087cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147605, "uuid": "bac471e4-494e-4390-b59e-5b8d2d0b7bc9", "comment": "Malware payload (Mirai)", "value": "a6a89a678e7699ffc5484596510345fd0d6fc84046d3d1a95921fc3b1baaff7fda57b8387faac80e4555f15c7be2d914", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "b49039fc-d1fc-4c45-b7e1-3add48ac1bd6", "value": "T1D3230220D15351D5FEB299B3C627460C0F0F4636C0ED62777A7AA5C8141AA91FEBCF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "4993f08e-11d3-42ba-be15-a62d0222fb6d", "value": "768:Ye67A6wQYhhW28RJ4PNxzCprvDd0y3GMHhsBlIH9q3UELTlt7bOGl6gmgbTR/oMt:Ye67fwZS266PDqpHhssWLLGC6gBZgzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147605, "uuid": "f8702444-0025-42e9-8760-fd0af38ba3da", "value": 48196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147605, "uuid": "c11661b3-51ed-4f5b-bd80-344a9ae68c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147605, "uuid": "820ee287-be88-494e-afba-3240969485a6", "value": "fuji.arm7-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116f2703-f49e-11ec-93bb-42010a9c0043", "comment": "Malware payload (DanaBot)", "timestamp": 1656172027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172027, "uuid": "70dfea3c-1a0e-4f23-aa5b-643461055683", "comment": "Malware payload (DanaBot)", "value": "2820526d4b78eb0f74e15f2755bf11a2", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172027, "uuid": "32dbb5a5-0e51-45e2-b832-8ecaada5043e", "comment": "Malware payload (DanaBot)", "value": "c4ba15d516f167a6dbcba5de62b0adb3e6f928a9cf746e7eb1ed5eb8bc852db2", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172027, "uuid": "4b5a4346-88e7-4018-9df0-48f8fddbe580", "comment": "Malware payload (DanaBot)", "value": "282330102009652ba0a20de22617bf0cba352766", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656172027, "uuid": "fea129df-ce5b-43f3-a3c0-75598b37289a", "comment": "Malware payload (DanaBot)", "value": "f7c06daf106a5be97c315e4b95d3e23e814c5cb47ac3bfb197ecc9420027f250491c0e9d376938cca596204895ae3ede", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172027, "uuid": "46922c6c-1750-4d24-9e01-d23efb46f575", "value": "T15B26227AC50D2FE0EE816B3C11F9A7E188393D320B4575224C3BDEB946769F1D692A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172027, "uuid": "033599de-50f8-4aa3-81af-3da98c26c3b4", "value": "c260f0123f3025abdc3a451719c0d74c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172027, "uuid": "d4726378-9cc5-4a69-9f45-8ae7aab143ee", "value": "98304:tMMQ+24igY8pmDHD07px3wc9L7HSrlGvyktPFhH/O7gH2+XlvIwwr12ekLKl4LbZ:MwNw4SrlQz/SLZkLHhh2pEgcz6Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656172027, "uuid": "a55c340a-32c3-420d-9372-7dde98e5db20", "value": 4632576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656172027, "uuid": "ae60a8c5-0f6e-436c-86c7-b2700a9aa624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656172027, "uuid": "a9d0c70d-b3a0-4eb0-bc7c-02efa7278043", "value": "C4BA15D516F167A6DBCBA5DE62B0ADB3E6F928A9CF746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec65bd3-f429-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656121772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121772, "uuid": "9905c102-e154-46ce-9d70-f4975dcec047", "comment": "Malware payload", "value": "73b14a9c5cc2d44a693e99a8ae6cf651", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121772, "uuid": "4bc954c5-b786-4228-9ff7-0bcea9452b42", "comment": "Malware payload", "value": "c659b4c80040d075c06c8ed8aa1da1a3025114005eb1a84fad6d7e064d6b50b1", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121772, "uuid": "84b62cea-35ab-4412-a9dd-b8a8667bc505", "comment": "Malware payload", "value": "3ab0cdb84b830caa872fc7436d557cd1ede39b72", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656121772, "uuid": "2d034613-65cd-4f4a-b973-20b5e30d7c8a", "comment": "Malware payload", "value": "eabc4f48b7fdab019605742ee320b50222b435ea46a69a565fca8a5c2aad9b9d53bbf31675e287dd7f97803cf73eab22", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121772, "uuid": "d21e5770-d865-4d0f-9221-a1854558f679", "value": "T13FD53354F46C7E4121C3A687FA42C5E84ADC8EF2CEE5CEA6A605F3D2190529FC05B2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121772, "uuid": "f2fd8ac9-69f1-46d4-a6fb-e24572d85e37", "value": "49152:9/YIrYTcTGSAxVFG1V5C35YOI/II251prxUzVUmiBSGB6eSRs9jAk6e0xBUFCmPw:9/z1GDsJCO8h51DUhHPGBZSpxHbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656121772, "uuid": "c1309a2a-216c-4860-a608-b78b936b8b34", "value": 2820279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656121772, "uuid": "d273aa1e-8a21-4aa7-aced-b0b401a7a12d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656121772, "uuid": "6219a8a7-cad3-472e-be57-f23be7568ad6", "value": "test_Vbzclvjs.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b3baa1-f489-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1656163263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656163263, "uuid": "0f9e9134-c4ac-4ba1-b3f1-0dcf7557b546", "comment": "Malware payload (Formbook)", "value": "9c2d7d1d32d96adb3a53a4d060fb0ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656163263, "uuid": "472a1ef4-e81b-496d-810b-4243c21777bb", "comment": "Malware payload (Formbook)", "value": "cc48a92eedc0b016d5faad9bef8ea4d9831328650cc6f51064c569955b5c2382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656163263, "uuid": "601a815f-7863-417e-a659-40839ca7f180", "comment": "Malware payload (Formbook)", "value": "e643b711718223ae35aea1c91bedcb3464cad482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656163263, "uuid": "6832dd7c-9fe1-4e9a-bd96-dbc8ae72e72e", "comment": "Malware payload (Formbook)", "value": "719800b7805cba909ee65fe63a3f4114a6922192c8481c02291b64483712e339453b5fcd15bf98b7f1a3228afff7aace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s0s2", "colour": "#AC7337", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656163263, "uuid": "9bcc11b8-e46b-4c3c-9bd4-d29a3e640f0b", "value": "T154854E073280652EE80C5AF5B8F78E2466D8D5E91763EFC3154CE3762B467A8BD42273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656163263, "uuid": "8887be4b-872b-4e2d-8265-a4bd3fd4d2b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656163263, "uuid": "bf00d9df-a3f3-46be-89b6-673ea273212c", "value": "24576:CtK6zYbHCHVHCKGGbnZckBQ9vVcW+WRptQg9ieVxLvOAo:CxzYVGDOv5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656163263, "uuid": "c0438ced-ed73-4004-9bbf-8eed27ba8004", "value": 1873408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656163263, "uuid": "8eda9cb9-d1a2-4492-b81d-44f592985d8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656163263, "uuid": "b2c693f2-d876-45a6-9e8e-0420fb946e51", "value": "Remittance_90523_03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e78a34b-f497-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656169204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169204, "uuid": "66b0e36c-545f-4eac-b4ac-1c926056917e", "comment": "Malware payload (Mirai)", "value": "3fbb6081716b1b1cbb4a44a61ec76464", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169204, "uuid": "b8a01e61-e802-440d-a2d3-5a59d3b78e69", "comment": "Malware payload (Mirai)", "value": "cf50872d403912122f953ef8c87ae36a656769b8ee04b94439a750592ed9ff1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169204, "uuid": "f7cf294e-f99b-4dde-a745-26f714f34e26", "comment": "Malware payload (Mirai)", "value": "ca3657e3d5963747872751482163cbd0a729bfbc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656169204, "uuid": "254f5dee-8154-44cd-83a2-9d48300dd711", "comment": "Malware payload (Mirai)", "value": "c1460eeafd78bd62f128cddd1e27339dd4074f95199bc98272c27bf0f7a6d45e9fc651aee30324ffbe742dd4ba0c4338", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169204, "uuid": "06efe8e2-852c-4603-bd4e-8ff293dbc0d3", "value": "T12AA2E042A355925FC2FE72FB83724C0E4404DAA183DEA8187FF2DD3A7666B358253C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169204, "uuid": "d7a24d3e-75c1-4032-a4bd-fa246c3064d1", "value": "384:MCWVTUuW0MoVpe2ZC6n+wC23YRQLCey5R6be3CYl40iSpyFoYNNgJ4N+v1Rs:eFwBoVpeS+wC2mB5Eb0Z4gpyPsFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656169204, "uuid": "39a6d217-3693-4f57-be19-b9025966d92f", "value": 23228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656169204, "uuid": "2503630c-5d00-4165-a775-22eec6494fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656169204, "uuid": "e5fd7722-ec3b-4d40-ad49-ffd7b4029557", "value": "b3astmode.x86-20220625-1500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e71dd7-f436-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656127338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127338, "uuid": "b70d24bb-a82e-481a-afdb-4992ccb7bbca", "comment": "Malware payload (Heodo)", "value": "0d60abf58b5c5dd18abdcc1cab43c6b1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127338, "uuid": "d7c070a0-4923-4ce8-b221-1107cebea902", "comment": "Malware payload (Heodo)", "value": "d1619b27247acf99f8e6c80b9b50716746d2a7dd79738ed257dc681a0c4d18a6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127338, "uuid": "363d9099-aa5f-4733-9e9a-3e01e936ec0e", "comment": "Malware payload (Heodo)", "value": "065a9192e0a524908aa3f519aa0ce932e1402b9d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127338, "uuid": "4e5b982a-48f7-4f01-9ace-fb3a27b27a7c", "comment": "Malware payload (Heodo)", "value": "db9b610b0f75d45d66e0813f62eaa6d39c5a07276885bb08d5c3943e394f01e7eb7e2b4d36c200d3ce1eb06a2418d6ad", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127338, "uuid": "c7a08354-a9b6-4ee8-98f3-8212e9334b80", "value": "T1CBE49D05B7A406B9F0778238C9934653E7B1B4865A30D78F13E5427E6F27BA16A3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127338, "uuid": "cb24944a-10c7-48b0-8670-bedad565579d", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127338, "uuid": "1efb9f00-77bb-444d-8519-3e2d445d7a31", "value": "12288:6Y7wgZv6SO4xxd49GK4qnzK4Mekn+U+HOmqomcpBSFYq9VxRTloUzpmGZ6sSAj8C:r7wgZvqqom0SfTC2YGZyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656127338, "uuid": "805df536-dbe4-4376-89e1-1e5fcd46c057", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656127338, "uuid": "ee86f4bf-68c2-4ff6-a171-09e7aef53031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127338, "uuid": "62e36027-008a-477c-97c7-3fb077734ea3", "value": "0d60abf58b5c5dd18abdcc1cab43c6b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54bee25-f421-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656118722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656118722, "uuid": "ded9e609-f050-40da-8acc-807d77bd5c42", "comment": "Malware payload (Heodo)", "value": "4edc14bd35bc896801ba011955577cac", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656118722, "uuid": "47f48f66-b504-47e9-8208-d2662df63d05", "comment": "Malware payload (Heodo)", "value": "d267bdfb30bcd1570df84331859c0a16c7fb67b00530b8ab8510921c39cdb2d4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656118722, "uuid": "3d77a0b0-1225-4c0e-8d35-f70af58f1670", "comment": "Malware payload (Heodo)", "value": "c0db470906454de46744484b3c866cdffa74a117", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656118722, "uuid": "27ec7aec-ac57-482f-932b-2f8f20429ef3", "comment": "Malware payload (Heodo)", "value": "8a1f1a73badc429be7067f49e41d01d2cd6aa8fd99ada15dd62b8844e5935fee580346650c9603a6f93ce629d9fc4f57", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656118722, "uuid": "9bf4a979-8b3a-4426-b2b8-a76f64895a19", "value": "T101E49D05B7A406B9F0778238C9934653E7B1B4865A30D78F13E5427E6F27BA16A3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656118722, "uuid": "37942353-0f8e-4b75-a5aa-c56a70d2b876", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656118722, "uuid": "84c8ad8f-61ff-4b14-b345-ba8ef5860a7d", "value": "12288:6Y7wgZv6SO4xxd49GK4qnzK4Mekn+U+HOmqomcpBSFYq9VxRTloUzpoGZ6sSAj8C:r7wgZvqqom0SfTC2yGZyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656118722, "uuid": "47e85656-a412-494f-a01e-b0d98613e351", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656118722, "uuid": "02b40f3e-e005-473b-b5f3-6e513c3973d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656118722, "uuid": "fe91323c-ca60-45f3-945f-5f0912997eff", "value": "4edc14bd35bc896801ba011955577cac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34094aeb-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "56cc52b7-6c72-4aed-b0cf-40c18ccabfd5", "comment": "Malware payload (Mirai)", "value": "0debc61e6259d53d1b48f62572634f5c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "86b69e4d-db40-422b-990c-aac3cdacfba0", "comment": "Malware payload (Mirai)", "value": "d2716fe04d07d3f3eda0b1069380ea59425a93774c49d751b8e4f1890924e7e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "b3919ec6-7244-4484-a294-b1e3657e181a", "comment": "Malware payload (Mirai)", "value": "6389b1dc2b02b30c80f8fe56821acfd284d52d3a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "3bae97f6-d106-4b24-88a9-b6984d4eac7e", "comment": "Malware payload (Mirai)", "value": "0200e56bb1d4af3555b9fa6b4ddf754617226923a8e73d4368af10b48886023f31421e7f269db58b5deb8bc71c5d48fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "41f9f1fc-af69-4e7f-9d56-ee0f4e7a4b3d", "value": "T108A2D190A0C9DF0FE8456339D77EE98E9484B464ABEDC7E253580E8913972F2AB78104", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "fc50ba8d-8146-42bf-8ad7-059a88276227", "value": "384:M/tOvArjB/JDKWb5BDf3gxXuu8fAp8N/D2uyU2uvsIiSq9v1RrP:mAArj3DR/f3eBluN/DvVHsnrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147604, "uuid": "15052a4d-83d2-4297-a2a8-41f1263d85cc", "value": 23116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147604, "uuid": "29c13bb9-5acd-4a54-9e27-48039c46dd48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "928a597e-685a-4dac-af48-59b8b572a8b3", "value": "fuji.x86-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97aab933-f44f-11ec-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1656138322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138322, "uuid": "83be7016-d8ae-45ee-8531-7e387bb97262", "comment": "Malware payload (RecordBreaker)", "value": "398ed7c0939e72a1df48196488ec00c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138322, "uuid": "a20c17b0-52b3-46df-8411-9b81669b27d2", "comment": "Malware payload (RecordBreaker)", "value": "d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138322, "uuid": "0531f94b-59ef-4f86-bfb6-a9f90bec68c0", "comment": "Malware payload (RecordBreaker)", "value": "4f6f076492ead1416d1d64158117c8b50cac4e88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138322, "uuid": "3b55705f-b340-4281-bcfd-9d81abf2a2bc", "comment": "Malware payload (RecordBreaker)", "value": "324fe8f5a21a3f0c83665d9f4427859b82b12b2e6e596dcb0956e310d47b1eec0e38834726ffdebcdd20c113d1dda554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138322, "uuid": "6a4178f7-92e7-4210-8551-5002ff6ca0e6", "value": "T1EEB4F1927615F632DEDE80FE28111D97F270DFA1182FB2A4F158524F6CA720ECA059ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138322, "uuid": "56b1522b-b11c-474d-b86c-a17eda3124e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138322, "uuid": "33392bc5-328d-4e75-a96a-42b5f4631d54", "value": "12288:MMohtRThpyREm35/g0NxxWDlQPwiivXt5mtAir+rkijY7:MMIhp2HgQWDdfmt5ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138322, "uuid": "42ae4358-d9be-46af-bd17-5f7eafc2073c", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138322, "uuid": "a880b943-d20e-4a71-aff9-61527f20bd5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138322, "uuid": "7fc4c0b6-bcb1-4fa6-b0b4-9ed55842f46d", "value": "398ed7c0939e72a1df48196488ec00c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340a7d15-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "d5cc0ed4-d004-4427-8c8a-9ef3cceb2ba7", "comment": "Malware payload (Mirai)", "value": "224231472ab65e96fca856c68f3727bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "523ec40e-457b-463c-a0c5-239d002e062e", "comment": "Malware payload (Mirai)", "value": "d4949b102bb5f1c425ff8d424856f85618bfd4556db0a5926d7383e6b7196397", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "6c3e482b-8b30-45b7-8a2f-a16f88dfc159", "comment": "Malware payload (Mirai)", "value": "d097a444dd0a471288fc149ab3380bf79eab0a24", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147604, "uuid": "8c3d72d6-ed06-4fc7-9ef5-b1283b7704c9", "comment": "Malware payload (Mirai)", "value": "e0e7b2a3ce1300409ebc1af2c9939630ac195a464cad8aa5d9ed31227a9ff706c063216ffde923c225df85f904a4af70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "bac68544-5860-4540-907c-770a0ac7bf80", "value": "T18392E130B3F6A1EECC1B9973657276F733E3D9729B0056AB9814C637A24610D1A24E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "51e1ca79-0a46-4802-a869-0fc74ce99d87", "value": "384:M2QFxRvkf0D0HZCtKWlsv7YUhu2HlvjDBLr0PDG9EuSyQ:tQ3RvksD0hWSv7YUhuclrFr0PaHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147604, "uuid": "5feface1-ee14-4396-b050-e631bdc3106c", "value": 20308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147604, "uuid": "9b5040ab-557d-483d-a92d-b5407e2b3923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147604, "uuid": "f633a140-5fde-43ba-b1f2-7bb99b6c4fc9", "value": "irc.x86-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06812c35-f458-11ec-93bb-42010a9c0043", "comment": "Malware payload (Lucifer)", "timestamp": 1656141944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141944, "uuid": "3ba79a35-c8cc-4a24-9756-4a2826f73bf2", "comment": "Malware payload (Lucifer)", "value": "421b15e5a8cc0546895d44436668e817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141944, "uuid": "b456f4d1-dafa-42dd-a063-762151af0920", "comment": "Malware payload (Lucifer)", "value": "d91bf42c9a19921e75c845ee57eb7a4b5e73c7872b50cd78b8ab4c6b01f26ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141944, "uuid": "e8cddd54-a5b7-4e40-915c-36ed7b93db73", "comment": "Malware payload (Lucifer)", "value": "98c75a7dd5c05a2d0b32a687e780b8f502573755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656141944, "uuid": "6e68c673-5ef7-46a4-9969-d98dfa44552e", "comment": "Malware payload (Lucifer)", "value": "8a200334f8c2f729c57d43e4241a07f4095019c50320780ea2f8fa5b5734fb62bad12663527cccf930166dfcb18a1783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141944, "uuid": "e829481f-dfc7-444c-91a7-0e8b4f13e1e5", "value": "T15BC46A0223FC4BA5E5FE2B31A631424543F6FD46657AE70D1D80E6EA4C777829E203A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141944, "uuid": "850c6e02-69f8-4b0c-9b16-9337c82688bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141944, "uuid": "0e3101e2-9c22-48c6-a3d1-076d7d41c48f", "value": "6144:X+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUE:OPw2PjCLe3a6Q70zbYow60E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656141944, "uuid": "f5c3b799-ea8a-4895-b4ab-8db32ea4aeb5", "value": 549410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656141944, "uuid": "2262649c-1b94-4d7c-93d9-eace91b925aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656141944, "uuid": "fbad3778-68fc-4037-ad1d-4313e2ef3eb3", "value": "421b15e5a8cc0546895d44436668e817.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f10f3f-f462-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656146459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146459, "uuid": "e211ccb4-d7d5-47dd-bc7c-b4cad3e27a2b", "comment": "Malware payload (AgentTesla)", "value": "a1eee08108873825963a158dcb94f392", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146459, "uuid": "ccde957d-9e03-419d-a854-83c48a221b70", "comment": "Malware payload (AgentTesla)", "value": "d98cec677e8258a3db09d95d06d5e0e6262680e9926494f34bf77d431a161454", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146459, "uuid": "8d0cd8f3-5f08-4613-a816-520b4e57215b", "comment": "Malware payload (AgentTesla)", "value": "17d1485ccd3fdf2e332c142020e4d4b65819df43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146459, "uuid": "d7a0ff22-b540-44f6-88bf-06a8b9c52f34", "comment": "Malware payload (AgentTesla)", "value": "c75431bc372983ce6f54a2a87817450accd3018135293f77bc79895c8492117cb6184ba16f59b12ec495b4b9fbb3c3ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146459, "uuid": "7cee18d2-3547-46a5-a89f-ab619270b936", "value": "T1D6A58F2C3B061E72FD0E9930CD110BE4BB66AB533781A9C2A7DF17CB8B5F1652D15988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146459, "uuid": "21b6368a-427d-407c-890f-a618d40da288", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146459, "uuid": "b9834783-fcb1-4ae0-b7d1-e07d9497fa3a", "value": "12288:zcj0h+SuDnZ4eed1mWBjHOJ1OkOe0j/EF/7hjEh8W0gHGY6F1/:unjev9SJ1OeQ/kYh8AHGY6F1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146459, "uuid": "4a40ccf0-0892-4f72-bdb6-2abd5cd08329", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146459, "uuid": "321d1dda-c274-49fd-ad2c-ea8b6ec1dfae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146459, "uuid": "66da3df0-1e38-44a8-a04b-6768cb15e51e", "value": "MV DA HUA V225 - VSL_PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee871e4-f434-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1656126899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656126899, "uuid": "af4318aa-ba6a-4c7c-91aa-3efec090d9f1", "comment": "Malware payload (CoinMiner.XMRig)", "value": "9e5ee657ffd064c82896f37879610e19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656126899, "uuid": "b23e84d8-d0cf-4f51-a5ee-8b5b29beb8fc", "comment": "Malware payload (CoinMiner.XMRig)", "value": "da5601fb44e12ea6e67933ca6b6ac28a8e5f7c02a2898c6677d227ad5fb5a502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656126899, "uuid": "32cb5ddf-4403-4c02-bfa5-8eec2b793a82", "comment": "Malware payload (CoinMiner.XMRig)", "value": "f583427ee08defa2e1426fcd803a3f4087584a28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656126899, "uuid": "20203087-bb89-4ab2-a922-870636e9701f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ccc278576e807d8e750a00a727d42bc848664cb7c1140ddb90d0570d02b22dbf301ae9d44d152a39b6724fcd95ae5f40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656126899, "uuid": "43c1e558-9d4b-454f-9f38-0eda7c89008f", "value": "T1F8442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656126899, "uuid": "cc7db1b7-5fa1-4a83-b978-18c740c15eea", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656126899, "uuid": "1b62b7da-da9e-4c89-89a6-f8e43d35cac6", "value": "6144:aBABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:amB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656126899, "uuid": "1a53bce5-17f7-4b92-ac57-64b42556b6b7", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656126899, "uuid": "76564b52-6498-41df-8c6e-2767dbc6866c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656126899, "uuid": "3f98d858-e8b2-4d5c-ba98-f294fddbe52d", "value": "9e5ee657ffd064c82896f37879610e19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9536223-f478-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656156068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156068, "uuid": "18b11f6e-770c-497d-a817-a9c787e0341b", "comment": "Malware payload (Mirai)", "value": "62cfebb75ce951bbbe792d15a62def22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156068, "uuid": "e0437d64-a078-4d83-98a8-6cbcc1afbe61", "comment": "Malware payload (Mirai)", "value": "daf73bd575396983cc0ce49a2d280442131ab3623f32cbcea707413e3e269428", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156068, "uuid": "f79d3611-37db-45b5-828b-0ffc23b6e286", "comment": "Malware payload (Mirai)", "value": "46850e4979e6a9143e2e770820893b24e6173d98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656156068, "uuid": "a81d99fd-7a6f-40f7-80c4-3e59c6a21e76", "comment": "Malware payload (Mirai)", "value": "d17fee83e3ca2754af85aad7f865be71d224bee74df4db375d6a518c7256042b0d0e3977cc0533a186bb314a2b1034b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156068, "uuid": "15935172-bf97-4fda-a030-19178971e994", "value": "T19A03E13D211D3049CB8EDABC2AA583D12A395A729147BE046AE4D743FC875E8F582CF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156068, "uuid": "dd2a44ad-ee9d-4180-8a0b-7db037c507b1", "value": "768:N4VwEB0yUIOmAZaKKfzfVG74fLQmuiCZiv4sx4Up/c7aNA86JgGlzDpbuR1JZF:NSRyZILfVGAQF5ZrCxkGmjVJuDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656156068, "uuid": "cadfa528-eb1c-4c53-a0ee-ea51e0a96e39", "value": 38532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656156068, "uuid": "7970eca9-6afb-4f88-9fb7-8beb6b1a298d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656156068, "uuid": "256d1884-b168-4fe0-be94-5a8bda772210", "value": "62cfebb75ce951bbbe792d15a62def22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb5ae88-f468-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1656149202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656149202, "uuid": "9b83b23d-75dd-46bc-a24a-9635de520d53", "comment": "Malware payload (AsyncRAT)", "value": "24b5149000c6618dff64500e51ef8214", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656149202, "uuid": "df2d1f2a-66c7-434a-8f42-baf4f78c6761", "comment": "Malware payload (AsyncRAT)", "value": "dbba46df2d1653b3df8765b6574d270664357af209b7931374fc5c098871828e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656149202, "uuid": "e5ec1353-5f71-43a0-bad9-ff5bd3d374bd", "comment": "Malware payload (AsyncRAT)", "value": "927f18e3da8bc2f12c1eabb4fca48b045b81db39", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656149202, "uuid": "3dfd893e-2a5c-4817-b2b8-c14c3051e9e7", "comment": "Malware payload (AsyncRAT)", "value": "85f20a8ee20400e94b69268ef74107144a7941cd0154098b511e10a3a1583ce7b9692aa95999a48d31e3b86f4ed3d1aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656149202, "uuid": "90a81739-fc56-47ea-824c-015ca35f996c", "value": "T19CB3DA31E144B7C8EAA45D73C8C089400574B763D92B9613FE954FFB3AA187EAB43936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656149202, "uuid": "29730574-4eb9-4429-b8c5-b885f6eb985a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656149202, "uuid": "d8432986-3c7d-416a-89bd-34a88a59efc6", "value": "3072:+ms7lUHHHHHHHHHIHHHHHHczJXNATd9Pou:+8HHHHHHHHHIHHHHHHczJXNATd9Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656149202, "uuid": "d11405af-d556-4abf-b0f2-ce45f58295cf", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656149202, "uuid": "58cc311f-4b99-4a72-9f97-8bece289f474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656149202, "uuid": "849bd7f9-0978-4e59-8305-cdb85f05b10e", "value": "QuotationCatalogProduct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706be8f8-f42e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656124083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124083, "uuid": "d408e427-c6ee-4a6a-865b-f861abfce0ac", "comment": "Malware payload (Mirai)", "value": "30ce66fa45abddf278dbb3eccf87ddad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124083, "uuid": "14b672f4-08c8-4b64-bbde-bbec5fe4425b", "comment": "Malware payload (Mirai)", "value": "dcdeedee4736ec528d1a30a585ec4a1a4f3462d6d25b71f6c1a4fef7f641e7ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124083, "uuid": "76b0221c-0a65-4b75-83a5-1c40b3bd1dc2", "comment": "Malware payload (Mirai)", "value": "4b6524d0a3f1ffeac80c1251ad63601274896eb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124083, "uuid": "58fb917f-dde6-4f94-9abe-9ba5d91533e7", "comment": "Malware payload (Mirai)", "value": "bb7b28898981dc7331612fff745c63a61c23be5d7fc6d659e7eed635491debdd9ca49ccf07b5d351adeb191df5b32dd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124083, "uuid": "615488eb-4275-402e-ac8b-306ad6766126", "value": "T1E6830A05F7D384B1C8074C7182BABB2A5EB5E93A8534DB6DDB90BF81AD15BC1E04932D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124083, "uuid": "c0200359-23d4-44ce-aa41-5a0a8cd7847a", "value": "1536:RkMxO7W0R4UnmS/jY6QbQzFLEI8EJLBOZEiQvT8r1tBocgyhBUd31s0IVPBLro:Rzx2R4UnDkvQzFgI8EJLBViQvgtBocgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656124083, "uuid": "17db9a53-63cc-417d-8b5a-d5a2ffdab37f", "value": 83428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656124083, "uuid": "69ad1292-fabd-4c14-ab8f-53c3ea86209e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124083, "uuid": "164b8ed4-c736-48a0-b5d1-f5e16c030fd2", "value": "30ce66fa45abddf278dbb3eccf87ddad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f5eb73-f47c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656157804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157804, "uuid": "a94c4715-48b2-4f94-9f95-81c113d965fa", "comment": "Malware payload (Mirai)", "value": "3b4473346b28778307b22e5d995ebaa7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157804, "uuid": "eaf163ed-8412-442b-8d2a-44c17a5564e6", "comment": "Malware payload (Mirai)", "value": "dd1737c08c314ec06f45e89a4a0cb42a131f020b76b59cd5b4c9854e5ed9843a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157804, "uuid": "aef07185-ab1d-40ed-935a-29bf16d97fb8", "comment": "Malware payload (Mirai)", "value": "762c9273f9145049488bb94e003cf45d7c19bc05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157804, "uuid": "3835aef5-45f1-4f29-8583-5e7571be7ced", "comment": "Malware payload (Mirai)", "value": "3ffe94134d7d7f19d6dca893bf48fd11fd324454b4e676b50c159c0def6a72676fbf719e5e0f66c6be7ad1265c4bb459", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157804, "uuid": "2a7d4e21-3ed4-4ab3-af7a-4377f7e4a96d", "value": "T1CBC2E0E63E773DABDA25103D3899CE3792B5E052D7AEA71392404249200B1BCF7365DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157804, "uuid": "560ccaf0-9aae-4ea0-8d55-0f96ba050f1b", "value": "384:Mn1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8Q79vmDO3N3:CMwKDZOFbBy6sSHRYfeAxdd8kZSOE0NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656157804, "uuid": "bebf533d-2013-4868-b152-559d79c1843b", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656157804, "uuid": "1ffe49ea-cfa3-4fd2-aef1-20d071a51e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157804, "uuid": "3f67ebfc-a64c-4bb9-af4f-6a853a977072", "value": "sora.x86-20220625-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bcd077-f497-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656168994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168994, "uuid": "7c6f8af5-2165-4f25-bbd0-759268ec2566", "comment": "Malware payload", "value": "95bfd387a4105a2e940f3c50c5aa1069", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168994, "uuid": "92b6e36f-9163-475c-9341-e1795db7f54c", "comment": "Malware payload", "value": "df81fe69de455d1aeceb00e4cd4702d94edf9ab917dede008b65d0f045d75baf", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168994, "uuid": "6ea5685f-fc58-42ac-9746-99536445fa48", "comment": "Malware payload", "value": "a3e793adc1deb51a86de3fa75fd9a7dd77477bce", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168994, "uuid": "09bd9693-0847-4cce-bec2-8090f7378045", "comment": "Malware payload", "value": "2ce913393fd22e7548c40d6854eff6e11b784d0ae8d9542ed96c4500e558b7f5c1dbb93c7e4dee2fc927537b58fd8348", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168994, "uuid": "634357e1-0255-4016-af76-b79e7b775766", "value": "T168646B11B9C08032D672383207B4D6B14DBDB8302D615B9FA7D81DBA9F74B90E625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168994, "uuid": "84dd4eb6-d0e7-4891-a2a9-8f51008e63b1", "value": "88d6696b72c6ea2fb3be7f1709c3ee0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168994, "uuid": "b412dbeb-5d80-4005-bb8e-c035e7f10bb0", "value": "6144:KCwSQz9fO5adXEior1thAA5/IAulozP+aEN25Frpuf1H8:9wSQz9fO5adXEim1DAA5/IAuK1puf1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168994, "uuid": "581ecfc8-d735-4453-be05-98d14ba5f93c", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168994, "uuid": "fca95148-8623-4b90-a81d-b2550bab64d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168994, "uuid": "9e6c3e7f-6ff3-4722-87b7-bfaf53cde3ae", "value": "MbrLock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08094026-f436-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656127344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127344, "uuid": "28a636ba-858c-4c1a-931f-f3df940ae84a", "comment": "Malware payload (Heodo)", "value": "d0a9ddd211e683ad7950f9f380e22984", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127344, "uuid": "eaee5f59-9285-4709-b003-82d7b304d7e9", "comment": "Malware payload (Heodo)", "value": "e3af46c1b829e4d51a9b8a0d68bf62f09627cb75c34ded3fb62cee31a86c4502", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127344, "uuid": "c2c1c968-b0d5-450f-844a-f6684ea68654", "comment": "Malware payload (Heodo)", "value": "06e963985d09b872798e786872b9bea6aa1d1d1b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656127344, "uuid": "835fc0e7-b34f-4051-9e55-cf305135f4cd", "comment": "Malware payload (Heodo)", "value": "e7eb352fb35ef5d0c76ddf7551ca0f23e72f0746391deeeab6d19979face2e09375e57b513155bd14c8b363e596b8e5d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127344, "uuid": "cc231cd1-86fe-46ba-88ef-e962190472d5", "value": "T1A1E4AE06B3A442B9F0779238C4974653E7B1B4865630E78F13E4437E6F27BA16A3E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127344, "uuid": "ce784f79-189d-4254-9dd8-8aa4cf8d5595", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127344, "uuid": "2eae74cd-6611-4ec5-986e-0cebbb407682", "value": "12288:i6ga9aSRQTSq4RxN46G6463za48ukW+0+HOZ26u3SaYuUVDJe07zEHCE8xCNI9pm:Zga9aSRQS2bSB33eXNOREYxyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656127344, "uuid": "86b7b7cb-8e2d-4d8f-86d4-5f911dfa076a", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656127344, "uuid": "52f72cfd-42a0-429c-9cc8-c8819021abad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656127344, "uuid": "a1531381-085f-403d-9581-85c29fe2af1a", "value": "d0a9ddd211e683ad7950f9f380e22984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968eebd5-f46d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656151205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151205, "uuid": "8302aa29-b1fd-48cb-be0a-86bd585880f9", "comment": "Malware payload (Mirai)", "value": "9d3655f1c68d8083673317be9dc2c4b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151205, "uuid": "efe3ca73-3938-476e-aa76-d354992eb67e", "comment": "Malware payload (Mirai)", "value": "e51fc2dd13de92c6242fd02476d810bda39be6a41c1fc2a3daad3f5b882785f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151205, "uuid": "1fb9fbec-f5ab-4e6c-aea6-315b40848906", "comment": "Malware payload (Mirai)", "value": "d26925c0aea66700bb647ac15083458ed54f4a19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656151205, "uuid": "ffdcc549-4764-43c8-b4ee-1269e6296417", "comment": "Malware payload (Mirai)", "value": "0babeec5068ba273eb3ca143c37e8d4982780ef3ee52836ba19b0c10f6139c01c37b2ed8dff3a2a77612d485162007d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151205, "uuid": "a20da66f-edb1-4389-84aa-d3d1a3f49a93", "value": "T1C1330241490A57B2C1AC4A7EE5C94ACB80038FFC84457E293A8D679C1A92F673FF3785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151205, "uuid": "eaab8413-e58a-4650-b670-9e2273c70e3d", "value": "1536:jsl9aVsQnaqNM6iJbsF5Nb1JpG3LWymUS7s5j:jsGR2tsFTTpSLWymU0Sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656151205, "uuid": "dc06cf48-c2d7-421c-a034-658af2a05d24", "value": 53284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656151205, "uuid": "30299675-9b45-4ca1-acb9-3f5d1c5679fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656151205, "uuid": "d38ac1db-2db2-4d74-a2f9-37dec63788c9", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531f57c4-f4a8-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656176432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176432, "uuid": "763b76f5-cc7a-44ec-880d-a9ff37b7fa3e", "comment": "Malware payload (Mirai)", "value": "58299c9b98c06bcd30e35c7dbca3615b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176432, "uuid": "5b90a848-a25d-42b4-82e8-f4d7ecf2d5e6", "comment": "Malware payload (Mirai)", "value": "e630019a9a4e6da42c892790c8f44f1319a97e311a22414c65df48719b21d619", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176432, "uuid": "b0a7e386-a2ac-418e-a2ae-dd9223e8e843", "comment": "Malware payload (Mirai)", "value": "ee7ec0cb68d2e4c3e5f204d56b9b901fa6be4262", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656176432, "uuid": "809fb908-d061-4d58-b98f-c8abd355fae0", "comment": "Malware payload (Mirai)", "value": "fc25571265d22c04e40ee4ee865cbd4a8ebb1a1fc3011a6a100f573cf0ec5ee200041b1e3c8b3886a413bc43e9f5f1a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176432, "uuid": "4a155dd9-bf00-4940-8b49-c0b568ff72b3", "value": "T1F6430881B841A626C7D14377FA6F418E371857D8E1DA73138C251BA07ACB81F1D67F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176432, "uuid": "94f1f168-b671-4693-87ea-a1a8349f1d1a", "value": "1536:n1JvTwhVJQJ/bG4bi7NoD+8fhWhH5FiS5n:n1PuNoDxpqH5/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656176432, "uuid": "129930f5-c1c8-4854-8066-a49317c3abca", "value": 56372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656176432, "uuid": "023e68ff-e4f3-4761-b358-7888d843250e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656176432, "uuid": "fbcb0f5c-ffb7-45f3-b862-b96b4cc789ee", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361b76b9-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "0d196a8b-12b8-4774-8041-3a1ee4596ae4", "comment": "Malware payload (Mirai)", "value": "92196b208a85395ee410f713a8bb1111", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "833c2e62-180c-434a-87de-35c29cd8daa5", "comment": "Malware payload (Mirai)", "value": "ea6eb8e7a74ab43e4a24e4ca1fb518ca62160c8f260ef9239be72a7d039247c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "79d7ce4e-b3a2-4eaa-886f-55e226e61cd0", "comment": "Malware payload (Mirai)", "value": "c3677db409cce1ec644a1c7c6f732f8190422ec9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "8c9c33b8-8080-47e8-83f5-69d14a046d20", "comment": "Malware payload (Mirai)", "value": "59e7b84c30689b320d75b3e16bef233fda6afcc12826299aa0da2016df4970cab41808aaaada2a13b295c2c806e346c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "6d8eb1f5-25aa-4734-bc83-12193417e8d1", "value": "T17F03E685B9829A07CAD0533BFE0E82DD3B25B39CF2DE3313CD166F51368A92B0967155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "f56dd3c9-a1cb-4dfd-98d9-d7a7852b0f75", "value": "768:LLMw6uPY5eosNoJ8o6N7PIo6VKmFVrJcpPEHjIpAX:fMwNO4NoKmREI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147607, "uuid": "f9af236a-94d2-424f-971d-dee242bffd94", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147607, "uuid": "a1bf582e-5b09-438a-817b-ee5e5290c793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "de9b1420-5541-4023-8737-d31137dcfe4a", "value": "miori.arm-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c48ab5-f4a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1656174965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174965, "uuid": "72fa71c7-79fa-4d1f-9d9a-c8602ed24e4b", "comment": "Malware payload (RedLineStealer)", "value": "4759de2a40d7d8220cf7470499dd7689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174965, "uuid": "2fdddfa8-9f6e-498f-a6f5-11821a1f6c4c", "comment": "Malware payload (RedLineStealer)", "value": "eb1fc46e8940fa7c36a9f0307613fb58cd82ede90e93f8fc501d88739517394a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174965, "uuid": "ebe37376-7a36-4795-a55e-bba7500336f0", "comment": "Malware payload (RedLineStealer)", "value": "8b39540e3b246cd6d815a8a622720c1858d07bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656174965, "uuid": "76f91975-0ce7-4b76-bc7e-770d9b352cc3", "comment": "Malware payload (RedLineStealer)", "value": "a1407e2e2eb1c0df6e2a7a4dc2196d8c8d2e13b14a9a91ffcc33c6596f062db82c1389a615711bb91f81dd1f1720c4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174965, "uuid": "d161f1c0-1540-4d36-802c-24c9c23327cf", "value": "T183A49D2BF2914F45C6951C7AA897C0944BD29B4A23B3E71EDE67016B2F633E04C16FE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174965, "uuid": "add18a6d-abce-4626-bd44-76e6ee3467a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174965, "uuid": "6cb0a827-39cc-4fe9-9a95-af18a13e7fe5", "value": "6144:tsE2zv9+c5iuAX0ZrY9JK6KS53KXyHUgExhlNvA+PeLGLaqS9NMiGGy6CqJQrryz:6QghZrY+6v5xHUfxxpC4aDUGy6Lsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656174965, "uuid": "e562f28c-1c0b-4039-af5a-9e52ee03a565", "value": 470256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656174965, "uuid": "1693032c-7dff-4200-bc0c-5122be2896c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656174965, "uuid": "4eede7a4-4a2c-44a3-a794-244427b33d9f", "value": "4759de2a40d7d8220cf7470499dd7689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b327cda9-f450-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1656138798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138798, "uuid": "055e9813-f09a-48d0-8338-900cc78e19b3", "comment": "Malware payload (Smoke Loader)", "value": "21241f78b89ce7e28ab274dd981eb5ec", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138798, "uuid": "bbfb6d33-f609-4272-beb6-1b164de5e30f", "comment": "Malware payload (Smoke Loader)", "value": "ece75c27dd16030024ce17a5a0b75f05849c95af77d85c08424062fd96376593", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138798, "uuid": "7f99b31f-6e2a-43ca-af71-2e6abfb10b94", "comment": "Malware payload (Smoke Loader)", "value": "bb5831445ea1cbbed0550230ec086a8fbc136eeb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138798, "uuid": "1727b930-a63d-49fc-99da-54819e27f992", "comment": "Malware payload (Smoke Loader)", "value": "8616d8528904fca8daf608a20a1cf530bb154bc7b390a11a3cc6b13ab34ba3eb8e7eeea151f9f455dcb5ed219c14fe7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138798, "uuid": "1e6e39e0-04cb-43b4-8111-d7c01e5182fc", "value": "T16C54BED07690C871C4223E309861CAA06B3BB821E7709547F77CAB6E1FB73D05AB6B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138798, "uuid": "0f70d7d8-cc79-4f35-a771-b8ad59af9060", "value": "53cf06e69ab6814920d9046a288a6256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138798, "uuid": "fb0e9911-a10f-47e3-81a7-ad10c289808a", "value": "6144:n1MiR/u3PO2avs/IaHQ6MdG0p7ITsq/HD/igabwVfw:n1MFl/NHQ6Wnp7YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138798, "uuid": "4df0e5e8-db5d-4ffc-beb6-af9036734f68", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138798, "uuid": "6beb8dc7-f025-49dc-ac82-1fc3c9668f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138798, "uuid": "721d2575-f4a8-4046-b2c4-7629a217c101", "value": "21241f78b89ce7e28ab274dd981eb5ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e79584b-f463-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1656146897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146897, "uuid": "2d6fe659-fd81-45dd-99a4-f84dcb26033f", "comment": "Malware payload (QuasarRAT)", "value": "4ff0a8472752f9b354de114f42db98ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146897, "uuid": "0dc4067e-b139-429e-b955-f4d46f5a48f5", "comment": "Malware payload (QuasarRAT)", "value": "ef4292a933e33418776d69b89f4cba6fc5acb974eccebd852c0d31cc16161dcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146897, "uuid": "83273267-a266-4b4f-aa15-80cab267251c", "comment": "Malware payload (QuasarRAT)", "value": "399a2b17af8ca60d833a67845aa06bea2fb23829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656146897, "uuid": "fff8876d-60b5-4101-a0b3-86ef4eaf8133", "comment": "Malware payload (QuasarRAT)", "value": "70ac055f323201558e823565f29cd52d789279e18e1a6bf3de53196a00a14871a8e569c3bd0b460cba6618f2d8a53e25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146897, "uuid": "be401fbf-f900-4ae9-8a10-7f02610e99a4", "value": "T137456A2D3A031B62FD1DD070D9121A09BB620B572383B9D25FDB99CA9B5FDEEDC05884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146897, "uuid": "b260184c-1901-4f3d-95c9-fcf916d36771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146897, "uuid": "5a6bf44a-37e1-47b5-b57b-0a0090787917", "value": "24576:H0mDPAqEPR6B+98YOKmeadRCEZyksG40ydbYtqYqqwFnIkLz:gq6oU98zRJoR0oYtqYqnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656146897, "uuid": "a798725f-f889-404f-8006-acf41afdfda0", "value": 1208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656146897, "uuid": "21625c8a-7f05-4e9b-96e7-0acb9332f871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656146897, "uuid": "e00cd3bf-bfce-4145-8a44-8c875e48ac68", "value": "MV TBN_SHIP PARTICULARS.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ce99d1-f47b-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1656157004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157004, "uuid": "0386c350-3bb3-4a81-a806-d81fe66eb253", "comment": "Malware payload (NanoCore)", "value": "20142e23d294762666962102fef84491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157004, "uuid": "cc11652e-6495-4b93-9445-954c8408e2e9", "comment": "Malware payload (NanoCore)", "value": "f3634c0ce882fd4fbcdfafb0574fdb51778e09c4d90b4b456beabff24e432186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157004, "uuid": "761af446-d729-4f24-bc20-33cab2871bf1", "comment": "Malware payload (NanoCore)", "value": "a555a3aae14a47211e4239548190eeae50aba7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656157004, "uuid": "7494a4b3-4516-46c7-b812-2d8acd1cd5c4", "comment": "Malware payload (NanoCore)", "value": "d7be3b737d391e8457345c864c6314bf5572076fa07956e92568ac2b7bf25d25885a15fc7df30832d958505b647ae26d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157004, "uuid": "99e7588b-65e0-4b2e-8fce-c7a7e3e60f9e", "value": "T1701513802E4847D8F8FE67B044AE46720677341E96E0D06DFF9A73A7D4523A5C923E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157004, "uuid": "d5e7d639-eacb-47e4-b7e7-62cf8e4f3249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157004, "uuid": "22d11e0e-c5df-46f6-abc4-f47d08731133", "value": "24576:9/W5X1K/W5kkPRrhciV9/jsJ8rM1vOumeM+l:gp92ksc/IJ8rU2T+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656157004, "uuid": "cd3819b5-a68f-49f6-bc5e-fa6f4c383790", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656157004, "uuid": "21cd096e-0be8-4298-b36a-b7354bb9b96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656157004, "uuid": "eb1fe5f7-bb15-43f5-ba28-e49a0f8eb637", "value": "20142e23d294762666962102fef84491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191c73c9-f496-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656168604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "9225dc92-cee8-4940-8564-19ff90f584ba", "comment": "Malware payload (Mirai)", "value": "01051d508b8fa7e5615fd138c9d8132d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "629194fa-a5c3-4d16-afc9-8661ccd361ea", "comment": "Malware payload (Mirai)", "value": "f397e60b04d5706a2937fe4c20e35958e498328145ff4da092ac048d689f52c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "3bb4e2c1-582b-4ebc-bef5-c3f9a297a992", "comment": "Malware payload (Mirai)", "value": "709ea5b19e06f574c6d60cb43bd217ad957e6d8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656168604, "uuid": "eaf211a4-46d9-4a80-bff1-d169c1616031", "comment": "Malware payload (Mirai)", "value": "aa7aad6a1c8b8ccb139af2390fce5b13a26c87625152b400ae7ffc9e4701d79da9b418186fe2390aefda171cfbf3663b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168604, "uuid": "9fd300ad-49f1-431c-a9a2-72868dc7a930", "value": "T1BF330272676D29E291B05373FC32BC1A66AC17F89CA730952CF06A1577C18014FF6786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168604, "uuid": "f11f5001-3721-48b2-895c-db445c65e3fb", "value": "1536:s9O/ZMAXIxNUk0l/nLcPqF1aBexo4opKZba:s9O/ZNKyR/nLGqFUFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656168604, "uuid": "7c3b9d97-94e4-4990-8ebd-737b9041d329", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656168604, "uuid": "b06869e5-63ff-4742-9f35-401fc0b16d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656168604, "uuid": "47c5a450-728d-45ac-8525-f59024b7be58", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb6a618-f44f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1656138201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138201, "uuid": "1faa3a8d-c348-4d2a-b4f3-c42585315488", "comment": "Malware payload (SnakeKeylogger)", "value": "98885a49acb18833bf0a73ce8693a0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138201, "uuid": "2ddaf218-1261-4c9c-b3c7-00190ea4b84f", "comment": "Malware payload (SnakeKeylogger)", "value": "f77b7a53564f8553d56104dc2ef6e13a18aceeee08365418c2181cfc765279b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138201, "uuid": "fab5d287-248f-4592-a3d7-c7f2ab923a88", "comment": "Malware payload (SnakeKeylogger)", "value": "9870f8278b583460b544bb3486c5104b701a8d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656138201, "uuid": "618b9c36-6dfe-4ae0-93ec-c17efbc17d6b", "comment": "Malware payload (SnakeKeylogger)", "value": "05599eb06d713547aea9e873173decb79e836c0453f5ff86686dca58a892094243b96c97182ff5570476584c61880847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138201, "uuid": "5ec55eca-83bd-43fa-8f62-d03405c9081b", "value": "T17B051206563C57A6ED7E87FC04E2228253F86423A05AF3ED0FDA71CE5C67B519790623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138201, "uuid": "606935e7-4e56-4e98-9c45-1e137f9eb875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138201, "uuid": "3d86e2e6-e549-4e2f-90c0-e24da3b65a21", "value": "12288:O2iNVqC12xuYf8R1G+cGbg5izb6tAOnOvOPozGdzTIzRFWojGq8UIVUBva:O1DT2JERTLiiv6RPdzTIlFrCq8RVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656138201, "uuid": "08079930-0b73-4c09-8e76-80d3d667a3af", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656138201, "uuid": "908c511a-303e-47b1-82bd-564f20775074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656138201, "uuid": "90c543ac-8dd1-4a74-b089-d493e9e16951", "value": "98885a49acb18833bf0a73ce8693a0e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a722c8d9-f42f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1656124604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124604, "uuid": "cce28cee-e7ac-4d53-bedf-616e8045836d", "comment": "Malware payload (Heodo)", "value": "1042289af54612f28909451105d41025", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124604, "uuid": "cf8e0c6d-b517-45f7-b44b-f7396efd0e58", "comment": "Malware payload (Heodo)", "value": "f79533b0188dddf270ff5e33f9fdae899b13af3f04ae9e177fcf00a5dea4142d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124604, "uuid": "7d892fbc-7f2b-4377-8348-cdb76258406f", "comment": "Malware payload (Heodo)", "value": "d5266ce91c65d64c31a5d1b6785f57e771e296e5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656124604, "uuid": "ed8cdbd6-0095-439e-af72-472ba53a3f99", "comment": "Malware payload (Heodo)", "value": "bbc088e315c779fc15a7147417a071812f3eb0c6b2529e524215ca312c63e91c52242bcec5e72c991aea68ff9f46f22e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124604, "uuid": "96fd0d67-6e6c-4c66-a040-b1fe1873e495", "value": "T189E49D05B7A406B9F0778238C9934653E7B1B4865A30D78F13E5427E6F27BA16A3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124604, "uuid": "6b9b98dc-f1cc-4136-88ef-20981ef24cbe", "value": "208d0cc211620e212f602a360cc4d858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124604, "uuid": "3c5f728f-8bcd-4edc-baf8-a1604e613ff2", "value": "12288:6Y7wgZv6SO4xxd49GK4qnzK4Mekn+U+HOmqomcpBSFYq9VxRTloUzpNGZ6sSAj8C:r7wgZvqqom0SfTC23GZyEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656124604, "uuid": "21610f09-94d1-4bfb-9dd8-be969d607611", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656124604, "uuid": "24416b4c-85a4-4f16-b15f-086152de3468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656124604, "uuid": "6b128031-ce26-4d9e-a507-f7bf8428002a", "value": "1042289af54612f28909451105d41025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb55048-f45f-11ec-93bb-42010a9c0043", "comment": "Malware payload (FormBook)", "timestamp": 1656145308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145308, "uuid": "ee8382a9-513a-435a-a2fd-94f3bcd5ec0d", "comment": "Malware payload (FormBook)", "value": "b1f7a384e6905559dded9928b6ae934e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145308, "uuid": "b68f1710-b00c-4678-93f9-43a78a9bffc3", "comment": "Malware payload (FormBook)", "value": "fa0677131dfa36d3a5bfa4308c751de8ea66ef94956e57660cb361d967fccdad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145308, "uuid": "9b85fa06-4d41-4b3d-90b4-6cd2b90d0f3c", "comment": "Malware payload (FormBook)", "value": "5cdfff9e12ebf6122cd24d902e3917178f136436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145308, "uuid": "65ec562c-8cbc-4ba4-b5f3-ebda3d7324c9", "comment": "Malware payload (FormBook)", "value": "c93680ea4e0906d31937eb373b535d3754bdccf4a21a057a68a0ea63dc403a34faf04cc3f28ce26cc63d3cbe4a1bf4bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145308, "uuid": "6bd709ba-11ed-4e64-991a-6cd7cbbc5107", "value": "T13F15022BBB579E12C50C1676D4C3492813699707B163EB8B2E820EC95F053E94DCEBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145308, "uuid": "7cab60ca-cc84-4544-88fd-36f67761cbb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145308, "uuid": "6f4b4baf-24de-484b-b503-a791c5029f44", "value": "24576:87DRdGdkLsmx7FxeaaClmsa30CiTo44Vi6S:87VcdkNBFaClmsakToel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145308, "uuid": "f819941c-cffb-4069-8ede-ace02d8ad3dc", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145308, "uuid": "f14d9d49-07ea-420c-9918-1937647c8460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145308, "uuid": "908df7f8-ef4d-4164-88bd-d3d66d4d1569", "value": "DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c05423-f461-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1656145998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145998, "uuid": "eaae6fe3-14a6-4d77-8f3d-f6f45c1231f4", "comment": "Malware payload (AgentTesla)", "value": "0a7f341f8858f4549affc15a7af737f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145998, "uuid": "f972f6ac-17fb-4acc-9230-4beab5d007e2", "comment": "Malware payload (AgentTesla)", "value": "fb88e54658ca403c246ee628aecde8091cb416377700d1cb60113d771d81b14a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145998, "uuid": "ee6f490f-bcc4-48a2-8048-8f739b9fbb64", "comment": "Malware payload (AgentTesla)", "value": "22338a93cac50a21a94647c240c8c0749840d420", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656145998, "uuid": "eaf816e3-70a6-4cfc-9e34-59b9859d4353", "comment": "Malware payload (AgentTesla)", "value": "dc006dd31fbbbe4d37c7bbefe36da1209752055676da5423fe953120aea1379e4b966f4b0990013dc2ce132ebba6c6de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145998, "uuid": "2222793a-34e3-42b2-9b88-4599fce4c2a9", "value": "T13655D85DAE618217CC3CC6F44893FB7432F68EC3A962C481AAE5BEC9877E7111C17169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145998, "uuid": "30d2fb0c-36fd-4be0-9d27-b6286f3279d5", "value": "12288:2vSuES/RR+Q0SqNQut/oTyluiDzqhjZa4xZRVMK0QGwOXB1lwb7Gim1qbqNjLZa6:URVAl+0Bsc22a1JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656145998, "uuid": "a1ab0db3-ddee-4f44-a96a-b709913491a2", "value": 1336320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656145998, "uuid": "3600d109-28e7-4f47-8016-7be19ee48ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656145998, "uuid": "a01373b2-441f-405b-ab8a-76de59fcc0e2", "value": "MV HARAR PARTICULARS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69962ad-f4e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656201134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201134, "uuid": "b9b95c4f-1624-4ee9-b8e2-d5ea4109b2f5", "comment": "Malware payload (Mirai)", "value": "586517d126a1dbc6275a1d8832f2ae8b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201134, "uuid": "66655836-e73f-41cf-834a-b9f8d835af0d", "comment": "Malware payload (Mirai)", "value": "fcc0527c817465b5fcb060b573981ba740ebc6c846c646797088039cffa9d2b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201134, "uuid": "ff0a10d9-0e95-4265-a71b-a67b38d2fdcb", "comment": "Malware payload (Mirai)", "value": "a28c360901b1f591e69c1c19d2d0119a08ac34ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656201134, "uuid": "8e453b50-0367-4d63-bea9-59a1b87eb39e", "comment": "Malware payload (Mirai)", "value": "0ddc9fbbe67a13d8841a2f3ce45e0b2193ce5053c87d5c54dd10136355e3683df87a9dfdc249cffa51cd7cd69f41c40f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201134, "uuid": "5e87d5fe-cdc9-45cd-924a-0521b137c564", "value": "T1A23302625BAE29D151B08777FC33BC1A66DC16F94D77309A2CF0A61977C58034EF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201134, "uuid": "6d7948a5-bdff-4210-9bef-f1ca3c4ced11", "value": "1536:s9O/ZMAXIxNUk0MLLcPqF1aBexo4opKZbm:s9O/ZNKyCLGqFUF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656201134, "uuid": "d8646d8c-b99f-46a7-9d41-fcab3c98b34c", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656201134, "uuid": "42afd8a6-adef-4b67-9b56-6039f0aa43ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656201134, "uuid": "91aa2da9-37aa-4094-806e-1bd4077248d3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361f8bb1-f465-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656147607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "74500d72-16b2-43ae-bef5-8c64df773a92", "comment": "Malware payload (Mirai)", "value": "0e87de3cc13da9c4d88691e4ce3b9189", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "babf85fb-8586-46e2-bb61-ff94c711bf48", "comment": "Malware payload (Mirai)", "value": "fcf260b8425bb735ac26bb16f91db76f3a153b261b7c965d7f1f0d1ea5bb9b92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "d510a7fe-82fd-4aa6-8ce1-c104723b0578", "comment": "Malware payload (Mirai)", "value": "2ea6b5b886f070db6a08e8db057b9d42bf585041", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656147607, "uuid": "fa49c4d1-4182-4b55-9066-e68c62e3ee49", "comment": "Malware payload (Mirai)", "value": "7455f67f3e6b1f36c45bcdfeefcdfa4498ba91a9a28e3c3287a17aafc3ea5ac99bcead6e09357e6bd69fc20f277d0c8c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "77235d49-61a2-4d0e-8c36-e40529d6cdf6", "value": "T148A2C015866C3572CE70CC76DA394AC222160B7AF6FE3937049447605B4270B7DBAAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "74cda4d8-82ac-4189-9d2e-d45fc57416cd", "value": "384:SBmlgAXLeXRLLvXEkWEHoXbkhipJtzuL4FF+sZO4zlhymdGUop5hHJ:SzDX+CokipbgE+sdzls3UozRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656147607, "uuid": "da3561d2-b2c6-4b61-a933-a22d5b424314", "value": 23368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656147607, "uuid": "6bb5a00d-9958-40b9-a319-00c68639f991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656147607, "uuid": "ceabd50d-55bb-4af6-ac07-69d61e28fa61", "value": "fuji.arm-20220625-0900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bc9c87-f430-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656125030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125030, "uuid": "5939b508-8d56-46d9-ac88-a2cd4598e294", "comment": "Malware payload (Mirai)", "value": "1aee246e6288f1ddd1f1b9a57ae41106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125030, "uuid": "319c085b-d323-46a4-ae75-96f1aaf3d29f", "comment": "Malware payload (Mirai)", "value": "fe1561299e1463e0cba5ed86b208d4707c5a962128900355c8766ddafaddd3af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125030, "uuid": "6bb55633-331b-4f7a-84df-0816720c90e7", "comment": "Malware payload (Mirai)", "value": "72ed49111684139922ad11800f3d7fa04b914c53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656125030, "uuid": "5c08b7cf-26a2-431d-bed8-63b15a76bd9d", "comment": "Malware payload (Mirai)", "value": "12aeb84eb907ad1eb64843d77919c1a1c432d6f49fbd30e054e94636275a6c8a85de4b00c963d7a7001d076a2bdd056a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125030, "uuid": "2ca7dc71-6fb6-45cf-a214-0708ac53543b", "value": "T175932A517C829A22C6E463BBF62E018C372663E8D2DE721BDD215F21378652F0D77792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125030, "uuid": "87d29fc1-0de5-47a4-b8aa-fbf9f81036da", "value": "1536:Ji3tiqwhu/tyGmBxM+J0vjSzGWmgih2VMYvnzEWi8O0x100YDImv804:JiQbu/tyG0wqfEhmpvzhplk804", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656125030, "uuid": "8a5a5535-255c-4e63-ba46-241fbdeef59d", "value": 96748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656125030, "uuid": "626e70a2-ccf3-4474-8366-78ecbe6813f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656125030, "uuid": "3530049e-098a-475d-b3cb-71cd9519adbc", "value": "SecuriteInfo.com.Linux.Siggen.9999.5211.14089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5570fefa-f4b0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1656179872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656179872, "uuid": "72ce1593-5b9d-434b-9968-09415ac38f81", "comment": "Malware payload", "value": "27d9bebcc17c197963e662dc6727380f", "object_relation": "md5", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656179872, "uuid": "de1e05cd-3661-4de4-8cd3-74b2126bee49", "comment": "Malware payload", "value": "fe733b9613eb17416e52f4a522005adcc612d4afda8fcb7e8d1b65e94291daed", "object_relation": "sha256", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656179872, "uuid": "d2ae3d40-dec1-4b77-a545-8d8eb6990e77", "comment": "Malware payload", "value": "89a1a3d52195633446b3448051ff96f2f540ce87", "object_relation": "sha1", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656179872, "uuid": "8cdc0253-06f5-490a-a433-b7ed9cb22e54", "comment": "Malware payload", "value": "ba7d60c75e74b83a3855907f4c4159ea49b2d7ffeedf95e4d030b222e8a1bcefd46903bd547fde2223ecf35d51399af7", "object_relation": "sha3-384", "Tag": [ { "name": "Javali", "colour": "#A0D90F", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656179872, "uuid": "050b6c8e-0be3-49e5-a044-0cbae861b1d3", "value": "T1EC3733FCD96CD54CF50E3667B86902B0CD50C6E8492AE06E66FAC59E4C4BE56CCD00BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656179872, "uuid": "cb780e79-5083-4366-a573-cf4146ffdfa9", "value": "393216:A+v4qo3V9WMTSHpjY895wteCxqwvLEVSLwReFJJt0qSaQPZ/ACX6ue2sR+xc0VvQ:B9kXOjp9eQCzLcFwJ1SaQh4hR+6QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656179872, "uuid": "0ef61e27-8ac1-49fd-94f9-20061eb7f9b3", "value": 23994723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656179872, "uuid": "b8074d8c-2bc9-430c-a77c-cd94a74e8a41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656179872, "uuid": "bcca514a-5e4e-4d49-af71-02576c20aba1", "value": "TribunalEleitoral.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dd7a80-f485-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1656161410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161410, "uuid": "e0b4d609-1b87-4714-abf8-7da48db4e8ed", "comment": "Malware payload (Mirai)", "value": "f00f6e7663420eb3b4f1b1ed38677534", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161410, "uuid": "4e7062d9-25e3-4e72-9f16-89a6125503e2", "comment": "Malware payload (Mirai)", "value": "fed7482f14d31bdd9111c95a7e70232189e51484db8979ae331afb927cabb2aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161410, "uuid": "51691a6c-c317-4132-aaa0-813586d5cfd8", "comment": "Malware payload (Mirai)", "value": "865a4da40bc836319830d2f133b0b527581f136b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1656161410, "uuid": "8f9da078-0107-41ad-8685-074ec80d638f", "comment": "Malware payload (Mirai)", "value": "d637d0e6f243c9dd1f6749d1334c32390147990873c1ccd4d1f65b6e65ece92978e576ef8b73cdd61acb9a37642b6741", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161410, "uuid": "2fce19dd-485b-47ae-8521-f1239fd29383", "value": "T19A62E8E5B981DE07C6C58133FB0E428D7B2A9758F2EF3303A71B2F51664792B0B66419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161410, "uuid": "a42c70b9-d49a-402c-aae4-06a4ffbfc2e7", "value": "192:USoSLPVw/3djt7UUYWG5hskdGMTgJBIssuUAXubWHv0kEZx4eYH3:UA2vwWc7lg4s5DZ0Fx4e+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1656161410, "uuid": "89fd2c56-e605-4f07-9a37-08881ea92ccf", "value": 14944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1656161410, "uuid": "43b01f60-de7c-42c2-884d-f9d35079a60b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1656161410, "uuid": "1edbc69c-65aa-4f41-a1bd-a359db60cc48", "value": "leo.arm-20220625-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }