{ "Event": { "published": true, "date": "2021-09-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-25", "timestamp": 1632614581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "90f908f9-b639-4670-ad0d-7b604947f6e6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e6850d-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601918, "uuid": "0f9080be-6f0e-405e-bde3-cde9c57aac7f", "comment": "Malware payload", "value": "de2342d04a3f858be9a7f131aad429a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601918, "uuid": "6ac60c60-b7e9-4fc9-99a5-06ccff23915e", "comment": "Malware payload", "value": "0041c6c41c57e7b0d27edbe8ed90f1b79faec4d9256ceed933a4e2a8c2184963", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601918, "uuid": "87b1a2de-3e20-442d-b0fd-b24b123340b4", "comment": "Malware payload", "value": "0b425ee44e4f27f7ae1962a9a013de4e3c95f7a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601918, "uuid": "807876b2-2004-4910-8f2e-ffbb482f2ac0", "comment": "Malware payload", "value": "4a69a00a1c77e758889aaf497a992e515088e9698b2df100623ff1c9ff7327b512d9ccf5ee13c6d5c441e9eba1aba81c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601918, "uuid": "ea4c450d-dc1c-4c0f-a48b-6418d5f73024", "value": "T17D335385BFA13FBFC81ECD324198CE46129D8D195398BFBB6B64E404A75B14A4AD3C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601918, "uuid": "6b1962b0-4f73-46cc-985a-ab5940f5ce88", "value": "384:z25LD2J5EyuPlFqyXs7l9HnzcNHQQZStbbDrQad3KxhpBC6YUp8Eln:q5LAoXs7/wFobbDrHKxMnQ8Eln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601918, "uuid": "35a2bdaa-8ddc-4b81-b8b8-90fff8217eb3", "value": 54628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601918, "uuid": "78d12471-a7f7-4e3f-a1b2-0d58cc2c99fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601918, "uuid": "60e8a816-5676-4131-ab45-6836bc1c032e", "value": "de2342d04a3f858be9a7f131aad429a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4772fe-1e26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632591036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591036, "uuid": "8a993af1-9501-4675-82e3-6024132c9776", "comment": "Malware payload (RaccoonStealer)", "value": "28de2210f04d9411bc70ee0ba511279e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591036, "uuid": "02a61104-c956-489d-8bd4-cbfa3d1a35ae", "comment": "Malware payload (RaccoonStealer)", "value": "005afe5d449f7ec37eddc21b5623994b7200ff33cae0d379625d66234db2eddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591036, "uuid": "1be04836-7a77-43d1-96b2-3d6d69dc8b17", "comment": "Malware payload (RaccoonStealer)", "value": "4975ade182e5159c6ef6287982b6db0fe20dcd1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591036, "uuid": "60b51272-a60a-4a0e-933d-5d517293c314", "comment": "Malware payload (RaccoonStealer)", "value": "9aec9d3c3f8ceb73b29abe6da8a391ee5de9a7e7c7f58e077791229967602709ec28d26ccfaa9e0375d5239bbae881f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591036, "uuid": "1c10d253-7226-45a4-83d2-1ab17f4f570b", "value": "T1189401D0A2A1C032C7F349334A65C3A5EA3FB922FD33944BFB4C265D5E682858AD1357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591036, "uuid": "323b147b-2896-45de-a01d-fee6d251992e", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591036, "uuid": "1b458cd4-ec75-4276-8e02-53825c45a18e", "value": "6144:8Pl7QGK8q1V9SjhtmhIqL4Szv0gOvDfe1SyysEDPzsEK6S+5pKZ9tEad:gcQdEh5kvytysEDrsB8E93d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632591036, "uuid": "776530d3-3a46-4ac3-aa5e-cdceb8b91406", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632591036, "uuid": "f1797770-83d8-4493-94a0-647d39fca367", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591036, "uuid": "7fab0123-22a9-4a14-b922-81665a97bf7f", "value": "28de2210f04d9411bc70ee0ba511279e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88141dd4-1df6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632570522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570522, "uuid": "b9061bee-c276-4615-812c-aec0f71c02b4", "comment": "Malware payload (RedLineStealer)", "value": "ace7aa40709b1a820b557f2337e90ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570522, "uuid": "b2bfe016-d11b-4dec-945e-10636e9ea987", "comment": "Malware payload (RedLineStealer)", "value": "007857c060c54c246baba8c01a998c435352a46e665d6e3b0cca95c2667053ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570522, "uuid": "89046c38-41fd-4dc5-af2a-5dfa68baeb0c", "comment": "Malware payload (RedLineStealer)", "value": "82dddfeb8db89a114f98e1bc999e0fb38ced1338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570522, "uuid": "5c1b23da-018f-46c9-a0a4-873ee4de084c", "comment": "Malware payload (RedLineStealer)", "value": "5de9f36909396d95c508c009b1916d8b1fed20e2b012697c98b81a85403979df41fc9b78f722ae345422c99d5c2b8359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570522, "uuid": "b51936ca-ce94-4957-bf2a-3dd799fc12e7", "value": "T1FF24E02032F1C432C7B75EB159709AA01A3BB9632F75814B76552B9D1E233E0DAA6F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570522, "uuid": "c81d405b-f09d-4088-9c00-78055da8ec75", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570522, "uuid": "d63c0c1f-89f5-4f1d-8a48-495e2c735ab9", "value": "3072:kB+CRGFhrVPBq2OsEwi3oFo0LwjWPBH8GTqK9NRKZ8I+ZKERVD5MKFcY5:kB+UwjloYwjybqWzK0ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632570522, "uuid": "0601c13a-6d76-47a7-8a53-cac2b8b92e0a", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632570522, "uuid": "1d552028-626a-432d-91c9-dede63438606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570522, "uuid": "3a964e37-5824-4e7c-b459-12d91331366c", "value": "ace7aa40709b1a820b557f2337e90ab9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c259ddb-1e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632613854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613854, "uuid": "96551945-c012-4940-91f4-17625a65db78", "comment": "Malware payload (RaccoonStealer)", "value": "4479ba601f68339e9dc6a92d18507a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613854, "uuid": "a482098e-4b03-4a70-a387-d1a5098ed96b", "comment": "Malware payload (RaccoonStealer)", "value": "00a0b4335a8d59371783a615f8c27dfba248ef0f393151935fc6ea6dbceeec6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613854, "uuid": "383d91b4-7829-4322-946c-f0dbcc6149e4", "comment": "Malware payload (RaccoonStealer)", "value": "fc4d2c5af0fdc574f12012a50a391464376f681a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613854, "uuid": "abd0a9b8-e0ba-4621-a2c9-0b8bcb8e5b71", "comment": "Malware payload (RaccoonStealer)", "value": "1c14bb28cca365f6bef3aa97ce88ea0dda54b84f5bec5295fa397849d9405bf3a00e1612483215332664cbb7274c45c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613854, "uuid": "b83a4134-b678-477d-af16-4e0a49351922", "value": "T1BA94F10076A1D0F2F3E796714D3EC264657E78A27D33850AFA8C1F5E5E322C19AE6352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613854, "uuid": "9761823a-a007-4c54-80cb-b2c31caea191", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613854, "uuid": "ab568bf4-b50f-4301-bcaf-0feebcdb1aa3", "value": "6144:jT99WwGfhFZ2ql2VV+rsbbeaOaoD5R02qZtYrIfux2g+XFPxfyOc3cMEa:7LGNfECrs5OaKbjqZtC+pxfrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613854, "uuid": "a16cad6a-44ef-4503-b99b-c9b975988f4b", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613854, "uuid": "082fc29c-86f4-4c8c-a628-0db83625ff74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613854, "uuid": "f4a37e31-fb0e-4f9c-9dc4-4086ad5f50bc", "value": "4479ba601f68339e9dc6a92d18507a93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782687ee-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632552886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552886, "uuid": "0a763ad7-d922-4d9e-bdde-5b3ba24be4b7", "comment": "Malware payload (AgentTesla)", "value": "7adc65e01679470950862eef7bab8a26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552886, "uuid": "a828e3d5-9534-4f76-b6ba-bb5382b65e29", "comment": "Malware payload (AgentTesla)", "value": "01da27664919204b91add198b731ab91dc59ab8eba281761042c347742c26614", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552886, "uuid": "345214db-8b93-4258-bd25-b5370e5c6bd2", "comment": "Malware payload (AgentTesla)", "value": "b8aaf166e7c084fc52af3028b59d9f70e7e2d821", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552886, "uuid": "5ec30494-6933-4c07-ad1b-3f4a2590822b", "comment": "Malware payload (AgentTesla)", "value": "61db87e279ab0530d6f0d02c792a735cf5bb68500a377e6642af2a4813b4f71daea82a917e231532de19732547a26656", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552886, "uuid": "db4f064c-6b02-467e-91c0-54b9cab856e5", "value": "T1E8A4E00157ECDF5FE3296A7598106D5086A2D3DE2193DF4AED9940B13EEA24CF710AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552886, "uuid": "84bc9558-7a64-4631-8e4c-f3f7f14ecf4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552886, "uuid": "e417c0a5-b8d5-40ce-ba55-cc5d49b8cdf8", "value": "6144:izbjfGHfcbhzZHSyho+AGmyynu2vRxtzg9BEcfv2PH5+GESGrL2zazx:uGEb8nu2RzUBSx1ER1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552886, "uuid": "ffe2f772-1103-49d3-b58c-d3fe8d3452c1", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552886, "uuid": "f9cb255c-2418-4363-a17c-ee711ce02617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552886, "uuid": "fe3c3443-5fd0-4caf-8137-75d5ae1a5ed7", "value": "7adc65e01679470950862eef7bab8a26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a708a8-1da2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632534608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534608, "uuid": "d7e78afc-0ae6-446c-99f8-d9755bdae06c", "comment": "Malware payload (Mirai)", "value": "ea8e110f5dbac6bde8abcf1433da68a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534608, "uuid": "0c73755f-c621-4467-934d-d8f0b8f4f04d", "comment": "Malware payload (Mirai)", "value": "03f0acbb2be5fb9cf5878d566bc92d6c56c412388cacd4533c388563446f1c75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534608, "uuid": "8a27352c-9d71-465b-8a15-22ad5a8ddfa5", "comment": "Malware payload (Mirai)", "value": "8cfbd4dd51ac0b93d28a45019b7228338870f13d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534608, "uuid": "348b7eee-1331-4ad4-9788-d53d296f5497", "comment": "Malware payload (Mirai)", "value": "4ecd3ea5336e93bed8c855df591bae42faa58a737d0be647c2bd2ab05705c1614deece4ed6f7471b28b89e0385b9e75c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534608, "uuid": "666fb987-c3cf-45d5-8685-164e140adcd8", "value": "T1CAC2D0301A967A21C62005358C78C7C56B3737F4D2AD78E715B80AACE0DBB8B657DBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534608, "uuid": "e52e7bca-1b6e-46f4-80c3-5de0b9e9c7ca", "value": "768:oQaaX8dMsZUIj84/11d5PKBEVXjvI4MSJus3UozbR:oQaaXP+Fj7t1KmFwSJTzbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632534608, "uuid": "825c173a-7974-45d6-b8b4-6bcad74af914", "value": 27928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632534608, "uuid": "15b97fe4-2edb-4603-8044-8d9d14b14725", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534608, "uuid": "f05e5e2f-6b19-41cf-b851-58e640e540cf", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dea42c0-1e54-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632610851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610851, "uuid": "ded69962-798f-4285-8acc-30a8c364b4c7", "comment": "Malware payload (RedLineStealer)", "value": "a1c1c6c1bc1eebb3d35ed56242e2a6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610851, "uuid": "642e65f9-ad16-4287-bb20-a7d978379abb", "comment": "Malware payload (RedLineStealer)", "value": "054df720cdaf5db7623d8f937ccc21427661cb5a7542c3401b70b5027c55d0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610851, "uuid": "74781bcd-a257-40cb-8445-3ef8b63493be", "comment": "Malware payload (RedLineStealer)", "value": "4071e1fa50d63443277393c38782949f6406f6c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610851, "uuid": "19fe0de7-cafd-4669-9034-2d4a9626016c", "comment": "Malware payload (RedLineStealer)", "value": "13525243d5b326bbda4c569de1116af0c7aeee1183f87755ea0e8ca1d13d9dce1b44aa48e8a2372dbd0e888278077221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610851, "uuid": "f5f7e266-d1eb-4be0-b212-2787054cf401", "value": "T1681633517763C9FBCA015034EEC82BBB703B83C07A998C97B365890C575A867E76A50F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610851, "uuid": "cb9225a8-f1fa-43b4-90a7-eb0f9612ca38", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610851, "uuid": "de4c9935-02d7-4565-ac89-81628024e40d", "value": "98304:x6CvLUBsgwlEh0v5d5WCkSlQpPk6Ti/T5wyvlz6+r7rGH:xbLUCgwJRCAQm6GdLvlukrGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632610851, "uuid": "7abf3a49-2e7e-4a83-8823-cda9ab6760e9", "value": 4251727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632610851, "uuid": "a729861e-1193-4639-b84b-92915c2cc8ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610851, "uuid": "315b7130-de36-4ddb-8b91-0d835582cb70", "value": "a1c1c6c1bc1eebb3d35ed56242e2a6ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83ea1a4-1e2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632594628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594628, "uuid": "9db0315a-de2d-471d-a334-26121d5f7652", "comment": "Malware payload", "value": "2ebb5774f37688e75c3965c6061dec23", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594628, "uuid": "5ab8a224-0f08-44e4-a95b-851d3c9b4b59", "comment": "Malware payload", "value": "06393372ef6bb16574dd368a0df562ed4ede97f0b53cbe42bb61cb1e3d61c10a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594628, "uuid": "bbcca6ea-6061-458d-bf0f-39f77aa48248", "comment": "Malware payload", "value": "64687a38cfba90ac752e34e4d6bd382c97ac587d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594628, "uuid": "848cdf24-6fe5-4c20-b25e-eb3441059016", "comment": "Malware payload", "value": "3818ac2cde4da7791eaf6740ca340cfaacd56beca789352393909be4229ba16302593415a8c23fba4af6acdff98338ed", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594628, "uuid": "ad96e1e9-e026-409a-b7dc-daec59376c51", "value": "T11D1523E62A3D340CCEE5E2727C4A3E92167A40448AFA7A7B7F9F073F0D535861425B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594628, "uuid": "e4710508-99d6-4caf-b844-d2633feda84d", "value": "24576:vpsJykzyRlkh/KtC+22yuE33Oem0RG6Cw3QKcc+K7J1rjBw9:vpsJpyRsKkxuyOeRG6135ch8J1Rw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632594628, "uuid": "10457e86-1918-4714-9a9a-601d13cc677e", "value": 956031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632594628, "uuid": "8ab6b32a-f27c-45c5-a0d5-e900c4c66f66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594628, "uuid": "a4039e1e-f4e2-4c83-affe-fed2c37d6dfe", "value": "2ebb5774f37688e75c3965c6061dec23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a584633a-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632552962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552962, "uuid": "8fe57c07-fdeb-4b85-9905-081ae5f9df1e", "comment": "Malware payload (NanoCore)", "value": "018e6e08398ae74f96cd3462111fe1ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552962, "uuid": "bca27970-2f07-4e01-b99b-30222ab4fe05", "comment": "Malware payload (NanoCore)", "value": "070e90b07cec3c978e33cb74a1848ba503d7ec1fd512a703c34fc5fa1a133ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552962, "uuid": "f97784a9-529d-4437-9a6e-73e282563559", "comment": "Malware payload (NanoCore)", "value": "58569bf339e0f4434364a4a9811af7a11a55ac69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552962, "uuid": "4d50730d-9943-4000-aa23-a5d7369fe1ef", "comment": "Malware payload (NanoCore)", "value": "bde8527ec9d5360b89dd3d23990baff4f24d0f3a8f26872812702c37b4a7e0c515a2a5a33e6d520faec26a7c1e569d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552962, "uuid": "395f81a1-abde-483e-abe0-bcd8cacdc0ca", "value": "T1EB422B92A7D45B79D87A8672FD3757000670F33BD8629F2E18C9503F6DA27111263B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552962, "uuid": "e95de7a4-94b3-4897-94f5-41424ff6b2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552962, "uuid": "3a6d9ad3-c281-45f2-87d5-ca7b8450a975", "value": "192:08gWwsyjUbqrTmreZM0qAjEeQqMT0U2/JT0JN7KaeJ7:08gWwrYbcTmre4/ZnT0UUKN7Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552962, "uuid": "bf4d4b66-64ff-49f5-a9e5-dc7ac1c837a9", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552962, "uuid": "b706f8ab-ba20-4b54-8cb4-dd8c86a3f7ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552962, "uuid": "2caf0b1f-b1f2-41da-a7b0-1a0b7c98e54e", "value": "018e6e08398ae74f96cd3462111fe1ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750e34f8-1e38-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632598837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598837, "uuid": "868e806e-19c1-443d-bea4-0f5589e912a9", "comment": "Malware payload (RaccoonStealer)", "value": "4f983fefe91a630006f993b9de3e8d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598837, "uuid": "c4eb473d-8daf-4382-8a87-ed3e623f9a39", "comment": "Malware payload (RaccoonStealer)", "value": "072dd3cb9c4155de3c094d9ce28b8c4ab7aa7b36d7d77eb034aa3272a017a90f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598837, "uuid": "967348d7-068f-4466-9e86-6fb8b275338e", "comment": "Malware payload (RaccoonStealer)", "value": "6eecc14e11d5c183c2a0699ab6ab26e692462462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598837, "uuid": "0f2cb076-2981-4bff-b753-704215ab8294", "comment": "Malware payload (RaccoonStealer)", "value": "40af366f79895d465f37fab574d2b7143d9cef5153e100b294370d7ff9aa8b33e5498b62e133ce35da15c7b75a3cb5a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598837, "uuid": "707daf10-d88b-4c05-8b88-5060ec2c4150", "value": "T1F4E38C2076E1C432F7A316315979CAA1563BBC725F77994BF74C375E0E222818AE2363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598837, "uuid": "f324a312-2e9e-422e-8de1-9fa8cadcd467", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598837, "uuid": "becc478a-74a5-4c38-bc9e-06a68b4b5eac", "value": "3072:UDD1mf8oXPo3ZhHLxT5K/5FEX1wr7HlS9H6dYs:K0f8oXPiTUKQ7FEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632598837, "uuid": "189058a9-0d3b-4f8e-b5b0-b935057d0cdd", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632598837, "uuid": "3a01e9cc-d24f-477f-999d-eb43bc29201f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598837, "uuid": "bdef4e70-9c97-4531-91f6-f459ed7bf3aa", "value": "4f983fefe91a630006f993b9de3e8d3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5329e1c-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573631, "uuid": "2a305988-0ad4-4572-8a59-0773c4bf6907", "comment": "Malware payload (Mirai)", "value": "95563bb45d5c9ed7e8c544c87346c6ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573631, "uuid": "145f51ea-14d9-4b8c-8d86-21eb793cc62c", "comment": "Malware payload (Mirai)", "value": "074c0ff5fd56bb8575e810c88f7a2ac2358cfa6b76a01bf736c143a9941d4edf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573631, "uuid": "44676f52-6a03-45e2-9cb2-5c4d655b976c", "comment": "Malware payload (Mirai)", "value": "41af88ae93db8ea5cd7536f6cf66100bbdce01ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573631, "uuid": "5ca7eeab-8e2f-4a38-885b-d177ec6eadd8", "comment": "Malware payload (Mirai)", "value": "e2bacba69d572f05457cc6b9725cf3ffa5f90d9a7c24342f3088eb8afd7d957f4cab3e4f17eb9acb0e769174b68ae82e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573631, "uuid": "1a80451b-15b3-482e-b83c-339203f1f213", "value": "T1117392097F614FFBF86FCC374AE92745218C641A22A87B397934D818F24B25B14E39B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573631, "uuid": "1d0ad587-8c49-44d3-9f6c-cc8189b0cfb7", "value": "1536:pda0IrPUujoSH8VrDjZrnAbK+OF9pHrmZS6TdBZnY:pdIrPUujoSUD9nA4rmxZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573631, "uuid": "7eaf7ea7-ac06-4b62-8383-a50d9f9f2fa0", "value": 76840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573631, "uuid": "bec003fc-2fdd-4d02-a8d9-5081b7a2b190", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573631, "uuid": "0862c8ee-9e41-47b3-94f8-1783d36104d2", "value": "mipsel-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f52dcb-1d94-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632528238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528238, "uuid": "547ed854-4632-44cd-ae7c-d267e23ff8b2", "comment": "Malware payload (Squirrelwaffle)", "value": "3d77d7a2e2697d35b281123afe4b030c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528238, "uuid": "3c378086-aa8f-4f88-995a-e25e27603767", "comment": "Malware payload (Squirrelwaffle)", "value": "07c7cb49350bf3c6de4193fb2eeb8dd92d6662d60393ebd483a54bac80fb0b44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528238, "uuid": "1bf18a36-7cca-474e-9c69-ebafee7b37cd", "comment": "Malware payload (Squirrelwaffle)", "value": "4087259179a6761e376dcfbf2e981e1c0cacc287", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528238, "uuid": "6ac9c237-e3e8-40ee-8340-6fc05c6df9a6", "comment": "Malware payload (Squirrelwaffle)", "value": "6356b43a3b58206421f161ce304e0517cdd554d1e156afa2b053bb48b13a4b54cf5f32a87ad9c8c03ade54674b7d65a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528238, "uuid": "65d6a701-ba7a-4190-86f2-4867fd8bfa6e", "value": "T14064BE20B5C3E034C43E46B44975D992663C7C704F20DA9B3BA8AF7E5AB71C06936B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528238, "uuid": "e0669311-e649-4206-a89d-ca1c0ceaa1b0", "value": "cc1e6975fa29dad96fae67f7e9b5f02b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528238, "uuid": "6c21f546-1dcb-44a1-b78f-5d7f0094ebae", "value": "3072:TsN//P/zD85fNsfmMBkw28lmNQOfNcopS94e+gpiHLXQAAAvvzBSV278HjCFo3s5:MzDkmra8oNBTppeCVSV278DufMs9zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632528238, "uuid": "37c3a8a6-d220-49ef-8b1e-d60438ff56b7", "value": 316832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632528238, "uuid": "f5689e88-20ee-46a1-bc75-a8f8e39e7ed8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528238, "uuid": "8d991b29-0f5f-45b3-8a6e-55dffa837978", "value": "test1.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e951201-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632552762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552762, "uuid": "f89c4343-e603-4a30-80e6-a06bce75be00", "comment": "Malware payload (RedLineStealer)", "value": "97feb1f3cc25f258764fec79af701df2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552762, "uuid": "76d5a730-be86-40e5-b65f-ae57e3e4f682", "comment": "Malware payload (RedLineStealer)", "value": "07e0cb59b6ecd2ca93fd59a315632d538f6167fef0cf3203d61714f5823bd548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552762, "uuid": "4517dd55-d7fb-4197-be4b-c0a28f756d10", "comment": "Malware payload (RedLineStealer)", "value": "00451d0072b5efedd0489cbfa3a286d553352aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552762, "uuid": "d03c216e-2929-47ea-94d8-4178ad879a5f", "comment": "Malware payload (RedLineStealer)", "value": "b294f422e6cb65ee700bb36d8e08b86cb6895c4d989fa53edc053c34aa3a09a343589dbaba7306118f0f1672232c550a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552762, "uuid": "f7965509-2f66-46eb-869b-47cb6f91a536", "value": "T158A35557C264541EC93C26B0D0610F0B3F68CE601CA1B1DDA14EB99ADF3A54E8BFDA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552762, "uuid": "d0968a61-aaf5-4f33-b8b7-66c3f852be60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552762, "uuid": "e1b127c4-f56a-4b82-9f1e-6f34ae8443e0", "value": "768:tcUPqhF44hAUT1ohdJmDi2Btwq3LI27rnwcTXm2XbZtsmqTI:03ZV8cTXJXbZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552762, "uuid": "8db0f923-e8fb-4733-a339-2ac89393c1aa", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552762, "uuid": "e3202021-217f-4bc2-8be1-aaaf953394f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552762, "uuid": "174b7651-e935-47a2-aa51-558b653e2ed9", "value": "97feb1f3cc25f258764fec79af701df2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b9520e-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "7f448b1b-3fbe-47ef-93d9-7d2bbf03e1c0", "comment": "Malware payload (Gafgyt)", "value": "c8297241e8cab1c7293bc5c3198e98cc", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "666dba80-def0-4004-be6e-cc42326e3512", "comment": "Malware payload (Gafgyt)", "value": "088879d41fb3628b6abcc1c32e9303a529ebeb094131e63b2a7661bbc90d0670", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "28fecf89-0045-43d8-87c8-96b8ca020aa6", "comment": "Malware payload (Gafgyt)", "value": "73be27793bd116a966c8e01f9e5b0e9b1a1cb99e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "3b4fc699-fb64-4e87-85fd-02f66dae4a5d", "comment": "Malware payload (Gafgyt)", "value": "741b5f413f902b9a5fe1c0bb1f1889d39e25d3a0ce72ee210de2776a190c7f7f9c32124f1adb21eb8aedd0af6e5e0d43", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "cae0f056-07df-4659-8674-6cd7c7f87086", "value": "T116E33B09E6408B57C1D2277AF78F424933239B74A3DB33199938ABF43FC27A95E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "0a324157-b1c9-4d50-9acc-20adc10546de", "value": "3072:pd/WdOnoa9ik35B6UJaEAOYGoMn/LDM/9BDpmpwfvRQAZn:L/Wdaoa9ik3P62AOYxMn/nM/93mpwfvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563404, "uuid": "95dd7ceb-450c-45eb-8d6e-66475b612cf8", "value": 155369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563404, "uuid": "bf6c40b8-0b7b-4367-bfe7-16d0638e4f5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "56520d2b-aad9-41fd-bacd-085a2e55772c", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423fc50a-1de1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561385, "uuid": "5f8c6926-6399-4436-897c-6df80c5000ad", "comment": "Malware payload (RedLineStealer)", "value": "f244c0d15cd2825a5d795ad450ea0338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561385, "uuid": "3df29dc0-00de-42be-a153-420bde802d5e", "comment": "Malware payload (RedLineStealer)", "value": "08acb35aa8757693dad0261b14a91c36587df778b91aa253824f002b9ba9efad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561385, "uuid": "2acf5182-b55b-4bf3-b2fb-736e1a33fb1f", "comment": "Malware payload (RedLineStealer)", "value": "a2890629a2fe643b1d51fe0e6c2aaa63049d9ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561385, "uuid": "7e2219d8-551e-4b88-8399-79c3fb52dd4d", "comment": "Malware payload (RedLineStealer)", "value": "f8ef281333d67cb7f4addc67eb7f1f03b39d177a66079ea51cbc635c3e9fd75c5c7c1bd75236abad96fb48fcaca282ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561385, "uuid": "4cebaa72-bd41-4939-9ebe-ab4928705e01", "value": "T1DA24E07136B1D032E2E305B98934D7A15D3FB5236B75458E36853AAE5F722C1FA2A303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561385, "uuid": "e76e8c9b-19f2-4fc3-9df8-ad00fd76d909", "value": "f7987bf55fcab080da60dcb9686a7f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561385, "uuid": "3472faf3-7141-47ed-8cb8-5d97c27d7740", "value": "3072:2466Mu0bYgdAm8yn5HfG1AJtqhrWX7mt4FRa1F2L+QIH755HfJOjFq4:247gdJ5+yqhKE4FRa1VQ6XfgjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561385, "uuid": "88197114-1848-4f4c-944a-c41fc1314a94", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561385, "uuid": "ed2f0984-6798-46fd-9f62-4e492f275d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561385, "uuid": "7d5c48f4-2d49-47d2-9f2d-c4d10d57828e", "value": "f244c0d15cd2825a5d795ad450ea0338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31af61a6-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561787, "uuid": "480d58de-f743-47e3-8586-d1c97e67507b", "comment": "Malware payload (RedLineStealer)", "value": "968085ef06de762b0689ab67fb0db60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561787, "uuid": "31f50031-32c1-4501-a7d8-85ebcf99e5f9", "comment": "Malware payload (RedLineStealer)", "value": "08e5425c1cd570b87d3fb62e0a4588f5ecc9b53bc9eb9f59194d028ec544b3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561787, "uuid": "4a09980e-2d57-4653-b2d8-b40e0110e1db", "comment": "Malware payload (RedLineStealer)", "value": "789a3a533cfdd63361d7be736dc3b2148a43aaf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561787, "uuid": "8606bc11-3ded-432b-8464-99bfe5290f94", "comment": "Malware payload (RedLineStealer)", "value": "98a832b88c78911e425e84023970f124360c4a6c615e3b789f146fcfb72e7962429051fb601e5f1517e60365d4f8b871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561787, "uuid": "eb80d8a4-d2da-4086-b668-a62f94a41e94", "value": "T14FC4022178A0D333D2A355B158E4D661966FB4326635908B2B9052FD1FF02A1AE3E3F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561787, "uuid": "3af847aa-573d-49e1-b91d-49b12a8e47fa", "value": "e0383fee3aa7c9c4dbf3a05a98d01075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561787, "uuid": "9ea24229-95f2-468d-b96e-4732e5c491d1", "value": "12288:myQIHlBcy6DKf6fcY/If0/v2oobNk7YubB0wuMTmkoA:muvRBik/0/uDbNX0BLTmfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561787, "uuid": "64cc713a-51db-414f-896b-7e765678d227", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561787, "uuid": "fef93c5f-cda9-4f88-95f3-fccbb55f698a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561787, "uuid": "52dc539c-17d3-4ad5-899a-33fb7f11d195", "value": "968085ef06de762b0689ab67fb0db60d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f984978-1de1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561381, "uuid": "68f8cfaf-775b-4f8d-ace0-3f79ba025ad5", "comment": "Malware payload (RedLineStealer)", "value": "bfb8bb0ab009a17bff1898c9741d1dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561381, "uuid": "dd283360-918d-4068-844c-6b7cc3892f4e", "comment": "Malware payload (RedLineStealer)", "value": "0a588c1bfdafa81464774517bd843899aa209e38d6a47c0bb418883ff376feeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561381, "uuid": "e720664d-bff8-4bce-9a18-7d87f474ab92", "comment": "Malware payload (RedLineStealer)", "value": "2129fe3eaa1566262a3e147094b02d86f4cd6ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561381, "uuid": "0aac8017-c8e0-4c80-a985-a4e134958c03", "comment": "Malware payload (RedLineStealer)", "value": "6c817ac832536827ac958fe0ac30f2ec90f5e8fd46a656edfbfa509e8cad541cf48a83c1ee718f937fc0c047e3241e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561381, "uuid": "58ce4c60-1f68-4525-bfe8-20c91eb786f1", "value": "T18924E12179E687B2D3F3F6B14A70C7A55ABF78633B74408A26031A9E5E31290D93D317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561381, "uuid": "2833ecb2-4fdd-4a39-a5e3-f506c3ab7dda", "value": "f7987bf55fcab080da60dcb9686a7f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561381, "uuid": "60e86497-5950-4eaf-a18c-3158baa6c858", "value": "6144:p44VfjfpYu4CVLcfcngVfqZhSWeqvXCJbZ4NF:p4MWpILcUn8uPv6JbZ4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561381, "uuid": "6a24fce9-e3a7-40a6-9b03-9547d1ff2869", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561381, "uuid": "d4329ebe-77ca-4fae-ab07-10597939a961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561381, "uuid": "681ede46-a95c-4389-9d8f-6ffcd343828f", "value": "bfb8bb0ab009a17bff1898c9741d1dce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d520c1c-1df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632569618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569618, "uuid": "35e15c40-685f-4f00-9bd0-583281547d7d", "comment": "Malware payload (RedLineStealer)", "value": "ba76048e74f2527780b64dbe32f23bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569618, "uuid": "2b22b8ee-41e4-43cb-a9e7-9aef79b64ede", "comment": "Malware payload (RedLineStealer)", "value": "0a83bd1dce102a14cf5a90780aec43b472e9061bb354db2d5cb6f62b2510f233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569618, "uuid": "3f9ccc14-02ed-4029-8b24-42587726bb94", "comment": "Malware payload (RedLineStealer)", "value": "250f1b19a8c4846c412f9a7c1a2bce5e2653c850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569618, "uuid": "b3ee6e67-0e48-49c0-aab0-8f66db33b6d7", "comment": "Malware payload (RedLineStealer)", "value": "65ff06bc5812e7e4a6312fcd515994cf21a9ab394cdb8238dff60d5a1683af9c0623f18da5d78b7bbfdc30b78b5f040c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569618, "uuid": "b70855a9-28ca-40fa-b0ae-4fc0ba380e76", "value": "T18724E0E075F1B037E6E3157189B492F13A3F78332E74864E3A89261E5EB17D08A26317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569618, "uuid": "5048628d-4fbb-4f2e-88d1-31f63109a5db", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569618, "uuid": "4447e14d-0ad3-4070-987a-9cc40a0e999f", "value": "3072:eGhntXBDPnfcfYHjfUzXmKK/LFFTapiQdwdQIo4wSb9Oa6V3cID5CpSOYQ:eGhnFBnf3wz2KK/ZFOp7kQX4rqMpSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632569618, "uuid": "f74bc2a0-49ba-45e8-b47b-338e167273ef", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632569618, "uuid": "cf42ce59-6ba5-40a6-b71f-95b3715dd66b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569618, "uuid": "cd837f29-381d-40de-84c6-546ff8b0de3b", "value": "ba76048e74f2527780b64dbe32f23bd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d69029-1e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632594917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594917, "uuid": "e4e28913-649e-48ff-8242-a22c90797317", "comment": "Malware payload (njrat)", "value": "3a78e71f75c331ae5ba44d223216a549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594917, "uuid": "561c4caa-dab4-47cf-a444-d0f23c54027a", "comment": "Malware payload (njrat)", "value": "0ada6c43746b280019ba4599becd675484265971fd3d9c48d74d25815275e066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594917, "uuid": "8e717bf9-2b98-484c-a74b-558fa3e8de07", "comment": "Malware payload (njrat)", "value": "3a63ed034a2ed3b98c6520be97aa1e693d706adf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594917, "uuid": "6e15d2f7-603d-4d37-b543-f49d6b0273ec", "comment": "Malware payload (njrat)", "value": "514d864ea80722189b9001cf1c243a2347708deb76f0fbf9942757c7be5f5ae00d5c41f7651f198f5fce4e133391ad14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594917, "uuid": "38205805-4432-42bb-9b58-c283c1caa09b", "value": "T1ABA45A493775AB16E3F308B23591BA7EF71ED301E612D0078D6359FAEB45090A096BF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594917, "uuid": "34a35e7e-3eff-4bf4-b53e-5d1412a6f81f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594917, "uuid": "85fa4a91-0138-4cde-b12a-e523dfb40ead", "value": "768:z0pXcWuTsKbIhM9gHZlobqwF89m9tyG/BR3oR/f7z8S9Ybbken7nI4oa6b1O6RV8:qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632594917, "uuid": "64699442-e4e1-4684-9dc8-146315c107f7", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632594917, "uuid": "e7cf69bd-638b-4f4b-b7d6-80dfb09e0324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594917, "uuid": "89a6d13e-3807-4768-928d-53819dbefd4b", "value": "3a63ed034a2ed3b98c6520be97aa1e693d706adf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57454fef-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559273, "uuid": "2304dac0-ccf7-48b4-8f3a-56cdf672926e", "comment": "Malware payload (RedLineStealer)", "value": "9ba57014ceb07ae777e94aafc7372817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559273, "uuid": "cd15ee90-14ee-4450-97b7-5c6cb6595def", "comment": "Malware payload (RedLineStealer)", "value": "0b396848e98cfeb35b16b565250d22aa58c449e59c0a1692b5dde580b46fae1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559273, "uuid": "e38567b0-92e9-4445-ab3f-2c65ae3a4075", "comment": "Malware payload (RedLineStealer)", "value": "50784c2a093cd8a178d58696410752d481200f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559273, "uuid": "5392ef2b-744f-46c5-a21a-15d128a2e4c8", "comment": "Malware payload (RedLineStealer)", "value": "d77740e32ec3e61efdb40a9643eb66c006b41fa157afa95572b74123384b313f3d4e4cb53f318250a99950ec2a732460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559273, "uuid": "2734e7d6-269c-4fe1-8aa0-bee5784e15c3", "value": "T1EF74D020B7E0C034F6B312F599B9D3B9AA2D7DB05B6885CB63D51AEA52706E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559273, "uuid": "12591237-73e9-4898-9e30-91ef1b102518", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559273, "uuid": "47cf9f76-7ac4-4548-8345-fe6e4458aad9", "value": "6144:Xsu3q5fxG1/0Bjmq9eP89wZWJuB5h8AocuGdyD4jbel5VeG5q:X53q5fM1/mm2uB78M3dy37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559273, "uuid": "321bdb71-851d-4c83-8368-67a9700e9206", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559273, "uuid": "1352cbad-ea0b-455f-9cb3-24a7bfae5a9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559273, "uuid": "8de30253-bb39-47c9-8e35-e4426cd751a0", "value": "9ba57014ceb07ae777e94aafc7372817.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ebf3d5-1e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632605368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605368, "uuid": "f16ab806-55f5-4aa0-9d19-83421f5ddc1e", "comment": "Malware payload (Gafgyt)", "value": "050a02100d4086b82d54e2d3f1fb3245", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605368, "uuid": "140e2777-c38e-4f58-a2a5-432612af68d5", "comment": "Malware payload (Gafgyt)", "value": "0b72e5ec12434322611980835e5ffd762d0572171878527bff13572cff2ea3fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605368, "uuid": "baa266eb-346d-442c-bbab-41829d160e1d", "comment": "Malware payload (Gafgyt)", "value": "ec5d0cef7a3f4876987e6f6a943729156f501f41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605368, "uuid": "6c0c785c-9fed-43bb-9a35-73d2b713f3fd", "comment": "Malware payload (Gafgyt)", "value": "345697e396a2be490d38c8871e90e94335a6a4b680637b61d5e25dd398b324ea9d4950b9a8eb2f14d4cb43fb429a8f45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605368, "uuid": "eb56ee02-f781-4a46-91b7-4ea80ae2c08d", "value": "T1D8832B41F9018B13C1C327B6FBDF47593B366A9497D73302AA297EB42B837991F29610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605368, "uuid": "c8ea5d18-a3fd-4c9a-923e-236f38d74031", "value": "1536:h9FUZ/fa3GzOqc1hR+6U+vRTffiMHp5KGB7OIm+mrQhrWKjsVMn:P3F1CGRTfp5K2m+mrQhr9jsVMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605368, "uuid": "967983b3-379d-4bdd-af00-1554f2f8f63a", "value": 85920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605368, "uuid": "6a394dad-389e-45c3-9f53-1d9856ded90c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605368, "uuid": "bdd6d29e-9798-4841-9378-b72ae2cf0ef7", "value": "050a02100d4086b82d54e2d3f1fb3245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb41a855-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556891, "uuid": "492115af-8c5e-4974-a0a8-6f28856b3718", "comment": "Malware payload (RedLineStealer)", "value": "9c9207e4c19eaf8c5d85e0ebb7928d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556891, "uuid": "b8c08be1-4df4-4780-b723-7f773ee69c2a", "comment": "Malware payload (RedLineStealer)", "value": "0bf6a1d5881e769e61a2f671e29dd45c0d3486f306b3d52f2976eb7223694256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556891, "uuid": "4f9b41ca-30f5-4468-b3a6-0a2c19f66254", "comment": "Malware payload (RedLineStealer)", "value": "c1f87583a6e77b443a2ffae2e5cb3c74c5b6b8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556891, "uuid": "b1beb265-1fad-4e70-8a24-6ffc29a95bb8", "comment": "Malware payload (RedLineStealer)", "value": "61587bb0db282bafc581419950880e95de873edb08d29d2823795a71dd422e1fc6050507996e03fd7e3d0c01d9edaa46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556891, "uuid": "b6daf93f-7e95-44b4-97e3-21bbd6a8620b", "value": "T12684CF2077E0C039F5B712F649BA97B8B93D7AB06B2890CF52D616EA52746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556891, "uuid": "159c204c-6b28-43a9-99d9-631ceacbe548", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556891, "uuid": "7bab29f9-daa3-404c-a9fe-0c2ed487f595", "value": "6144:pp/ToiYjh9lKburnI4eZsSorx5exAUQzWBcNbWSq9GKil:pp/Tqjh9lFrdeZs1ri2nKBcML9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556891, "uuid": "024826d7-6a5f-49d7-83d6-e97c2e7c4238", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556891, "uuid": "91a164e0-03a4-40be-99d5-44d7f6e73c21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556891, "uuid": "6b95cb4f-9d81-44aa-aee1-445924d204df", "value": "9c9207e4c19eaf8c5d85e0ebb7928d25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78c7d95-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556884, "uuid": "cb56978c-57e9-4aea-af2a-d2dcfe771d85", "comment": "Malware payload (RedLineStealer)", "value": "25e200ef3ac6b6ab551e97ad8212c231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556884, "uuid": "c55dc321-7e38-4d32-9f4a-d717245ce503", "comment": "Malware payload (RedLineStealer)", "value": "0d7e4504e34ba7c354478d7e236e2fed7f0f318fc977656286211a0dff5d6048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556884, "uuid": "1d7e2a76-6cad-4895-bf22-18b66d7230f8", "comment": "Malware payload (RedLineStealer)", "value": "d438165652dd002814acd2e099c784e4314ab76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556884, "uuid": "1592b718-9021-4517-bb25-6f8eed7d42f6", "comment": "Malware payload (RedLineStealer)", "value": "faf40117b1db0a6e140b1241d0dc11b5627b6ad16417ac1c191521b61f24e448f6c7964dd5aed29ad1dfa37bf34c0f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556884, "uuid": "f74fa322-02b0-4868-98bc-6d6df4d1dcb0", "value": "T1D434E05025F08432EBF29B749931DF98667BBE721E31818F77C4176E1F22291B92A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556884, "uuid": "652b34a1-6a3a-4495-b3f0-644ab7482664", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556884, "uuid": "32258202-7b9b-480a-a2a2-7f4b5da569f1", "value": "6144:6uYIbrsVjbVxxYC52SGi1CT/vD9AnPvE3:6uYI0bVQ6lQvDOPvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556884, "uuid": "7ea92033-8032-43f4-b790-72354246ec65", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556884, "uuid": "f9a4fc23-024e-47ce-959b-1ba6da22218e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556884, "uuid": "83f19b8f-0d51-49e8-87f3-246cd5eb77e7", "value": "25e200ef3ac6b6ab551e97ad8212c231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ff1ec9-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632573632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "332c819a-5e01-4e3c-97c6-48b791e48ad9", "comment": "Malware payload (Squirrelwaffle)", "value": "e8f3bcb2560827a8aee38e739fe927af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "82f9bf69-3ae7-40e4-aee0-45d1adf2ff59", "comment": "Malware payload (Squirrelwaffle)", "value": "0d82df77582d5ea4c734ccac7c0c6559398e0ff942d8ce49772713b47667380b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "462bfe99-8717-4c93-bd04-698cf0f5c22a", "comment": "Malware payload (Squirrelwaffle)", "value": "2468ca8a3ddf6c763b7e9378fc4676d90a3f5637", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "ebd29fe8-a21f-410f-b341-07a16dd02573", "comment": "Malware payload (Squirrelwaffle)", "value": "3e1f577be9282c9d71a4a3a5a6ab660750e3d589cb4120c91643a69733d25e234db503f691f4bd6830a66bcd28792aab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573632, "uuid": "f0680c44-a3d2-4c91-a08e-333c4d7ad4de", "value": "T16664F6A5BD4D8C33FDD8363152836E1C691A3BD3B16C328F326EF6146967F44A892E50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573632, "uuid": "680eebb5-55e1-4898-804f-5d5931efb113", "value": "6527345f9aee9363b094aad01304de88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573632, "uuid": "5f2cbbb0-e8bd-4553-8805-d622633d25e6", "value": "6144:9/st+16ZWiobj+n5QZRO0Xj/Ee+aRLvccAOPyI:A+QoOaEFA7RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573632, "uuid": "c743d28a-ce93-40ea-8868-854fdb73e3b8", "value": 320541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573632, "uuid": "42286953-9311-4154-992e-937967465af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573632, "uuid": "e2f2b640-1f46-4227-adfd-926ea92ae0a1", "value": "e8f3bcb2560827a8aee38e739fe927af.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cb3e24-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562671, "uuid": "ddfadf4b-2252-4a4a-ab55-4105bd73437c", "comment": "Malware payload (RedLineStealer)", "value": "ea82729c16f0066b15d6ecf7600e9069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562671, "uuid": "f7b270ae-309c-4db9-b256-c1ba2338fa64", "comment": "Malware payload (RedLineStealer)", "value": "0eacfcddb54670cb6b1585e554d4bd26bb7f74d5b0728b1679b117f49b349743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562671, "uuid": "48b15cdf-bc66-4aed-b57e-513533357453", "comment": "Malware payload (RedLineStealer)", "value": "a811e4936c9965d452fea56c0e50e0349b9b7878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562671, "uuid": "e91b35e8-0080-491f-98fe-69b4f74f1c4b", "comment": "Malware payload (RedLineStealer)", "value": "d33d3b3ac80c43eddba5bd05d311a72d8e740455e8ba766c3695472a56dd119873903533bbcc93066fc86a6c19e90133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562671, "uuid": "e258ef2f-0bea-40e5-a151-d761d9ab4e70", "value": "T15874BE20BAA0C031F5F716F815B583B8A93E7AB16B3480CB52D656ED27347E4AC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562671, "uuid": "a60c06dd-f0aa-41a7-9e07-26c82e76b613", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562671, "uuid": "b0e62946-c938-4a97-9ecc-b6d94a9dc886", "value": "6144:WNZQiiWzV62WOFzFJvOkwDLkqHTnalC9mvewVvASX0Y6c8esu:UZVzV67OJvOj08naUmvewVvtVNFsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562671, "uuid": "b9860643-e9b1-41d8-8dd1-2307c6e9e3fc", "value": 340648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562671, "uuid": "e85f56ce-1bb7-4edc-917e-7a891ba3f276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562671, "uuid": "d5e2e2e0-a508-44b3-a5d1-269c610180b2", "value": "ea82729c16f0066b15d6ecf7600e9069.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9ed96b-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565157, "uuid": "e9e50e98-351d-4dec-88e0-ea3bae9e7693", "comment": "Malware payload (RedLineStealer)", "value": "e6262eac5bcab494e1b1011b2b7d66c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565157, "uuid": "e0574ced-135d-441f-a196-3923bc33666d", "comment": "Malware payload (RedLineStealer)", "value": "0f2e6968f4354610048786db7d9a98b62bf759c46f9922152ea14ab5fe880e33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565157, "uuid": "c0dcfb6f-f97b-4e67-ab1d-2c67092ab971", "comment": "Malware payload (RedLineStealer)", "value": "167c5519ce4b1ff03d68de19e6d586cef0ec2feb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565157, "uuid": "c697ab27-bcdc-4c39-a393-87405e687992", "comment": "Malware payload (RedLineStealer)", "value": "bb10c6e3773cf4141048addef35574824b42d19828e3602a35703f3e1ee69ae697cf05b6d5974ef179cbb8f7e2656177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565157, "uuid": "0f949ae6-3a0a-4b9c-a788-781b54a43c51", "value": "T1F854BF20AB90C035F0B312F859BA9378E53D7EB15B3491CB62D626FA67346E49C30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565157, "uuid": "d5667a40-cba3-473b-829c-657c075353e8", "value": "90edc546938f77c6811e626812a78363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565157, "uuid": "a6a84f8c-2e48-477f-ba8c-0d1e776e5a74", "value": "6144:whZQm7qmzodtyg67zakBX30PSuA9IFLuek6EoFkjdtxmWZC:GZLodtygCzh0PVA+F48WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565157, "uuid": "9f024671-d224-4fec-b012-41399e0d8bfc", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565157, "uuid": "320af7a1-152b-42d1-9233-03ee8e056d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565157, "uuid": "87e1537d-2f75-4908-871d-081f652e9373", "value": "167c5519ce4b1ff03d68de19e6d586cef0ec2feb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79a71fa-1df0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632568105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632568105, "uuid": "684aa168-107a-419c-9545-12ea94975dc2", "comment": "Malware payload (RedLineStealer)", "value": "438cea7b85ac9253cff796356a57c260", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632568105, "uuid": "038819c1-1b6c-4723-8cf4-6e6d7aa44aa0", "comment": "Malware payload (RedLineStealer)", "value": "0f413477b0a01b7c34c422767d2886bc703ba8e34b2f835f2f41661e758fb101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632568105, "uuid": "3879434a-05ff-4c91-9cae-3c2890a42215", "comment": "Malware payload (RedLineStealer)", "value": "e2ea5f5e932edd1c31cc9bdcff5e1066f79f813d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632568105, "uuid": "bfe0e61f-9022-4c93-8597-443328b467cc", "comment": "Malware payload (RedLineStealer)", "value": "57920b313c5c6a15a41d258b97d243cea4f6e9a82e295f2edd7b9c7b69f4a6730ad37f92c64d24327861ce56f5b0fcb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632568105, "uuid": "0b7b6561-ae3d-401c-a455-0e1e2b8896cf", "value": "T13944DF11B2A28433C3E31A764875C2B4596BBC262F6741CBE77D1F5A5E327C25AF2312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632568105, "uuid": "b8af9048-86ee-4b2f-b98f-fb2f583655c1", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632568105, "uuid": "798a1ebb-6f2b-4b7c-945d-63fb97e405ae", "value": "3072:7OYJ+RujHoG12dWJKDLUMpuJpVtO1sweIDmfIrjqiE3gz8c5VMsGYSgS9H6dYe:7OJRbtwKcMpuJpTkswgfyvwOEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632568105, "uuid": "504492ae-e608-420b-8839-44970c9f50db", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632568105, "uuid": "186ca778-6c89-4a2f-b0eb-fbe2470825fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632568105, "uuid": "db8fa5ca-a663-49ba-932e-e6bdf6766432", "value": "438cea7b85ac9253cff796356a57c260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9540b21a-1e37-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632598461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598461, "uuid": "66a381ca-7e56-4406-82eb-939a88b823a3", "comment": "Malware payload (RedLineStealer)", "value": "2f3d8be0a78fc37621172b9c4e4ae73e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598461, "uuid": "68c07644-3716-4f46-b229-db019e8ed079", "comment": "Malware payload (RedLineStealer)", "value": "10408f8456addaa2ec0c7fb4154d9bfff76c3d453323c7d0ae467704243cc445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598461, "uuid": "fd45115f-0792-40a2-957a-39be1290df91", "comment": "Malware payload (RedLineStealer)", "value": "a6ce190cf6067a77adf7f6faf2091a3365cf71cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598461, "uuid": "78016f07-7827-45ee-8bfe-eb1f50f5acbf", "comment": "Malware payload (RedLineStealer)", "value": "f1d3fae901182e1f21733767875cb0213ae78d30813bba5211c5ee82ceed7653cddc968a4b9775d69cfa433b09318950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598461, "uuid": "d5546f02-3860-4008-95e8-b9948c443ee6", "value": "T18044DF1072AAC6F2E7E70834497CF26056FBF8321E77C14BF65D0A1A5E712815AEE312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598461, "uuid": "ed6269b7-0bc6-4e05-8948-ae1d1cda83cd", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598461, "uuid": "0239b70a-a60b-496d-be63-491201ba4515", "value": "6144:TJl182D2nPdWi2p31jWNuc+lp7tGPdnxVtUUfKoKinEad:VNegLp3tWPotIdxoUCoTBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632598461, "uuid": "6255a195-3eb0-4bdb-a923-8d40888b55ef", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632598461, "uuid": "8b2d05bf-45f2-4ee1-b55a-211b3e7f14bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598461, "uuid": "b51a5561-d5cc-4470-9670-ac96be8cd1d2", "value": "2f3d8be0a78fc37621172b9c4e4ae73e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e91855-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556853, "uuid": "6ffd72ad-3bd9-474d-90be-dc1f5e5cef8a", "comment": "Malware payload (RedLineStealer)", "value": "6991603097a011d73b25213dba357b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556853, "uuid": "e28cee8c-dcc7-40c1-a6e6-b788a384134b", "comment": "Malware payload (RedLineStealer)", "value": "111d1312a6f53b62202bc1901a200fecf7ad434853036279fe73287f8877897a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556853, "uuid": "308f617b-e3b5-4e86-9332-4069e1d2b099", "comment": "Malware payload (RedLineStealer)", "value": "c7d00bf33525837fd841c1d3d4255304a2b34566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556853, "uuid": "496b06d9-bcdc-4a82-ad4a-2a58f6b27b73", "comment": "Malware payload (RedLineStealer)", "value": "aeb319fd5b9ff0a5d9aad81612813f1b2e69fcde392e7e22768e02807f4563789588775c08996b43925ccc1ba03aff51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556853, "uuid": "26bc4047-0fe2-4ace-8e34-8851d457ae07", "value": "T19F24E120B2A0C036E1F35A7549B1F2D02A3F79637FB5878E3A44271E3D217D1962A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556853, "uuid": "969a0418-903f-48df-b59c-24ce89a232a3", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556853, "uuid": "73183a96-8195-45aa-908c-effd3c683bd8", "value": "6144:cGpz7KFZCZCVpeaFOxElVLiqd2SsKVYNrS:cGpqCZCVuE3eqdmKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556853, "uuid": "028adcc8-47aa-41a6-bcd4-7a24b642eff6", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556853, "uuid": "e6fd5e7e-6586-4834-98fc-0c101cc71ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556853, "uuid": "d71ac7dd-b71b-4454-9931-bbc3c4704f13", "value": "6991603097a011d73b25213dba357b93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a5f429-1df5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632570217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570217, "uuid": "26c9777b-c3ce-4eb7-a96e-682f90fd320a", "comment": "Malware payload (RedLineStealer)", "value": "a00e4fa185e2e0df564a2ff808a29a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570217, "uuid": "35361432-5940-489c-90a6-ab2ea09f5a56", "comment": "Malware payload (RedLineStealer)", "value": "112222e358613dd59bab7d3c0901b6f1ad0490c95cc89e3dc3de51b9e80545c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570217, "uuid": "e09a194c-86e5-4bfc-a6e3-2cc4c8e0cb1a", "comment": "Malware payload (RedLineStealer)", "value": "7d317f75edb049b5e6abf50f334ccc05516272ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570217, "uuid": "bbf32894-9456-477d-98e2-1686c17baa24", "comment": "Malware payload (RedLineStealer)", "value": "00147ce3863d7b9fe55909120c299d751d2a57ebe30cbe8aec18e0377d852b1a20aca67487d3f3d5a9e43517e6fb3fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570217, "uuid": "f64c173f-e5a8-4477-afcc-16a3c8578339", "value": "T18134E0617AB3C132E2F749354978C7919A3F7C336A71820B3A751F3D8D226929A27317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570217, "uuid": "96998afb-5174-48c3-b694-16c24e70cd23", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570217, "uuid": "4c386e01-d333-4f9f-b225-15ac8c6214ba", "value": "3072:jOY9JzzRQU4deKTJRaK8TKSo2UQS+ukDfCaVbURk5ACc754N835Sv5lY2:jOofPKTqTKStUQSpkDfjUa51cdSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632570217, "uuid": "378f0e44-aecd-4826-8390-eceaade4edbb", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632570217, "uuid": "b150efb3-ac65-46e9-b587-a515280b2db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570217, "uuid": "9de2da00-08ef-4271-be24-f4d2bb1e776c", "value": "a00e4fa185e2e0df564a2ff808a29a6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7015ac1-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559917, "uuid": "c36ed58a-de5a-4a1a-9912-268b0a3e8d8f", "comment": "Malware payload (RedLineStealer)", "value": "4ac4e35b92672cbbb9d9727c4ac74f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559917, "uuid": "e7e83304-572e-416d-9ff0-548bdff5f51f", "comment": "Malware payload (RedLineStealer)", "value": "11d87dc5a25c72944fc7c9edff33708244ada7c57e35140f6319f51c4de45cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559917, "uuid": "3a58e7c7-31d6-4225-bfd2-b2184e9964e3", "comment": "Malware payload (RedLineStealer)", "value": "dbb447a765b7e2a19c9c799d5363b15f58370cc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559917, "uuid": "56a2f383-20e4-4781-b16e-ab21968df1b7", "comment": "Malware payload (RedLineStealer)", "value": "bd5a3991e36c2b670af9095672001140c851b5bda6c7cc5ca60b0417923e86b87fc36bf49df084206bab95b084782d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559917, "uuid": "69f0c6ad-ea5d-4bbc-803d-17b6e6fc6799", "value": "T1B624E12175F18832F7F35BB589B487A4557BB9732F71848F2A050A5ECE723908A2E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559917, "uuid": "0619b865-dec4-48ea-ab14-fc0b93a72c32", "value": "47bd1659724c857851ce24d0b21faf34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559917, "uuid": "1fbeee0a-dad9-42b0-98dd-4ceaae23f18e", "value": "6144:KbqBvFJcTulP8DFhRqN6OMHE63Mxw25stNsdz:Kbq9FJkbRHECMG25s/sdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559917, "uuid": "f2a4f520-2eb0-4fd2-b853-e6aeafa424c3", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559917, "uuid": "be73718b-081c-454e-897b-2bf69c984408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559917, "uuid": "e15263fd-5fdc-455e-804b-5ba05644d2d5", "value": "4ac4e35b92672cbbb9d9727c4ac74f12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3174792-1ddf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632560796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560796, "uuid": "ca77134e-5939-4009-b5f5-779b03f2f60a", "comment": "Malware payload (RedLineStealer)", "value": "6778794e6ead74d291162a0bab1b6d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560796, "uuid": "40125816-db7e-45fd-b3ec-1d2054cbc94d", "comment": "Malware payload (RedLineStealer)", "value": "124ccd4fb5d47dc51b374f72e35e9bf0c4524c1204b6b23953c1e982939a9160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560796, "uuid": "8f941923-6221-4b58-95cf-d5e7e57dd376", "comment": "Malware payload (RedLineStealer)", "value": "3fc5213ea6f228fe6f3d62553fa5f29404d0e451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560796, "uuid": "bb852bd5-ceb2-41bf-b406-5fcdf56088e4", "comment": "Malware payload (RedLineStealer)", "value": "79a4541caee5299d8a1ad38f975d5efe51cbaaee525814060f6a29a217ee922aa67a180a001660fb4c3d193d8181961d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560796, "uuid": "bc9397c4-a475-4245-868f-87fcb61f4d34", "value": "T19924E06230F8C433E7A39AF48670D7915A3FB9A22B34859B765C166A5F717C08B76303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560796, "uuid": "df71fdcc-bc2d-4ee3-b009-4628b86db631", "value": "5fbfc74c3ddccb96d094c58debd98462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560796, "uuid": "76c9b4a3-6f01-435d-8307-d34158cd622c", "value": "3072:B45M1B1b74iB0GIs6UOMBuxyWZfN9zudDa93dA3K8jw0BlaEkaxR+k5iLy0ASRe:B4yT1LBIsiiuxNQDa3d/8MQlar/LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632560796, "uuid": "8d72dfb9-9a36-459a-bd8f-15d86af59455", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632560796, "uuid": "932d54ee-efbd-4cf6-b6bc-335e87c3cfaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560796, "uuid": "a76a1c6e-66bc-4d71-a02f-8b2bf7ba7255", "value": "6778794e6ead74d291162a0bab1b6d4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58198e23-1d9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532646, "uuid": "630731c6-44ae-4d7e-bbb6-6b633964e412", "comment": "Malware payload (Mirai)", "value": "b2c2aaa56745525ff2e982a2a759fde3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532646, "uuid": "5002da5e-8a44-4e2c-b31e-9d7ea14080a2", "comment": "Malware payload (Mirai)", "value": "128eacd5ad4be63ec3cc2f1ecaaf5344c16bd38306a5d934ddb7cc6cbec935f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532646, "uuid": "17d31d66-4894-4b68-8509-07752c3f38d4", "comment": "Malware payload (Mirai)", "value": "365600f336bcdda2515c9869e2bb6e682ae95b4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532646, "uuid": "4ebd9fb1-758e-4a3a-ab3b-6ad1bba4780b", "comment": "Malware payload (Mirai)", "value": "5478cc480d77807290873c33ec5d926f457c9325ce48924d151a4ede57d9e5d9b52d250a561e27f63c2cf777afeb4fc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532646, "uuid": "f53cc276-8ee1-4980-8e62-0c51d5648b9e", "value": "T1E4A33C76E642C5B3C4430AB20297A69B4E21FD3B4D2A9F4AF31D3CB49B328C87115F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532646, "uuid": "36078e38-fc7f-415c-a37a-7b60a07047ac", "value": "3072:oM3IpPv1DXFTHctfEmPwcx8FYmmFVcqh09c2bB:oM6PvhCmmPwcx8FYmmFVcqh09c2bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532646, "uuid": "ed57a53d-b712-4015-9446-84e0ba6d385c", "value": 100096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532646, "uuid": "0a875a67-524e-44f7-9aaa-8961e2fa32b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532646, "uuid": "06587338-d2f9-4be4-8c34-ac1bac000c01", "value": "b2c2aaa56745525ff2e982a2a759fde3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15120dc2-1e36-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632597817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597817, "uuid": "dd8c5b29-1e0d-4a67-bd6b-acf2b29cfb88", "comment": "Malware payload (RedLineStealer)", "value": "c6e57e09b85a0ca9eee261154006adea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597817, "uuid": "87b87ac2-4ec9-4e26-bdd3-67612079a53b", "comment": "Malware payload (RedLineStealer)", "value": "12dfaeb190ce9a075ec57df27cf95bb210830568222f033d83c5aaab6426765a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597817, "uuid": "2ffaad91-521d-4dd8-b572-1e854a1c126d", "comment": "Malware payload (RedLineStealer)", "value": "9178bac7dce4695fc677941037d55d5960bbb713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597817, "uuid": "daa3fe07-8d01-4597-9139-5d6fa6eb68a2", "comment": "Malware payload (RedLineStealer)", "value": "7108c8f99b2be07f46ef128fb706a075249f8985e4e1b8ae82eda850338549116693e790877f8219727cb67d964f4cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597817, "uuid": "062b0f99-3f85-4f75-9b26-fe8f5cad45e3", "value": "T15944DF1072B1C832E3EB0A7C59B582955A37BC721E77865FF61C167A1E332918AE530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597817, "uuid": "6fa1cab8-1eae-4e31-b3db-173571ebd79e", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597817, "uuid": "1ebdff55-c510-44ad-ab0a-4283b686551e", "value": "3072:aE2DOsoL0izNo8A/h3ctXH7uyvLtGf+qKXx9/zR1RKiUd1hrQC10OPbUdHK5JNPE:ah3F86hM9Cyv/J/bAdnr10OPASzEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632597817, "uuid": "0eeaf2ff-f4b6-45de-bcf0-fcd2ecd2b145", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632597817, "uuid": "8b598de8-fd7c-4626-9284-50a6e20a6432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597817, "uuid": "0ec309b8-3b9d-43e4-a199-1b5dde5eca16", "value": "c6e57e09b85a0ca9eee261154006adea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea9f457-1e53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632610396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610396, "uuid": "c04aa796-e1c1-411e-be07-4e99cfb58378", "comment": "Malware payload (RedLineStealer)", "value": "41fc599d5737fe9fa5668e1a2906a4dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610396, "uuid": "8702e0c8-f844-441e-8970-bcb287a83526", "comment": "Malware payload (RedLineStealer)", "value": "130cf1b8065ef35f07ea6ff2221651d4e372fdecce0aacd8209369cfa8d28f9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610396, "uuid": "c8ef6a6c-5672-42d6-93ad-de200b31d0f8", "comment": "Malware payload (RedLineStealer)", "value": "34935349d39d27b1410f3c51980beebd6b27eb40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610396, "uuid": "0ed05ed7-9b9f-4e56-9cf3-b59ebd71bf42", "comment": "Malware payload (RedLineStealer)", "value": "5a13b9eb6aa8f2f7c2dee782ed0aaffcb5e3dd1336be12682386bfd94170ca495819a3f6c98d20d0370b9266a74dcfe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610396, "uuid": "52bc5a75-be75-4994-b82b-b7593829de6b", "value": "T14D44D02077A2C831F7E3B974592586A56637FC626E33815FF60C1B4E5E222C19AF2317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610396, "uuid": "87dd27b6-cff6-4607-95ef-b537aaecfb8e", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610396, "uuid": "86604995-abc8-410c-b017-e4a8cf0690ca", "value": "3072:iEQwH0QXSCqWy71zzl89iCZE59c00uYfgdSAQSM0We55TCNs7FciS9H6dY3:iiSh7zzu4Cubd0uVSAO0PT5XEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632610396, "uuid": "4eed7296-13c7-4948-8125-fff85997ac6c", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632610396, "uuid": "b4885fff-e42b-4837-971c-94448693499f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610396, "uuid": "1982821b-9a5f-41d0-8c2f-35d862012f3c", "value": "41fc599d5737fe9fa5668e1a2906a4dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b36fec-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632552503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552503, "uuid": "2abbb2b9-0346-44ac-a3c1-a71efb21d1e2", "comment": "Malware payload (Smoke Loader)", "value": "45429bac42f102d6b5a9fc45fdafb340", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552503, "uuid": "775de097-4e7f-4c36-93a1-4d5e5c2cf04f", "comment": "Malware payload (Smoke Loader)", "value": "133304b5052863dc2916413ac706f13189ac5a40698bdcbc30f2ed82dd99a1eb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552503, "uuid": "c19e50ea-48fd-49f3-bc38-df4d1edc1ff0", "comment": "Malware payload (Smoke Loader)", "value": "377444ca89882de437165cd24def5ea9eee30db9", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552503, "uuid": "582d7112-5c4c-4c45-8df1-e302421c9d1e", "comment": "Malware payload (Smoke Loader)", "value": "80faaa0a084c326367371c94c0d95614f8acf975d72e1274f5b69b8ac38cc3e2c57e7c41bc986e88125fa1e56b30f992", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552503, "uuid": "eb3c713b-e0c8-4699-882c-3c4087adbb51", "value": "T1AB549E20B7E0C035F4B713F949B997B8A92D7EB06B2890CB62C617EA52756E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552503, "uuid": "ffb6dd63-3783-4d8e-8ad5-35406cc62cb6", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552503, "uuid": "ba018716-eb0d-4942-abab-4252f4727258", "value": "3072:dAFxXBEcqxT2RjRkn/lWBF5KPRu0ay/MvVDKk2QA8ohuTjLP8HHUTMQKm5yUH:dATXL82RjRGlWb0PjTk2QRohuT3Pzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552503, "uuid": "0420c2b5-e173-499f-b39f-a76cecada3ee", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552503, "uuid": "db617d78-d720-4352-a5cf-f804a3d4eb23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552503, "uuid": "7811690c-f857-4352-a923-92b1392005ed", "value": "45429bac42f102d6b5a9fc45fdafb340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99ad3ca-1e15-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632584027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584027, "uuid": "c40ed06b-f9c4-443e-9b6d-e00f0758b174", "comment": "Malware payload (RedLineStealer)", "value": "1c117dcbf5a8fd565e286eb9fc1902f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584027, "uuid": "de818d35-8589-45c6-af11-8cebf9ad5bf8", "comment": "Malware payload (RedLineStealer)", "value": "13769d8301e8a5636e3ed2baa96720b70ca1267fc639ceaa48cae63db70afe98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584027, "uuid": "1ff92f63-2c13-4a11-9dd8-e456b0aae660", "comment": "Malware payload (RedLineStealer)", "value": "bc82aacd5bbd03d685ac389fc6bc9e27a411f1f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584027, "uuid": "4a62776c-b6a9-4fdf-ba06-e4c7a3da748b", "comment": "Malware payload (RedLineStealer)", "value": "7a045bce11a41477de05790c66db79d21763567faa0f85e7b2459afdf5fc293b9e25752bd1bc8bf575cb1db90839f73c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584027, "uuid": "2ee99096-5bf0-4c4d-84aa-d24ec33e6e2e", "value": "T17C44D02036A2FC71D3A749751A35D3E0563BB9322E37864BF71F174A1F22281A6E6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584027, "uuid": "948a4d70-58db-42ae-b156-2ed9f6265717", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584027, "uuid": "16c0633e-1bac-4f3f-9a41-8ba442e3fab8", "value": "3072:JFwNuSsJBDRF/BDkwlnjtAdahWmUUNBx4IITvU2iN/5nvR85S2uWn9S9H6dYe:JONuSGDFBtnjYah5NX47vXJJn9Ead", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584027, "uuid": "e563a8cb-0a07-4f6d-9617-f056dd6bd100", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584027, "uuid": "fc7e1f27-13f0-4880-9586-425bab2059e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584027, "uuid": "bb41958e-5704-4290-aa06-39e60f5f5c39", "value": "1c117dcbf5a8fd565e286eb9fc1902f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc7839e-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632556788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556788, "uuid": "1ae97c1c-88f2-49e5-b6db-1a7a7106a1b6", "comment": "Malware payload (AsyncRAT)", "value": "51bada4133b4400a6f7acac7e67695af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556788, "uuid": "845a1e96-b829-4b2e-9a44-953a7431f6b1", "comment": "Malware payload (AsyncRAT)", "value": "14670db63054f493d6b33519e1eab9caf1dd1576999ffedf775d19119c0d78e2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556788, "uuid": "39214308-f190-40de-a756-aa3b6cb96b45", "comment": "Malware payload (AsyncRAT)", "value": "53d9b24ac41d2c5b5452c004797a9aff04a64487", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556788, "uuid": "122f0849-754d-4cff-8863-c23ed7e10fdb", "comment": "Malware payload (AsyncRAT)", "value": "466b8c7a814d87e20d788754a4c48388c2fe82eaba8bc513d3690cfad7381a55f811971afdca824fd388d96659d2cb12", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556788, "uuid": "cd4e808c-2264-4106-846c-76a2eaabafd3", "value": "T19B557D30CB1EB4CA461254A336CB99370E654F0326D8DF9934ACD934DB1D96C4DB9533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556788, "uuid": "b191556a-ad1a-4060-9c8d-feb23bf19b56", "value": "48:ddy/nt1L3Geqqqz3L0exPf70ZvTlIWfu5:ddUntpbqqqrL0wPfYFTlIWfu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556788, "uuid": "1a6ba3bd-7ffe-4b54-b5a9-2677b6f67147", "value": 1327456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556788, "uuid": "3e9c2f9c-46bb-41af-a76d-417c98aeba5b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556788, "uuid": "fb257927-8d3b-4d2c-a6ad-422a0cb603e1", "value": "KDH32783JHC73287SDF87.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba66aa2c-1de6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632563734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563734, "uuid": "56051f9f-9921-4835-89d0-54f53f9beb36", "comment": "Malware payload (RaccoonStealer)", "value": "58c4362e759e839d02238640a873c729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563734, "uuid": "53f77eee-8b32-48d4-b362-f5be83d15ed6", "comment": "Malware payload (RaccoonStealer)", "value": "1493fc3f03016cd9d1c43c5e2e37ed2a618e0eadfcd35d4aff12f42e2e443813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563734, "uuid": "56cb6ed7-8c7d-42fb-a989-52330bfc5f05", "comment": "Malware payload (RaccoonStealer)", "value": "d7be7938ffc8598f48c28ada754f7284820211a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563734, "uuid": "0465c164-1172-4895-a139-c3ac8fe40891", "comment": "Malware payload (RaccoonStealer)", "value": "29a2d5be000c55feb1fd733e7681cbbb890585f811def25adb16f278674cf9455f9df254bc9d04d7219b2e071898bf9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563734, "uuid": "47ce3ae3-8a54-44b5-af0b-837c8149cfdc", "value": "T182941221B7E08433D2A76A794921EA416D7BBCF2EE3DC14E2A442F772E313D05926317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563734, "uuid": "8c66ae9d-f002-4f13-8ea7-80e7d569fa2a", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563734, "uuid": "e1733207-a128-457d-8174-ecc528326e1f", "value": "12288:Co9dEezcIDg/oQoqpHTq5LgGORKyEvE/z3s1:CzecD/QIHO5LgAyEvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563734, "uuid": "27d580ec-2fbb-4fc2-9ce7-278f7919bf80", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563734, "uuid": "fd705620-5c84-4496-9d77-b047b4e2e109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563734, "uuid": "92486f45-c1e4-4202-b916-b3318ea19979", "value": "58c4362e759e839d02238640a873c729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a44b159-1df3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632569264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569264, "uuid": "d0ee3c0a-f6cc-456a-83a0-c70d42548270", "comment": "Malware payload", "value": "c4f1adcd03ce1b18687fee4246d3547e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569264, "uuid": "cde91247-4e18-4592-a2f7-a0e1b54f77e8", "comment": "Malware payload", "value": "14c71d639d1f1bb7d988c4560419269069b0644cda9751decd84e2d968658523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569264, "uuid": "2dce3287-3460-4440-97b5-f6a9ad8b1f17", "comment": "Malware payload", "value": "fba0a577adc6b7582cdee19dbc16a1ab55036af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569264, "uuid": "9ebc638e-f631-45d2-963e-a2e9e27f7ff0", "comment": "Malware payload", "value": "7348d75e2cc58696541096c813603abb2f84742548453ba15a60bcc109785b7f36edeefab53c4e798a1b3af418c7c4a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569264, "uuid": "421d2427-e324-48af-a486-77f9b2877af4", "value": "T14CD41292784084E7F8774C772562CD7BA4D2AD295804869BBB1CFB6F5B33A44DE0133A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569264, "uuid": "60b5159f-9399-4a4b-acc2-9cf404bf7f32", "value": "574fc8bd765c45c839d5b6ef4e76cdf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569264, "uuid": "53a44125-6dd9-455f-a304-e664d81b4537", "value": "12288:j/ebPZW6rXCkbXYjYi6tU20cXMBJXZ8Nd3tLjR95p4WXQh+EO7vA:jeEypXYsit20cXQENNtLd/WjvO7vA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632569264, "uuid": "ef59445a-4236-460c-82e7-336f9094e426", "value": 607168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632569264, "uuid": "60487d03-b43b-4dfa-847d-641dc03e5425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569264, "uuid": "c1448c6e-9e01-4e47-99a6-c85c6ee2cc24", "value": "DS-Setup[ZYiO2kA].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213186c1-1e2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632592683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632592683, "uuid": "e945c1de-03e5-45d9-9a09-48e1a98c8a1e", "comment": "Malware payload (RedLineStealer)", "value": "57a23b83f6187239ad7bbb6faff7ad21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632592683, "uuid": "fc33039f-fa3e-4bd4-ba46-4bc5c862587d", "comment": "Malware payload (RedLineStealer)", "value": "154019f3ffaf8e563b0022926b336a48e36417d27341bd91b11b0d9e6f0ac1e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632592683, "uuid": "1eadf2cc-ab46-40b6-b76e-87811921073e", "comment": "Malware payload (RedLineStealer)", "value": "1916f67f0b65388886883b2a27266df5e0ea5613", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632592683, "uuid": "8d2fc49b-4d72-4b2b-8501-49046f32521d", "comment": "Malware payload (RedLineStealer)", "value": "76b5e58834fadb38186f67931bdc5f17fa9a13e539f91d238ee7b018714d33a466102f8ced879b139eac5bc6dc34e1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632592683, "uuid": "204a70eb-e48a-4010-b095-93c9a83d84b8", "value": "T19A24E06176B0C437E3B716B49870D7812B7FB8736BB5814E36580B9E0E312D29A7A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632592683, "uuid": "5d140b0b-e7e8-4094-93da-e7407b9323bc", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632592683, "uuid": "63994485-5067-4f62-8e7d-3ffa83d8f874", "value": "3072:hB+C1vnN3YsqFGEzyzT6uzFlBnoa9srckKmUHPLFHtyq4r/h4D5tbbaY5:hB+o39Y3u5bbirckKmUDFHhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632592683, "uuid": "48fd75ff-8eba-4845-88e7-8ef8d5660dd9", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632592683, "uuid": "dc6c9ea9-8c93-4586-baeb-4b1ec4e71e1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632592683, "uuid": "2463b051-4d51-43bb-8f0d-150b735de04c", "value": "57a23b83f6187239ad7bbb6faff7ad21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fee74ec-1e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632593513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593513, "uuid": "8c9d6385-202f-4bcf-9ac0-495e2f3f53be", "comment": "Malware payload", "value": "b235c5ae6e3d3b7503c187074aca1f0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593513, "uuid": "7d81df7c-64f0-4b10-b2fe-9824ea677d60", "comment": "Malware payload", "value": "1576e741674fb57e8788c4a95615b73946cca56bf18e117c5dbe5ea412fdfa82", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593513, "uuid": "5d7fe2b2-878d-4cc9-8bab-ebe1fb88ed2e", "comment": "Malware payload", "value": "49d6d64ed718897d889c83b28e01a92bc5323d3b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593513, "uuid": "09b16020-ea37-48fc-8c68-c14762595914", "comment": "Malware payload", "value": "c264ab7413d3ed4ede75ab75d15df7ad57dc5383bc1d40502c6c64454646b2146c7fa1ff2b727e3cc99e892118c96718", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593513, "uuid": "6bbb8fe6-f45b-4972-90e5-5821c88ebe30", "value": "T181921CD5D752C574EABB01F66A713D6C7D6E8A0203CB41F309D84E2D9B898C63DB18B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593513, "uuid": "7d1bf28c-5915-41d3-86fc-0af9738651a4", "value": "a4dbfdddf99d7cde4db0ccd5b4ac4ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593513, "uuid": "1780ddc2-7d65-4ad7-b06d-3f263d673279", "value": "384:OW789SqTdbKauboaofJM6h0aWwdN8E0nQdbez:f784qTVKDoaohM80Vm4nQdbez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632593513, "uuid": "670a0140-54d4-4a51-8e7f-758fd8e410b4", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632593513, "uuid": "8dafcb0c-c36d-4e66-9293-0c80a653f9ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593513, "uuid": "3d2ab518-c288-4337-93a1-a49a9c73eefb", "value": "SecuriteInfo.com.Trojan.GenericKD.37646766.21896.21825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58c58de-1de0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561122, "uuid": "5a1a895d-3330-422d-ab17-c4442f15c329", "comment": "Malware payload (RedLineStealer)", "value": "a3b14867a8a29003ddc9e734ee29e097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561122, "uuid": "c87292d6-44b6-4c1f-a0db-c2014cd055fe", "comment": "Malware payload (RedLineStealer)", "value": "157de0cb9d98f5da07fdda4961323b8678bd1c82cf6cd6461558ab6994d1a59c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561122, "uuid": "97c95456-22c9-4ffe-ba9b-5bca747d9e06", "comment": "Malware payload (RedLineStealer)", "value": "fbd711b29474b40187aca5791cab4acf78dbc5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561122, "uuid": "e294b522-1da6-40c8-9843-132c91c1bf57", "comment": "Malware payload (RedLineStealer)", "value": "9bfa3d4581af6db6871dd4761f41e761930047cac3a4f52e414603f4937618f815caa71fb8b89e06781c91699c72c538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561122, "uuid": "a3d22eca-a76d-413b-9413-68bd74573560", "value": "T1C5B4122035F1E637C7E395B595B6C38C5E7B79236B65847A7A08232A1E223C05E23733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561122, "uuid": "1555901f-7de9-4b68-8421-7c0e75723707", "value": "5fbfc74c3ddccb96d094c58debd98462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561122, "uuid": "bc2376fc-2ac2-4a6a-ac7c-a407f766cfcf", "value": "6144:PoMEiUsqxUNtfCVQ6Qtg0z+1uXoFcqo3X1DoyIBedSqITkcdQCEPAEoayQuoDOMy:QL5sx472gUcBi9NEcxPAEtyQZDVipAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561122, "uuid": "a9bc5620-36d3-4fa6-b6aa-3be56a358251", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561122, "uuid": "fb4225df-1d38-4259-a25d-1c6dd17fdab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561122, "uuid": "81b2c412-df1f-464b-8971-35ab9bc0abe3", "value": "a3b14867a8a29003ddc9e734ee29e097.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533fbba2-1d9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532638, "uuid": "ca8de2bf-6b51-4d60-9c43-e3eb66e853ca", "comment": "Malware payload (Mirai)", "value": "141902e7765f034ba13f47a99a0f7054", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532638, "uuid": "9b2868ec-c8eb-42cc-b24e-facca2cb00b5", "comment": "Malware payload (Mirai)", "value": "17c025c38395330901054286fab594b62022a51f58380ab905807b220adf9fc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532638, "uuid": "3e00075b-f2ef-426f-9364-d1d8452baa64", "comment": "Malware payload (Mirai)", "value": "35035126f5974a35145e14e258085192a5fdf410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532638, "uuid": "761e39af-ef46-4bfb-8f01-4f46185a6b0d", "comment": "Malware payload (Mirai)", "value": "c50c2ca45cd24f1f2ede6922cf51f9147ffb67dd608ee2531317e72ed76b3293244f7b211ff7763889da96ad8382c0b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532638, "uuid": "457e2f4a-fdcf-4644-8311-8c6debc8fd11", "value": "T132C3F73B2B170A63C0C9507102E31332AEB5DF5B34B95397A9E07D6C2F36A983456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532638, "uuid": "20087966-2cea-493c-a832-037a5da5e318", "value": "1536:ja8zhS5A5DL1/QRyFbX10cEFZN95cJptugQDtbZxijrmmi4QMuszFkczpYNZ:miX+BLNPcJMtZxivmm/QMusBkclYNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532638, "uuid": "38c21acc-2488-4bc5-a314-d97d78a5f3f6", "value": 128726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532638, "uuid": "17eb3343-094b-40d4-b2c6-3d61f6651975", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532638, "uuid": "130ade75-3ded-495f-b0ba-6471dd5ae98b", "value": "141902e7765f034ba13f47a99a0f7054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba16f2b-1dd9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632558072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558072, "uuid": "08e1dfc4-4ad5-4107-97e6-7d646d38e507", "comment": "Malware payload (RedLineStealer)", "value": "7711189d0118eff202c6f892e220d13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558072, "uuid": "61e73a38-33a0-45c7-b3ec-c4250e0d2737", "comment": "Malware payload (RedLineStealer)", "value": "1808800289beb117a06ae896db97593232c531d6489ccb9c811fcbc5e3fd50d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558072, "uuid": "66418d90-eb55-464d-9a01-b359adea5d66", "comment": "Malware payload (RedLineStealer)", "value": "68bae658800d4b8038a378497e4d3d7eaf2fd8a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558072, "uuid": "9cbedcff-a58d-45c1-bdd0-c7ddff8b2884", "comment": "Malware payload (RedLineStealer)", "value": "94a65c7721f4e5dda0bc73eb0900abc18f93bd54859084987a1ec4bfea20f5b62a7838caaa9c81862894a99ac57774cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558072, "uuid": "872173fa-3ba2-48db-897e-4d2abd937386", "value": "T19E24E02075E4C833DBA7D9B58970C6E62A3BBC236F75813F6654169D1E32EF08626343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558072, "uuid": "bbefcc44-43ca-4982-bcb0-8da14dd14dd3", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558072, "uuid": "f29f3334-7b9a-4ac1-861a-822d0a882066", "value": "3072:eB+CYMaZBQIuRm1NHtgfGIF0IZxA1clpOk4kbXy0/COAzPqD5qGmqY5:eB+DPBQI1jHo1GIZxA1SgmwOAiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558072, "uuid": "cf309bb5-9e8d-4520-8c57-449d5ab84abf", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558072, "uuid": "b70729b5-e607-4e2e-906e-975a3b1e971e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558072, "uuid": "24ad5e20-1484-474d-abd6-d3a90d16e08b", "value": "7711189d0118eff202c6f892e220d13d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3be58a-1e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632593505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593505, "uuid": "33d6e5bb-ab6b-426e-a2f9-a58d9156f7f3", "comment": "Malware payload", "value": "731ddab9e9bcdb17a059fca6320dcc80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593505, "uuid": "ed495f71-54e1-42fb-8f76-bc93478c45cf", "comment": "Malware payload", "value": "1826d0e604d68f81001dfd38e3bc475d036fe6eaef08d7b74c3af7e2683170ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593505, "uuid": "93abff8f-450b-4309-860d-1cfccb91e3bc", "comment": "Malware payload", "value": "11ce746cba27661ce67c4198b0a50423af2e70de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593505, "uuid": "66511618-23d2-4c71-b497-c4fc22806dc0", "comment": "Malware payload", "value": "de6772684aa34b084b4376e967e418ae6e0405d3d9834674485dc81ea68427e166205885202dca8fb8f5fa04bfccf00c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593505, "uuid": "f1eed456-f363-42fe-8a7b-41fba5397e11", "value": "T1CB922B91E762C179EABB01FA56712C7CB91D8A0103CB42F309D84E2D9B895C77DB2CB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593505, "uuid": "751f862f-ef19-4e86-915b-672cc43b86a8", "value": "a4dbfdddf99d7cde4db0ccd5b4ac4ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593505, "uuid": "fb7b19e0-e4e3-482a-9eea-e8bafd5367af", "value": "384:OBbmQvVlF1m2TubQcJZ52O3joAlIANPsTez:GbHVlzm1QQZzjoECez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632593505, "uuid": "de2cba46-7462-410e-aefb-666de9b7bfb1", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632593505, "uuid": "e92adf2f-ead2-449a-bfad-64cf6d930cfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593505, "uuid": "64db6cb3-3558-4348-989d-da69172ab69c", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.30782.25602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3cc68d-1dee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632566932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566932, "uuid": "efe06cb7-9cfd-44de-8bde-54bd7592c523", "comment": "Malware payload (TrickBot)", "value": "1e9430f7984f9f971e4c0ecfa0d9b531", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566932, "uuid": "deb87d3c-5d63-4636-98a6-9c177680956e", "comment": "Malware payload (TrickBot)", "value": "1846bc537e84c6ad4b8556b51ca0f9fa9e5b4037182fd8350cb9f783caa90d4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566932, "uuid": "1aa52549-ad85-423f-a724-1d3a68bfecf6", "comment": "Malware payload (TrickBot)", "value": "5f07e3455ae4cb3338c4d4fae53ff9c638bfa861", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566932, "uuid": "561620dc-3224-4155-82ad-9378bcc73142", "comment": "Malware payload (TrickBot)", "value": "7e4b8f1fb4a572a1d0ac815c5b4ad0d9d79c33632def72964ff2653af2bb27f763ebccd3f2561a588b4a941e2ebfe551", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566932, "uuid": "87e7ac62-9f9c-4626-aa87-6b7a7254e2a0", "value": "T1F0B4D03535E08973D16319308EFD07E963B9BCA147B2958F8F902F0D3C7E556A43A2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566932, "uuid": "83c566c4-0207-46f2-a61b-365ff9bf1860", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566932, "uuid": "0dcf8293-9e58-4651-97f4-da1a6ba8ca1b", "value": "12288:cbVMh0tRyr3W3S0niM+uwkMx8nXoTT0WJZmo:WMh0tRyS3lY8X2xJZmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632566932, "uuid": "2e800c3d-179a-4cea-a2c4-e07b03df52b2", "value": 528443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632566932, "uuid": "c8da092a-662a-45c4-82ec-a8dcd7f6a08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566932, "uuid": "f7522da2-956c-40e1-aa41-259e15f3f7f1", "value": "1e9430f7984f9f971e4c0ecfa0d9b531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0af515c-1e4c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632607500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607500, "uuid": "f92b047b-2d60-4eb6-b3e4-85deb7f005bc", "comment": "Malware payload (RedLineStealer)", "value": "00f96742e30d5151d30b199e822b014b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607500, "uuid": "4d56befc-3819-44c4-84ff-ab9c524a3521", "comment": "Malware payload (RedLineStealer)", "value": "1a258df93de3955089e869e2348df88c72444d09930ff31cba0fab7022701da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607500, "uuid": "47479ab4-aea2-4ec6-992a-8e1c919f936d", "comment": "Malware payload (RedLineStealer)", "value": "b00a8589649e09282ea8de72a9c6ebd37f59874c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607500, "uuid": "44d87e01-510d-45a6-afce-cc3934a785d1", "comment": "Malware payload (RedLineStealer)", "value": "9a91cd850c7e62a4c4b73cf0fd190ded77a4e8b18280c35f647acd7ab6e7c6251f31cb16ec03cb16bfae1b3f61bf9ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607500, "uuid": "f97be840-7349-47cd-8905-475d12be10f9", "value": "T1A744E0A07EA3C831EFA746759826C3A5673BBC322D77845BF25C175E6E312C195E2302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607500, "uuid": "52a4392b-c791-4526-a5cd-8a547797b89f", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607500, "uuid": "009225cd-9aaa-43e2-bfbd-91e7b990c651", "value": "6144:djlMIaiORrQJmaKX0XGapdXGfv+Y7N9Ea:8KORrUmao0jXWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632607500, "uuid": "9a8f38d8-1b5d-48d0-a543-d034d53e2d4d", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632607500, "uuid": "5100a570-d0b6-4e2b-ad05-5a7d19bb5ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607500, "uuid": "696902d8-2969-4f69-a9b1-1e3670b7eae0", "value": "00f96742e30d5151d30b199e822b014b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5ef662-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559662, "uuid": "b302bf01-6359-4f77-80c2-a1a52f927cc8", "comment": "Malware payload (RedLineStealer)", "value": "beb473ce18dbf99b7a80a3229d45176c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559662, "uuid": "93be1be9-6927-40f6-b624-17e4efde876b", "comment": "Malware payload (RedLineStealer)", "value": "1a4441fde76b520e4a87032c97afcc64a81e05481889ce1b6de196310472a491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559662, "uuid": "a951c93c-4294-4078-b0a1-68efb4395ee2", "comment": "Malware payload (RedLineStealer)", "value": "27858344036d6cce6591c8820673255bc218beb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559662, "uuid": "e75a9f74-3589-4538-835c-d32a2db06ce6", "comment": "Malware payload (RedLineStealer)", "value": "fdf1bc9533c1ca219faf839b60a530bc7bc781fa43b6ef02e4168d14cfcfa7f967590cc7190e0fee931d66beef59d0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559662, "uuid": "a2d32d5f-de81-40dc-a62f-0ad79c6b2bdc", "value": "T10A74CF10B7E0C039F6B712FA49B993B8B82DBDB09768C5CB62D516EA16746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559662, "uuid": "05e159b8-d12c-4395-a54d-bb20848ccb3c", "value": "110da1023e5bbd9b585d5ac7f21f7aaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559662, "uuid": "14e7c7f3-8cbf-4d22-9e7a-fce85454fec1", "value": "6144:KOWJAMfOTbFZ8yIkw+tm7UrRzzycDTFCcREoi2:KOWJAMfOTb/IutmlcD0o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559662, "uuid": "83d5adf6-80bb-4606-814a-23af555ea858", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559662, "uuid": "b8cf59f9-92fb-493e-b734-c2856eaa3a8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559662, "uuid": "4f70aad8-450b-445d-a26b-791e9187a13b", "value": "beb473ce18dbf99b7a80a3229d45176c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e7407c-1e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632578919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632578919, "uuid": "193af688-4c18-4dde-84a5-5fa9b762fc7a", "comment": "Malware payload (RedLineStealer)", "value": "b122249c8e52d4142772ba6ad5dc5392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632578919, "uuid": "0563e6e2-2a19-47dc-bb06-3dcfc64a9d65", "comment": "Malware payload (RedLineStealer)", "value": "1ab78b8014edb013c57a3bc2584acf4482a57d5d7fc8371461c13fa42a9877e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632578919, "uuid": "d89eef6c-fec5-4a46-951d-d2b3cb322eaa", "comment": "Malware payload (RedLineStealer)", "value": "c54eb5691504c11258918058d603fda3db5afaed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632578919, "uuid": "a653411a-7dfe-4105-a38d-56586c331998", "comment": "Malware payload (RedLineStealer)", "value": "3d319b4015bdd1513c4981c57805f1920ac9bb73ac42ae1f2bb98ab47c734f8f8624accfaf15dbf863a9e0e6bf65cacb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632578919, "uuid": "cb341cb3-b272-4aa4-9a82-358f08b69822", "value": "T1D224D02176B1CC32DEF706B49871C7A1DB7BB9236B35810B265437AE1E312D18A3935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632578919, "uuid": "106f9ea2-ba5b-4e8b-90c0-af538ac02669", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632578919, "uuid": "98a931f2-2ed1-4b6d-bdb7-8a6575680002", "value": "6144:FB+RAOf5L5Q2ksKom/jNmyjWWqlQXvlqw1r1o7+Iz:FB+eC5gsKBRlWW4IMw1r1lIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632578919, "uuid": "692f70ab-a030-477a-b96e-dca1a309f7f5", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632578919, "uuid": "e8a5e674-bbab-4244-bf58-2ddc9a008a73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632578919, "uuid": "38a9489d-ab5f-4939-a398-2b9d74fb5d88", "value": "b122249c8e52d4142772ba6ad5dc5392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6499f1b-1da4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632535408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535408, "uuid": "8d16ec66-421c-402b-bdcc-89bd15ce5668", "comment": "Malware payload (Gafgyt)", "value": "a441f3ae3f31ca29458565e15b4d2286", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535408, "uuid": "e507db5d-9bcb-4126-9f1c-54321dc034fe", "comment": "Malware payload (Gafgyt)", "value": "1b4c249388cb8e630dc5d98b10a27e0185132ff351efd6a6431b8f77e6b6e02e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535408, "uuid": "48888b30-9b6b-4e9c-a9c0-ec7e3eff3d0c", "comment": "Malware payload (Gafgyt)", "value": "7f2614240b9f14b167d9b8f6d61ac804e1af5e5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535408, "uuid": "4a42718d-4a20-47ae-b81f-6c7d3a4b006c", "comment": "Malware payload (Gafgyt)", "value": "f503fe3fa6b7cf79357372f8670e5fb3db1109832ef19424315872dcce32e6460404d6a72f04bd8f4492f275894e91a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535408, "uuid": "1618b9c4-8b73-4223-a602-ce9daf4471d2", "value": "T1CBC32905F0518727C1D31379B69E9A5E3B322BE493DB33125A346BB82FC279A1D39C25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535408, "uuid": "21c05abe-3071-4059-8c1a-8b10a667a3c8", "value": "3072:exd5OraLKZVYCKRtec7kD+wiZmdQO1vXvMn:ezcaLKZVc7kDAZmdQO1vvMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632535408, "uuid": "3cc88c06-4564-407f-890d-f4d7ab4ac81c", "value": 127629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632535408, "uuid": "880cb6b9-2f6a-4260-92f2-cfc04b33cd74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535408, "uuid": "4305ea25-faa6-4d43-8244-0371d81c8cb8", "value": "a441f3ae3f31ca29458565e15b4d2286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7992edc-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562092, "uuid": "e3e7b7b7-1056-4b91-9fd9-02f340c024e9", "comment": "Malware payload (RedLineStealer)", "value": "6a59144d4ce51d4ae147c3da00914071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562092, "uuid": "928f6180-81df-4fbb-b027-276eb766564e", "comment": "Malware payload (RedLineStealer)", "value": "1bb780874cc2487b51219376e2ac09e2596fde50c61ba0904d58a9594de64bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562092, "uuid": "0f17e5e3-c6f4-4a33-bdb3-56c4be30090d", "comment": "Malware payload (RedLineStealer)", "value": "7df7e0d23bfedb44e49eb496e5ac14c1308f58ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562092, "uuid": "a77ec3c3-f3db-48a6-ac57-d39278b316ca", "comment": "Malware payload (RedLineStealer)", "value": "be6f65ab3b50df6a480c058b54fc65ed0cac9a6fe3570d566bb56c5fe422e71b2ccf73121915612a127656d59e081b0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562092, "uuid": "ea034502-dff3-4099-ba04-573c6eac0de8", "value": "T13974AE10B7F0C034F6F352B949B992B8A93ABDB1AB3881CF62D516EA56746D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562092, "uuid": "4cedccfc-ffa9-4a1f-aca1-fb0ff2dde340", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562092, "uuid": "1468cc62-5878-40be-836e-074df161a6ea", "value": "6144:XkLmyrom0SbBZ5/JADF7319oJGje1ylfuLa7BVWal3pdh:XkLmyrom0SbBJcT19oUi1y8WRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562092, "uuid": "8927f610-aed7-4f04-8a0f-56675f1757db", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562092, "uuid": "c814ef0a-e4e9-4fc8-9adb-37dc2ac43187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562092, "uuid": "0cb0978a-0bbf-485a-8f0e-e5f3b7bae416", "value": "6a59144d4ce51d4ae147c3da00914071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa334680-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563278, "uuid": "d996e857-f8bd-4a57-87bf-650ed8dd724a", "comment": "Malware payload (RedLineStealer)", "value": "b0b47d08eb71afc251ed0de1d2aade7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563278, "uuid": "f3025920-ed52-4523-a902-9b53ad370439", "comment": "Malware payload (RedLineStealer)", "value": "1c87e75b744eff463557cb432e48e042635f418655e250e0456a50770fae5552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563278, "uuid": "8496d050-2475-4955-bd9a-5b74eb6895da", "comment": "Malware payload (RedLineStealer)", "value": "cfe54039dcf77da6dc0ae0940dbae86bc01da086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563278, "uuid": "6c71dc70-5327-4181-9400-8223aa8107fe", "comment": "Malware payload (RedLineStealer)", "value": "a88fd3a8fa420219e91f516a496d6686d6af12e8df6c521dae4c4d4778b6b26b7334d172d68b64c2f3382d227a46e6bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563278, "uuid": "6047fb68-f0bc-4f86-9ecf-178488d56911", "value": "T10F84AE20BAE0C035F1F712F989B993B8A93E7EB25B3540CB62D516EA56346E4DC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563278, "uuid": "3ee28385-13f8-43ad-9b84-48bbf18dc8ae", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563278, "uuid": "2800a1e9-48d2-429b-8fef-e305fc0583cd", "value": "6144:58CdbPiqsI9a5KaTjFvlNn1RJwzyRbtnlNZApiZb930s4youjNg7M90X3:rbPiqsIc5Fj1n1CQnXZUAh30svjNsM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563278, "uuid": "1ccdab43-4913-4f84-9261-9187ba3f4f1a", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563278, "uuid": "ee8fded4-7d64-437b-90ce-36bed6eca8ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563278, "uuid": "6a9c631c-ffae-414d-a4ea-e32e6f4b3382", "value": "b0b47d08eb71afc251ed0de1d2aade7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d86e3a-1e1f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632588188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588188, "uuid": "3e288335-9fb7-4a85-aa10-4f31d75672c9", "comment": "Malware payload (RedLineStealer)", "value": "40cad2667129bc6ce9f7ec9a53bd2a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588188, "uuid": "ab5835b7-691e-4e9f-928b-40a18f5d843d", "comment": "Malware payload (RedLineStealer)", "value": "1d92fbf1e15c6e58a4650461bdab7ce4706b626fc6ae084aa7d102c3356ab565", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588188, "uuid": "e91889b6-5a4a-4892-bb67-57e9fe4c043d", "comment": "Malware payload (RedLineStealer)", "value": "b6bf0786295aa627f3e9a9ba6a7e6e2fcbdbe07b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588188, "uuid": "0a49a20b-0b2a-4d20-9993-47681d486a03", "comment": "Malware payload (RedLineStealer)", "value": "ca1ac785558a8173e3d15c991d3ec1d3797b60a7f36cce135d97936ad9951a5d14396cec65f8060dac11592000b2a255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588188, "uuid": "461ad96e-a4a9-4d80-bb6a-fb6f84450889", "value": "T17B34E02177B2C132E1E74F719D7887A26A3FBC336AB5461B77540B1E1E326928A16313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588188, "uuid": "5e59c2a2-7ad0-44eb-a33f-b0845aaea4e5", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588188, "uuid": "bcc3da7c-15be-4767-9f11-081e271c6c50", "value": "6144:NOa9pI0DGrNh+VumrM2pxXpwW/IAjC5aAl4F:Nc6uR2Rz/I+YZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632588188, "uuid": "ba7e0081-8e53-473e-89eb-b1e64a41ed1f", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632588188, "uuid": "676fe6e8-a8c7-4f37-9de6-7c3bd18cf527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588188, "uuid": "b311e96e-1ab0-461d-b146-f228d551e121", "value": "40cad2667129bc6ce9f7ec9a53bd2a5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1ace62-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559280, "uuid": "63cfd946-978d-4634-8fb1-734c2c071ff6", "comment": "Malware payload (RedLineStealer)", "value": "17bdd374c11bcb0664a21001f8466efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559280, "uuid": "273fef21-4948-4ec2-adca-3d890f0c3c01", "comment": "Malware payload (RedLineStealer)", "value": "1de7290995e43ef59ed48500035448580267086b51e24a4d36be4e71ebe1b635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559280, "uuid": "dd46fbb0-1031-4e94-aee5-7fc2b494a037", "comment": "Malware payload (RedLineStealer)", "value": "429b96782936ae029308c2b01017fc038385ed65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559280, "uuid": "5862ca52-87d4-4b87-b0c8-32a28dad8ac1", "comment": "Malware payload (RedLineStealer)", "value": "fc7c7166b717e5f3da48c8f98d8897d8d394e7d11c7bfb345db4b8764ea72dd71a476bf8f84ed4d543e66bb74bfcf0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559280, "uuid": "af8e6b5b-1fd4-4545-952e-7c0db90804b9", "value": "T10A74CF10B7E0C034F5B723F999B993B9A92DBDB06B78D5CB66C506EA52606E0CC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559280, "uuid": "6f4fbd7a-ec56-43a2-9aaa-fa26f56b1d79", "value": "658c49f2b142429657b3337ed8c9de9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559280, "uuid": "e2ebbd58-bbe6-4541-8688-96f3a94968e8", "value": "6144:iStAJDL21/kBIRlWw5pjY83e4DSgbNyhNDmEQ:iStAJDa1/hRBMqbfyh1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559280, "uuid": "84cc2e12-a687-4bb7-bdc7-0ffb5a707c46", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559280, "uuid": "3bda2e6b-a3f4-4054-8874-e91a9d591cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559280, "uuid": "3583cd7e-fe79-4493-a3ac-8181a3e364a3", "value": "17bdd374c11bcb0664a21001f8466efb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53244e8b-1e2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632594055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594055, "uuid": "38a4bdd6-1bb9-4456-8dee-971a9142dc31", "comment": "Malware payload (AsyncRAT)", "value": "95280a52b0485944520a068c6d5d574c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594055, "uuid": "d254a640-eaa9-4648-a487-14f5ba1e1695", "comment": "Malware payload (AsyncRAT)", "value": "1df559b48fe8a76a0815ff8571d47ccc9c11809062be62bfac847a82e5d63d2c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594055, "uuid": "c1790f9a-3e4f-4105-bf1d-87344fdef6b1", "comment": "Malware payload (AsyncRAT)", "value": "a601749516b5467f7109c916c3fb7b25eb9cca51", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594055, "uuid": "f179ad86-d825-4c6a-9a71-b510b3dfaad8", "comment": "Malware payload (AsyncRAT)", "value": "33b1395ce8c9ba1fd908abb1df5cd46207a0df7cbeb7a5460c3b5f104eaf3bfc8b50f86aef063ea1f77f2d0745c08e26", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594055, "uuid": "e35ca594-7ab8-4f89-9af0-a62fb2ecbd59", "value": "T1A8B37DC0A7D8847AE13F0A78CC71A591463BBD33D812E62E1DC5719E29337C65487AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594055, "uuid": "196a06bd-5f94-405c-9af8-45d59ac6b5f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594055, "uuid": "4f715088-fe5d-4ea0-b58a-e4b9516982b0", "value": "3072:ZuojTxoZ2QfO3F3btApJ/Oz6sI8zEj9C2CJ:Zuom8QfE3bs2uQk9to", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632594055, "uuid": "fd9b2ed7-6426-4b0c-9582-1fc72610f9d3", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632594055, "uuid": "865b3a4d-f3fa-4100-8f32-aac811a3435b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594055, "uuid": "6a6a5f41-b69b-414d-b6ba-44085db9c363", "value": "1DF559B48FE8A76A0815FF8571D47CCC9C11809062BE6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bb64b6-1de6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563571, "uuid": "82d3363f-50a8-4754-a7f8-e9bd1b758c89", "comment": "Malware payload (RedLineStealer)", "value": "69e7e37c205748afd16e6f1abe7b7547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563571, "uuid": "7df1bdc1-4fdd-48cd-92eb-29d3c91bc94f", "comment": "Malware payload (RedLineStealer)", "value": "1df7d3e67e65403a617b188deb6c172b1aa342591badd64fdd1562fcdde0b097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563571, "uuid": "50ec4004-837e-40cc-8805-303f49d7e151", "comment": "Malware payload (RedLineStealer)", "value": "c665aabacaae3b28234032f0397c75073825fe30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563571, "uuid": "8d6b262c-0eae-46f3-afbc-183a8e03ca1a", "comment": "Malware payload (RedLineStealer)", "value": "9bb08ab1af1e564e01c27d617457575151b5a93c333ca1377bdc1cce10e05309527bc2f7b259855267c1110bcc785150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563571, "uuid": "51f36758-5448-48c6-9015-c1d4a1518a91", "value": "T19664E00DFEA0CF31C5A305718820D7E46A76B821F921CD47676AFB2E7E326D1562235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563571, "uuid": "45aff96d-786b-4fbd-90e9-61d7de4a1049", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563571, "uuid": "277b50b3-72c3-4bf7-9c74-2ff8bee6e9bb", "value": "6144:JqfD0YR7mmFZeKn4Kdfotzqqfw/hXQBwjt4:s7vR7rFoM4ioMdXQBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563571, "uuid": "fbee42a4-ce8a-4f4f-b383-d503497da4c7", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563571, "uuid": "151c46f2-c253-4df3-8898-ac1217904c12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563571, "uuid": "23616c53-1914-4312-af5d-ba5cdece583a", "value": "69e7e37c205748afd16e6f1abe7b7547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7a4d79-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563305, "uuid": "10cee46d-51e9-439e-af04-e0d2436971af", "comment": "Malware payload (RedLineStealer)", "value": "e41403e0101de204fd00e2c17e5ba644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563305, "uuid": "fab5e2ee-b7d3-4ee2-842c-df86fc6a96fb", "comment": "Malware payload (RedLineStealer)", "value": "1fb7568e5927698079a34e472cbfbe4b94b28c0d140856e146f4960f81096924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563305, "uuid": "53461ecf-fb4f-4861-9be4-e829e8ccf6d3", "comment": "Malware payload (RedLineStealer)", "value": "48cca2676fe3c665505f76209d0652d6fe46e152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563305, "uuid": "82191790-609d-4b92-92ee-e03982840cb4", "comment": "Malware payload (RedLineStealer)", "value": "1ac217a9c281404495ff66fb2a700ccfa16220bc978785a6ffad67a274b2f3c31377bedb63474d4627de12c81367cc8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563305, "uuid": "83c98352-25e9-40f5-8465-7753dcfba3e8", "value": "T19574BF20AAE1C034E5F702F449BAD368A93D7EB27B2051CB63D626EE16346E4DC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563305, "uuid": "ef3a9ba5-cac0-4026-a5e3-19aa665caeca", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563305, "uuid": "01dacd83-5c82-4ecb-b828-2b35ea1383ad", "value": "6144:vgr7Fees9D4sZkLVeVgC7uFr5PwteZHhBmfAj573GbHUCn:k7Xs14sZkLuv7iPw4ZHhBm4B3yHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563305, "uuid": "5532c1c3-4c9a-4192-a146-49df42d7b745", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563305, "uuid": "f616d3d3-62bb-4d6a-8629-f035d73ef668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563305, "uuid": "7e93054a-70a7-4dec-9175-3716f3f61b26", "value": "e41403e0101de204fd00e2c17e5ba644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9267e1-1e17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632584570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584570, "uuid": "2ffb3505-8702-4e8a-89b1-a29656a67e62", "comment": "Malware payload (Gafgyt)", "value": "4b97768edfc497d9f04a11dc91825196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584570, "uuid": "889c01fe-526e-421b-916f-d4a1a9c5490a", "comment": "Malware payload (Gafgyt)", "value": "1fd0fb9234ef0bb09d41c4c8f618576c06028b832dda8d737a01d8fd22317920", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584570, "uuid": "06f17234-f1f2-4893-a7f1-7b4a0956a1f1", "comment": "Malware payload (Gafgyt)", "value": "098a077d1c2b876b06ecaf37d54aa1d9148974e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584570, "uuid": "2abb91b8-ac61-4949-8600-2333eb9959f1", "comment": "Malware payload (Gafgyt)", "value": "39655958757724a7efb741c51ff2ab09808aa28c783b25e1221f4f49d76b64a11a2e02c68a1122900817675314e995c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584570, "uuid": "4a521ede-2e28-4774-a90a-9a6e4ad1aeb3", "value": "T103931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584570, "uuid": "274f6052-92b9-42f7-8404-e49a8383911d", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvSNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGSNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584570, "uuid": "a2dfacb6-b8a7-456b-bd38-bb8659bcbac3", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584570, "uuid": "9b8175dd-d81b-412e-9cbb-dfb746daec2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584570, "uuid": "7109ccd7-a903-42b2-836d-90e37f606332", "value": "4b97768edfc497d9f04a11dc91825196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4b41fd-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632565536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565536, "uuid": "d0a89e9a-b382-43f5-9536-686220317f73", "comment": "Malware payload (Quakbot)", "value": "34ee9111f987b903bce643f660d2d7ce", "object_relation": "md5", "Tag": [ { "name": "excel4macros", "colour": "#C77CD6", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565536, "uuid": "3e741e7f-f4b3-489e-8f57-0d09b91c301f", "comment": "Malware payload (Quakbot)", "value": "2013496fe5524988c28357245d684cdca787b47c0b3b16cae20b3222977d769b", "object_relation": "sha256", "Tag": [ { "name": "excel4macros", "colour": "#C77CD6", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565536, "uuid": "7bf34af1-a001-45c3-914a-76fca24a748c", "comment": "Malware payload (Quakbot)", "value": "a7b9d6fa34914921826fc7913e0d3ccd145ebaf2", "object_relation": "sha1", "Tag": [ { "name": "excel4macros", "colour": "#C77CD6", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565536, "uuid": "43f5bab6-ac61-4b6b-9f47-ddec9270e6ee", "comment": "Malware payload (Quakbot)", "value": "fb65a35408915dd602fc3e6da66e313c3ce02e39701491c8267fd2d089bb8d512e5165cc6f992cb5744905e11b15d3f1", "object_relation": "sha3-384", "Tag": [ { "name": "excel4macros", "colour": "#C77CD6", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565536, "uuid": "06b10609-0657-413d-baf0-de01f0934afb", "value": "T1D0149157A9058AC3E51C93F8BE434ED92F066F08E9463EEB21157F8B7F742530D8A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565536, "uuid": "f119eb7c-1dec-44aa-9657-7369a27b0c05", "value": "6144:oKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgCSPofSHl8oD5j:ERq55j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565536, "uuid": "2ba4cd01-bd40-4400-a6c0-fa2105b433cb", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565536, "uuid": "613ed60c-e7f7-44a0-845b-af6e0c87d7bc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565536, "uuid": "ba783b2e-1843-452e-820e-7044b82bf559", "value": "2013496fe5524988c28357245d684cdca787b47c0b3b16cae20b3222977d769b.vir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea21e8a-1e44-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632603819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632603819, "uuid": "f6194ea1-f3aa-4d21-a657-4fa38b27b04c", "comment": "Malware payload (RedLineStealer)", "value": "6e5a0a0713d395d94f510d889fdcf527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632603819, "uuid": "2c0ef591-4a4f-4a28-8fff-f8031704dbe0", "comment": "Malware payload (RedLineStealer)", "value": "20e0f616b3637a01793cec3cdcecd2307225c0dfd17566d24d03d1c6a81845d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632603819, "uuid": "8011d7a4-ece2-417c-ba57-05b6f3ad66b4", "comment": "Malware payload (RedLineStealer)", "value": "7b5473a7c0a38d86279fc2fac0122c152c7e2ab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632603819, "uuid": "2e346fc0-0178-4349-85ce-be89b66a4e76", "comment": "Malware payload (RedLineStealer)", "value": "9a695c5843c064a616c3e3a33dcf9fe860620b8b00f88e07a7726b1ae63d30ae7495eb690eeeefefde4a993a73587475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632603819, "uuid": "ffd2397f-9b12-4225-ac67-0f22bb728422", "value": "T1D144D010B6B2C432E7E356755935C2909A3BBCB36E33429BF60C365E6E352C25AD2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632603819, "uuid": "67d4aaec-6c32-4bb4-9f4b-ecfd98c8ed00", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632603819, "uuid": "c6053ba8-02dd-421f-b669-430efc3f5610", "value": "3072:aENuwIvt+uKvGQNVjK9AeJs+vsYnZLTmeh7bXuajc7w15XnBobmUGwS9H6dY3:aL/KvGQ/bIDsWZlhHZc7wtwEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632603819, "uuid": "f157f84c-eac4-42ce-99d1-eb0bc2d0f115", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632603819, "uuid": "77f0680a-3afe-4481-837e-f5614034874c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632603819, "uuid": "126c58b4-a2d2-40cf-a981-3ff3e66ac7a4", "value": "6e5a0a0713d395d94f510d889fdcf527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7a5150-1d9b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632531636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632531636, "uuid": "ed7d0b88-97ff-4f63-8e8b-f41f2495d896", "comment": "Malware payload (RaccoonStealer)", "value": "2242bd6ead215d66c2b32beb82e97d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632531636, "uuid": "212cb271-442f-493c-bb3a-06c9e4cee0fb", "comment": "Malware payload (RaccoonStealer)", "value": "227c4d5b4d3975c14e7358e444fd6ba4f918f5ca87cb830c3407ca765336552b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632531636, "uuid": "f4db4117-ef74-4cfe-8d3e-a7064269a63b", "comment": "Malware payload (RaccoonStealer)", "value": "06bdbf304a648aa79ab724056c5160872625ed28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632531636, "uuid": "bcc8d188-b3a3-4f9f-9ff9-f36e5ab7ce5c", "comment": "Malware payload (RaccoonStealer)", "value": "ca7f863a9766f1cddbaa8c7376251880a911dca0b47c311c2ff1e60ddc9feef5193283d04b571566e19c82b4ddf6c71d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632531636, "uuid": "5012262c-d214-4ef7-8963-dd4966086cea", "value": "T188C4E12077E0C035F4B302F649B9937979397AB06B2850CFA2D617EA56786E8DD30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632531636, "uuid": "89a6186a-ddec-40d3-8d76-2e13cd7a687c", "value": "d63272091af7602d3a8fe5b2f0726122", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632531636, "uuid": "a287f922-ee50-4a3e-8907-de9f2835723e", "value": "6144:1eSWysjO2llCKU/gb4XfzTqFWKVYC/ctNkLuXBHCrEqmO91ctGc8zGd73W/:1eSW1jO2l5UhvzThsI0AVsbVc8zC3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632531636, "uuid": "c166f627-9f19-4378-a607-f2ea39b69d32", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632531636, "uuid": "b15a8208-407f-4529-b26f-a2fb39e6cbc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632531636, "uuid": "cb57f1f3-0d0b-430b-b6b8-40b2f78a067a", "value": "2242bd6ead215d66c2b32beb82e97d36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c2e444-1e01-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632575019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575019, "uuid": "58671f1d-52ac-4d40-9e7d-20e8ea1edf5f", "comment": "Malware payload (RedLineStealer)", "value": "c1c23502a853a2293624190b9b8da7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575019, "uuid": "4fabe1e4-a0e7-4201-8d9f-aab675b8a4f6", "comment": "Malware payload (RedLineStealer)", "value": "2311e582d1d225002460a99ae2e867509df69640d49fd441e1863506ae30e10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575019, "uuid": "2fd13f86-7704-4184-81b7-58480e3c89f1", "comment": "Malware payload (RedLineStealer)", "value": "81f43d8374d340eb7bc5f9689ada3016d9ea9c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575019, "uuid": "2e66ce73-5c9d-411f-8fbf-6b2c9d4f04b3", "comment": "Malware payload (RedLineStealer)", "value": "1b45ae2271784230b7c3b21a1a57b32f9a02b56fcd567d64535e80f554da7a3ba32a3189c5fad22f14096fb4fbb85fb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575019, "uuid": "a5a6fe65-de5d-42e9-9f95-07a7a7934915", "value": "T1B824D0316AF4C032E3F34AB55AB4C2F55A7BB8736BB1814B66440F6A5E313E19A75303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575019, "uuid": "c0aa25e8-c6c6-4fd5-b65d-25ce61fad1e9", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575019, "uuid": "8df4030d-eeca-4622-b738-46d8c543e101", "value": "3072:PB+CiuQLYVLyCY+LyemOco/wvXty7d47jEGtrFSM6HSIQAiYD58RoEwYQ:PB+9Wo+LNwvQ7O7gaE5HSJroh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632575019, "uuid": "73834f27-9520-473d-9eea-27007eefe0e7", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632575019, "uuid": "1c6c4962-5c87-4149-8f3b-877cdef56435", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575019, "uuid": "c5ec8900-7d2a-4c71-ba29-9b5b4defd71e", "value": "c1c23502a853a2293624190b9b8da7ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935835fb-1e3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632600176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600176, "uuid": "29f3b2ce-8d6b-4abb-8b86-f6e98f91fa47", "comment": "Malware payload (RedLineStealer)", "value": "e29a4d9593f891760a540240f966c68c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600176, "uuid": "c672d019-15fd-45a2-aa7b-6c9ced91b977", "comment": "Malware payload (RedLineStealer)", "value": "241c4db3a5201c5562e0cf4f7f46a7b5fcd115038d0cbe19e0c93bee5fc8a440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600176, "uuid": "e2bd115a-e9ca-4f64-8b2f-91e6e8a7ac0c", "comment": "Malware payload (RedLineStealer)", "value": "c7ccd7b85c1b726c6324d783c01b3dc11997eb29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600176, "uuid": "2d6f9a22-ebb8-4f50-a433-6ab669dc5068", "comment": "Malware payload (RedLineStealer)", "value": "df4a1a2eb1d22cfb045015af804e33aea588c61c69d0d3acada1b5d08635af9bebc2b2902f9aefa1c07923bc28d963fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600176, "uuid": "04c86c2d-e337-4c19-87e2-3bd9bd987f1a", "value": "T15544D0107EB1C431D7EB457448A592A49A3BBC32EE7346EBF21CD75E5E312918EE6302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600176, "uuid": "f2f15e8e-639f-4ea5-a5ce-05bee8ad199a", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600176, "uuid": "12cb5911-880a-40df-b24c-3992db0f5ae9", "value": "3072:+EeRi1UM/Oeb65hfUlDceMoiD92XekLcMP+QSeAaLyF8CCwY5qTRik980tS9H6dP:+PcubFechopXzLcMJSCyF829iG8UEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632600176, "uuid": "5c2c54f2-a01f-4c48-8408-e3a18891f2d0", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632600176, "uuid": "db915576-a305-4b9f-8b01-f997637f1684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600176, "uuid": "61b9cf1c-b253-42c6-bf36-a84ac79cd802", "value": "e29a4d9593f891760a540240f966c68c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d74649-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573624, "uuid": "25383192-1042-44e5-9d98-ee9822a1c2cf", "comment": "Malware payload (Mirai)", "value": "cb5677476dd8da21dad156b63691e9d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573624, "uuid": "23515f89-c08a-4211-ab62-6d5786951fea", "comment": "Malware payload (Mirai)", "value": "24835e45408130c61750ea69fc582e193d2ce677dabf42512ad18863dab71faa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573624, "uuid": "99365dab-7b79-4430-8035-6046643d8db9", "comment": "Malware payload (Mirai)", "value": "5cb46757fe65131aa4d299c261eb70a5257edb49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573624, "uuid": "10b7a61c-85de-42ad-afaf-d15c80863efe", "comment": "Malware payload (Mirai)", "value": "e032b411f7f1d3c650658ff27a0e00c15c4d28b2e04c6ca6b8af3b0ddd9392033990f5b5475f8b137449c602421089fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573624, "uuid": "28bcb36e-2c20-4bcf-a592-c233ee385d2f", "value": "T1AA63A50E3E619FBCFB9C863547B78F20924933A626A1C685D15DEA011E7034E345FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573624, "uuid": "cb0bd869-d482-4768-8155-42b48ef6a253", "value": "1536:N8cd7Y1je1aVQ7pHenXFnXaEnX1Qw7vdD4+wOmVzkSaUVZo+amv:hpAjwaqJcxJmVzkSzVZo+Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573624, "uuid": "d378824a-546a-4782-b2d8-8834a088e1fe", "value": 72744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573624, "uuid": "86308a54-c167-4f14-8571-366fe4fab639", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573624, "uuid": "6ce50e72-7f7f-4611-a30b-90757124de09", "value": "mips-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb48664-1e1f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632587923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587923, "uuid": "5ed985c1-72e2-47c9-b88e-dba4d5ca574b", "comment": "Malware payload (CoinMiner)", "value": "4a9b7ce3b984ae30b259a621da2f908e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587923, "uuid": "83a802b2-8c1c-4677-a55d-db523fc0582c", "comment": "Malware payload (CoinMiner)", "value": "25149614d2732a9db3e86ee490064f943cef5747b19d937d2f3cc2d7e13d29b7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587923, "uuid": "975fbc73-13e8-47d3-a196-3abedcaaa183", "comment": "Malware payload (CoinMiner)", "value": "185cd7f239c55aa781b0acbf9bdf80c5d0ed3a22", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587923, "uuid": "e449095c-400a-447c-a8b5-5d27f65d3415", "comment": "Malware payload (CoinMiner)", "value": "2b8941414e27de2b16dc176f458c168fff2a7d748eec966020eaf97a3a7ae9da287f7f3359edd7723def299f51424ade", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587923, "uuid": "6655f756-1420-4d75-8a59-6cf6dc41427a", "value": "T1D8E38C2076A1D0F1F3A216794A64C7A95A3BBC32AE37D90BF78D175E4E312C186E5313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587923, "uuid": "23960e07-4f60-4888-979f-9a1c11cd2b5f", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587923, "uuid": "97491367-b6af-4295-962b-ef38ad80cc08", "value": "1536:hSmkQu2XBbAfpKmKPpVEJRhjMkzSjJGP17Uu5o6S8lJzkGX+RooRy/494dL8Tfa2:pD1mTJEIfP17Uu5l7lJzBS9H6dYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632587923, "uuid": "3f2285a5-50ec-401b-8cf6-634ea384f9cd", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632587923, "uuid": "30182635-4475-40ec-894e-616768de4303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587923, "uuid": "0187d29d-8bd0-43e0-9ecc-3b1e175249b1", "value": "4a9b7ce3b984ae30b259a621da2f908e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fa6b48-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563403, "uuid": "f10db21c-bb86-4765-a228-31d260dfd554", "comment": "Malware payload (Gafgyt)", "value": "3a380d02a0ce9b727cdbc55238043efc", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563403, "uuid": "f57ba9f2-672e-48e2-9f23-cdb0a90800e5", "comment": "Malware payload (Gafgyt)", "value": "254033deaae3a226a64637d23fc2a93ec8e5303107027323afd2dadc759fef84", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563403, "uuid": "9549214b-cf86-45d5-88e1-c853b309c8f3", "comment": "Malware payload (Gafgyt)", "value": "2c4207e89347a112b4f13b9a795369bef7a4f532", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563403, "uuid": "515215de-0ee6-43ea-9772-a541a7194059", "comment": "Malware payload (Gafgyt)", "value": "481b13b332efc4fd8a5ef7e5c32c75ac2785b74dece7f07647a845114918c4014510855c97724f48a54765f4a5687ce1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563403, "uuid": "add52bc0-af34-4857-bd3f-ce82ef26cdd8", "value": "T1BA932941F9008B57C2D227BAF7CF469D37366A7957EB33116A346DB42FC27981E2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563403, "uuid": "b4fb8b5f-1077-4928-a60a-aca78d875f0f", "value": "1536:FEQ7x4YPjg+ZATTfq/GuCkNF/N0xEOtXZPcq5AmXpmlUmREqQ4b/X7Xtee:gYkAAaZCS0vZP1iqnmREqQ4bv7Xtee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563403, "uuid": "3af2653c-c3d2-4def-b846-7238df92d3b6", "value": 96600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563403, "uuid": "ba20d755-c012-4cfb-88d9-23a9f1654990", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563403, "uuid": "4d5a69dc-3bc3-43d7-b4c8-48a4ce72d70f", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d25951-1d9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632532377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532377, "uuid": "1989ffc8-68d8-462f-959c-1e0a4cbeba61", "comment": "Malware payload (Gafgyt)", "value": "c3e9c1df6ca3c5a0bb59f7a14327fc2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532377, "uuid": "22dda5ff-6fca-43f4-8611-73e9e7928a35", "comment": "Malware payload (Gafgyt)", "value": "25510349474c95d228f71a262d30a9e9e3eaf94682dbfc6ed59b02d5b779cf66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532377, "uuid": "4bd1e686-7417-480c-a930-950edf33ddd6", "comment": "Malware payload (Gafgyt)", "value": "fb22120dfc6fc5d1837128c2dba5c27b1f879ffe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532377, "uuid": "9c97f6af-0a9e-4c17-96d4-636d8bba7a4f", "comment": "Malware payload (Gafgyt)", "value": "476d4014332f10647940d9030f9bdedbba9d4ad9857e627974ff4011af4acda807f2d3efb5d7ac605f18783c6733b6e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532377, "uuid": "abe97577-2ca9-4d3c-a7f0-ec59c0a60f85", "value": "T141E31824D450871BC2D223BAE79A424D3F321FAB93DB33159A34BEB41FE17991E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532377, "uuid": "f273d56f-faba-48a5-819d-361da1bb06d0", "value": "3072:ZHO60Aa7a+9sUYs8TvTw1PUNldXkmhxQwBVNyNQ:ZHda7a++vTw1PAkmhxQwBVNyNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532377, "uuid": "b3a835e1-0fe8-42f3-b726-464a0631c410", "value": 143158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532377, "uuid": "9d66b421-8fb1-4e59-8b3b-8f2800f327db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532377, "uuid": "003bd956-3ce5-463c-87f0-d380d4811e3e", "value": "c3e9c1df6ca3c5a0bb59f7a14327fc2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c639ab-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559277, "uuid": "b2a07737-367d-4f32-a050-88a4ac0b91c6", "comment": "Malware payload (RedLineStealer)", "value": "3d09b651baa310515bb5df3c04506961", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559277, "uuid": "57f38ac4-a75c-4dfd-bfc2-411609762fc4", "comment": "Malware payload (RedLineStealer)", "value": "2599fed90469c6c2250883f90d1c9d20fe41755b9da670a306a884797dbd7df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559277, "uuid": "76c8a2d6-750e-470a-9162-634e6d0eabde", "comment": "Malware payload (RedLineStealer)", "value": "e1e1cff9e8a5d4093dbdabb0b83c886601141575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559277, "uuid": "661e8f24-8c2b-4a1d-800a-3d847910205c", "comment": "Malware payload (RedLineStealer)", "value": "bbc4419ce1750fab9b4192e17747edd0e49eaf98528605650cea725b218c96b0f1eab84d4c59830cab870675f8bcb01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559277, "uuid": "002f2b22-2546-4652-8a36-cb74ebe4757f", "value": "T1EA74CF20B7E0C030F1B712F599B997A8A92D7EB0577885CF67D61AEA56746E0CC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559277, "uuid": "039a41d3-eb07-46d8-b8f2-2c5d41053f86", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559277, "uuid": "866345d6-b0a9-4aff-8abd-391bbd8ff34a", "value": "6144:yfnsUf4f1/YBlP+QJ68GS9SYPPrOiwub+chZ3Bsjwvlg:yfnsUfq1/APGAsaOlub+0Blg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559277, "uuid": "edad76cc-d022-438f-97d6-dfa2156fa649", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559277, "uuid": "40171109-820b-417a-b868-1896990ab2ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559277, "uuid": "5d9901b6-9f43-4a30-9e1c-d63bda1a6b19", "value": "3d09b651baa310515bb5df3c04506961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e15bff5-1e41-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632602771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602771, "uuid": "cd3406e1-5260-4000-94e2-b8ae2ac30bd5", "comment": "Malware payload (RedLineStealer)", "value": "750e9be2e713fed3222f9eae83578d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602771, "uuid": "2e83edbc-1be0-4862-8dfe-50979e5025e2", "comment": "Malware payload (RedLineStealer)", "value": "25abaf64209dd04a95795a8040ff3104802ef3959b277616aa4054f0bde86d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602771, "uuid": "bee3c8f4-0fc5-496e-88c1-7de9eeb5160b", "comment": "Malware payload (RedLineStealer)", "value": "fc9e1b8c3a56ab686c75280cd5a94c8c146ca870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602771, "uuid": "c5efe3a3-bf31-4a43-a8f7-84d54d84effd", "comment": "Malware payload (RedLineStealer)", "value": "69561a1d455018f3092386ddc2ee2b5eb0adb76de3919481988dbfce024aedd61be0f208da620a438971969a6f3df72a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602771, "uuid": "947090f2-05c9-4363-9f80-d516842cd4ff", "value": "T13DD4E120B69CC0F9F5B701F4557697A8A93DBDB05B3091CB32E626EE6538AE58C30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602771, "uuid": "6528b11b-656f-4314-8bb1-c470316a50cb", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602771, "uuid": "7600029b-8438-4676-8813-fa454290e2b5", "value": "12288:a3qGlOD4r+rGPX+Z+66+ef78sqxXajaFq0r6yf87tZ1CxHD+CtG:a3tODhrkKmvqZFq0WdHsj+Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602771, "uuid": "21cf7ca5-eaf9-49aa-be38-aa29b6d50c6b", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602771, "uuid": "65f7e408-5a0a-4696-8bf0-0c0d0cf789d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602771, "uuid": "58dea384-e4cc-48b6-bcd0-74632fd95499", "value": "750e9be2e713fed3222f9eae83578d59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799b3cdf-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632552459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552459, "uuid": "aa23c327-d422-4269-9b6d-aadc52ccf94a", "comment": "Malware payload (RaccoonStealer)", "value": "0afdf906ca8f4090b2dfdc65fe84f52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552459, "uuid": "843d0429-9d8d-47d0-8980-ff071f4d6c13", "comment": "Malware payload (RaccoonStealer)", "value": "25e9cccce341abac8cb2c2ea0aa426ebb6ce8e4f6bf41e95634067da50b090ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552459, "uuid": "4708b3a4-17b7-4628-bcdb-3af5bda715b4", "comment": "Malware payload (RaccoonStealer)", "value": "09c5ccfa2bc2b13c56b78f43f5a337415b490f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552459, "uuid": "140acccf-ac6c-4686-9ed0-d9d8573b3024", "comment": "Malware payload (RaccoonStealer)", "value": "e783e62eea740fc1964e9c1ab7229927cbed30e4594440131133c38117d091fb62b8834ea55649947aeb02a392aa6838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552459, "uuid": "962510e8-46ca-458c-b24e-17a88c3faa17", "value": "T1FDC4F11067E0C038F5BB12F549BA8768A52C7DB09B7891CFA3D616EA56786F4CC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552459, "uuid": "e5231fc7-0f6a-4fc4-967a-a5757efef06c", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552459, "uuid": "90a66408-d156-4693-99cd-9082ffcf6934", "value": "12288:H0nYpjfSlJHyb6TTjLSGWc+RtdYLjlR0O3CxCvxgoA3Rn5g:9jKl86TTvIFELjlRjCAvxgoAh5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552459, "uuid": "302842a3-d4c2-47f5-a957-99280b594c23", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552459, "uuid": "3f64602d-93f4-4ec0-aa87-adfbd4243d0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552459, "uuid": "82d34a70-2a1a-47ec-b50a-13e1610b3c6d", "value": "0afdf906ca8f4090b2dfdc65fe84f52e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b14ccd7-1e36-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632597880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597880, "uuid": "969cff2d-4848-40be-96c4-5afbd9f9f417", "comment": "Malware payload (RedLineStealer)", "value": "eb29727de82d381b66470f17fd82daed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597880, "uuid": "d0122bf6-7694-4aa3-b35a-ca142959b939", "comment": "Malware payload (RedLineStealer)", "value": "265d1b224159adff68531474aad69dbb85c879dad7d1d330ff9c98aa8c179fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597880, "uuid": "69317ce2-100e-4ba5-837b-b24548271eb9", "comment": "Malware payload (RedLineStealer)", "value": "b09f0d758409589b2b6bedf62c9f9acde6d0d72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597880, "uuid": "57668dca-6a3d-4583-a7c6-88f845b19c4f", "comment": "Malware payload (RedLineStealer)", "value": "b53dec1941939833f6738e7b301c4ed80949e38bb65d791a5bee5fabb57b30a084931051a5a11f0d27838da92f753e36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597880, "uuid": "0ed2afd1-1d2d-47df-8f44-b7295b8a1646", "value": "T17B34E03172E1CC31C7A34A345A7487A5AA3BBC232E31848F77542A5F1E2139D86E675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597880, "uuid": "9634b600-eab6-4011-9c7d-279e525eb92b", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597880, "uuid": "1e6aaf08-416e-4241-9096-06b6c5626be9", "value": "3072:KuYIbQUF4c39UgazE5Q7gWcr2p6A9L8zkEk6G0Ax5ScrOpf2BYPvD5kvv5MYQ:KuYIbQTQ9UxDGy/z35ScoWvxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632597880, "uuid": "2c7e6748-3ab8-4e50-a568-874b42894b24", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632597880, "uuid": "0ecf3f7f-36fa-4fe4-932d-60697620aaa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597880, "uuid": "0e88ac21-f210-4d2f-96f1-c31b2ae0d787", "value": "eb29727de82d381b66470f17fd82daed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f521d35a-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601629, "uuid": "539558cc-eab9-4fcd-9f5e-518dc9602130", "comment": "Malware payload", "value": "bbfae5395bc382ab38ef88015869e7b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601629, "uuid": "54890c6a-324e-4148-a4be-eb4c2c494ba0", "comment": "Malware payload", "value": "267865b8fc4efc36b5b0b82691ae590eb02897673b6db4b38eeace87bedae780", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601629, "uuid": "478c80f4-e776-437d-906f-22d4f4dd12e2", "comment": "Malware payload", "value": "bf266b0cdb2b7a91023745f2b91479d71536ffb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601629, "uuid": "8cdd3772-5601-4dad-9d31-b884ee457289", "comment": "Malware payload", "value": "8719853b73b54225c8578a7b295216c8e962c20c0ccd71a03b5768d1d64e687d24e5ef65f43e1a8f29f4cd5258b1e849", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601629, "uuid": "6822fed3-6187-4383-a389-565871da1d11", "value": "T18343F946F9419B12C1D122BAFE5E419D33133FB8E6EE3202DD247FA03BAA9D90D97511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601629, "uuid": "852803ee-33f6-4480-bf07-d0daf8d51fd9", "value": "1536:73nKfq6k84Sm5txooSbygGQk44R88cRl6iQyYVxjdO+8FA5+:mfq+m5PonbygGQk44R8lRMoJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601629, "uuid": "ac2ad58e-f093-4d11-8ba6-dce897b15390", "value": 56212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601629, "uuid": "a999e72b-622a-43c6-8ee4-fb6bc7cd7ac7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601629, "uuid": "098eff12-55c1-4185-87d3-4489667b717b", "value": "bbfae5395bc382ab38ef88015869e7b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc09b284-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556865, "uuid": "a814b7e4-9d75-49e0-843e-220d579aaf72", "comment": "Malware payload (RedLineStealer)", "value": "1a1aca13d538427143bbaab026fe82ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556865, "uuid": "26e99412-7152-42c1-bd36-db0afe5be696", "comment": "Malware payload (RedLineStealer)", "value": "267fad2a2432ab3e4214952aee8ce30058be5375c4b5d1f2fc48184e3f789885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556865, "uuid": "18ab2de3-6b5a-4488-8a6b-5645f07a1ad9", "comment": "Malware payload (RedLineStealer)", "value": "c785bc072ec4a2a5a8e14c9b9374c5dc437c996d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556865, "uuid": "febb5df6-858d-4c34-8bec-2645e7d73762", "comment": "Malware payload (RedLineStealer)", "value": "786c6e3f02e54df261e9506a4d19829340c5de97ea377d83befa15b38aa2688bc0015d6a2fb5948735076ff2e69ecade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556865, "uuid": "4249889c-a5ca-424b-b62e-2b65bf94c3e6", "value": "T1C474CF20B7E0C035F4B712F649BA97B9A9397DB06B2880CB63D616EA53746E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556865, "uuid": "1477dee2-d34e-4496-946b-1942d4b1ee56", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556865, "uuid": "e862c095-fbdc-4ab5-a554-32923d973de4", "value": "6144:xRb7g0jjhilabOLSSfDXs1YWdM+UvKIdvODEbtDf8:xRb7LjhillLv5xvKGvODUtDf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556865, "uuid": "d13e4182-5efb-4aa7-ad7c-b18448b9d651", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556865, "uuid": "ca229ee6-dbe4-4b40-be30-efe604955fc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556865, "uuid": "a529996d-f247-4a14-844c-e69f3d6e8814", "value": "1a1aca13d538427143bbaab026fe82ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dbcd1c-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565415, "uuid": "ca033f79-6da6-4b8c-a019-e242272462c8", "comment": "Malware payload (RedLineStealer)", "value": "4fc4cf8211d805832f0682230b4e1cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565415, "uuid": "bb0f3d68-4aa6-4660-ada1-7a27c812415b", "comment": "Malware payload (RedLineStealer)", "value": "26efe12dde9ae5aeaaad25eec96f2ea4e9d7890919132a6ff97f48a63599e613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565415, "uuid": "edb6db46-b5b0-42e6-b030-496a2d5b49b0", "comment": "Malware payload (RedLineStealer)", "value": "f64db75b22dc888d1bb15f227c0bbfc47f9dba1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565415, "uuid": "40189da4-9051-45e1-a851-ff7bee95e269", "comment": "Malware payload (RedLineStealer)", "value": "59947e521a44afb6132bdc8df7ae06fb16e1615503ba86c923df2c24e797b81884e410c6d877eff24762d976ca7a6e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565415, "uuid": "c6d9d685-af86-4847-b872-fc764f5eeef3", "value": "T10264E00135A0CFB1E65765718B61D7E81A2AF86259B183472727776EFF302C0BB3631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565415, "uuid": "fd897b60-be3b-44eb-b685-377007d19c84", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565415, "uuid": "b8ca10a3-2324-4a20-a06f-38706fdc3bab", "value": "6144:Ryf/x26dEfTsxN8S7U875zfEATaw6Bwjtw:QXx26dSTON37qAuw6Bai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565415, "uuid": "a94f399d-2751-4085-8225-bd615e82c489", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565415, "uuid": "d5947672-fa30-4f87-bb4f-5dc9628e88d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565415, "uuid": "e0388665-0c4f-4ba5-b128-f9fb3f23a2f4", "value": "4fc4cf8211d805832f0682230b4e1cd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb79452-1d9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632532652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532652, "uuid": "6fba2979-e7d2-4900-8788-1cf93670eede", "comment": "Malware payload (Gafgyt)", "value": "17f665226608374978372fb93d01df51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532652, "uuid": "523e8a18-520b-4149-a1ee-72b419c4c832", "comment": "Malware payload (Gafgyt)", "value": "28344bbe9ec196a5ff37cd375d11b7b9210140398fe7272afab3caada5619a65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532652, "uuid": "3ad8d19b-1024-4eba-a29d-2f42b5876f28", "comment": "Malware payload (Gafgyt)", "value": "ccbd1b6267e599ad8517ea312b2df1b763bc904b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532652, "uuid": "234741e6-b184-41ea-a409-4cbbb61046c3", "comment": "Malware payload (Gafgyt)", "value": "c718d1087aa4ce7e5f76a9816232cb89f3355c32bcc1f8e6b0c54f3a92fc3144e797a9bb80b49c1f4d3fc7623a6d6302", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532652, "uuid": "caed1766-8f62-45d1-b24b-edc5a4323b90", "value": "T192C3F761ED44472BC2D227BBE78E038D3F395E6B979733115A347DB02BE57982E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532652, "uuid": "279eebbe-2661-4fe0-8cb7-ac8f59d6a31e", "value": "3072:wmaqkNiJi05pghqg+m4moYh/m7/L7Qs+mNEB0NZ:wSlJisg8g+mppm7/L7Qs+mNEB0NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532652, "uuid": "a82ab574-f050-4bac-ac1b-b6c8fd6ad527", "value": 122299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532652, "uuid": "e345b209-784f-4fe6-9ec2-49b4e7bd3e36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532652, "uuid": "3f83ef92-5934-4b1f-9c8a-1c2e36919990", "value": "17f665226608374978372fb93d01df51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fd567b-1d9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532370, "uuid": "e3332b30-3b1f-43e1-8056-fc22bc1fbaf4", "comment": "Malware payload (Mirai)", "value": "3539b28d2378e3650c901651090e31b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532370, "uuid": "0037e69b-6ce6-46fb-b1e3-ce32eb0e0301", "comment": "Malware payload (Mirai)", "value": "28407b7d3340e3b3cb583b8a08e65381d8df39c842cc72670132159312deafa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532370, "uuid": "4428cb4a-a88b-4e01-80f8-a39b45804d21", "comment": "Malware payload (Mirai)", "value": "3d721d010b60ec4ab125539f8ef73eb19d702cbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532370, "uuid": "e0102040-cea5-42fa-9653-bac1fef64f1d", "comment": "Malware payload (Mirai)", "value": "3557065fce07b53b76667cbf0c4a9c94ce7cf5a52c7af24195a1bbfec0d9db015dfb370eaee7fa2898da2290636dc750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532370, "uuid": "a8304521-3088-4b63-b566-62a4ea1b646d", "value": "T115F3943ABB619EB7D81ECE33059A4502188CD95B02D96F6FB2B0E51CE76BD4E08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532370, "uuid": "663a884f-a425-4524-8ff5-c57786704c0d", "value": "1536:QmeTKAx5VT/EtyMh1myEA1EZWRS4cpgJ4XA+L8ARAaqmOTimPaLy2qr+xNZ:QGtmlA1ED4sg6AKRA1mOThPaLynr+xNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532370, "uuid": "c7f04c20-de5a-4d92-886d-5ae27f4d3c98", "value": 159815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532370, "uuid": "d45e6b16-98c2-406b-9bcd-02030510c4e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532370, "uuid": "009e8f84-8e11-4dfe-a6fb-f43c6cca554e", "value": "3539b28d2378e3650c901651090e31b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51eb766f-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559264, "uuid": "3ea57172-2ff4-4b48-9340-0f097c2c4bda", "comment": "Malware payload (RedLineStealer)", "value": "0ac248f3dc565fb27a750c61e54a0642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559264, "uuid": "2ea88a94-5b33-444f-81cf-c26fffb870cb", "comment": "Malware payload (RedLineStealer)", "value": "286cdfa5578fa7e89ae0d97c0ff35fcc886a58d2dc48d5f889f7c74144566122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559264, "uuid": "c33da3bd-f1eb-46fb-8805-362c370d2021", "comment": "Malware payload (RedLineStealer)", "value": "26b0e55e41cf41705eed20a13f2141c3e14bd56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559264, "uuid": "74502275-2d7b-47c9-ae08-36ea4b9a25d6", "comment": "Malware payload (RedLineStealer)", "value": "a2af125d8b1200b8d91b8a34ba6af37e033653e269791f810df98dbb68693c9e77110ce083163159e2594a40e1c11414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559264, "uuid": "cd260061-42a0-4bda-84d8-69f999df92c9", "value": "T18F74CF20B6E0C035F2B722F546B993B8AA2C7DB05B38C9CF97D616EA56645E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559264, "uuid": "aadaffc8-79ed-4dc0-8c70-9a35f4da660d", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559264, "uuid": "2372e8cc-889b-45c4-832f-ba695dc11cf7", "value": "6144:MAv+sLf7W1/0BAjgr7ywMl02CectrksTKmns:MAv+sLfC1/Zj2gtmks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559264, "uuid": "8c5c0919-4804-4220-ac84-a03928c1471f", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559264, "uuid": "37d75bfe-d85f-490e-b0f5-2b43cf3f0fdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559264, "uuid": "157b905c-c706-44a1-adc9-3098e02e3f6b", "value": "0ac248f3dc565fb27a750c61e54a0642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722afc17-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562325, "uuid": "5efec651-9725-40b6-bb08-c50fb4f72634", "comment": "Malware payload (RedLineStealer)", "value": "7276560d5d8186a5214f9ec45c8051c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562325, "uuid": "e5c92cc1-55fa-41f5-b358-953a0af69bde", "comment": "Malware payload (RedLineStealer)", "value": "2915c45951457c2d8ec7f2642171d9cf6855e611843520d5de5665bcb8584488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562325, "uuid": "92fbe529-6858-4995-9c53-334fde1e355e", "comment": "Malware payload (RedLineStealer)", "value": "acda7dc09e586af800c5dc5608cf5c03e0f3b3f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562325, "uuid": "0fc7b9ae-6c1f-4297-b70b-435577aa58fb", "comment": "Malware payload (RedLineStealer)", "value": "848d174a8d8a8de71b388fac83e070f0320b8eb4e4c6c8917d0ece979f0e054c508d832d24bea143acc5fd9fa7255e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562325, "uuid": "f0dc99a3-fff3-42c3-b830-d2465e6a645c", "value": "T1FE74AE10B6F0C034F6F312B949B993B8A53ABEB16B3494CF62D526EA56746D0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562325, "uuid": "9ba61f46-9cc6-4465-b4cb-a0c9571e71f0", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562325, "uuid": "3303fcc7-884e-4d63-94b7-6b39c566a5bb", "value": "6144:FDy7moqGDbZZWvb0vX4Z/KEVpm9tpIRvZ3j6+NII4wBZj8:FDy7moqGDbwb5/bVkm9Z39NCwBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562325, "uuid": "73e63789-77ea-464e-830f-39e15777a43f", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562325, "uuid": "829a615b-8213-4646-bfb9-fed38ddcbcd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562325, "uuid": "cc430ad4-c648-4f34-bf8f-b7175e9630be", "value": "7276560d5d8186a5214f9ec45c8051c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f588d10c-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "f7dddff6-7f48-48ac-8e30-222de7f22c17", "comment": "Malware payload (Gafgyt)", "value": "b39a871b7e638fad86ae4c676c162025", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "d2afc973-9475-47c5-898f-4659ff6cb7ab", "comment": "Malware payload (Gafgyt)", "value": "29c7f62df5c3c689a1eb3904286052389ff32e06e94d18f164cc22cb412cbcea", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "a7bd83d4-74de-4518-8111-5fa1f2faaa78", "comment": "Malware payload (Gafgyt)", "value": "f8e264f36bd346cfae4e154de5b4ad4dec97b7be", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "e57a14fd-e7b1-4e35-ae77-c85ba370efe6", "comment": "Malware payload (Gafgyt)", "value": "c02f1b80d02e33d68d6391005f905e2377e31722bbabd121a95673ca5fe13a09cca498f927956b4ed9a495035d13c620", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "e7f5abc8-dcec-4273-8f01-c3947fee5b13", "value": "T11C734C0AE782C6B3C4831BF60697AB690A31F87A1A2F9F45F31CBCB49B125C87116755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "c6c38c12-ba1f-4aed-bcf6-4da57d00bf44", "value": "1536:Y8Qpk4MSyGYfgWoMDiBuLeEozBZjcfU4sA7+mLI2VOCjXUfyRk:ukayG2X+BuLepzfUsY+mU2VOCbUfyRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563404, "uuid": "219abfff-3f3f-4419-82b4-7951cef5c1f8", "value": 78112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563404, "uuid": "4a5e8300-bfc4-454c-99de-f1b6e3161d15", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "a3dd4622-594c-483b-b338-4d587bfde4ea", "value": "x-3.2-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12334cad-1d9f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532958, "uuid": "a983ebcf-54e5-4302-8e72-f32a442cfe80", "comment": "Malware payload (Mirai)", "value": "c29c773a5354904deb564fea1d8e601c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532958, "uuid": "761cd1ee-720b-40ca-be08-f276ef97cf92", "comment": "Malware payload (Mirai)", "value": "2bf54a7b06e8315923ee9531cd62c9764b639eb3572d60ae187b96ab487f8e87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532958, "uuid": "cf1a3e27-6df2-41d0-9633-afdfd7431546", "comment": "Malware payload (Mirai)", "value": "515800d7ebe6dce3e381de63ce058081ccd24980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532958, "uuid": "dcf12c15-5be6-448d-8850-7b91167ec002", "comment": "Malware payload (Mirai)", "value": "c617bcbd945178d856ce21a0d12214682316713730daadce2da1fac18a7c52bfe8ae9051634778bb151b7dc9a437acff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532958, "uuid": "b3518fe2-1764-4a39-aec4-b3a96c5eafa4", "value": "T174B3177798A59FB3C045A9B125AB5A600F22AD530F4F0A99713DBAB0037F4CDB44FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532958, "uuid": "45818b0b-b78c-47e8-9c3c-638f7497cca4", "value": "3072:B++GqYlX8vCYGhQW6OSHmH1cu7gWcF4N5:B+dq16zn6OSHmH1cu7gWcF4N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532958, "uuid": "fd82b01d-15b0-49d9-a983-278dfb489244", "value": 108875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532958, "uuid": "fc2badab-1bd7-420e-9311-eb1f3d372048", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532958, "uuid": "424204ff-be5c-4c5d-bcb0-96d8da3b760d", "value": "c29c773a5354904deb564fea1d8e601c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffc85f7-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565193, "uuid": "12ecd813-b823-48be-a751-c26bb0239e65", "comment": "Malware payload (RedLineStealer)", "value": "98a27dd667acbdd29e8e57d1c4f941ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565193, "uuid": "7c7b9b54-58f9-40ac-a100-108c629e4e26", "comment": "Malware payload (RedLineStealer)", "value": "2c0d4d1b7d79d5fc515db0ee4727088fc9b50c7c6510a80fcf2b88b59060fe3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565193, "uuid": "9ab397ea-8ad1-4abe-b658-6c1254e807c0", "comment": "Malware payload (RedLineStealer)", "value": "e78c28a4059fb1d6e9f5285f0d090259f3d9479c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565193, "uuid": "b4bec9cf-27ac-4a5e-84cf-b9ec2b550230", "comment": "Malware payload (RedLineStealer)", "value": "06ba324ca1c0b7693cae1737d4453fd5f21b2df1d80b97365b39994809bf136697e0e6bc6ff6dfa632e5261fa673aecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565193, "uuid": "d38d8b23-88e9-4d81-9ba3-07df53025f02", "value": "T125C3F115AFF40526E67E6BB134F1150A6F70FA4BCA16D79E385DD08E27933408EA0379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565193, "uuid": "89a7eefd-9bc5-4a3d-97a6-7341a91b6f62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565193, "uuid": "7dd70c0f-1540-433d-9245-79a7b6c594af", "value": "3072:6qpG4g3bpbcZL737ulZvMaKAonA1YVRkqE:6qpz+w7aBx3CVRkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565193, "uuid": "3f7dca30-d3f5-4dc7-8306-2c2753831a3c", "value": 129144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565193, "uuid": "07bd0263-a087-488d-964e-32e00764f384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565193, "uuid": "8e2134cc-1118-49b1-a320-1b31be9f8920", "value": "2c0d4d1b7d79d5fc515db0ee4727088fc9b50c7c6510a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1e0c47-1dfe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632573753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573753, "uuid": "2514bb41-2846-44ae-abea-234d5703e87f", "comment": "Malware payload (Squirrelwaffle)", "value": "3d3c017c7c99c90432bffe11332a1faf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573753, "uuid": "7a53b3c4-027c-4580-8ad7-fe7e729d5f67", "comment": "Malware payload (Squirrelwaffle)", "value": "2c84012e233c6b20375f1f0712f615154709d40df1847879ed5758bc5b0d339d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573753, "uuid": "ca883442-9934-4ddb-b838-c952c2e9d1ca", "comment": "Malware payload (Squirrelwaffle)", "value": "5b6f0201f8254a56ca7a3f388367dbc74673dd27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573753, "uuid": "a565e003-7d02-4cfb-baa0-0d4ae11f635e", "comment": "Malware payload (Squirrelwaffle)", "value": "30253faee540c5933d841e5aebb01d8dcc80a51c78f313d6eada6cc72bfdf25990da6f1352cc5a6afe814b1dda4ee3b0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573753, "uuid": "b9032da3-4e45-4276-9e07-73408ecfae92", "value": "T13864F6A5BD4D8C33FDD8363152836E1C691A3BD3B16C328F326EF6146967F44A892E50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573753, "uuid": "68fd1921-4d5e-4f76-b624-abe5c9f18fb9", "value": "6527345f9aee9363b094aad01304de88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573753, "uuid": "0fed2782-f2ee-429f-8ad0-ace4a7068ab6", "value": "6144:9/st+16ZWiobj+n5QZRO0Xj/Ee+aRLvccAOPyI:A+QoOaEFA7RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573753, "uuid": "4e4ab8ee-a049-4cf9-b545-6d07d6ea7bb5", "value": 322611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573753, "uuid": "62ec9db1-8484-441e-b65f-4066d13fc1af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573753, "uuid": "5e7141a9-6358-4500-948d-b55e4cfff34a", "value": "3d3c017c7c99c90432bffe11332a1faf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b948c62c-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563303, "uuid": "c93f90f2-a127-4fe0-95a3-829a75d705b7", "comment": "Malware payload (RedLineStealer)", "value": "29d8d4ce684f81372785ccc35e783ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563303, "uuid": "78cd4173-80ed-4770-8e5f-f1be6a3152c8", "comment": "Malware payload (RedLineStealer)", "value": "2c9371842f8e757a3268ca7128fc20c1f38e5e00795f36f23113f6842166359b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563303, "uuid": "fbbc89a5-c997-4b90-b5ba-3fdb865aa3eb", "comment": "Malware payload (RedLineStealer)", "value": "622fdc6f7d217a729a259ad7ef4ca62c2d8ba984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563303, "uuid": "e63a1a2a-7563-4bb3-be72-7ad5e25710ee", "comment": "Malware payload (RedLineStealer)", "value": "18a2d825c6f3c8ea1bf0619ca6d20dda3c74b70ae3cbb5541614843477af62b40be11d0500e9dfec2c8f847bdb5a1cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563303, "uuid": "f256d38f-a4fd-40a6-805a-3317f277a379", "value": "T17D74BF20A6E4C035E5B742F849BA93A8953DBD736B3191CF22D527EE16386E4BC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563303, "uuid": "3017fe49-c866-4642-ae6f-89468dfa991a", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563303, "uuid": "9998dc91-2630-4355-8e9e-b4d5318bda45", "value": "6144:sAkEeey2+28ALEeUgCItUefaBgmOt/yyrjdTN5nRW6Ul:c0y2+28ALovIjfaBgtBNrjhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563303, "uuid": "d79c81a7-408d-4c69-9785-bee95003bddf", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563303, "uuid": "ab329563-5861-4c5e-8853-d31d22e064db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563303, "uuid": "f16a3199-9199-4b8b-bafd-d76e338b981d", "value": "29d8d4ce684f81372785ccc35e783ccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2d7d07-1e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632596621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596621, "uuid": "ac2efa4e-6a6d-44fd-ad9d-1238398142ac", "comment": "Malware payload (RedLineStealer)", "value": "488b6bbdcef6e9f47d844f4e45d065b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596621, "uuid": "e61ee069-272d-4c60-8a45-b1bb99676e9a", "comment": "Malware payload (RedLineStealer)", "value": "2d07d380e31b6e3308b1fba40eed899dd9fce0fbb7d7beca3c708656961b6217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596621, "uuid": "705cf824-b542-474b-8a35-f246581b113d", "comment": "Malware payload (RedLineStealer)", "value": "f328549e7f5f9c2fd89dfb9c3e97422005c932d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596621, "uuid": "ae13d89c-ff8d-47ad-938e-17c8123cfdc4", "comment": "Malware payload (RedLineStealer)", "value": "7de8b6aa144f49e339fc9c2ce96895488227f90c4f180a7b09031d606cf6f05bfbc2fb11e516be2468209bae552006c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596621, "uuid": "c127536f-3e24-4afe-8f48-14b29e217f12", "value": "T16EC39C2176E1CC32E3F799745974C2B05A3BBC722A71858B7A54135E1F222D28AF7363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596621, "uuid": "6326003c-2159-41a2-9040-7118fc40053a", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596621, "uuid": "17f6a3dd-ce03-4b5d-9066-922043731886", "value": "1536:AtJEIKXpaPv4jgK4Th15wBd0WMD5TL4DTCklqT/8Qsa5Y4dz8:8JfKL8nh15AMD534qxThhYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632596621, "uuid": "2dbbee8b-478b-4f19-beb2-e6ac1ee52200", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632596621, "uuid": "21209c8c-9a2c-4852-b86f-78646f95e16e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596621, "uuid": "8f7378c5-0700-480d-b6d4-7403fcad78d5", "value": "488b6bbdcef6e9f47d844f4e45d065b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404ad3db-1dd7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632557087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557087, "uuid": "3ca5a225-8dec-4ef1-83fa-583404507ccf", "comment": "Malware payload (Squirrelwaffle)", "value": "1ff17ce907ce2d98867ec9c78998518e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557087, "uuid": "bc7054da-c74e-4276-8a19-d1609fa49ee6", "comment": "Malware payload (Squirrelwaffle)", "value": "2dca3e9494cc2b34e8e1d53d1c9b78830ef35cda9473c5a0b8d84ef9bf4ea330", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557087, "uuid": "28a5d2e0-32aa-4a67-abd9-3cc7c1a76f29", "comment": "Malware payload (Squirrelwaffle)", "value": "91818954ba50a5c63b73461af867a8c68958e20e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557087, "uuid": "f81ad334-a877-42ad-94f1-37315aa93e56", "comment": "Malware payload (Squirrelwaffle)", "value": "9f6c38b2930bc7c1bfc237d0bc20dfb004a7a6691fb2662ae36da595f82bb7d4308f3d8aa351271ac18de7c47437a29a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557087, "uuid": "06482872-b9cf-47df-8d1d-b801af8d11fb", "value": "T13764F6A5BD4D8C33FDD8363152836E1C691A3BD3B16C328F326EF6146967F44A892E50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557087, "uuid": "41611c82-2429-4749-9b09-c9a50d198422", "value": "6527345f9aee9363b094aad01304de88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557087, "uuid": "11f570c5-5f1b-43f1-8eed-639c17fc0b44", "value": "6144:9/st+16ZWiobj+n5QZRO0Xj/Ee+aRLvccAOPyI:A+QoOaEFA7RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557087, "uuid": "03ec7a3e-3fc5-4f9f-9928-9bff3f2c533f", "value": 336237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557087, "uuid": "7934e4e2-748b-49e8-97e6-fd51bb04c9e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557087, "uuid": "895bf579-5c7b-4ab9-a9aa-e581ad187d22", "value": "1ff17ce907ce2d98867ec9c78998518e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0476371b-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561711, "uuid": "5dadcc31-07ae-4a52-b7bb-2ae3b80f4924", "comment": "Malware payload (RedLineStealer)", "value": "79d1f5a077af4d15ccd1e4029a29a667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561711, "uuid": "806a8368-bab8-41c0-82a8-a476229e572e", "comment": "Malware payload (RedLineStealer)", "value": "2e17deea6cf258ab55a0eade69da1e30d1ffe14a59be634152d4438685619ee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561711, "uuid": "a7f0dd35-ce83-444b-a6ef-69897ca2182f", "comment": "Malware payload (RedLineStealer)", "value": "3bda44b44b7ab237312caea3aac169da9d6f08eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561711, "uuid": "5f5c6794-6703-4246-832d-67cc848694d3", "comment": "Malware payload (RedLineStealer)", "value": "b352eeff7c2a02c21cdf0ccc45f421cde21c55c7bce125a270c7dd27e3f6853e0c040581652b44af55183948a3fcaa5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561711, "uuid": "d4757c66-35b2-4479-b572-5af423b96b5b", "value": "T13244E01273B0D832D6E35A308874DAAD5F7FB5226A75814F3B28277D6F312D08A2531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561711, "uuid": "ba40ced0-81f1-4635-9366-f72eb1c479f0", "value": "e0383fee3aa7c9c4dbf3a05a98d01075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561711, "uuid": "00c040fa-e225-4aad-b846-aadd307d5c8b", "value": "3072:REcMpMYn11NrjRwvVSIbeXwvmhAk73Q1XjYLNCzqZGcJTGOdX6GYh8K1mMrJ2fgN:NMBVWvErgY16YLNfZPdXo30fJ9uCB08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561711, "uuid": "df858e61-9079-4aa5-863d-8eb14febe8bc", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561711, "uuid": "81434ee1-a168-4022-a080-964a39621560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561711, "uuid": "97da653f-fe43-458e-8eb4-4f3c6f6400e5", "value": "79d1f5a077af4d15ccd1e4029a29a667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e1e7bd-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632573607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573607, "uuid": "f44d66b7-ac28-42f0-bfd6-8580bfba1730", "comment": "Malware payload (TrickBot)", "value": "152cae688da8f9726fd740007e6a8345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot153", "colour": "#151E4E", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573607, "uuid": "257c55b1-9fb0-4578-80dd-4056d74862e5", "comment": "Malware payload (TrickBot)", "value": "2e2b2b42ca06698c2e034ce202c2d887e86d4b33cb58fa7fbd5930ca87100d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot153", "colour": "#151E4E", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573607, "uuid": "889b8038-8c6d-4ffc-9440-3d49bcbe35c1", "comment": "Malware payload (TrickBot)", "value": "7f883589ea35a63d6b63d9ce01bae6c257377aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot153", "colour": "#151E4E", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573607, "uuid": "853c8278-bf33-4d3f-9e45-76e5d352a808", "comment": "Malware payload (TrickBot)", "value": "626bc7499695e7bff5b72b9672624b20175cc7116f8a8a48c01da7c2963af062c5d83b96fedcaa3bb19bc5f415f1f6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot153", "colour": "#151E4E", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573607, "uuid": "596e7b0c-1431-49ff-97fd-323dadc8f5a7", "value": "T1CFB4D03535E08973D16319308EFD07E963B9BCA147B2958F8F902F0D3C7E556A43A2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573607, "uuid": "d83ff1a2-e900-4424-8817-54834683fb9c", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573607, "uuid": "7b8c8376-29ee-42a2-a0b9-8393419dd180", "value": "12288:cbVMh0tRyr3W3SyniM+uwkMx8nXoTT0WJZmo:WMh0tRyM3lY8X2xJZmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573607, "uuid": "f1784f56-baf5-43d5-bbe2-359f044a3104", "value": 528443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573607, "uuid": "8f0ee0b6-1e70-4e99-8863-c1ae97b0d46c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573607, "uuid": "4440b8c2-267f-4da3-9444-6632c71bdd31", "value": "152cae688da8f9726fd740007e6a8345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5117a294-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632552391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552391, "uuid": "3d6f7462-d07c-480a-a686-4a431bdbfcfd", "comment": "Malware payload (Quakbot)", "value": "b1850081b2ab11877d41937d668c485a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552391, "uuid": "e9f01e61-5b89-4728-876a-95d8acd084c2", "comment": "Malware payload (Quakbot)", "value": "2fcc75e80856e2c3fe1672861fa14a7c9b16c452e4d2c977946a462d4676f804", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552391, "uuid": "e0bd2216-85e9-475e-a0de-d9a1fd83514b", "comment": "Malware payload (Quakbot)", "value": "5457b4d13ef32f0af65813836c01fe7273fad2ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552391, "uuid": "a5a5d12e-b68a-40b8-a18d-7521d446c067", "comment": "Malware payload (Quakbot)", "value": "61f4f23ea6c95b4b6db67beb483c2d4cdbeb7d418fb9eecc591ba899656d3bc97ea81d9a9a2c9733515df986ebceb23f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552391, "uuid": "72b5fe98-5ea9-42ee-b0e8-3393ca6616fb", "value": "T10705D02A7ED6E191C83C5D7988E1C8E67238BC686D28961739E53F3F29F30D1584909F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552391, "uuid": "e72e9242-3f19-4f33-b2dc-d2a5e8e59275", "value": "fcecb109cd51f9ec6659a40269cd21c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552391, "uuid": "5a8300f2-b46b-4f62-a2f1-cef4bc00cf08", "value": "12288:n0y+ZOB93YJh6kwi4eYHc+12GPUhW1brsZCesX/OkSAIV5TQi/c+FI2PXakp5:n0ymQFViB7IOcesPIVVZQi/csIvk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552391, "uuid": "f0e1be27-88d5-4f7f-a13e-08b35b207a61", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552391, "uuid": "9c16df23-8572-4c91-8687-abf8602f8a22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552391, "uuid": "3ed24eee-98af-49d0-8571-a61176049779", "value": "b1850081b2ab11877d41937d668c485a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09dafab-1dde-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632560255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560255, "uuid": "9d6e679d-3a00-4f43-9a9e-eb3b4826fcbc", "comment": "Malware payload (RedLineStealer)", "value": "20e5f0cea84c5c3e17bebddecf04126d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560255, "uuid": "a04c7c1f-ddd4-41ed-92d5-c5de523f9956", "comment": "Malware payload (RedLineStealer)", "value": "2fd3207bf2afd0fcebb92faa05afe1d40f54a49f374bdfe84556e1c418d16e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560255, "uuid": "b9a70acd-59c1-46b7-a230-e6878c5d8b6f", "comment": "Malware payload (RedLineStealer)", "value": "bd7153b8b6b7c02cd4b5750def0f7282a4cf91ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560255, "uuid": "58026a8a-c0d3-4d26-8695-fef17a367055", "comment": "Malware payload (RedLineStealer)", "value": "0ca95dc70ee27c172a9c09bbf5a22a0c4126cf2f2c390c8136a501e5d3ac52a7b53167913ae3d4dd068563e8bf3992c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560255, "uuid": "8d6698e7-4eed-4e52-9f02-49849a6e782b", "value": "T10364BF20B6E0C039F1B752F449BA93ACA83D7EB15B3491CB62D616EE56346E8DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560255, "uuid": "9a5690aa-6d81-4a3e-b291-ff87d35c9aaa", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560255, "uuid": "7fe8effe-b044-49b6-9142-1f6f9cfed968", "value": "6144:rBZQVtRfVBGel7qJ7Wc6S9K8F3TQAUTIyrwMC7t:tZkfVBGelW0c6kZFDQAUTIyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632560255, "uuid": "a536ae00-7582-4d13-9a52-c429b49ba63f", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632560255, "uuid": "bc9014c3-2b41-450e-8769-07eebd73d961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560255, "uuid": "82585ce0-5160-4cd8-9763-110f59aeaa7d", "value": "20e5f0cea84c5c3e17bebddecf04126d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4881692-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563295, "uuid": "24dee911-7fbe-47a0-b57f-ec0165ec8a96", "comment": "Malware payload (RedLineStealer)", "value": "97b693372041c82e392a00f1cdadbfc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563295, "uuid": "41220832-8e5a-4a8f-8187-d264c90565ec", "comment": "Malware payload (RedLineStealer)", "value": "31524fe7e748c4b7a3c00f9def961b87002376351e6025aefa9521897334cad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563295, "uuid": "98a5b50e-0a17-477a-a9e1-6965018c2616", "comment": "Malware payload (RedLineStealer)", "value": "12258f80760f3bd21a498822261cf769c125922c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563295, "uuid": "c8c6985e-97b4-4b8d-a0d2-d4812d025f65", "comment": "Malware payload (RedLineStealer)", "value": "3ce78dc5801113300cc505ab87e58add5e31679915952235c6f3a9ad88747716cbc9b1749cb607be05e40f0e6e47f958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563295, "uuid": "08332616-2a48-4573-8aa0-25c2f5df1b19", "value": "T11C84BE20BAE0C035F5F712F84ABA93B8A93E7AB15B3441CB62D516EA16347E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563295, "uuid": "ef908819-cb1a-4410-a319-aeb8a50c3e63", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563295, "uuid": "3c360aef-f5da-47c3-b1b3-eb8eb3105c6d", "value": "6144:LD3K6X3VI0G5wa7PF/VVjIFNSqexXt5JLeS30ZG:vK6X3VI353P9jI7ehJLev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563295, "uuid": "37274c8a-ff2e-4d28-9e0a-e1dcaa5478a9", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563295, "uuid": "51622569-e6ad-4884-9f30-cf84b98fb3a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563295, "uuid": "41ec9c59-84ae-400b-91be-264ac8197834", "value": "97b693372041c82e392a00f1cdadbfc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f02027-1df3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632569304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569304, "uuid": "45412daf-875a-4b3d-84c9-396b1f8fc72a", "comment": "Malware payload (RedLineStealer)", "value": "6059f3d5f9363aec4fc073b0eae1b212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569304, "uuid": "49d560c1-fbd1-4781-9ee6-56a2b1478dee", "comment": "Malware payload (RedLineStealer)", "value": "329368ae3068f366ed33afbacccd2b33dde105abfaf94710c3d85975e6b7da9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569304, "uuid": "f51034d5-2bfb-4118-8ab6-3c6f0f1adb67", "comment": "Malware payload (RedLineStealer)", "value": "fdceb547579c070365cd16639201de49a4fa6e7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569304, "uuid": "e2f12409-7128-44d9-b3a4-28182eadea2d", "comment": "Malware payload (RedLineStealer)", "value": "2b771a2b720e096d93b3fb08017862abcc2c6c0f3b5cffe9304884e799119838e37af41594fafe0262a74c55aac1e511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569304, "uuid": "d3d4e187-35af-4dfd-ba6d-d32d98913d03", "value": "T10F34E160F6A2C031E2E34975687193A16F3FF8726A75425B375D376F4E232D18A2A313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569304, "uuid": "4e8ea070-7009-4fc6-ad09-40b713edf778", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569304, "uuid": "6a0bd15d-3c3c-4327-813c-5be59ce2336d", "value": "3072:POYTAa9mzb7UAQnIXHNzcuU+wyHrXAdiMxHA+u+4fsYRQMbvC5tTx2mYQ:POwtkff8iHGyLYn3yBH24m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632569304, "uuid": "8678a461-040a-44e1-9873-ccc8107c2097", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632569304, "uuid": "7932e96b-0232-4c31-86c9-8020b3a5d16b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569304, "uuid": "f0fc0c3f-c662-4010-9d5f-08fe8a152f60", "value": "6059f3d5f9363aec4fc073b0eae1b212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e2db1d-1de9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565076, "uuid": "81e5e1f5-f7ea-4d0b-8d08-3d4dc9a8800a", "comment": "Malware payload (RedLineStealer)", "value": "e58c5a4ab8a6704fc0184cd3c8cceb35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565076, "uuid": "b73deb12-fc7b-4a31-b4b8-01fd2edc0887", "comment": "Malware payload (RedLineStealer)", "value": "32af6eab31697cdb2e7f0518de353bf8001fb61cd4e8cb11e1f9ba3ee163813a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565076, "uuid": "e78e1220-316b-440d-86d5-8f7a9504cb54", "comment": "Malware payload (RedLineStealer)", "value": "372396e5acfa0387189b4dd06ce539b4dedd5b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565076, "uuid": "9c086f2e-78da-4a98-be43-8062cf5b6b9d", "comment": "Malware payload (RedLineStealer)", "value": "493fec620a7bb7bad0b97f79173e975886b4c14aacf8a193f4a8b24c034291fc57cdb26bb81381272475b6e83ce04414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565076, "uuid": "d0c80621-11bd-46a3-ad1f-45b49643d4e3", "value": "T13E64E0017EA4CF31C4A345308810E7E5673AF821F961CD4B7BAAFA2E6E30ED1566535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565076, "uuid": "5189cc20-b3e8-4120-9047-bc36736ea0eb", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565076, "uuid": "322d1dbf-2ec8-43e6-9cc0-c5b3a3a68ef6", "value": "6144:jqf4QC0U+N0jnLHCJMGDDxZTPVHJgOnBwjt4:2fJ/WnEMGDbN2SBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565076, "uuid": "18c50d80-92c3-464d-b2bf-af48eca50a0f", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565076, "uuid": "2451d6df-70d9-4f2a-9cc5-74088ddbc7d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565076, "uuid": "9e054d92-8cf6-4a2e-9219-d32055cc0419", "value": "e58c5a4ab8a6704fc0184cd3c8cceb35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6b4253-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561721, "uuid": "b0c0f3b2-f2ad-4a72-8f42-8456ea3c2833", "comment": "Malware payload (RedLineStealer)", "value": "48a76a62b240d91320e07471b016fba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561721, "uuid": "bda3338e-774d-4d21-a2bb-ce1dec54bf31", "comment": "Malware payload (RedLineStealer)", "value": "32b9b4bce4d318a9df816799b1ab544126244277da5d9d5395f05e926c238cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561721, "uuid": "22b3146b-25d8-4793-9baf-d7fa621e0904", "comment": "Malware payload (RedLineStealer)", "value": "7050b6117c99da9f7a1032395e4485ac156c9461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561721, "uuid": "ec9165dc-7137-4cfa-8070-d778c39191b6", "comment": "Malware payload (RedLineStealer)", "value": "37ecda13ebdd95be766c65534b8e3641ffe2ae0e01d29ff88ee018c9827118e08e921a86a2d41a1eadca5c2098954d47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561721, "uuid": "2b092cb9-8689-4af3-af2c-52ae85d8a6d7", "value": "T1EA44E02239F0C932DAF75A308C74C7915FBFB5226E7191CB3764266E6F202C09A66357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561721, "uuid": "3115bad3-17da-4466-b755-7023c53d554e", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561721, "uuid": "b3eb8d35-e345-4d95-8d08-65ef43dd4b4a", "value": "6144:6IaO+ASydIcrkjBOyfvjGGBGau7WaTJzjNP2:Ba0SydsOsjPADSaJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561721, "uuid": "14634f9d-0bfd-45ae-b068-633bef3fb5a8", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561721, "uuid": "eb88f17a-cf2f-45c0-bc4b-5c411ba1e783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561721, "uuid": "665f7809-5dfa-4689-a541-ceac845e391f", "value": "48a76a62b240d91320e07471b016fba3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7e2355-1ddb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632558748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558748, "uuid": "b976eb83-46ac-4368-9152-883c2e80d941", "comment": "Malware payload (Gafgyt)", "value": "4add7e56faea19442cc2c2c7b5a68deb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558748, "uuid": "211fa75d-4bea-435d-9a98-b00a8699900b", "comment": "Malware payload (Gafgyt)", "value": "33072d876c8f140d7c46aec1d415ed584c46725547cf1868a097c2daca814071", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558748, "uuid": "6d8306ca-01cd-4a2e-82f7-2e48edfdf8ca", "comment": "Malware payload (Gafgyt)", "value": "fa2eb72b5c5c44e4a14f6a663ad1e34f3c587694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558748, "uuid": "aba26391-39b8-4bcb-9ba1-ff38bfd0a9a5", "comment": "Malware payload (Gafgyt)", "value": "b6cd512c9c907132249a6aa8c0900b1c679b583722bb7bdf1021eec92b14596ce32a9a872731cc85213c4915eb06e48e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558748, "uuid": "0f5c334b-7d78-47d7-9836-f6fa130298ae", "value": "T14D83199BB61D0BABC5975BB12CB737F18B6DFD6002A21184910EFF9007B29742532F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558748, "uuid": "79fb140c-23c8-4b0c-88dc-36681c5d6312", "value": "1536:rhohfXRh3IKCV1rahuT537KqBFYrrUQI8fItwHUIe:1W/Ej6uT53OuTQ/Itl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558748, "uuid": "2ecdf98c-b600-48d0-a62e-dfcbe304c4c8", "value": 88551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558748, "uuid": "e462da76-967c-4c10-af29-7a55b88bb1ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558748, "uuid": "c597923b-a465-4fd9-968a-ef9d9a9e694a", "value": "4add7e56faea19442cc2c2c7b5a68deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901ae97d-1e4d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632607902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607902, "uuid": "ca87b287-a9e9-483f-b23f-8c653232b3d8", "comment": "Malware payload (Mirai)", "value": "0dee9e5fe04093a2e8724bac441c4d60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607902, "uuid": "5c2b659f-9bcb-4c00-b14a-28c329496fe9", "comment": "Malware payload (Mirai)", "value": "335a0f7578779e6ce35a56b8cb18868b092c17bbc0be2733e5c4573c43e7e84b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607902, "uuid": "caf13b36-ec06-41a7-ac69-76a3e318a651", "comment": "Malware payload (Mirai)", "value": "9533ed46bc5a2ee26f5ffc5a5ae95ce8656d04e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607902, "uuid": "27911550-d1eb-4acb-8afc-cbb34d94b3f6", "comment": "Malware payload (Mirai)", "value": "e9c776851d11e1455c6a74033c36bfb6aab7f22ebf33c82afdff25c629359a6d37f5dc311576e42ae9441257436e5259", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607902, "uuid": "851654fc-8a49-4bb4-a829-09cb239f8aa8", "value": "T101E34C46FA818A13C4D5137ABAAF414A3322D7A4E3DB73079D185FB43F86A5F0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607902, "uuid": "d2bdc7f5-ca32-4318-a905-f5deaeb6c649", "value": "3072:kymDOH89DIK0y36Di56EE7CHazUkp+lmLM/9F4Zk:hmyiDFjqi56EEO6d+lmM/9KZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632607902, "uuid": "172c4e75-3c00-41a8-b033-fcc44d7d67f2", "value": 150579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632607902, "uuid": "6821ecfe-a801-4fc1-82d1-d890b610f403", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607902, "uuid": "2a1dda55-ff9f-40ee-a1f9-6137308bc41d", "value": "arm7-20210925-2211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f2dc09-1d94-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632528246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528246, "uuid": "926c1844-84a4-4a6e-924f-33b30eafe5a3", "comment": "Malware payload", "value": "4e67a6a1ff5c40d3273b94e6a57496f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528246, "uuid": "19142130-61e0-463e-9715-98f9ad9219b1", "comment": "Malware payload", "value": "341ccda0496c689de17b25ee406fda05bcb34d7c7b71a639d492345c18139c57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528246, "uuid": "3c15c5fc-a84d-4dfc-8428-0bedc6df4d3e", "comment": "Malware payload", "value": "651dfe5c6c89f01cda743d7b629dcc1a514018d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528246, "uuid": "e4a5effd-1508-447e-a67d-0ef35abeabe1", "comment": "Malware payload", "value": "b718050fbe85c7980ff2d8739a770720ce32730ca9d1f2606ff40e1219d86229feab23486ffac665f388c877e02d78db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528246, "uuid": "f0db3b2e-3255-4490-add4-88a6ce1dba69", "value": "T1CAC4E41926485A6DC9F322B2052FB1B193AEC471233202CB73149BD6BE447E15EFD6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528246, "uuid": "7497bfd2-b63a-4568-9592-5e33c262cf9a", "value": "3072:lv/5YOhZIslTuNlFPVXqP00KIkOPcs0SeM:VWOPlTuNlF9XqP00KIkqcvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632528246, "uuid": "764a85ab-8288-479f-98f3-39008e615ba4", "value": 555478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632528246, "uuid": "bb67db1c-3be6-4508-a939-8daca9b09a5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528246, "uuid": "0ab0f0e3-9989-4173-b4f9-4746964d329f", "value": "test2.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0b6dfe-1d9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532649, "uuid": "dfd1341d-4521-44b7-97d4-b1c8178b95b6", "comment": "Malware payload (Mirai)", "value": "3b178d04947b5b297ce11ebfb2b301d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532649, "uuid": "de5e415b-b8bb-48c5-b98f-aba02055b72d", "comment": "Malware payload (Mirai)", "value": "349022b63e41afb6372a30ef834a7812ca5bfa2577842737596563c38bad7d45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532649, "uuid": "812d44d9-8fcd-47ab-ab63-7b4ced7ebf2b", "comment": "Malware payload (Mirai)", "value": "52471b873cb2c597f1d21975f497998be6172aed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532649, "uuid": "7b7e1c1a-5f4b-4462-ade8-fdd2a0f27ac8", "comment": "Malware payload (Mirai)", "value": "a19f5f71926d3607cf4ed9d7547f0840517e21105ed51c74063677f6396eb7205cd269484c4062f09e9f8c37a307342a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532649, "uuid": "805772b8-9d0d-49ff-bf2b-c8a4fdf3e384", "value": "T169F3863E7E21BBBEE268823107F76F70CB99699326A19341E16CF6185E7124C0D9F750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532649, "uuid": "1f421266-b85a-4ef3-a31c-a5fe830a7639", "value": "3072:fZUdjijQ9gREPM3TI7uzao1QEFWmOThPaLynr+xNZ:udjijYC91QhmOThPaLynr+xNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532649, "uuid": "073c9986-fc1e-428f-849c-f983a2bb880b", "value": 159815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532649, "uuid": "912ea6ea-d035-4793-9335-c6c585a054d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532649, "uuid": "bbc310db-5463-4516-b5aa-17475455d9c5", "value": "3b178d04947b5b297ce11ebfb2b301d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af81da43-1e15-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632583902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583902, "uuid": "b74166a9-dfde-44ad-9d5f-9bbd36b39dba", "comment": "Malware payload (Gafgyt)", "value": "652a66ddd4f66e31ca27d1d30313dccb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583902, "uuid": "413c6f75-b7f3-42da-8f27-bd4ecea95348", "comment": "Malware payload (Gafgyt)", "value": "34b404d9cb357730cca3c77261ab7f94c1189148d7d01cea376621051308713a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583902, "uuid": "8f23f4a5-9c8a-40cf-87d7-a24af2c7c637", "comment": "Malware payload (Gafgyt)", "value": "3d7f2242c0066618cf9c79ba5e81baef682e5f3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583902, "uuid": "0937cd5f-6c0f-462e-af4b-0c0da40dc7f8", "comment": "Malware payload (Gafgyt)", "value": "5782fdddc8030dfa0f236ca3dfc3692194c544e073f9d9ef886c8304f3f342b89fefe178ad90c2c7135752b572eafd52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583902, "uuid": "f5aedc5d-a8fa-4bab-94b9-fbebf87de196", "value": "T17EB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583902, "uuid": "5484b682-1c79-41e4-9fd8-6a7ea1f1d033", "value": "3072:b6an17WtsWhdgYJc0D6mbPbmTQOWsXAOn:Wan17WPJc0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632583902, "uuid": "1c5394ad-afc6-4c3d-b876-8b282b1a73a2", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632583902, "uuid": "14d1fb9d-12ba-4278-8eec-219e5457d23c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583902, "uuid": "caf242b2-f87a-4859-a5e5-9cf0cfb33980", "value": "652a66ddd4f66e31ca27d1d30313dccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28af8aa7-1daa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632537720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537720, "uuid": "751bf5b8-2804-4507-8bcf-f0989d9c5168", "comment": "Malware payload (Mirai)", "value": "011cf48596b6129028b345eb433b3a10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537720, "uuid": "96af0ef5-0c2e-4dc5-acfe-51a239482689", "comment": "Malware payload (Mirai)", "value": "3605ae1b7e76b58fa229e9abfc825d5da376fddb597d0ec558b5651fa9d44174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537720, "uuid": "e53968e3-9fe2-48f2-87fe-62d0f62cd143", "comment": "Malware payload (Mirai)", "value": "e77858a4b5882dae0d43c10bab29e74171ef1c58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537720, "uuid": "602f1a90-a472-494a-ae28-6ec7ad5b731c", "comment": "Malware payload (Mirai)", "value": "9a4f6abe1257ddbf4dd978164bdc9503d2ee26a76dfcd14f5aa5705e50d28638edec8259f37867f1ac891eb66c758c79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537720, "uuid": "34cbcad2-ade0-4784-ae82-d6c494e68b37", "value": "T19DD2E0EED18198F7E9BAC83957D643431A24239189835C9761B6A683CF658B0B8871FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537720, "uuid": "730675d3-4505-4d6e-ab31-b01ede63699b", "value": "768:0ZI8JvLN/MnqFFvj6lc6YBNolvPJa5JgGlzDpbuR1JQ:0O8JvR/IqFFurYBNoRJGVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632537720, "uuid": "87efede4-7e45-4bfe-bb1b-2883a23d3288", "value": 28532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632537720, "uuid": "1a7f34bd-8e30-4d19-8157-2e027464e886", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537720, "uuid": "c1fc5cd6-f8d8-4b6a-a7e2-37d831867988", "value": "011cf48596b6129028b345eb433b3a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3a5c3b-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556862, "uuid": "f8454a95-89eb-4991-8ef8-1b8a9b3b1a39", "comment": "Malware payload (RedLineStealer)", "value": "1dee93cff70132fef20a785b647f2f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556862, "uuid": "062ca826-3222-4ba0-81c7-b8c90ab61edc", "comment": "Malware payload (RedLineStealer)", "value": "3668ef74bccc72fe12cb1dfe661a5a3eccb4a4b07f2080db423f0b4f1cc3f10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556862, "uuid": "94b8405c-91a0-4651-abe7-3273cc2da673", "comment": "Malware payload (RedLineStealer)", "value": "800c10f0b81f856490db0a07494aec257f64d017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556862, "uuid": "a30c7a48-992a-496b-88fc-1fef0a03583c", "comment": "Malware payload (RedLineStealer)", "value": "981f8c4b2aaaf41737b1a432a29d2453c6daf428282e18989e2bc2cfabb3337425e119f30019581f52faa03b790e6982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556862, "uuid": "1ab2ec79-4089-487c-8dcc-d9b147ea1008", "value": "T19274CF20A7E0C039F5B713F55ABA97B9A92D7DB09B2880CF52D217EA52746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556862, "uuid": "fff599ba-e295-4e0d-8ddb-86ed311586a9", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556862, "uuid": "3e9e9884-2ef9-4a7b-8930-75486175eadc", "value": "6144:MaVvOAUzjh96ldbi4MVzyK+sDIZoCXS3owu9Mv3:VVvOHjhEl84xKzQXS3oXM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556862, "uuid": "fd4b790b-b974-4370-9c98-70ec2af1fe23", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556862, "uuid": "1e11b286-fe80-448c-8619-5289aa388d89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556862, "uuid": "875553ff-6bbe-424a-80b8-8a2f9dca2304", "value": "1dee93cff70132fef20a785b647f2f7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a8f190-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601633, "uuid": "388763e4-089e-4216-8841-614b3e6cc210", "comment": "Malware payload", "value": "d9ceb33c787ac9b9fa66fb52a3d9ffb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601633, "uuid": "64e83dcb-187c-4193-a477-9a7196be3b9f", "comment": "Malware payload", "value": "374a6d264d9a27cb813ebb208add947fa593149726713f7fbf63db5eecea85be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601633, "uuid": "ec4f712c-ca71-415e-b53a-3fa41ce2d4e7", "comment": "Malware payload", "value": "503e0ec07115ef75ad22995c878d974484b1a12f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601633, "uuid": "7a45996e-4350-479d-b74d-a83d075c5ae4", "comment": "Malware payload", "value": "8be40b372336af8a0787abd0770a2d2aa5fe010e2df537e04a7d2f9706295957cd5e8d15e9b36e6768da9322afe9b031", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601633, "uuid": "46ad5546-e173-4d76-86dd-07f86943d3e4", "value": "T1DCD2E161F00AB161D6316E3EE8764004A1DD1B3ED9A4A3B319294B867CA6CC7F3AC907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601633, "uuid": "78325fbc-e071-434e-bd18-f77482e467a2", "value": "384:CjuFPaj7a8FeiMG46B7fwAilV/sx2agrr5Os3jL9z1wgL404LRtOGfuzkjAcIfqX:pk7JMyqAi3bagrtRz170UtZfq3U72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601633, "uuid": "3eac64d1-e531-4af4-bb35-20c95df1e3a4", "value": 28460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601633, "uuid": "5919157f-c788-436b-86ff-c5f0b7bd5ce7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601633, "uuid": "c4459cc1-6b96-4dd7-be06-7e30766d502a", "value": "d9ceb33c787ac9b9fa66fb52a3d9ffb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888464d6-1ded-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632566657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566657, "uuid": "c5118d8d-10fc-4ee6-9b84-37d78eeac3e2", "comment": "Malware payload", "value": "b356a1f3ebd403a0aa9ca53e3bf7c9e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566657, "uuid": "4ca18191-a073-4da9-abc7-95f264da86bb", "comment": "Malware payload", "value": "3789eb98cd85bdb343c973c3ac232819ff1b993e59b808eb278b364be099cc48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566657, "uuid": "b58e7f38-0640-4cee-a0c9-794c5dbd8830", "comment": "Malware payload", "value": "583b7cdf2422500f7e8ef436a1928bd3603d7c7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632566657, "uuid": "d7ac850d-afd3-4fba-859a-838120e3f528", "comment": "Malware payload", "value": "13c05aa1c62b21282cbb6b3d303f2f8971485ecd41112dc5661ee3299d4be6b2e86eb038eb115f6162b9566bb975052a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566657, "uuid": "980662a9-a0bb-4120-bbcd-eea66483a55c", "value": "T1D624CF6037A2C032E3E366344975A760577B7EA32F73D24AF64C269B4E322C158E6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566657, "uuid": "c4a34372-62c5-4b64-9775-b492ae7bb3f7", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566657, "uuid": "5bfdde9d-aebc-4fd6-a5e2-d47706a8adb3", "value": "3072:diwXcldEIf0JlACICjNbAizTSTqOSOAO7xcfDd8tdLe50McNS9H6dYe:APnf0oHeTSAOAotFMcNEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632566657, "uuid": "0af65beb-2b12-4822-976c-d37c5d88d1b3", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632566657, "uuid": "e5796720-51f3-4f5f-83be-a86599a6e292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632566657, "uuid": "4be90fe3-9fab-4597-9368-78b8f2858cd4", "value": "b356a1f3ebd403a0aa9ca53e3bf7c9e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250e5afc-1da4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632535137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535137, "uuid": "e59f9f30-9615-422a-a97f-6cf94a28a434", "comment": "Malware payload (Gafgyt)", "value": "b435788bcbfb515e884071ea493ed2e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535137, "uuid": "0216d1af-b98d-43f7-b843-73d36f6cf3ba", "comment": "Malware payload (Gafgyt)", "value": "38375c62a83211291065dc36e434dda64798de93eb92f313148bc8c46901322c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535137, "uuid": "2a37169b-ad1d-4f1a-a3a8-514f6666a236", "comment": "Malware payload (Gafgyt)", "value": "705d8ee8e317d742c063a9b65b9263eceffe6a28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535137, "uuid": "93b2afc6-653d-4d0f-b1a3-499e3c359620", "comment": "Malware payload (Gafgyt)", "value": "54009969c1a754b3d7420b2865f8c546418c1bba2fb57da6af31ad2eda581d29c351e7b2e411f2e409b7222a402d7f29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535137, "uuid": "3e699f8e-1b4a-414d-a26c-b063bb19eab9", "value": "T1CAA3E766F501DFBBF40B963504D74F217A70BBE10F93262273663AA6AE721C53822F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535137, "uuid": "c16a5f8d-7642-435b-b919-35cbd2a8532a", "value": "3072:/Cl8E13tfLTd6ANWpyQZobmUnVqwLOf/Pe:/NE13tfLTgyQ6bmUnVqwLOf/Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632535137, "uuid": "1ddb0601-6b87-4fd0-bf91-6f4ed75c713c", "value": 102376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632535137, "uuid": "d32c193a-7eb3-422b-b989-b3969dfa8143", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535137, "uuid": "5172c9a0-da9a-43c7-93ab-29649bd1abaf", "value": "b435788bcbfb515e884071ea493ed2e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3886cebe-1dd8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557504, "uuid": "84a0df47-21d8-4f2a-abcd-b9ef2f07d06c", "comment": "Malware payload (RedLineStealer)", "value": "355fbd5060b3bbaf8c5737b4279e9000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557504, "uuid": "4bdd93bb-b518-4eff-aa58-be635f7cff20", "comment": "Malware payload (RedLineStealer)", "value": "383f147b7eb4c815bc9def993cff994da41c7395092ceedd3c22d10e130b8c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557504, "uuid": "1eab9f44-871a-409f-82d5-f6a3117216f0", "comment": "Malware payload (RedLineStealer)", "value": "88fa1113f76294bade7fd9075cd5e4ea76cf5314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557504, "uuid": "a3f25254-6f33-401b-a5f6-3a4563ac72f8", "comment": "Malware payload (RedLineStealer)", "value": "07bc2fdf9e8d6bf6291f49b6c0414229c0bc5acfdd3c78449b9d4379b76f84d3f0af98933be18767b3b46c2a95532223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557504, "uuid": "b18ff0d2-d73c-47af-852c-27a031bcef06", "value": "T16E84BE20BAE0C035F5B706F955B993A8AA3E7EB16B3480CB62C156FA57346E4DC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557504, "uuid": "3e31f2f8-67b1-48eb-bbfc-cb5c68d68fb2", "value": "0f0c12643909b692a9be3510bdc965e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557504, "uuid": "dd9fe3bd-3571-4529-b104-0f42dea0a63a", "value": "6144:hvVtPR9Pnxd2EDFDiah109/UWi9RoJAq3+Cbs+3we88Kqb11tW7GvVsu:959Pnxd20FG9/+foLuBTFc1tW7ysu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557504, "uuid": "16eadca3-6199-4a4f-a10e-458dce655974", "value": 404648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557504, "uuid": "fc860ad4-0ad8-4d09-9091-ead0d52203a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557504, "uuid": "3cbcbcf8-859f-4304-94d3-7c8513b7b1bb", "value": "355fbd5060b3bbaf8c5737b4279e9000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff17f03-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561784, "uuid": "f030c386-8119-4165-b061-732ea7d2f861", "comment": "Malware payload (RedLineStealer)", "value": "8e1701a683bd0cc5be3553fc01292ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561784, "uuid": "72fdbbaf-e22f-4c76-94b8-b291d2e0f325", "comment": "Malware payload (RedLineStealer)", "value": "389ff8b769a88d86d6678629c156706373c36baf8727e100ca6ade27c03c713c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561784, "uuid": "54cde947-780f-4994-be86-1fb2cfc40a84", "comment": "Malware payload (RedLineStealer)", "value": "c81e2236b8a95aa52502471b7ef643fb7fc14a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561784, "uuid": "fdbb6289-a726-4bd9-8af1-621b5be6d329", "comment": "Malware payload (RedLineStealer)", "value": "4c5b291ed173f7392a55407f1ff105d4315a92f46da1c7b9f30ebb1d3f84b5c0d427c30e1b1b56051a124372b7741eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561784, "uuid": "1f4b8f07-93ef-4acc-a478-87f2bd37fed5", "value": "T1C8C4012237A1F131D6A7A6709834D6A4357AB9325979718F6F00173E5F312F1CFA6322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561784, "uuid": "9b2fcb51-920d-45c0-8ca5-4325b4c42ba6", "value": "e0383fee3aa7c9c4dbf3a05a98d01075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561784, "uuid": "010864ce-87ac-4ca9-b129-9688c0206914", "value": "6144:RFWi95JEduc/N6Er+6uqot/CXjGVWuRhjU368C4rZa5Upf9KlQTQYdjGeztnR1GI:usS47ELoFCXBmhjU/C4rUM1H13ck52I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561784, "uuid": "87a3a945-c18b-460a-a725-b226b2683d15", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561784, "uuid": "8ca2e3d4-8ea6-4144-8f1c-146960620377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561784, "uuid": "1bcb1191-16c7-4e95-b8b9-33c8748b85f3", "value": "8e1701a683bd0cc5be3553fc01292ec2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534490cf-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559266, "uuid": "56ac31e0-f05c-4c47-afea-e1ae250a451c", "comment": "Malware payload (RedLineStealer)", "value": "59d38ab7555f4827536208196ef5b991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559266, "uuid": "c7dc3fe3-1e98-407d-9f48-73e0d30994d0", "comment": "Malware payload (RedLineStealer)", "value": "39e633180b358dcbf24fbb05ffc3a1eee4acdcb29959571769953000b68f22da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559266, "uuid": "7594a27e-4211-4225-99ab-e3a5cfbb3dcc", "comment": "Malware payload (RedLineStealer)", "value": "4064c6d08e7f46ca66f190e39212e03b9d9ce8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559266, "uuid": "754e0da9-adb8-4b70-98d1-67514629fac3", "comment": "Malware payload (RedLineStealer)", "value": "45a275edef4e23535fc369373bfe20c3a78ca5172b227d71670caae4dc09cc0517565850f3fc11ccc85c34bf7748bb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559266, "uuid": "ac3f8a32-9e92-49be-ac1f-9d745b9c29f0", "value": "T1DB74C010B6E0C034F6F712F959BA93B8AA2D7DB15B28D5CB66D51AEB16706E0CC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559266, "uuid": "14391cf5-6035-4764-96f7-378f0bca01b7", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559266, "uuid": "440d6106-51d7-42ab-ab59-0ad40eb7732f", "value": "6144:f7xCafTMK1/YBtI2YNLgXzc4MYj9R1ah1/aRGm:f7xCafN1/4IiI4MI9+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559266, "uuid": "e47371c5-8ff8-4040-b171-12212f4ed570", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559266, "uuid": "e6ea31d8-df94-4151-8abb-28a45281875a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559266, "uuid": "379ed4a3-ca14-49db-802c-b7362b8eb755", "value": "59d38ab7555f4827536208196ef5b991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add7b9b8-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563284, "uuid": "5423886e-132f-4cfc-a03b-81c2c058fe13", "comment": "Malware payload (RedLineStealer)", "value": "0d9c66e386df78a650cfc763a2a3836a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563284, "uuid": "70adca02-3628-4307-aa8e-2fa2c1ba7adc", "comment": "Malware payload (RedLineStealer)", "value": "3a7d2aa2f97b5cf696abcff1375cfb804d933a10abb657a5ba82ff91baa77ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563284, "uuid": "f72daec6-9d57-439c-b58e-d59f9b210a8f", "comment": "Malware payload (RedLineStealer)", "value": "dfa837573219612172404906569eb1e0ad46cc37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563284, "uuid": "6fb2709c-da69-4ea5-8835-9649b27a8842", "comment": "Malware payload (RedLineStealer)", "value": "847ed5548eabfb37800c685e2a1ca212296a3a67a2d06452fad82e372165b5b46bcabca44e82f5ded04e1be6a1f5c194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563284, "uuid": "2ec470df-07ae-4b31-b7d9-7e145c2b998e", "value": "T1F484BF20BAE0C034F1F712F989B993A8A93D7AB15B3491CF62D516FA16346E4DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563284, "uuid": "643c34ce-3543-443f-ad38-148892096fe7", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563284, "uuid": "6a13395f-d2a0-47f6-8830-17ee05e8317e", "value": "6144:tCqBlpmfINj59a7qFvlzsURvsxneOzpf0h0nVLd6QV:JBlpmfIF58qLsUJsxn3p8kZbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563284, "uuid": "d79fb0b1-93db-44b1-a189-7ca68cc3d6df", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563284, "uuid": "96580e7a-c666-4ba0-a237-150837857e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563284, "uuid": "a6db7c0f-1c8b-44b4-bfbc-310bdf206a21", "value": "0d9c66e386df78a650cfc763a2a3836a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683df843-1e16-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632584212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584212, "uuid": "523c3f4c-32c9-4655-bcbd-245bcb7338a5", "comment": "Malware payload", "value": "a32eea9d74319b4c9e82d2d6d612d539", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584212, "uuid": "0e1cb9da-7f34-414b-a2f3-d1386f19426d", "comment": "Malware payload", "value": "3aab753b71e73c6b53f64f3702a6174139e6df3c31337d65f6d61f2064e7dd42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584212, "uuid": "188f0006-4f9a-4333-a9ce-b69d20528f59", "comment": "Malware payload", "value": "cfa6e612490cc8d947e3ee03d0a9509851bc1e1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584212, "uuid": "e0d0d68b-e077-438e-b4c5-e038810b5043", "comment": "Malware payload", "value": "3c6c346c939af6b64d62e46bb5a7bfd60d83cbe753775bb054d72bdfc882da2a1a102932c7e3bc346c963cdfdcddb3b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584212, "uuid": "e2ddaaee-81f7-4fa1-aec9-ff07877cb6c4", "value": "T18E831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584212, "uuid": "c5b63f74-c1ff-4816-8e41-d1d124aa2d2a", "value": "1536:BQOc40ozMPjej5qckA39ikRFaunrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BPrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584212, "uuid": "47a17b64-d057-4a6a-ba68-624a932da141", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584212, "uuid": "c59e405e-1dde-4c5d-b000-99ba74267460", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584212, "uuid": "304a4cad-794b-47ff-981c-0747d8d63f30", "value": "a32eea9d74319b4c9e82d2d6d612d539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ed999e-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563299, "uuid": "62a3d85b-cb95-49f1-9a71-3b895289477a", "comment": "Malware payload (RedLineStealer)", "value": "192c23fcbd45670b17991a85f03e1269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563299, "uuid": "30924969-8809-4bb0-bd63-12acd51098af", "comment": "Malware payload (RedLineStealer)", "value": "3ab85ab4a622b77f9baba6d13b5f74ff84d80d9b372074e56abb5c97d51a22ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563299, "uuid": "b59a76ea-1131-4c10-bf65-4e9366091c1b", "comment": "Malware payload (RedLineStealer)", "value": "eb5d37cd39b9fd27d37d9d7299217f642768bddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563299, "uuid": "f02baac3-11d0-46cf-8e03-d52579104d04", "comment": "Malware payload (RedLineStealer)", "value": "adb5b7831bcc7d50684ee849d4e659cb3cd3044578606865445969441f706aa7468eaa4804d945b811dc7f2726724999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563299, "uuid": "7376c0e8-4059-4dd0-b128-0605dcdab393", "value": "T1C3949E20B6B2C035F5B706F489B593B8A93F79B29B2450CB22D526FA16346E4DC32753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563299, "uuid": "c223794a-52c3-4357-9864-76581797b3db", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563299, "uuid": "399c8bc9-b558-4bd8-a946-9ef51b21d5b0", "value": "6144:TJcBb8ITnQ5FCUn3/mfn3KRmCWdqKU1PoRmhOu3hU6+dxKef2:aJ8ITQ5/nvmiRmCWdQKRSt3hiXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563299, "uuid": "6d147984-a8a2-4df6-ac65-2783b9c4e72c", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563299, "uuid": "564c8fa2-50ef-463e-b78a-e5c21defb8ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563299, "uuid": "12a146cf-7cc1-41d8-af89-b8e47b3f8c76", "value": "192c23fcbd45670b17991a85f03e1269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd22482e-1e01-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632575335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575335, "uuid": "d212e87c-f3bc-4099-8cca-d91455279ff2", "comment": "Malware payload (ArkeiStealer)", "value": "e9e2051b6009144e1b3a74ff568ffd86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575335, "uuid": "6edd204b-28a7-4655-868f-f4724decf502", "comment": "Malware payload (ArkeiStealer)", "value": "3b0e228b1dea61e9788cf1844739335673b9fabad5a847839ffbf345a1c34f2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575335, "uuid": "6c827a63-de79-407c-ac39-a1de3fdb1645", "comment": "Malware payload (ArkeiStealer)", "value": "cc8c67eec84142dd46675ea6ff791f93673cb2bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575335, "uuid": "0a1b71dc-7d38-493e-80bb-150fd01f63b5", "comment": "Malware payload (ArkeiStealer)", "value": "dedf7ee0a7cf6c51c27a855266cec535038c93449fc7d5a91774bd1cfe9a2f9c32cf652e9afe1e499de5501b844db070", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575335, "uuid": "2c530a86-c67d-4168-bae1-40619bc83e7c", "value": "T18FD4120062A1D536DBB299701A68C691667BBD211FBF815BF34C2B4F4B736C1EEE1306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575335, "uuid": "b6c84e17-b7ca-42bd-8d9b-a91eb2416283", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575335, "uuid": "4aa00ad1-1085-41a4-bc4f-d54d56c89317", "value": "12288:MdceM9lzwLxvYb1RwbfU5fEbE0+jc0SOHqOXd:/9lzw2hybMmtKc0JKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632575335, "uuid": "88fb2623-013e-4b3c-b93b-40b50b1e89c8", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632575335, "uuid": "b145d99a-f82c-495e-a05c-3e2d13b8132e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575335, "uuid": "bc656ba6-b4fe-4b33-9567-2a9a1b5d14ab", "value": "e9e2051b6009144e1b3a74ff568ffd86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c6a4cc-1e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632605336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605336, "uuid": "6e046e4b-93cc-4c42-b313-bbf1aeaa2149", "comment": "Malware payload", "value": "6bc2baaafdc89a93b4e34ad7f3232362", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605336, "uuid": "685080e1-822c-480e-af12-30c1b1b4f2de", "comment": "Malware payload", "value": "3b964d9300195510a0dd285ceaed7a388c85d53afb2e7faa1afda316c4d909d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605336, "uuid": "2f3de3cf-e621-4bfd-a1c0-fa07c1ed7bc1", "comment": "Malware payload", "value": "c39a439f1225f0c0f7cf57af40d7cd1b438fbdaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605336, "uuid": "6b2932e1-de10-43eb-93e9-0d54d25f9992", "comment": "Malware payload", "value": "17f0219d3ef545423fd780322a3e8927a692fd2ca6cbb46942f539b50831872e3972396a954b0d25632eb21143651395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605336, "uuid": "9f9d5909-c268-4660-8e74-2135aaf65f94", "value": "T1EE631903E9519FB7C1875AB526F78E300B13F8911B471B4A7239EAF847479CDB80A768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605336, "uuid": "eb4d8740-d8db-478c-901d-6339ac991f00", "value": "1536:y+f7o8h+RmoKKVHWcr6CQw6am6EVhcLdvEfyn:yC7o+Kl6rwDm6EVhcJvEfyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605336, "uuid": "2ef17155-0a3b-4db8-9ea8-d47ba6bd0ec8", "value": 66879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605336, "uuid": "5554d323-e81c-4310-ab0c-eeff612e3759", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605336, "uuid": "1f5fe83b-70e3-44de-aa66-e911db47d66f", "value": "6bc2baaafdc89a93b4e34ad7f3232362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a907b1af-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563276, "uuid": "f9028c92-ad43-4d8a-b439-c8b68ec6d120", "comment": "Malware payload (RedLineStealer)", "value": "c796d09232b536924ba5614fc020b79f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563276, "uuid": "badc2892-0ead-4c10-8152-edc705081b21", "comment": "Malware payload (RedLineStealer)", "value": "3c1e1dd1ae47d076d2042e3d4beb5103451da3fce48f7b0a53dade4fcace4582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563276, "uuid": "b715dd7d-ce06-428d-adba-db9359223c4b", "comment": "Malware payload (RedLineStealer)", "value": "014a66200fe9e95e0ea5a6a31af4f51ffe82dae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563276, "uuid": "812ee2bb-49b1-4d96-9e12-34dbd0ee7476", "comment": "Malware payload (RedLineStealer)", "value": "5b47b29ce378c81351815916396c68e70ff3ecea32033a5182fd9c61fa6e8af151395bde06f4b0047406d12cd3b8473a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563276, "uuid": "077c06f3-fba8-4493-a3b2-e88c2043e129", "value": "T1DF84BE3076E0C034F5F752F889B993A8A93EB9B1AB3490CB62D516EA16347E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563276, "uuid": "121fa3a6-8e1a-41e4-9e82-c5dca477da38", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563276, "uuid": "80d92355-9683-4ee7-a4ee-0e2ac87a050f", "value": "6144:oyw9NJtEI0z5NaRPF/V4HZFX8mDrntStf5lVrsMNIf7Ot:W9NJtEI+5WPQHZxHZStPVjyOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563276, "uuid": "9dc66690-f317-43b2-afdc-bb3787ad6ebd", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563276, "uuid": "179afb18-c449-4914-9c63-ce23fca209c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563276, "uuid": "7797d213-deb9-4f95-a9a6-74a901b951ee", "value": "c796d09232b536924ba5614fc020b79f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af63409-1dde-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632560192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560192, "uuid": "01d55719-c489-4fb3-b3ab-3d55ba901fbf", "comment": "Malware payload (RedLineStealer)", "value": "2773aa2ef39fc86bd2556816482c5ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560192, "uuid": "c9e53530-8730-45f3-bbf9-385bc8da918c", "comment": "Malware payload (RedLineStealer)", "value": "3cf7f96726f5a73e6ae9350619679e53710775a304ad7ad64eee9093ca3dccc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560192, "uuid": "cb50400b-f2ee-477b-b46e-f3465ecb0f02", "comment": "Malware payload (RedLineStealer)", "value": "76adcd320ed9e39a5e7589c417dbf9add8ee5c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560192, "uuid": "5bd6c352-1922-481c-b044-87be2a2bb93c", "comment": "Malware payload (RedLineStealer)", "value": "4f5286fc4c5fd31a2ca7e7eb7bc5911b61beae664ff139bcafb28cdfd2fb8bc9fb5dca5a7768f3b8000d2e074da8ecfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560192, "uuid": "73c75c6f-df83-4e77-a017-7ec3d1d4007a", "value": "T13024E02276F1C033E6A75AB54170D2E13F3FBA233B71428E66511ADA5F622D08A3535F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560192, "uuid": "eb4d6261-55fa-40ce-a4d7-5ebe444f4b6c", "value": "5fbfc74c3ddccb96d094c58debd98462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560192, "uuid": "0a2c2ab7-3759-4392-8d84-2e67028c8891", "value": "3072:245crv084NaYs8iuaM6/slpWklyaceOfbumoPu+8COr6eqk5hrvF0iPh1e:24q084oYbBaM6/s7lyacemb2PuzCOrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632560192, "uuid": "3f3b276b-3139-403d-8209-3cbe2ede09d2", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632560192, "uuid": "efa88e39-4e43-4449-8dc9-fe83fc5d2c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560192, "uuid": "693be2c7-393f-4968-b2f0-ae9fcdb11fa1", "value": "2773aa2ef39fc86bd2556816482c5ca5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6492aa93-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559725, "uuid": "dbffddb8-468f-4727-b444-c3e2db18f2ec", "comment": "Malware payload (RedLineStealer)", "value": "a356fdb0d53fad19696ec77ed588440c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559725, "uuid": "ebd64b3e-29f5-45dc-b805-d3df0b49a1ea", "comment": "Malware payload (RedLineStealer)", "value": "3dbafd23050c48a7bb5db2da73a7ce3047a3dc20c6dfbf7d0726fa4dcf89ceb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559725, "uuid": "30e5b717-17bc-4662-b244-25dc73af6ba8", "comment": "Malware payload (RedLineStealer)", "value": "5e3f2984136062b1499e1561846c2c5a9743187c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559725, "uuid": "b7b4394f-dcc4-47a4-ae42-3a33c0c4e018", "comment": "Malware payload (RedLineStealer)", "value": "415ed5cc04ab8f484a04b0f5d97aa2dc49517fe95d1cd75a5fc204e43ed4bb78c8f1e9ce675d98af535c08425fecc719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559725, "uuid": "1e08c565-153a-4bf0-9f32-dd5cadedce5f", "value": "T1A5B41518647FC019C0E3EEB52DDCA8BAD99A59E3640C703701B46B3BAB51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559725, "uuid": "15099286-a13b-4798-83fa-9847644784c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559725, "uuid": "c44a97b5-c779-4972-a391-2d60bd18541e", "value": "12288:nklT97iieFM2hujh//UTVKzTZsSeTktzzof8Aot3hifYh2hZa:S3jhkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559725, "uuid": "8d1ea0ec-2126-4d17-b9fc-7f5965564084", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559725, "uuid": "02eb328c-6573-4e0d-b922-4dfeafa17fe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559725, "uuid": "b5908837-b0a3-4299-9821-4e7e3633a61a", "value": "a356fdb0d53fad19696ec77ed588440c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9519b846-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632552934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552934, "uuid": "64d1c26d-b092-4038-a825-60da0b01f3a0", "comment": "Malware payload (Formbook)", "value": "638e7aeb015199f26c16d111f6d623d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552934, "uuid": "d99d7ae1-2492-44ad-b56c-c0d8f996e153", "comment": "Malware payload (Formbook)", "value": "3dfa10d42004768b9da7da94dc0586a0b9d68b56dd6bf5b5057b6b896eec5336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552934, "uuid": "a87b1bd0-1a39-410c-b7f5-aa4d776cb3fb", "comment": "Malware payload (Formbook)", "value": "09c27479e0440c8d993d3c737fd0b14da56ced2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552934, "uuid": "8715e979-45d8-471f-8adf-a81a7ef820e6", "comment": "Malware payload (Formbook)", "value": "8b1dd9a828e8fad61c0efcca0dabe0b54d1d91c355e895e7bc8fcf5c2ad79826aed2fa2de52d48273daa1caffe2bbf85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552934, "uuid": "ef31c7d2-3856-41d8-84b3-78994c1618fa", "value": "T1C044129CF2C6CCF3E6970AF105B7EBA9F3BF4A854110810A8BA17F7797149564A0C392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552934, "uuid": "19105334-1333-4de6-af18-5e2885897273", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552934, "uuid": "2634ec20-00f9-48e3-ac24-9e89dd124899", "value": "6144:F8LxBseowubEKdtL9d+3a7ufe5OXUPZp1kEvkR:/eBub7tL9d+gjOEH6EvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552934, "uuid": "6b2e5ada-9983-4313-80df-c2fcd42c2aa9", "value": 263105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552934, "uuid": "d6545ba7-a858-4b50-b08c-612b8aba6060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552934, "uuid": "e4f2015b-61e4-4d08-a810-c942dfd92eec", "value": "638e7aeb015199f26c16d111f6d623d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a3ff13-1e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632613110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613110, "uuid": "346c2c18-0a78-4695-bca2-0ccc70435e36", "comment": "Malware payload (RedLineStealer)", "value": "a5126407c11745036120ccb770877c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613110, "uuid": "edfd4451-96fc-4427-8ffe-ce1b334d39fe", "comment": "Malware payload (RedLineStealer)", "value": "3e01caea24eba8166d952f056b445ea836fe8ede6ddf648caaf461ce7e964698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613110, "uuid": "c7ad6651-357d-4784-b28f-66f38dfc1d04", "comment": "Malware payload (RedLineStealer)", "value": "f5884dfaa9f493d3b9e941ae1f7b52dbb7d2379a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613110, "uuid": "66811189-8cba-4796-b3f4-9679b7bcfdee", "comment": "Malware payload (RedLineStealer)", "value": "c3e2e5eb9c2c20c25449922468c3fb4487670f88699c4660edbe9b0fbec7f1ed1617dc0d225a84082f1e82f85d097912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613110, "uuid": "f6811b6a-d5bd-4e60-8e81-eec14c12ddd9", "value": "T14A44D02076B2D032D7A78A7C5964C3A0563BB832EDB3C04BF74D1A5E1E3269187E6317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613110, "uuid": "b49d5314-4bee-4a2d-b561-1b567019fdf9", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613110, "uuid": "4dbb4996-5269-483a-8bb8-966d5c1c51e9", "value": "3072:V1cD75zB3W6HUz0+7mCDVY5xN5KPTwbbyYl+KC/6O54LL/EvKottJCS9H6l:V1WmzdS0PTwbyYlUSlLc1sEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613110, "uuid": "04c5f59a-dd4d-441b-93c0-75fc088d9ed1", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613110, "uuid": "a75a2701-fcfe-4245-ac0c-e394d11a16a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613110, "uuid": "5e4eab4f-bc41-4001-849e-ad5e7a3d9f80", "value": "a5126407c11745036120ccb770877c25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d7dba3-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563405, "uuid": "b578a8bf-5884-43e5-8f1c-4f9baae82de6", "comment": "Malware payload (Gafgyt)", "value": "1680089f3019629ead07c7f6b18b4155", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563405, "uuid": "453aeaab-65c4-4091-88cc-eadbcf3d0e94", "comment": "Malware payload (Gafgyt)", "value": "3e6901ba7499a5f30a72abbe7ca17f774e974ae7da101fe62e4a1964a4499299", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563405, "uuid": "0bd2d2c7-b180-4bfe-a395-500aab5e0b07", "comment": "Malware payload (Gafgyt)", "value": "44b8c6de4d06406a03389cba83acb8799ed15b5e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563405, "uuid": "bae93531-c6f6-46f5-ab98-45ae26086e7a", "comment": "Malware payload (Gafgyt)", "value": "95477b7d7d56fe3b8113881939954d72f4cd338473d012075e0f0b4181b50fa46b19d608edd9e97d7979dda6e2bb10ed", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563405, "uuid": "57db1abb-40a1-443c-8b39-68ce5f99c186", "value": "T10BC3D767AB10CEB7C81FCE730A9A8501108DA94652E97FAFB2B4D95CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563405, "uuid": "7488ce9a-c812-4d92-a41e-c7fa9fe8495f", "value": "1536:KfeTbN7jNPSiqDMmdrZUvqAWeMeWM/k5KmjexSCcgIOmQUUmkiSFxfC7xoXe:KglqDVdrmnF/G6xMBUmkiSFxfKxoXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563405, "uuid": "83206a72-5c90-4788-9c53-8e979d79930e", "value": 121527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563405, "uuid": "2c331775-7de0-4b6f-a477-820953eea672", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563405, "uuid": "470777a6-ce12-419f-80bf-0672bc2c4c0a", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6409dcf5-1e28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632591936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591936, "uuid": "967ecba6-673c-49b3-868d-0efcd44e34ea", "comment": "Malware payload (RaccoonStealer)", "value": "82729b46754db1f3eb73be457bdcc42c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591936, "uuid": "73436c2b-b1ca-42be-b668-535023cde9e5", "comment": "Malware payload (RaccoonStealer)", "value": "3e929304dd13990cc2fdb0673a8eac7387fac96052f76f9fd432c3fc7f04fd1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591936, "uuid": "5d6a01fe-fa3c-4adb-aeb2-95e43d34b87a", "comment": "Malware payload (RaccoonStealer)", "value": "05c82572c7b189ae065f8c3d24f73c17ada3a801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591936, "uuid": "2b7b5a79-99b1-4d47-9e8d-ef676b7fd8e6", "comment": "Malware payload (RaccoonStealer)", "value": "104a295dd0fb822042e5f72aa0fc7e2df725fff4ec8c50f7635f1f97c50db8b611efef8fc2a1b4033195a8fe2443152c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591936, "uuid": "aedfbd68-1aaa-472e-8cb3-5b14284dbcae", "value": "T15C9401E066E0C432D3A64A33C83ADD61662FBE695E33610BF68D225E2F317C195D5F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591936, "uuid": "e6a2e745-b86b-4aa0-a139-271e94ee6f09", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591936, "uuid": "c3e8e27e-e8de-4d1c-98e7-d00b0bf9df0e", "value": "12288:B7XYPuOBrjXXN2CrZ8mvGz5Ho3NyvWw+R2Vd:B7XYTJjcuMHo3N5R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632591936, "uuid": "824d4677-8f53-4c73-9259-7a4458019d82", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632591936, "uuid": "a3a50088-33b8-4348-884e-d16be58f2038", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591936, "uuid": "ccc99f86-aae7-4902-be83-87badaeec2ec", "value": "82729b46754db1f3eb73be457bdcc42c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1ea24c-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563311, "uuid": "55f24b70-812b-473f-9e6d-b5507a1a3665", "comment": "Malware payload (RedLineStealer)", "value": "73149ae2e584b3d3829ea6cd5709035b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563311, "uuid": "6a827336-15a6-4bcc-b6e2-a21d29294ec6", "comment": "Malware payload (RedLineStealer)", "value": "3ec482600f9fbb506f8a8706dd80d33ef16f0dd7929c7bdfe2b2755ddb059a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563311, "uuid": "ff23cd79-86ea-4116-a065-f74629245b72", "comment": "Malware payload (RedLineStealer)", "value": "3a66126554e7d7e0661ca0c8358941a6709170e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563311, "uuid": "023686ad-6074-456f-95fd-4218c01159a0", "comment": "Malware payload (RedLineStealer)", "value": "7045c67b1208f506d8aa7165c0cb4c9806a23810c68ead45f2e5f55c73eed6a1e8e984ce00ec7b8dd4fcb154f98b9f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563311, "uuid": "b5ad1645-19ad-4b9e-835b-0c84c50491fb", "value": "T1A574AE20A6A0C035E5B726F449BA93A8A93D7E716F3060CB22D527FED6346E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563311, "uuid": "533e5e43-498d-4e84-a945-b53b3d75a61e", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563311, "uuid": "925e931e-675f-4994-ab5f-0705adf46b80", "value": "6144:2xeqeqy2yK5YLbeFgC9C9OZLW8+46ufhwswHonzmixsIrIjQBzUIH:ZOy2yK5YLIv9jZLLtRes2onzmW2g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563311, "uuid": "da38a146-f168-4e84-8468-92ffba31b6b1", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563311, "uuid": "d47c4904-7858-402c-a68b-00aa7011d951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563311, "uuid": "8da7ddf5-42ad-4f16-9c5b-1725017947f0", "value": "73149ae2e584b3d3829ea6cd5709035b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f395b7-1dac-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632538569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632538569, "uuid": "f6e70698-8bd1-4b60-ad11-fc7aac90196a", "comment": "Malware payload (Mirai)", "value": "6883e82e6f83df49d520fab99ecb1834", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632538569, "uuid": "c0f7924e-4bcc-444f-872e-60109c4f9faa", "comment": "Malware payload (Mirai)", "value": "3ee6dddbade8c69e3c1d7d21dc38b5eb6123fb7cafb7c2b257564229a19bfc71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632538569, "uuid": "a2f92e1b-b196-4e08-936a-b94a48cec04e", "comment": "Malware payload (Mirai)", "value": "27e9cf36d681a9ce958e36599ca798c46f704699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632538569, "uuid": "13954b21-9896-4caf-9026-6af489d00093", "comment": "Malware payload (Mirai)", "value": "8117665444721550758a359b2c3e0810472c5f4c71525c2fcd0659f791f95d648cb082a440496eeaabc656fd8e3aded8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632538569, "uuid": "21896919-58a9-4f4d-8d37-2967181931f2", "value": "T1C793293565382B62C8D4F87E31B78744B2E5366D2AB4898E7C320E5FFF24B8059462F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632538569, "uuid": "dd736a42-8521-4693-80e4-4998e84ee48a", "value": "1536:JkN/p1vSUo4lL6GxYsCk7gID9vg+8lESrYVqLpd+426Qvkk6vC1O0XAkgIFO:WNzjdxpg+8lx8q84JVvC1ekW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632538569, "uuid": "0b8e16a5-c7d9-4879-84ba-b94bd69fb7be", "value": 91456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632538569, "uuid": "e9010a97-cee2-43ac-b90d-9a06423f5ce3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632538569, "uuid": "82ead2bb-5be9-4db2-b028-0dd75bb1e4dc", "value": "6883e82e6f83df49d520fab99ecb1834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02733179-1dd7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632556983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556983, "uuid": "72cc4c30-37a3-42b4-9568-4ca51637fe6e", "comment": "Malware payload (ArkeiStealer)", "value": "14c81d7bc27bdb0d92cfff414f8ffd04", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556983, "uuid": "3cceb961-051e-4263-ba7a-a40fa961bf7a", "comment": "Malware payload (ArkeiStealer)", "value": "4087eb3e978126b130b53e7477fbccec4c5502cf670594daea6176e4535169b3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556983, "uuid": "22bd4e5e-c1f5-473a-9d6e-150d5c88ae22", "comment": "Malware payload (ArkeiStealer)", "value": "a1e4f8e3c26b95f96915a7258d9af11f5361d01c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556983, "uuid": "d6f1a7cf-b322-4326-abda-0c5134bb25dd", "comment": "Malware payload (ArkeiStealer)", "value": "c25478c7681f97bd13dcfbc925e1807d9160dacb9dea4e4f34f23b028042c21b218ac877bde484c6f532bc16432e118b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556983, "uuid": "98abe767-0334-4753-8ed5-408edd3b1784", "value": "T16FC412813AB2D437E7F319784335D5D1327B7A26A93298867912133FDB312A19E1036F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556983, "uuid": "252978bb-85ec-4def-a88e-9d24600a55eb", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556983, "uuid": "72fdcc26-7c5d-4d60-b066-88e0bb77ec6b", "value": "12288:avl7iDu/YedzIaqOA1yWvbFJze8mgvVnISfAqRWxwBe:E7eu/YehLqPgqFRbVfxWxwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556983, "uuid": "2996e7aa-76c1-4fb8-9ecd-8d9b561cb03c", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556983, "uuid": "2baefced-cd76-4282-9044-d7eb9b7fc7e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556983, "uuid": "deb214e2-477c-45ec-9a4e-d8d6b8cd01b5", "value": "14c81d7bc27bdb0d92cfff414f8ffd04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1550fea4-1e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632605119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605119, "uuid": "b26d5eda-36fa-4c12-882b-339c151e202d", "comment": "Malware payload (RedLineStealer)", "value": "93714264ae09837b1800e0fc39f94b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605119, "uuid": "ca80fb10-d105-421b-8dec-a529654bad41", "comment": "Malware payload (RedLineStealer)", "value": "4119121867385bd05cacf4c5d92eccd73d6b82308bef24b5ffe52fbe42911901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605119, "uuid": "16037fef-6a72-4146-8f5f-32a88064f019", "comment": "Malware payload (RedLineStealer)", "value": "3bcee567139712a2ed4c4dbd00f2bf893f766534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605119, "uuid": "7bdbec87-ad06-4cc3-b0f7-636daf627b1e", "comment": "Malware payload (RedLineStealer)", "value": "b61e9ed2e400f76e03b50080863f93081efbe6d8af6bd7f611e0e9dc7f08a50c271498fa5a1f5caf1ba17d68aad7c744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605119, "uuid": "655eec6d-acbd-4d45-86c9-126d082306ce", "value": "T17A44D01072E1FC32F7E6DA755976C2A756B7B8321D37854BE25C1B0E1E30281BAE2352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605119, "uuid": "02ee2548-e0f9-44d0-9082-96084dd566ee", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605119, "uuid": "c335ddcb-e3be-46bd-b0ed-4a212bb92b04", "value": "6144:GBIBRcNkMCK3uFWMQeyfGN75mP8ttRufZcEad:MNqK3uFpQeiEttR6Z2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605119, "uuid": "b43f100a-95d0-453a-9176-d610e2cf673d", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605119, "uuid": "d1b9d064-c838-4bb8-a2ca-08c28d9bcfa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605119, "uuid": "03c31afe-afd4-4f90-8e33-c5a5629ae4f7", "value": "93714264ae09837b1800e0fc39f94b64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03176819-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561709, "uuid": "85be06bc-954f-40af-b79f-d94f89807ce5", "comment": "Malware payload (RedLineStealer)", "value": "ad14bf7cd09c545c79ce61a3d1343cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561709, "uuid": "0560da0e-4f07-473d-9425-54bf9c2e8881", "comment": "Malware payload (RedLineStealer)", "value": "4130e2ce5b2ecf6063f7fbe0e0c7139bc888356b383246db7b9c49e71edf1757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561709, "uuid": "eb7d6c9d-b054-4443-83ae-2cfb00254e4d", "comment": "Malware payload (RedLineStealer)", "value": "fd6f79280edbe2f985539d57ac8d0ee6387bd3c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561709, "uuid": "7a811230-e2b5-4bd9-8235-dfc2fa302d69", "comment": "Malware payload (RedLineStealer)", "value": "c452beb1bbb4c67e6edbb87ec754d9d91d840229d94dfd55af55fcdbdf3c8201a65c961cb4a9e390752e362f90ae8366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561709, "uuid": "9d7646f1-44f2-4dd8-b4b1-581ed4354053", "value": "T16224DF213EFD8D32D6E366B549B0C691257BB823BB70869F3A44066ECD317D0D66A303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561709, "uuid": "b2c61359-5364-4bfb-a5d1-27f8aab4e3b1", "value": "f7987bf55fcab080da60dcb9686a7f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561709, "uuid": "b2ccbf31-c61f-44c4-abc2-878892029512", "value": "3072:F466T5XVMHPn7F7S0Wb6ftFAfecL+ha5qpoKK4zBTqgS755EyL1ux4:F4T5j0WbcWfemca5CoKKiTqXFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561709, "uuid": "18928aea-8415-400c-a169-7d2e88940b89", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561709, "uuid": "39b9de81-44a5-4f4f-b95d-9334f1daa38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561709, "uuid": "892e7404-daba-4a2a-9c4c-36abd6eba315", "value": "ad14bf7cd09c545c79ce61a3d1343cf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e129ea2d-1ddf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632560793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560793, "uuid": "82e6f9a8-7b0e-4a30-9f88-fc4e9930f9cd", "comment": "Malware payload (RedLineStealer)", "value": "ed5b08949f12b2dae4a00e7d04e86290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560793, "uuid": "d51af828-5f11-49ae-a0da-b9df6acae281", "comment": "Malware payload (RedLineStealer)", "value": "414f5b30244ad58aa8996d5995477f1a388e03a78813790d457c9b038f5f66a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560793, "uuid": "90e021e8-bd18-4790-83b6-31c3b25ee482", "comment": "Malware payload (RedLineStealer)", "value": "5a1caba1ae7c683ccebb2a90ca96ed68f12565bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560793, "uuid": "2f0a1c07-5cfd-4dfc-ae13-197b03976883", "comment": "Malware payload (RedLineStealer)", "value": "502ee9e53bd22dfea776cf7b82054692f4bac584b1aba0f65227f557df66ccd6cc76efcb91f2ceac75134c8d8ea14a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560793, "uuid": "bf11cb64-2b94-423c-8edc-4dda59825bb6", "value": "T15424D07136B0F436F2A35AB68974D2ACB57BB5236B70954A3B05169D2E323D08B3530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560793, "uuid": "c59a0a43-3813-4236-9d15-b6fae6bfb0f0", "value": "5fbfc74c3ddccb96d094c58debd98462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560793, "uuid": "910a340d-3832-4e75-bf6c-7da75b82418c", "value": "6144:I4KXvWOq2oDyb7xD5fUFVTbgHmscNl1Mo:I4KXvWO1o+Hp5MbpNlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632560793, "uuid": "2114655e-7c48-4d3e-8802-eb48ad9ca044", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632560793, "uuid": "5e2f7fa0-a159-4481-8f65-52c7520c8643", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560793, "uuid": "fa6eb6fe-cf75-41eb-ad65-1e9cc64c44a3", "value": "ed5b08949f12b2dae4a00e7d04e86290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf76ffd5-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562025, "uuid": "92e161e2-57ab-4951-90dc-b49e65de5685", "comment": "Malware payload (RedLineStealer)", "value": "40a234971081964dd924588f78be8ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562025, "uuid": "d758f59d-552f-429c-9e3b-5b89ebfc2179", "comment": "Malware payload (RedLineStealer)", "value": "41a07231a545437d57e20e3863390f8c529a27d75515c903937f2b488e124e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562025, "uuid": "b66c55c2-2387-4bf8-b761-d05ee1a0cb52", "comment": "Malware payload (RedLineStealer)", "value": "b27dfa31ae485f140c30a13daaa312ad3203686e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562025, "uuid": "087670aa-b1c8-4e4b-b149-b6c446ba8c9b", "comment": "Malware payload (RedLineStealer)", "value": "1ebc1c1fbfbea0e6af025d00a8f4d24472967e1fa3708b52f5cfc1f11f9bd87a4e03fe8afcdf7b09e787966652c4bef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562025, "uuid": "d734915d-1f3c-4775-88cc-f99e06cf9120", "value": "T13044E02175FDC832D6F36A7D4874DAA12E7BB82269B1404F2B64167E6F31EC09B25313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562025, "uuid": "e56c02b4-9e4e-44a9-a7fe-5714b395494e", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562025, "uuid": "b9682118-f67e-4c30-9c33-28a4d111669f", "value": "6144:MIfMSz5+OgimDnZxPlu3ekCpYb0gcL/Teon:XfMc3mD7k3T07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562025, "uuid": "01c30111-9c58-4cee-a34b-8aff8c4057db", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562025, "uuid": "1aac94bd-3521-4572-9f6b-70098c7951ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562025, "uuid": "b058a0aa-c3dd-43b2-828b-842b1d7ce5a0", "value": "40a234971081964dd924588f78be8ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aca954a-1de1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561480, "uuid": "853bf46a-020b-4859-8a4e-5bc230af3f16", "comment": "Malware payload (RedLineStealer)", "value": "784288080147af8bb829b00712c84bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561480, "uuid": "3005331b-79cd-443b-b97f-c6538a273ea3", "comment": "Malware payload (RedLineStealer)", "value": "42c67e25393301648626c1f3affbc2e98e56b1c88c79bd2befa0a140a32dbd41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561480, "uuid": "506b8925-7826-4c14-8369-d3005b859aa3", "comment": "Malware payload (RedLineStealer)", "value": "943927dc141accef8830fa66670b090c52b6a88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561480, "uuid": "0a6b9f9e-dc9e-4935-a25f-0452727d583b", "comment": "Malware payload (RedLineStealer)", "value": "eccff16d528fc278b77d49206fece5a8326087566a31edf23db49eb5747d8db906a40896d27b023503293e711319c1ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561480, "uuid": "bea86e81-b6bc-41a6-87b6-76dc0d3f964f", "value": "T1B1C3D53740655066C9F81334E8699F0B7E6CDF240E41B2DCB14EB2EA9E3CA4D8EF5265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561480, "uuid": "90f40b82-773a-4a72-8b33-ff00723cf017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561480, "uuid": "9e3a5e30-31e5-4f98-9fa0-27d8e7cb5b5b", "value": "768:sY7oBSwPlpmjLgi5yrmdybD9Yz79uomBOncxmRtXP5Ywp2VkdeXeK0Jpeqpe1lYf:sKeDPloM2yrFdYdRXYa0kyVbYYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561480, "uuid": "9fbb0803-dc56-4a05-b66b-130d65b4b1a1", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561480, "uuid": "1ae58909-81a0-4f84-9480-2215824d5264", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561480, "uuid": "f131097f-7bdd-4c2b-bac3-f75236a5056c", "value": "784288080147af8bb829b00712c84bd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7d4a88-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562852, "uuid": "826f3c51-53a3-48d8-af0f-f3752647ba88", "comment": "Malware payload (RedLineStealer)", "value": "cd189a104b286f934f6fe2d719cf0754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562852, "uuid": "dd3242cf-4076-4ba8-a98f-bc9a235fe892", "comment": "Malware payload (RedLineStealer)", "value": "42e4a191d8816dd28c8124f8fb0f7c2f9393742953719ea623a53b686b0f4f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562852, "uuid": "342c8448-0e44-4c69-8989-6400d34fdd40", "comment": "Malware payload (RedLineStealer)", "value": "617e28dcf784fac85ed5185d0e7ba4e0de9b5975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562852, "uuid": "6a95b0ff-5824-4ca7-9c60-30d2085d8055", "comment": "Malware payload (RedLineStealer)", "value": "af7cd2e81f9fec4c3bcccd034d8efd9507103d5ed687b30e6ca77d2c6f7aca47fc0efbe1cde786269560c1351a87dc0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562852, "uuid": "eb78a8eb-4cec-4b68-8d84-6f64856669ea", "value": "T1F784BE20BAB0C035F5F712F846BA93A8B93E79715B3491CF62D216EA26346E4DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562852, "uuid": "c65a9e2d-bb35-49b0-b574-b0ea3fd86736", "value": "a2bc3921f9c8d145b9a6f1e3eaf1f8a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562852, "uuid": "cc75459a-f8cb-4c15-8186-fc6e17870713", "value": "6144:K7ZFQ68c2lyYn3ys78aBO+WmA/AJkjxPSXP9RDXxGri8eVQPDEn1z:8FQ68c2lnyc8aM+WEG5SXLbaiWPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562852, "uuid": "4689fb01-15d1-4eb7-a6a5-0275b95d8560", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562852, "uuid": "fa436ab6-ef23-4155-b579-21af56a384ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562852, "uuid": "a7b9ed43-ae13-4f5d-82de-c9d37f617058", "value": "cd189a104b286f934f6fe2d719cf0754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a457ee1f-1e20-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632588608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588608, "uuid": "21cd2250-82f7-4e48-b7dd-efa0b4857341", "comment": "Malware payload", "value": "fd5f6a521acc2ef25991db4ade35cde7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588608, "uuid": "50f38fe0-ce68-4ede-b847-e2b5400173d7", "comment": "Malware payload", "value": "4313d6dbbe3f155630d3daf780c108ea18540be8c7a2a862c703b1d37d1e8ee0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588608, "uuid": "b6589ba8-6a84-4bd4-8815-b34a379a3bcc", "comment": "Malware payload", "value": "a351d24f3ac1ddab020df7743041b13ea48e6a0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588608, "uuid": "084ebff5-a60b-4d21-89a7-a7aac241ed38", "comment": "Malware payload", "value": "50947773135368f5552d249262d43b1ca401628c6c67c0d2b1f6794744961af01fa9fc81ff56f99b51e580535aef9e70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588608, "uuid": "be92b243-5669-4642-b3d0-7610904a069b", "value": "T183334B42F881A656C5D8167FFE0E12CC732657AD92EF3A03DE299F7137E701A0D2A152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588608, "uuid": "87981571-dd48-4b45-af68-2608f54260eb", "value": "1536:3U0afGv11UQ/6OzbXGk6VVwVpGF4psm4l:3z11UQ/6OXf4ieF4psmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632588608, "uuid": "652f76a0-57c6-4367-8532-18004dd63e34", "value": 52144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632588608, "uuid": "ad90adad-30b0-495d-aea3-2065d25b368b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588608, "uuid": "c392bed4-9fdc-4603-a690-ff8cf3425194", "value": "bot.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f064eec-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565406, "uuid": "cf03d613-a240-4f9b-8b23-d6eaa1006660", "comment": "Malware payload (RedLineStealer)", "value": "36bd83eb0a8ed60c434c0c2cd1944b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565406, "uuid": "5794b898-5d02-45be-870c-dd2c122cd9c0", "comment": "Malware payload (RedLineStealer)", "value": "43a033ee9f24fd518ec91ed99b5082cac45e0d3ced6955a68f14a919c30b478e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565406, "uuid": "647caed7-17cf-4879-bcf2-31c82df76061", "comment": "Malware payload (RedLineStealer)", "value": "37e2f2ee6eb2e4d4aaa38991ccd789ab49022aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565406, "uuid": "f3444965-de6f-4c93-8bdd-f8a1a38b4bcf", "comment": "Malware payload (RedLineStealer)", "value": "0771ee11693e90c8e15d62f2d812745503a24c98c85f21c1a576ec3f45e48aefbcfea2854ea07c04ecfd04201156091b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565406, "uuid": "15864d1a-dfcf-4f9e-b166-c3ea4448abf2", "value": "T1EE64F10176E0CE31C5631671CB65D7E06AFBB93259B0534B27AA776EEF302907A22346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565406, "uuid": "f8c7de9d-ad3d-4ab2-9e42-729b46ae5296", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565406, "uuid": "e52cd0ae-4bc0-423a-91c2-e657d23f8b5d", "value": "6144:Py9MKG2tyczZhS9tf392WjWATpyBwjtw:63ptTZQ9n2WaAVyBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565406, "uuid": "6ceff9ea-bd1d-4b08-8110-57aa65957f10", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565406, "uuid": "9ed47f15-d788-478d-9272-399c1ee1e972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565406, "uuid": "608e0a6c-fa2f-453b-8ca9-1d30130f1d3f", "value": "36bd83eb0a8ed60c434c0c2cd1944b7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a06e736-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559654, "uuid": "ad90838d-96f2-4e1a-8519-d97419dd3030", "comment": "Malware payload (RedLineStealer)", "value": "381244f61990c9d17050221e3a15c36b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559654, "uuid": "ba6526a1-1201-479b-9764-499ff8192908", "comment": "Malware payload (RedLineStealer)", "value": "43ce1005b72068b3c9efd50b39fe654c31f06f1dedc957d24c76304addba37ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559654, "uuid": "b8957615-0cd3-4b91-b74b-c3163338658a", "comment": "Malware payload (RedLineStealer)", "value": "7edb457ed58ea1f70320c89e58414d92fa058a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559654, "uuid": "bfb50cd2-0108-4e24-8bf7-a2e3ce9857c1", "comment": "Malware payload (RedLineStealer)", "value": "600e7d7ddccac1332517470dbdf6e23910be7e6d1a8518e59d1c798b8754fff1fe477378476ba0efc63984f36dd535d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559654, "uuid": "5aa88e9c-2e80-41e0-8411-b7f440cf0377", "value": "T19074CF10B6E0C034F6F312F949B683B9A8397DB16B28D5CF66D11AEA66746D0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559654, "uuid": "2dc01f8e-3510-4deb-9b97-742d906d5900", "value": "3791a43698849237226e5f1b2f617635", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559654, "uuid": "8d774ce1-b2a7-41d2-96ee-c0301bca05e9", "value": "6144:ec8u0QhrRbmAXlxhe/0ei5NEdlrnbfLJzNmlIhXzC:ec8u0QhrRbdx/EdlrTLJsGpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559654, "uuid": "d4c8f157-d0d8-4d24-a0ee-6802d580f4df", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559654, "uuid": "b25fc948-414f-4b01-9076-7b5807cac77b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559654, "uuid": "88bd3af0-1563-4be5-a8cb-9c2280bc76a3", "value": "381244f61990c9d17050221e3a15c36b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a7128c-1e04-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632576334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576334, "uuid": "67d89371-9577-4727-b15a-6835ea0456ae", "comment": "Malware payload", "value": "a3d57e318ff524efddbf570f0b684511", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576334, "uuid": "2834d4df-d80d-4aeb-8090-205e4916b648", "comment": "Malware payload", "value": "4579985f392f485c674812b5f3a8463b63e3f1e4c572f97b05733f7aba59807b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576334, "uuid": "fdf987c2-eaf9-43ad-aa10-ca5ce82a2c3d", "comment": "Malware payload", "value": "f582079f8fad1bdffccf88497b730f2f8f61dd4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576334, "uuid": "1f79b8ea-eca4-4ef4-9333-7ef1f2b7efa7", "comment": "Malware payload", "value": "954f189a2a6ede59de5d242e3c8638a549f3c516e67b5c759cf8d1b54b3daae733648dfeef54203a211abc29d47d95d0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576334, "uuid": "2593d02b-8df5-43d1-8332-96661741e671", "value": "T135B4BF2E7ED6E261C83C1978C892C9F67178B869AD24D6833AD53F3F59F30C0186715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576334, "uuid": "964a0fbb-e4e8-4537-8fdc-1bc275020b13", "value": "b26423d4dee498862b9d2df8c7549de2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576334, "uuid": "d2adb0a4-f87c-4036-aee0-93175ba46ca5", "value": "12288:PpXuXXZxPJ52IeRM+2hVo8Zk5TnjakaSwGWZcoA5iqs7aV:PpXEPJ8zuVLk5TnjUSWZcoA5iteV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632576334, "uuid": "2a04a7a1-2506-49e8-84c3-f6cd066bbad3", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632576334, "uuid": "080989c2-7f8b-49e8-87c7-0e302819d9f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576334, "uuid": "cc44bf4c-0688-472f-a7af-39f874cc627b", "value": "4579985f392f485c674812b5f3a8463b63e3f1e4c572f97b05733f7aba59807b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a55d580-1e25-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632590605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632590605, "uuid": "a019844f-f40a-447c-88c9-670127a93b46", "comment": "Malware payload (RedLineStealer)", "value": "4611905e79011cdb6ce55e6f7b4cd421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632590605, "uuid": "9094c911-f9d6-40f5-9a07-573c779f6e6c", "comment": "Malware payload (RedLineStealer)", "value": "45999399ac27862881a6e4e666b9b1cda8469f975fd9f19833ce30876752d2b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632590605, "uuid": "0868545f-cecb-4b4d-8a7c-ffae75997ae8", "comment": "Malware payload (RedLineStealer)", "value": "fb990324ea0482cbad5a473984aa778a8854f2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632590605, "uuid": "49f7363e-7038-4a90-8219-449f627002cf", "comment": "Malware payload (RedLineStealer)", "value": "c883377aebfe16ee052059b15b4f010d2d18103361f72a385fd9c2d51a9094a5f0c4328ad095965661383d55a20f3bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632590605, "uuid": "571c4914-e141-4349-a34c-6bae41d0bdcb", "value": "T12B44D02176B3C035D3F7453569348394A63BBF225E73814BF64D2B6F6E322816AE2346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632590605, "uuid": "087f8d0c-7e92-49e9-ba98-5cc9d1fda6e5", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632590605, "uuid": "69364932-418f-4a68-bcc2-21178168544b", "value": "6144:Mn5zkEMzDieXPOm5riqbPYVYOU64QoEad:u5zvMvieXPjnbPYV9U64Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632590605, "uuid": "2b4613d7-4707-4b71-b178-d3bba2236ffb", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632590605, "uuid": "1fc8b5f9-326f-4adf-9eef-fdd25ffa4b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632590605, "uuid": "423c1b00-47b8-4694-ade7-e02836b6703e", "value": "4611905e79011cdb6ce55e6f7b4cd421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe3979e-1e02-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632575736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575736, "uuid": "feb5ad1f-a0ea-466f-a81a-31b394d08099", "comment": "Malware payload (Quakbot)", "value": "473f4322945d1142612e6059cf7f0cc5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575736, "uuid": "f04004aa-5681-4b6b-96ac-b2266a7543f0", "comment": "Malware payload (Quakbot)", "value": "45e5bddd31db89802853edbb213d2b1bbd9837fc0a2c2fafc44293633726566b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575736, "uuid": "a2da9f75-a01c-40cc-8aa7-d14a33f7afba", "comment": "Malware payload (Quakbot)", "value": "7266f1e9f82c5189a1963be5a4915f7da8b434f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575736, "uuid": "36a1338b-07cb-4129-95f4-69d0b2d0e681", "comment": "Malware payload (Quakbot)", "value": "ee5dcfbc4bae8d891f52f7aa247374689096c2fd2e719f3da9344221b3ae0be0d0a5783e8d03908bf279fc3426bd5f68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575736, "uuid": "e9a82409-411d-4ab9-b34c-e16154e36427", "value": "T10CB4AE2EBED2D151C83819B9CD92C8E672387865AE18D2533AD53F3F68F74D11C4A08E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575736, "uuid": "38997896-4589-4463-920e-7b8a37fb148f", "value": "55e63e10220d9780afbfa2f458c9d3dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575736, "uuid": "e6658251-7d6c-4690-a9f7-3a9ab174d04a", "value": "6144:AbqzVbbUYjG8AClk8+B05KhoSiMsJZuSsnDxeHakVqhhmaM+5Vg0nKH5PnFyunf:aqxgYjG8ACv+GKhpsJZRXH52LMcg5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632575736, "uuid": "78cd5132-ae10-484c-aa44-ee49b6943c8b", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632575736, "uuid": "c6cf91e0-5356-4056-ba8e-3db53b111b75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575736, "uuid": "e1421906-cc83-4685-a2a2-1d4cdab3479e", "value": "473f4322945d1142612e6059cf7f0cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d1462f-1e17-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632584832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584832, "uuid": "4697b07d-7a6c-4e0f-adfb-1e1634cfa0d1", "comment": "Malware payload", "value": "0165cd12cf949f721f32885e84d17563", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584832, "uuid": "d9924a6d-3c82-42f1-9640-29a2a247cc73", "comment": "Malware payload", "value": "463cf9919109df1b570d1db40d1377cc22045a47d99668b31d4838150cb5c323", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584832, "uuid": "5d7d4dbd-1da4-4af6-9899-eefb5e66deaa", "comment": "Malware payload", "value": "09014ff3787677c0a8fa605676f097398e6b9b0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584832, "uuid": "febf6c7a-482a-4e81-90ac-a0dcf7fbc2fd", "comment": "Malware payload", "value": "8c87729f6c1390ade1cebde17771174b84da15395db6f4e0e1257817f230df76a9cc938bcdef03369e16c99e3b2df4a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584832, "uuid": "0fd000ba-0b3b-4f5f-8383-993c210b485b", "value": "T193734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584832, "uuid": "adc039e0-0fc7-45da-8950-c8a7ccf9fcbb", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/CS3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/J3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584832, "uuid": "b4621002-8570-4122-a44a-947a3d5dec7e", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584832, "uuid": "78df76c5-6ff1-4f25-97d5-e85d76acf6e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584832, "uuid": "f32a40b7-b362-481d-a05f-2d865cd4f5ae", "value": "0165cd12cf949f721f32885e84d17563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9dc74d-1e45-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632604245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604245, "uuid": "db37e06b-aa25-456a-a634-eeb2ed152b33", "comment": "Malware payload (CoinMiner)", "value": "8c67759c8c18fd520cd116d3a2a71cb4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604245, "uuid": "69231f8c-7782-4330-b5a9-37eacdc37f6e", "comment": "Malware payload (CoinMiner)", "value": "467425771038209d08868a51e6bbb8834fa53a33762f15818bd9905f5663828a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604245, "uuid": "5bc82100-7750-4ff9-becd-51d8bd888759", "comment": "Malware payload (CoinMiner)", "value": "aaed41a233bbf08691b6fd796670f17746538502", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604245, "uuid": "21008049-abb2-426b-835d-2b823a75a467", "comment": "Malware payload (CoinMiner)", "value": "55bdfb7c06e1b305dc9a13038b2a37e862e786dab0d5bdd53f5776869323789dc5e30f4cf77d421a8b9a51eab7a6e366", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604245, "uuid": "3a798c17-6c8a-4bae-b6bd-ee38b9dcced1", "value": "T162E39D30B6A1C03AD7A316718D25E7A0563BBD722E33854BF78C175E0E3128A96E535F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604245, "uuid": "3c5b28e1-36d3-4896-b52f-465d196f9142", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604245, "uuid": "747afe1c-3ee3-4525-95b3-d7a8f0704722", "value": "3072:0YG2ThYZLD9r22ldR5qr55kguuS9H6dYs:OehYZLN22CsIEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632604245, "uuid": "105af29d-81b7-462a-9360-0641c32d4f28", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632604245, "uuid": "0d42fd4f-25b5-40c4-a4e3-e85f0525fe99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604245, "uuid": "9c459402-3f75-4d64-a8f6-7af0c64d85a0", "value": "8c67759c8c18fd520cd116d3a2a71cb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512dc8df-1d9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532634, "uuid": "6ff034b1-f708-4dbc-988b-002b5b66951f", "comment": "Malware payload (Mirai)", "value": "314debe4ff7fb8992cb81e8ccadc4bf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532634, "uuid": "88040ad1-adc4-4e98-875e-2d63297ca5db", "comment": "Malware payload (Mirai)", "value": "47580143ce05882758f1ee101df6b56f165ab67ace8616f92fd5f41bbf644043", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532634, "uuid": "6b2dd820-f3b0-4f70-a79d-561e3bfc56c1", "comment": "Malware payload (Mirai)", "value": "837d70e5d5a2d23f352b2094e29b42813862b213", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532634, "uuid": "2725f5e4-c895-4112-977a-442651760abc", "comment": "Malware payload (Mirai)", "value": "4631d023a31d6bdda532879fc9316f46a2b86330be07cf716a5963bcbca61cbbcd6331435de968b2f3d227a66a369cdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532634, "uuid": "43613034-c4fc-4a0d-bad6-d4dfeb50b852", "value": "T19CA34A32AB80D573D14315B216D78B150E32FD7B1A5AAE5AF32D3CB09B35484B221FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532634, "uuid": "3dafcc6d-c2c6-4f3b-b3c8-278999e87a99", "value": "3072:G+whzrnV8NUlR5OMwP+1f/EIm0L0FyolommFVcqh09c2bB:G+wWggx2u0LcyolommFVcqh09c2bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532634, "uuid": "389187c4-f23e-4686-98b1-68ecdef4236f", "value": 100096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532634, "uuid": "4b834b5e-90ad-4ec9-a9a3-5655b26f744b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532634, "uuid": "c9fc9d34-a986-4f04-b989-d8910b6905af", "value": "314debe4ff7fb8992cb81e8ccadc4bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cad62f-1e3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632600938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600938, "uuid": "fbd915ad-c977-451d-a462-50f78d9a6a2d", "comment": "Malware payload", "value": "5cf9bec1dcd5fb97656e8d5abd9610bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600938, "uuid": "2306629d-5da8-4440-96e1-83b830e8f97c", "comment": "Malware payload", "value": "478bc2fe7ac7d6dd1600fa6f6065671e56ad5b125d9dd9fa45ff7ef7d1b6ef9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600938, "uuid": "670557e1-9b27-4bcc-ac84-d85e549e6615", "comment": "Malware payload", "value": "4f78206ad4b42e01022bd5dd401bc00a26ad535f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600938, "uuid": "8802fd52-d5d5-4d12-994c-6c36a26fde6b", "comment": "Malware payload", "value": "2aedf6aa440b1782803751b5405b1c0242d3bdff5c2ae965b19a2018b3144b84ab700d4fd69b2cfbb6b8fb226f095560", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600938, "uuid": "73f0bd4f-ecce-4362-b8da-e0748502a27d", "value": "T19144F1499D60AFE4CF24570491FC5E1C6BF11A4F84A06BEE732EBD49DBB2058D06E1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600938, "uuid": "69a63cc4-00f7-4484-9861-7003bac06e10", "value": "6144:LqMdTTs41txqEyCPiR8LLmSMi+HyGl3UaRr35Kkzku:RNeCPiswyLamk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632600938, "uuid": "432f6a68-78b7-4de5-ab3a-0052b8ba4094", "value": 271110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632600938, "uuid": "30b777f7-dfc7-4a41-aaaa-94f9970179e5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600938, "uuid": "ccc8fd86-2eb1-4c42-a382-70c6882021e0", "value": "dhl-paket.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f734a48-1de9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632564951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564951, "uuid": "64549fd0-6f18-440f-af68-6482446ef5c5", "comment": "Malware payload (RedLineStealer)", "value": "005e2671cb3b8360426cf9c578a87896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564951, "uuid": "95423c6e-56a2-4124-aa24-e3e51f04aa8a", "comment": "Malware payload (RedLineStealer)", "value": "47a2b7233b1dfb9e62b12f0adfc9ab4be04d59ddea680f38c6dadf3ffaf29936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564951, "uuid": "41e0c5f7-ca59-45b0-9272-6dc68b967757", "comment": "Malware payload (RedLineStealer)", "value": "45f85c9da20af9b961945ef6dcd97b8b32ea5285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564951, "uuid": "ea49a4e6-e613-49ca-9b17-cbb8b58d133b", "comment": "Malware payload (RedLineStealer)", "value": "e682856be83d881e3ca725b942d5ef9f43bb877ca1b47fb20954e3678091f67af9dd69553cf875ba273fcd2c50e8fe7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564951, "uuid": "c8d39759-4e0c-4448-be38-25b8e4fd1206", "value": "T1AD64DF013EA0DE31C9A345308831E6E4567AF9E1FB64CD4B776AF6EF2E306805626357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564951, "uuid": "f584f4c1-108f-4516-aa19-86db25736891", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564951, "uuid": "e2fb4d61-ae64-4886-8f59-58c410b597c1", "value": "6144:30iwypdzN/KWzcTjpOtDrVE/VsjNBwjt4:kgd98jpwDu2jNBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564951, "uuid": "5b99ce26-f7a3-4129-99d2-41098fac87e1", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564951, "uuid": "afd8829d-9ab0-4c89-8d29-def138ca3771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564951, "uuid": "62aa67e5-5f69-49dd-8312-90a3c04a7104", "value": "005e2671cb3b8360426cf9c578a87896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07699b7-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632552524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552524, "uuid": "13a33b4e-8a76-41a0-aa4c-69737f9f920a", "comment": "Malware payload (Squirrelwaffle)", "value": "6b8fc61be0fb3787c5d23c68e61beea6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552524, "uuid": "7bd391ea-86ee-43da-b0b7-bd1ccbe3378b", "comment": "Malware payload (Squirrelwaffle)", "value": "4808b847657adbd328b8b7bd226559341b6bf45a655d0895c1ee1b1e4b903250", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552524, "uuid": "c3097169-c14e-4f9a-a619-6a27c0e21823", "comment": "Malware payload (Squirrelwaffle)", "value": "468b217291df43dc46aa58e290e8c81c483b1128", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552524, "uuid": "86150fc6-603f-44c7-a814-e4f97177a114", "comment": "Malware payload (Squirrelwaffle)", "value": "a11cc50ec9b0a7536c799eb27a23d37d10fa6d26b23452f9c4cbb4a3c3c150c91b09df1fa740cb7182cba2ee2b4c5ea5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552524, "uuid": "23c470f1-fe36-4242-9565-ebc008fdf35b", "value": "T168C4BF2E7ED6E261C83C1978C892C9F67178B869AD24D6833AD53F3F59F30C0186715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552524, "uuid": "a5d4355f-f248-4870-aa46-ce36d6eebf3d", "value": "b26423d4dee498862b9d2df8c7549de2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552524, "uuid": "6c000c4a-2256-4962-bf6f-431d87b9518d", "value": "12288:PpXuXXZxPJ52IeRM+2hVo8Zk5TnjakaSwGWZcoA5iqs7aV:PpXEPJ8zuVLk5TnjUSWZcoA5iteV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552524, "uuid": "b226a59b-b9fe-4971-9ccd-a2718ebe123a", "value": 544309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552524, "uuid": "771545fd-6997-46be-96d3-0b01044162fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552524, "uuid": "4b0a4c05-d102-475a-b6ff-0ffd9528865d", "value": "6b8fc61be0fb3787c5d23c68e61beea6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae59034f-1e37-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632598503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598503, "uuid": "057bdf01-18d1-4993-9fab-034c8b35718f", "comment": "Malware payload (RedLineStealer)", "value": "27ce9b715e67ee43a97f5f277500825e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598503, "uuid": "4084f90f-8045-473d-bc6b-83d7578525f1", "comment": "Malware payload (RedLineStealer)", "value": "48158a7fc253f0cf5a6608c0575eb315081169b3c0024e7282a0b0b38b1c3a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598503, "uuid": "6f8c9d04-353d-4a32-94e2-12af067c797f", "comment": "Malware payload (RedLineStealer)", "value": "a567648c28f7af694e062d68957a4570db89acc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598503, "uuid": "0556578e-8a1a-40e5-9d6f-a385499a5d28", "comment": "Malware payload (RedLineStealer)", "value": "976607ef42b9ad45374853d1ef5ae99b0848fb1f26facde3342070eb149b815733df40f1e304dc89ca96fc9b869ee558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598503, "uuid": "d977720c-5675-4b5d-aa18-2f7ad9ef5295", "value": "T18C44E02176B3D032D3A319751A7593A4263FBCB22E37864FF25D165E5E322E286D6303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598503, "uuid": "bb2dc3c9-8a68-4c73-b13a-e8d336e24cf1", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598503, "uuid": "e107e33c-f6f2-4fd1-8977-85c84b1f811e", "value": "3072:6ESN2USwe8y79KwAagqGwoJsZyJqNBShFMtIJGMVqkoVGo15E+fnBGKW73WS9H6t:6DNydCzwoSswXs6teXQkoDfYKW7GEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632598503, "uuid": "d6228795-acaf-4b0f-a2e9-cc906df755de", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632598503, "uuid": "60c2fa38-9595-45ae-8426-02d0566f71c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598503, "uuid": "24b0dcb0-fc83-409b-ad95-d0d276b4a7da", "value": "27ce9b715e67ee43a97f5f277500825e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed629b5-1e3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632600034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600034, "uuid": "8d164d6b-2872-4314-b2bd-75451250ddd9", "comment": "Malware payload (RaccoonStealer)", "value": "6f579eceac6a0278e08444445ab4dbea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600034, "uuid": "78d39080-3cc6-4c0b-9939-f12ba3dc7bbb", "comment": "Malware payload (RaccoonStealer)", "value": "485743b58458601c1947f2ef8d25cdca62b87ad6bbfda4841f7d49b31512cc8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600034, "uuid": "9f6c782d-7b95-48e0-acc8-0fa807fe060c", "comment": "Malware payload (RaccoonStealer)", "value": "7526006efa1b52d61dbf7695606ab5f6ba0fbec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600034, "uuid": "0d5b8174-22a3-4e9a-b22c-230d30c705da", "comment": "Malware payload (RaccoonStealer)", "value": "f287307d69db01b72235cb682f646df33e8387f707173ad43acd6a39cdb787dc547b61e35a1cfa73408d2d8fd9e4c70f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600034, "uuid": "1074ef31-e8cd-4b46-abb9-81794da9a834", "value": "T1B8940260F6A1C833E6E72A32DD348671513B7AF31674464FBA9C371A1EE16D09A27313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600034, "uuid": "8e1fa92e-7eb3-4387-bfe5-5aec0f33f70c", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600034, "uuid": "6b71bad5-cc0d-474e-96ce-83732675335b", "value": "6144:Jz+PStDveYAZSq4zZpWidPI2Di00QjQTSCjJgxRzl4wWFW:oqB9n7ddOmoMxRzl4JFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632600034, "uuid": "089b04b3-91d1-45a9-ae32-7559d7eb2232", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632600034, "uuid": "5f2117e0-cba4-4958-a39a-283fae5ff2f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600034, "uuid": "f24d75bb-1d7d-4291-9e28-fc8003f84b61", "value": "6f579eceac6a0278e08444445ab4dbea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ec5725-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632605729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605729, "uuid": "2da51689-eee7-4c8a-aa70-8a91cbdd43f6", "comment": "Malware payload", "value": "b35b0b20fc3e3a98b97f37d97d6bdb89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605729, "uuid": "b49cdfc7-466f-4f3c-afbd-a9e18b26906a", "comment": "Malware payload", "value": "4930394ce3009abd91e688004eccd4ff947fb95c9c14620726dba4a53b75ec78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605729, "uuid": "a283cffa-6258-41a0-bf9a-836c45b36687", "comment": "Malware payload", "value": "8471f4053f575b2bd0f8760ea058f498175a865a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605729, "uuid": "9b824d70-728e-4d25-85ca-1cb4c512f7ac", "comment": "Malware payload", "value": "040db3efd6764124801f6aff37877efc0176637b4db6a7c5ef142273d320823a28722d1a9930bca29f03fdf7873da36b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605729, "uuid": "66b2dba2-f823-4242-a64e-1f8f1c8cbe19", "value": "T11BD33C05E7408B57C4D32775FADF464633239B94B39B33099628BBF43BC27A95E22906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605729, "uuid": "8cd44a6c-2b67-4fcb-ad3c-16e82dd3a011", "value": "3072:ods6osMKEQKGmuaiA6M+KhuYj86M/9QP+mKwGj6WGPA:is6ohKxrja0MnhuO1M/9QP+mKwGj7GPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605729, "uuid": "51324590-7cf4-49e1-a21e-c09b073c6657", "value": 137381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605729, "uuid": "8fe56e7f-1b64-4083-84cc-c07be8084fde", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605729, "uuid": "7c5e0e05-4457-4dcd-b411-5151f6ac453a", "value": "b35b0b20fc3e3a98b97f37d97d6bdb89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d47b511-1e53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632610393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610393, "uuid": "d027ed63-1e9c-42be-9bbf-46ee79eb7eea", "comment": "Malware payload (RedLineStealer)", "value": "c89f058e3a92ecfd7e4791c93cbe8cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610393, "uuid": "85b3733f-e128-4d96-b264-70659c6927f1", "comment": "Malware payload (RedLineStealer)", "value": "4a01d82d2df04196b711471d18fa98ce780c458c164b991d995576571367ad59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610393, "uuid": "09883dcd-8201-4691-8ac2-53ca4c3f4511", "comment": "Malware payload (RedLineStealer)", "value": "646ccfe06c9a58381b844827f8476401a1d796e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610393, "uuid": "a86c4fed-c489-40ea-a819-2dcedc8012d2", "comment": "Malware payload (RedLineStealer)", "value": "444f8b4a5f1062b511a54bb1f9470e38803f390e3ae5030df3653015127f2bf70e5003a8c5b64fcb176c0020c8782148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610393, "uuid": "95a05f9e-e180-440f-9dd9-c226d80c7add", "value": "T1F544D020B6A38472D3E31531C97983A1563BB9F22E77854BF64C173A1EF229249E7313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610393, "uuid": "a39460f1-1c02-467a-9d13-21ba693ad1c5", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610393, "uuid": "4314f1b5-e3b1-4528-acc0-900a211c15b7", "value": "6144:r5jFdC1zf2YO1wy6/Quel7K1uV7BT+RuEad:VjC13O1tssl216TGAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632610393, "uuid": "ab47c15b-e96c-41a0-9a89-049ed25f8dd8", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632610393, "uuid": "08a09f87-46a1-42a6-9944-ccfa32a691ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610393, "uuid": "2a0b3462-f31c-4427-86fa-acd105ffebc8", "value": "c89f058e3a92ecfd7e4791c93cbe8cb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effd3df5-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563395, "uuid": "028e17b6-566b-4534-b2ec-830570163918", "comment": "Malware payload (RedLineStealer)", "value": "5a80f8b122ac52eb066b8b8f1d698094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563395, "uuid": "6829cf78-43e6-4790-82bd-e7cd5c9941d4", "comment": "Malware payload (RedLineStealer)", "value": "4a463049a45cca24453073235c1693c54919e0109cdb72bc26d8bd5989f1c432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563395, "uuid": "755116dc-0eb9-4765-96cc-0483fc27ee5f", "comment": "Malware payload (RedLineStealer)", "value": "01d266faea81c3bd03c50d2a7913a8413e88c504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563395, "uuid": "f6e06a66-6d7a-42d7-9150-ff6083be7bc6", "comment": "Malware payload (RedLineStealer)", "value": "e7424ab8726c08649488dca86235414360a1861c8786d5813c3a5f614e497b687583128c364651e9309b7c1ddfbf7b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563395, "uuid": "5652512c-67b9-42b0-8ee9-c2add1797389", "value": "T10DA4142864BFC01945E3EEA52EDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563395, "uuid": "aa5c0bb9-86e7-4ace-84f3-164f361873ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563395, "uuid": "cd27671a-9010-4c0e-bc95-0e442210fe4e", "value": "12288:0klT97uXmy/BRjhq/jGRSvqjEMISNX+iof8FFt3hi9l7s3K4olfI:rYjho5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563395, "uuid": "a7f0c018-d427-4692-875d-ed6dc289f6b6", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563395, "uuid": "62994121-0aee-4a67-b921-9f35b5c0bcc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563395, "uuid": "dfbdf8d6-e305-435d-a203-ad9257fcc9a9", "value": "4a463049a45cca24453073235c1693c54919e0109cdb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112d0152-1e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632593515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593515, "uuid": "b3c7f585-cbea-4180-bdb5-cf30b519559d", "comment": "Malware payload", "value": "90ce73a2842aadef66ed4460d41bbaf3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593515, "uuid": "96924093-8b7e-4fa1-ad85-e40f14de4d1b", "comment": "Malware payload", "value": "4a7b6264eb470c3f5c02b7ac5969b52898950640fad368f6a266bfb129eda437", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593515, "uuid": "7821cb2c-8987-4419-970f-410fdea46037", "comment": "Malware payload", "value": "c838935723b499e6a6a23f1c19d61ba5c305cd43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593515, "uuid": "6f1ecb21-277b-4df0-893c-f077029b83e4", "comment": "Malware payload", "value": "7469321c6b65bf6fabd2bddf21ba9f669d5406d7614c74e23bc0b2dac7c027d0530c8f739f58bd2a4aba5dd1cb77ef76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593515, "uuid": "d4c0e040-dccc-46ab-b8fa-875dec7252cc", "value": "T1E9922B81E662C5B8FABB00FA5A712C6C7D6E890103CB42F319DC5E2D9F994C73972871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593515, "uuid": "a35afe1d-8444-45d2-a23f-3013e1444ebb", "value": "a4dbfdddf99d7cde4db0ccd5b4ac4ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593515, "uuid": "2a902059-6d61-4d06-a2a9-4f0c0122d9ec", "value": "192:O+G4ZtFHYcERup0hwTPFHruNDfZTIRfVtYMLw5GUEux165+FWGRgT2BpwDbr++hz:O+G4ZtFAgiNsVUEub65JKeD/cXKez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632593515, "uuid": "b909eb82-9c63-4a4b-8808-e7d31b8cce74", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632593515, "uuid": "1ad3f2ca-6ce6-4415-acbc-a428f8ce7dd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593515, "uuid": "0aefd250-bc5a-45ca-a4b4-0c18a83d2fc0", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.23718.12284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862525e8-1da9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632537447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537447, "uuid": "ea21329f-e2cb-4262-b2a2-ffec084563a5", "comment": "Malware payload (Mirai)", "value": "4e25ddc1a4ae299669741be3eebefa08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537447, "uuid": "650ade02-47d1-41a7-88be-8e01dc5458d3", "comment": "Malware payload (Mirai)", "value": "4b0303320ab21706ea18a8a4cafba5b2f2b426093c624674d1415e7fc1cb4965", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537447, "uuid": "127dbdc8-645f-46f3-a211-590243adc536", "comment": "Malware payload (Mirai)", "value": "7d66fe52a0ffa7fb94acbce0e8df296c6082a3e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537447, "uuid": "bfeb330b-6580-4911-abe2-b8de1d98016e", "comment": "Malware payload (Mirai)", "value": "a233ebad6a1f660d7a7efe4293cdc741522d918def73b8d174e27c532573ec892df2aea4f95a59a58168a8b4d298f08e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537447, "uuid": "2b8dbd20-35cd-417c-8ec8-ccd16458d210", "value": "T169B2D175160AF8B0D2708C38E9B9C3C76ADF0DE9D1BA323335948B557A458437C392C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537447, "uuid": "42d5c84a-da94-467e-98dd-fe77d9dfb869", "value": "384:qrR5Z6gtWkY+iTULFUycBswe573K9VAa/SM7OYIjPmMJ4yGZyiRBvhymdGUop5hS:DoWkq0FUEwelR7M7Ajt4MiRJs3Uoz9G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632537447, "uuid": "792878e3-deb8-4d3e-ad22-f8e22fa776c7", "value": 24184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632537447, "uuid": "49ec59f3-0252-408a-9c5c-715fc8dfa320", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537447, "uuid": "2d3f9204-4b1f-44eb-9d88-eed8645c0521", "value": "4e25ddc1a4ae299669741be3eebefa08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7011f1-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562340, "uuid": "bee41cb3-49a9-4705-97dd-3307c43e0ec8", "comment": "Malware payload (RedLineStealer)", "value": "6150dbca1a32f5d0a80c6058d5208f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562340, "uuid": "9bfdcca9-348e-4c22-9264-fe6bc67bf806", "comment": "Malware payload (RedLineStealer)", "value": "4c49074ba812570879b6374fc61bf7177b09a1ceb5f51ca6f401772ba0f5b3af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562340, "uuid": "b0ff6d08-240e-4709-b1b9-d11667ceefd7", "comment": "Malware payload (RedLineStealer)", "value": "152debe349befe16e8e1597fb4dcc3cfe1dfa1ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562340, "uuid": "57a86a4b-cf7a-4909-b1b5-a5ce282f8acb", "comment": "Malware payload (RedLineStealer)", "value": "9820734f9de414eeb3f70fd9649e78a09ce128486e75fa96751de2e92dd730eda62a2284c483d499d0d86357be0910ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562340, "uuid": "be0a80a7-4bd3-47a1-9b27-0c83500ee083", "value": "T1C774AE10BBE0C035F6F712B949B99378A53ABDB16B34C5CB62D01AEA16B46E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562340, "uuid": "4da00e9c-0e7c-40bf-8c3e-eab0cce4e912", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562340, "uuid": "1c3a4fa5-0851-458a-b603-890295abf58f", "value": "6144:ipEVI8QubQ3suNn3ozTgdjofyiSZIr3PMun1GB5e5F:ipEVI8QubJudygdkaiB3PpGBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562340, "uuid": "0b9aa32c-2f22-4ada-a05e-9fd2ced5b5b5", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562340, "uuid": "b39f813a-7629-4f70-a2e3-f84d9ed23103", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562340, "uuid": "6264e6ce-ad60-4f28-a879-410f4cfbbc8a", "value": "6150dbca1a32f5d0a80c6058d5208f2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6be0c24-1e39-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632599403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599403, "uuid": "2fec71e3-2521-4b2d-b0bb-5ffdd52210cf", "comment": "Malware payload", "value": "6192ed370757a102dc5d281e70c7cf15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599403, "uuid": "f4a23389-5701-4c3b-bad2-0306f23433fc", "comment": "Malware payload", "value": "4c6bb4ed84b824952aa4560ace5fc6002aada3dad3ea1940a115e7e2467e77b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599403, "uuid": "c87cfe8c-2fe3-4e55-8db5-95f70a1b402c", "comment": "Malware payload", "value": "ca9228072cb6afe664122bd6ebf7fe7f73458aec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599403, "uuid": "f58d8e56-34cb-47cd-877d-8fbc94af58c6", "comment": "Malware payload", "value": "9e343b220c0ff1e3ce3afa68187f9d251d48e4902f4fc3f9a0dd67b797b1c33ba213c09167ed610131ff00b38cb53fc2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599403, "uuid": "83b7e5f0-a9b4-4418-b441-4ba309e4183a", "value": "T167B2D02D49211885DD9E2C79B1FF2F86DD44F180B09F0F4EA7519C11CBA9A833A6E4B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599403, "uuid": "c968fffa-1a4d-47b2-86ab-89f725fb6762", "value": "384:owuRSIpt/NZwHHxlRsSFrm0hOnDdRmDeSLhmRkjea4PXc4L5Uci5HU7MHQPu+RWT:lInwHHbTrm0QwVLhmR8Mh5Q5Hyu6WRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632599403, "uuid": "32edc3a9-99dc-4f5f-ad07-2016fe3f0cea", "value": 24936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632599403, "uuid": "8ee14e3f-c8d5-4fea-9b71-dc1517244bb2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599403, "uuid": "5945a78c-27e4-4aac-886d-c5414dbbfa4b", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d10e4a6-1dcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632553646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553646, "uuid": "46db5bb4-3701-4e9d-941d-9d36ec5e0a9b", "comment": "Malware payload (RedLineStealer)", "value": "9346511058f2ed33ad447947722c45bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553646, "uuid": "804b218d-bbb7-4445-838c-03baf73d195b", "comment": "Malware payload (RedLineStealer)", "value": "4cdf79fa689da6c5c26f90996ac70bbee4b49bf58349c766c0e5222d45271a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553646, "uuid": "c17ddb49-6198-4c23-b839-2b06a14d6398", "comment": "Malware payload (RedLineStealer)", "value": "c08c9430e0abfa40dd1d066a91213d35ae1b1366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553646, "uuid": "72023532-6f18-43e8-95c6-c046e5cadbcb", "comment": "Malware payload (RedLineStealer)", "value": "6450686f76b3e6a72bafe30979f90eb390dc80a2f98106e531c35c3381747ba9959b5726c6061320ffb09ca405b64bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553646, "uuid": "716ec537-1e5a-4f3f-be69-31c804a544b4", "value": "T155E4F120A7F0C034F6F712B549BA93B8A52E7AB16B3881CF52D51AEA52746E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553646, "uuid": "e2589603-8ae2-4ee8-a638-14b78648a10a", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553646, "uuid": "1de84bf1-5f44-4699-9baf-010277e95b97", "value": "12288:3sqc0oCZ8b5rWtRTr3FmUzeTNg9/KAYhhjwiMWstSAyega:1oCWb4r3Q+eq9lQjhM7tqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632553646, "uuid": "b337f7a6-6856-4c1f-ba4d-ef8768245f84", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632553646, "uuid": "84e2891e-db20-4f6e-94fb-d877595ae3c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553646, "uuid": "81cdafbe-84a8-4ebd-b450-1af6f17d9b33", "value": "9346511058f2ed33ad447947722c45bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c398b2a-1daa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632537726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537726, "uuid": "85ba8e95-761f-4725-b3ba-d4ecb2beaa6c", "comment": "Malware payload (Mirai)", "value": "1bd3fd525b86697797927884f72eefae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537726, "uuid": "25860d37-f361-4ecc-949f-b5c20cc77893", "comment": "Malware payload (Mirai)", "value": "4e01dac7e8d480be180f2fb5b45bf80a3bb2e0b9e596b0a2975c2e51c7f98533", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537726, "uuid": "f7bf38e8-077c-419c-a5d8-45d75b22df25", "comment": "Malware payload (Mirai)", "value": "2996830fbd4576972104dbb5b48de30818f65a49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537726, "uuid": "4859632a-2cf8-49ae-ab2f-8e23664a6340", "comment": "Malware payload (Mirai)", "value": "bf25c565eaa36933621cc6904705734f12caf467bfb67fd7e469d1fbfc0cc70aaae9b7bb9a7930d09f3fbdfb67d0a913", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537726, "uuid": "9f059ea8-7f7f-41ae-955b-f5d9a173e83f", "value": "T132E2F136C056B76087B46CB6E7722DE72F151DBAE0063159F1A8DA3C90B264FC776142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537726, "uuid": "91488c11-e18d-44a1-9567-a7e336349123", "value": "768:AeHlHk29rbDTcTJQsr7FsZypqIws2qYQS9q3UELCQ:AeFHzVfgTW8JsZiws3Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632537726, "uuid": "f735f248-ef61-49c3-9a9c-6e6a0e5cf447", "value": 32188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632537726, "uuid": "41d06e94-dc30-4610-acd3-b8ea3b343a1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537726, "uuid": "aea4b6ee-2c8e-4c87-9cdb-86b6bcd51aac", "value": "1bd3fd525b86697797927884f72eefae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0631d8-1e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632593512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593512, "uuid": "0eae945b-670a-45e6-93f6-1780c6821933", "comment": "Malware payload", "value": "3d111303b8e6bed3962b2f622e898e14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593512, "uuid": "60cce41b-1cf7-43e0-ab60-402f7504141a", "comment": "Malware payload", "value": "4e0c2fbc970afa2af9b165e1ef235c9d69f6fe89fe55d3f1738a9c524deaddf8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593512, "uuid": "393dcc6a-7bce-4598-b22a-eb4f9ec86203", "comment": "Malware payload", "value": "d55b3675fa042b33dc175c5025ddc2e260a50fc3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593512, "uuid": "6fc9008e-5d21-4350-a13f-cbac8f221eb3", "comment": "Malware payload", "value": "8814cc3402c369e49731db0a839efcb071891444da033d5773406be717f153d29162bdd79c02ef202c129aa4a69830d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593512, "uuid": "626544c5-720f-444f-b0db-51e3f5ab9433", "value": "T176627D5A761294FBE671437B6E631C3D196A9F52130202C368E50C69BB4C5E33E36FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593512, "uuid": "48d42a1a-e32d-49fc-8494-aecf2f229389", "value": "0f191ea882ec254c56f5a83276937d8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593512, "uuid": "75f7c2ee-491e-42ed-a521-2181d7e2572d", "value": "192:pkwmq7JStz57S5oRT5OoiV7/qq7WIL9m7niu8c/LTvhbFhbNYp7bIglSt8xI5:qSEp5t5QzJPyTVFHYRbIgAMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632593512, "uuid": "a8b7462a-580f-400a-810f-4ca058041855", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632593512, "uuid": "3d84c395-3e51-4cd4-acfb-fc975a7bc0ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593512, "uuid": "53cccafe-5af6-4d70-85da-57a672257de0", "value": "SecuriteInfo.com.Trojan.GenericKD.37645155.8784.27671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8917e5eb-1de0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561075, "uuid": "f02c5137-a5d5-4a0c-aa8e-d5da59a343f8", "comment": "Malware payload (RedLineStealer)", "value": "49c18e08e08275bf512ffa81bbb950e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561075, "uuid": "40d79c24-65bc-400b-bede-9c530d181f79", "comment": "Malware payload (RedLineStealer)", "value": "4f0c5d8a6dcb806c4bf49685b785b7080cfe91a56702e171c4bc50ab6ef4054c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561075, "uuid": "2c00fefc-9676-4ddd-81db-b55c2b7bd509", "comment": "Malware payload (RedLineStealer)", "value": "19392a00c558c40404c02ca3c97511da1e0814c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561075, "uuid": "72dffb04-cab2-4453-bf39-db9bee3ee09b", "comment": "Malware payload (RedLineStealer)", "value": "f9f26a6b0ac448b73290ad82eff320ad55fdcaa2cbc5282411cda40e9e00af9c2c395ef14d08a5c21e564f48fc5da002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561075, "uuid": "49bb7bb7-e39c-49e5-9ecc-99dcc7d43a44", "value": "T11F24DF3139F1D437D2A39AB08874D6A1567FB5333E71848A261026DD1EE22CC99E63DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561075, "uuid": "7819a9ed-4eae-4fa7-b8e0-4fdd091c4193", "value": "5fbfc74c3ddccb96d094c58debd98462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561075, "uuid": "95793a91-e322-4667-bd63-a68f660ec308", "value": "6144:Bz2lX6SJ7t0Y0aSrmzxzxbBEzxpLmR4m03:BzcKSJpnimzxVbBiLmqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561075, "uuid": "f8906531-0e95-44b6-8e65-c495a97033e4", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561075, "uuid": "729d445a-c781-409c-a18b-2f1e88592e68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561075, "uuid": "90e61b0c-f6c1-44af-b73f-62c3ba2413d6", "value": "49c18e08e08275bf512ffa81bbb950e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a405ea70-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632601922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601922, "uuid": "d7d6f0c1-8837-46a8-9c08-c32f76af2568", "comment": "Malware payload (Gafgyt)", "value": "187a3b5c1923063dbb45da4c06d16220", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601922, "uuid": "bc2cde1b-32cd-470e-b00d-44eb77c1b6f8", "comment": "Malware payload (Gafgyt)", "value": "4fa681d47a2578204f8d8c89c652f2500039b8b2e3700c16eb7b02eadfe4bb7b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601922, "uuid": "645aa8a8-7826-48bd-b5ca-619b466e6c16", "comment": "Malware payload (Gafgyt)", "value": "3eba389213ca8697e79665938227b02b41def947", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601922, "uuid": "7edf7bc2-0cea-49e2-af29-187bfb4fc195", "comment": "Malware payload (Gafgyt)", "value": "01f0d2ccc9499590d69c769a879386568c9338bdde52e358dd1ace0de92277c6d04053658ea95dc26f38cc401c9821b8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601922, "uuid": "5c4e0c5f-bdaf-46c7-94c1-52f76a96d175", "value": "T19403E043536F9EF5DA31643523296C04F6B6E89293110F4F09D953B7CDB9508AA70AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601922, "uuid": "3535f07d-da8a-4316-8399-df350c35cb6d", "value": "768:cRMROvmQjkSNDl4N8hVE86W+0d1RQrM2v9sPFJ7LhjFMU2SR:cutQjkSBlZ1d0FuF9EoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601922, "uuid": "9bbcd2eb-7996-4093-b504-ff5bea96681e", "value": 38332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601922, "uuid": "d5a2eed9-0e3e-4117-8876-05113ee0cf93", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601922, "uuid": "2d35171c-440a-495b-b4ab-4d2e54c4ab70", "value": "187a3b5c1923063dbb45da4c06d16220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b8d372-1d94-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632528231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528231, "uuid": "e8f987a9-b5a3-4d18-9b87-0313574dc011", "comment": "Malware payload", "value": "39768b36a3e407a04647138aa2507b07", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528231, "uuid": "b276c38f-09e0-4929-8561-2b45d592e927", "comment": "Malware payload", "value": "5010ad6ed71152f44398a399ef39d31152ed4b407db86956f72792e647311d19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528231, "uuid": "962776af-c2ac-4027-bd64-feb769b729d6", "comment": "Malware payload", "value": "a3fe8e4e435029f15d35b4424d2eb2193e946e74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632528231, "uuid": "1c3d52f8-92c3-4f6f-90a2-c4734a25e9e5", "comment": "Malware payload", "value": "e245a3bcb657a06cbbf6b2916bf8546d57fa9131c5e53d6c6df6aaaff2ad6c56bb35c31d54fd67f75767b1f76b8152ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528231, "uuid": "f72cc802-03a4-4430-83af-464c41ff5432", "value": "T13CC4E41926485A6DC9F322B2052FB1B193AEC471233202CB73149BD6BE447E15EFD6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528231, "uuid": "e40c1349-caa6-4d19-af6d-93c529dc570f", "value": "3072:lv/5YOhZIslTuNlFPVXqP00KIkOPcs0SeM:VWOPlTuNlF9XqP00KIkqcvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632528231, "uuid": "40e84f70-399c-4b56-a9ee-343a56987a9a", "value": 555361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632528231, "uuid": "e6698b1a-2fc0-4471-b1ce-52b8e21789bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632528231, "uuid": "9f7c6785-a843-4622-b72f-96ef7135ea40", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1ef76a-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632552653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552653, "uuid": "a33775d7-91d6-4999-bdea-37c3a57cd37e", "comment": "Malware payload (Quakbot)", "value": "dc5421945696fc0950f22da06b121d84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552653, "uuid": "cd532f32-2b64-4833-8d11-5ce8b9b2bcd9", "comment": "Malware payload (Quakbot)", "value": "507b876c0338193836078c588a6d0085ab63fe65848bbead2bdfb0391f615d3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552653, "uuid": "7295d390-bf14-4a80-b309-21de5343ae79", "comment": "Malware payload (Quakbot)", "value": "08297234f6357b6ce8510f0124345c28fffc1fbf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552653, "uuid": "293ae364-13f6-4360-9c0d-b128af8b810f", "comment": "Malware payload (Quakbot)", "value": "79d8d09667599e2abdd603572ffe419127a6d638f0f48888fd4a32aea79678ea67bd514180dec0c0257462f28cc9cbf8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552653, "uuid": "eac04b79-2d1f-4abe-9820-d4d6b30a25a8", "value": "T1C6B4AF2EBED2D151C83819B9CD92C8E672387865AE18D2533AD53F3F69F74D11C4A08E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552653, "uuid": "2fcba7d6-61bf-44a5-b7cc-c4072215cad7", "value": "55e63e10220d9780afbfa2f458c9d3dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552653, "uuid": "3d97a489-40bb-4cb2-b2d2-d4349690b925", "value": "6144:8bqzVbbUYjG8AClk8+i05KhoSiMsJZuSsnDxeHakVqhhmaM+5Vg0nKH5PnFyunU:OqxgYjG8ACv+hKhpsJZRXH52LMcg5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552653, "uuid": "037fc61b-4c88-4686-9ef7-cfb8177d9ce8", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552653, "uuid": "eaa7891f-d027-47c2-b42e-ff90629a8111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552653, "uuid": "98d11166-a29d-4ddb-87af-7991108ad0ba", "value": "dc5421945696fc0950f22da06b121d84.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48600ba-1e06-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632577442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632577442, "uuid": "4119127f-fab8-483e-84de-ef6042e8de27", "comment": "Malware payload (RedLineStealer)", "value": "916dd6ea66ce8fab96e56ab8d095ed3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632577442, "uuid": "f80d7890-1308-4bb2-9f61-f396493d8298", "comment": "Malware payload (RedLineStealer)", "value": "507e6d823c658bc19de57c55306d54b92a63f689ae2f4bb720a94ae8a9fa8992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632577442, "uuid": "5ab2d4a6-a18d-482f-a3de-60e753abfa0e", "comment": "Malware payload (RedLineStealer)", "value": "ef8c085efcbe65b59004a38d2b1d0811c7280f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632577442, "uuid": "11d1302f-43bd-4e05-b518-87815093037b", "comment": "Malware payload (RedLineStealer)", "value": "c2677c59be44093b3a6dc112e4e03b362488120a4545cda159fba4b38d585e6062fbbe66820d1085c62e3e4f9afba5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632577442, "uuid": "972dbd6a-bd69-4d00-af52-24f686121fd2", "value": "T13024DF25F2E5C03AE2F7197419F587D1663F7C632FB9448E26442A5E4E322D3862632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632577442, "uuid": "ba88b889-e63c-4bbc-8628-08de7b0c6554", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632577442, "uuid": "b6f99e38-c640-4761-b44d-9d2f52f33942", "value": "3072:cG97Vn0LBFhjxoOGPG0EXG46R8GxUb5yMB4VvGGejQD5UvbKYQ:cGhAdjxW+0j4C9pXkr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632577442, "uuid": "cc6a73b2-8e9a-48cc-8045-ff68a69f9d7a", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632577442, "uuid": "67a48688-2e48-42c0-8741-20d6d0efa299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632577442, "uuid": "92be12c1-0931-489d-b7a1-bce9c4a2b79c", "value": "916dd6ea66ce8fab96e56ab8d095ed3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f4a2ad-1dca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632551614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632551614, "uuid": "3802459f-f1d1-4d54-bf71-68fede0734bb", "comment": "Malware payload (Formbook)", "value": "3a1aaaa96c49fd9f331586f7c3756ddb", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632551614, "uuid": "1ebfb209-ded4-4ee6-b162-830195d79bbb", "comment": "Malware payload (Formbook)", "value": "50f68589033f5bb45e5b5d6ea886b66e0f0a6712f1ec88b3e12e272990f1ad60", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632551614, "uuid": "6cf83e47-208f-4872-bcb2-7a31f24dc0eb", "comment": "Malware payload (Formbook)", "value": "e10347f468b49c7f6ed321483ef50807fd8204c2", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632551614, "uuid": "e9becbb2-8ffd-4da0-8ec8-975f816a8362", "comment": "Malware payload (Formbook)", "value": "95dca147ba138514b218852f59839e8231c979865dc80656319f7d9f4a22cd9e481bfe7bb937ad2d0c027747ed149852", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632551614, "uuid": "aa6a57e8-502c-4175-8dc8-417ba71450a7", "value": "T1FB4412576DC294BBEBC663B105BBD1E8EFB7850452609A1B4BF41F322B700874B3A1D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632551614, "uuid": "20fb605f-31f9-430f-a413-7831e6612ee8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632551614, "uuid": "bec83295-d1d0-4cfc-88e9-916c148cc140", "value": "6144:F8LxBsMqCEhCeUifbJBbEnLSmBVdAonSKzd2GBuXJ0GhcjE:/0tifbJEorGBsJFWjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632551614, "uuid": "3aa6be2d-117d-440f-969b-5ee844cb7635", "value": 260210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632551614, "uuid": "be946420-d297-45bc-b3d3-bfc444f1dbb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632551614, "uuid": "f5674c05-7c0b-4b64-bc27-edfe0261714e", "value": "Cotizaci\u00f3n 02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034889c6-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601652, "uuid": "8315570f-badb-469f-9ec9-f89fef6788a7", "comment": "Malware payload", "value": "1cde53f2c7fcd821febbfd429bd26e7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601652, "uuid": "124b9784-319e-4356-969d-dd45038e0968", "comment": "Malware payload", "value": "51033ec4ac87c6f69f8f96155e56d1c88d283b2166c1eb120eb50ac267c5a231", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601652, "uuid": "2b918129-6fbd-4ac0-9fa0-3a4079ff27ba", "comment": "Malware payload", "value": "2db2eef3f7ada7cbae370c223b0e72f4c8ff38de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601652, "uuid": "3979aee3-2fd0-4df5-ae80-cfd746520406", "comment": "Malware payload", "value": "cc5531bf246ecc911b3f71fe7b1b3e337d2136a0b427c2debef8317641b8bf92ae62b13f559db07723db93c09d207e2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601652, "uuid": "26d53133-928d-435b-b508-f0324d69e66c", "value": "T195A22A49BC84CA56C2C0517AFA5D924C37326BA8E1DF73434F26AF622B9785A0F3F540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601652, "uuid": "fac640eb-409b-451e-8eba-1e132f2b67ed", "value": "384:U3DaOE9Kg+seqtyv1PIDH914JJLtobP5bL9LP5L1RxEzIhihFhfeVUFx4e:U3DaOE9yseqQv1sWlmP531P5L1RSchiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601652, "uuid": "1a1afd43-6276-4fed-a1df-1b4cbbf69376", "value": 21676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601652, "uuid": "0e311ebd-b3bf-4ce1-8513-46946958deda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601652, "uuid": "0cc15a2d-364f-4da6-932f-b0561aa8ca42", "value": "1cde53f2c7fcd821febbfd429bd26e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db222be2-1e40-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632602444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602444, "uuid": "04444fab-32e2-4b1e-8b1b-59ebc4c06359", "comment": "Malware payload", "value": "f290b51d8135bf04d5313880a54a1465", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602444, "uuid": "5af64535-e7fe-4713-8ac2-72011ace03fc", "comment": "Malware payload", "value": "5130095f1a90914d46e7706ddba207deb42349c15312da9f8d3422600372494e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602444, "uuid": "fe5e2803-17cd-42b6-9fef-07c8ec4f5f32", "comment": "Malware payload", "value": "b1f30872ccbea9c68bd5b21145117e0f853c7fd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602444, "uuid": "8c596e06-65b0-4f76-bff1-19693e299e13", "comment": "Malware payload", "value": "f61f970af12e8cc570ffd1eafec294da6a07baace5c89a9c4df5425116cbf057ce0a8b131a3bd24f5b17f848b178550a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602444, "uuid": "c1ff8bfd-4a50-4b8c-a0df-3420ec41711c", "value": "T15113F283F744F11685E17C79DCBC0CC785FAFFAAD7BB81056A946294F6A524382F0642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602444, "uuid": "378d535e-745d-4a74-87b9-c34dee8104fe", "value": "768:ePHNiBA+E767/D7FT//b2RVbj3+X/bq3U7RiLnqELEdq0vhCN:ePp+is/D7Frb2RVbj3+P/O/LEdzvMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602444, "uuid": "3d2b85b6-72c9-4928-9dfc-6a1807f2227f", "value": 44872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602444, "uuid": "bd541d2f-775d-4f7d-a877-e05cced7291d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602444, "uuid": "35b9c48b-9614-4960-aa85-ce7559fb466b", "value": "f290b51d8135bf04d5313880a54a1465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c436958-1dcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (XpertRAT)", "timestamp": 1632553617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553617, "uuid": "649ed47f-63ce-4a65-b438-f7a5bf140c78", "comment": "Malware payload (XpertRAT)", "value": "d761f42a4df1938b43282d88e12c741a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553617, "uuid": "eca063b6-4fde-4ab7-8f86-e083d3739dd7", "comment": "Malware payload (XpertRAT)", "value": "515fbf67c103e796658acaf24ae3762943a56ebf14337ab46bf9e140f61da0f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553617, "uuid": "38ee42a3-e579-4e26-88e0-ab90a257160d", "comment": "Malware payload (XpertRAT)", "value": "fc1913d79b6f8c738bfdbb64cb99ac863ce42f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553617, "uuid": "8a1248ac-ffe9-4e52-876c-bede49c7aa0c", "comment": "Malware payload (XpertRAT)", "value": "5073a2716df37b8dcccceae617acee7c470b09a7bd20389be0e66cb55ea18d3452172057366f74d6ca0b0a8345cef5a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553617, "uuid": "36765693-8e41-4d38-a696-707778ae963c", "value": "T195423B52A3D45A7AD9758972FC3767010A70F23BD8A2DF2E28C9503F6DA331051A373A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553617, "uuid": "6125a85b-efde-470f-a010-816f3ed5a201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553617, "uuid": "7c9a4c65-cc2e-45d7-88a1-be30b61a44ac", "value": "192:zoLLS20e1PbqSTYreGfLhcqDEmQqMT0U2/JT0JN7KaeGq:zof0edb3TYreGvYBnT0UUKN7K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632553617, "uuid": "17ab8297-cb14-4d46-ad98-b081afbe9259", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632553617, "uuid": "b8794aeb-cb00-40ff-96e1-fc35deae34c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553617, "uuid": "ac86c590-90c2-4714-a1e4-2e7e8d829f41", "value": "d761f42a4df1938b43282d88e12c741a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c6e174-1de9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632564849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564849, "uuid": "1f33c899-46df-4ab8-8bfc-06a0d33851cc", "comment": "Malware payload (Gafgyt)", "value": "d94278af756244e538803b9bae13ffaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564849, "uuid": "5d29df5c-8d20-4878-a501-caba830a4557", "comment": "Malware payload (Gafgyt)", "value": "51961729ef4c087c8c8a8541d3e8c19cdc3d53f7ead294dd51170188990f5306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564849, "uuid": "2e8dc52f-3fb0-4e40-a00d-be26e5056823", "comment": "Malware payload (Gafgyt)", "value": "eb3c4d50e3e8acb3a058d98b4a2de89e00514b24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564849, "uuid": "b77ec419-81a0-423e-bf20-52f150498ace", "comment": "Malware payload (Gafgyt)", "value": "e35ca1f20599fc9c6348b51b84227f2239b56ea1ed8cf2e23eea68ade89698a555ac71357fc3f8b1ce6d4e5671b075d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564849, "uuid": "d4ac3b48-bc5c-4c63-aa27-1f4b49932eeb", "value": "T102932903771C0F93C5DB6AF129F727F0876AB96112A76181690BBEC44773AB82113FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564849, "uuid": "9f23e4d7-ae90-42ea-bf64-984a4da603fd", "value": "1536:NQN2rk2nwIzHaZNjXcI8cSei3iu+iRApYqevp6TEmQ9VqXjtWfNXe:NWUgbGcS73dnZvp6TEmQ9VqXBWfNXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564849, "uuid": "4c7b1b33-41b4-401c-9186-380d98236439", "value": 89732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564849, "uuid": "1a95d91e-45d2-4c8d-9f3c-317e10d29b35", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564849, "uuid": "12927469-2fa1-4dc6-af75-e0b48bd37f7c", "value": "d94278af756244e538803b9bae13ffaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf734c3-1e04-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632576647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576647, "uuid": "dc059bca-f678-47c3-991a-00b14b2b54ef", "comment": "Malware payload (RaccoonStealer)", "value": "97f409a2d635c502d5ebbe62330a4f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576647, "uuid": "4cbabf1d-ca2f-4fc5-aa2d-91ffc29305ad", "comment": "Malware payload (RaccoonStealer)", "value": "528e8cab7a7a341eeb6f80aa091f0ff5c0143f6a83b21c975dd5c6318128dd74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576647, "uuid": "112153c4-5542-4ea1-a7f5-2914c7d65b63", "comment": "Malware payload (RaccoonStealer)", "value": "a6c164493a2b6d707b1deac9068a109507abfdf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576647, "uuid": "1532b8d9-45c2-4a4c-aedc-c447265b85e8", "comment": "Malware payload (RaccoonStealer)", "value": "4dbebfdc1629743c750f57d8560e48caa4153dc7b6f87aedc505fc1c43e63dcc38cd822166d7f6cd390bcbf5b39f4d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576647, "uuid": "447a33e2-9356-4f17-a88a-121d39d822ad", "value": "T1729402117AA1E872C79357310E3A83B2953F78626C774127FE4C2B5E0E711C16AE276E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576647, "uuid": "d264ed66-702b-4f3a-b41e-2ac225157c6b", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576647, "uuid": "61535f76-1804-4a99-94e3-2e2ebd82bf9b", "value": "6144:VPILwKnOVc0jMA+XN1BdD5NxUfRT0dsEoHW3J22bAe/JUh2Kbd1+ZRuNYJMEad:7KOMzNjprsR4ymTbAe/JUhLCZR0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632576647, "uuid": "54d290fe-caa3-483a-aa25-1d6846213a61", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632576647, "uuid": "f4a3316c-e8fc-46dd-a261-64146c704beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576647, "uuid": "152aaf14-8eec-4bae-b97d-da57b86ba8ab", "value": "97f409a2d635c502d5ebbe62330a4f3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9456c55a-1e27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632591588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591588, "uuid": "81f726ea-b721-44be-8f44-938f2b386ef1", "comment": "Malware payload (RedLineStealer)", "value": "f9c17c191f39f17d9eede920af183827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591588, "uuid": "2f462cdd-11ff-43e0-9a8e-8b950f0084db", "comment": "Malware payload (RedLineStealer)", "value": "529d2d84f3415216cd991d6e83039ab13a3476c3d54c1958b3164260129ad796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591588, "uuid": "21314ab0-dbc9-4433-b602-28429c076287", "comment": "Malware payload (RedLineStealer)", "value": "ba38ec584d286850ba63abddb0f6428a6b50ab6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632591588, "uuid": "902ce06d-83fc-4cd2-8090-35e640b13ac6", "comment": "Malware payload (RedLineStealer)", "value": "399ee1b0b7c19b7a09e11e18ea9056cf0ff982b58efabd16f42050953c0d40b25edeb3e1253ebb60fcdbc59b4d9c4ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591588, "uuid": "64336622-380e-45c6-9f06-b9e8afe0343a", "value": "T18444D09072A1D832E7E206707A35C7D3663BB9626C77858BF71C265A3F312C156E2F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591588, "uuid": "166cdc69-63ea-4ea5-ac90-50dacf01b908", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591588, "uuid": "d1e9bb88-e136-4aa5-a7f2-8573716ada2b", "value": "6144:TQsCSGKd1jSt7OaKtOR22zIgqQCscF91b7vHL8Ead:mKd1jS5UtOKlBsY91b7vHyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632591588, "uuid": "9c0dd2a2-6b9b-484a-abb6-66a3225d957b", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632591588, "uuid": "3af1bbdf-3e65-4f32-8525-687ec5544378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632591588, "uuid": "14a9b534-f983-4348-bda7-d665e0af9809", "value": "f9c17c191f39f17d9eede920af183827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69b45da-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563272, "uuid": "7433b09f-864a-49a0-8572-d6f525713a46", "comment": "Malware payload (RedLineStealer)", "value": "ff2f90ff39e9007e4ad4181a037af16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563272, "uuid": "bde3a56e-0177-4f08-a0f2-f271e89c63c5", "comment": "Malware payload (RedLineStealer)", "value": "53c5a8d28627cb44403e898d9337c3f3a61bbf87e71dc872a442e147c7aadf53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563272, "uuid": "e53a53a3-5e78-4da1-acc7-8c46d933f489", "comment": "Malware payload (RedLineStealer)", "value": "122cdcd2ff855537b4cc7111899c37744857b1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563272, "uuid": "09fc6f18-eff4-4e82-80e8-5c83fa5c1bfb", "comment": "Malware payload (RedLineStealer)", "value": "1effd8dac661d774bbf21b979eb110961ec533c8925d7b94ea5ec60a5940b804d9d2af40bb0fef95e99ce7401aac0010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563272, "uuid": "f7028903-5374-4837-a65c-5d9fd48f0ed9", "value": "T1A184BF20B7E0C035F1F712F849B993A9AA3EBAB15B3490CB62C517EA16346E4DC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563272, "uuid": "da1008e0-9e0b-4095-96e1-8fa4cf4c1cb1", "value": "0f0c12643909b692a9be3510bdc965e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563272, "uuid": "5e10e2b1-8320-4e29-9e2f-f03313b0473c", "value": "6144:xasNMPMa9cqJFbUaSCt9bUWHvh1J74jcD9pWMTM9Aoh6z/d:9NMPMa9c4Ff9bzZ1+EpWMTWhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563272, "uuid": "089d3bd8-4b69-495f-b64a-a901aaa93548", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563272, "uuid": "179c9923-40ac-4ea3-a499-1e28148811b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563272, "uuid": "2b8d95b5-0cb7-4643-bb1c-c85c86601e1b", "value": "ff2f90ff39e9007e4ad4181a037af16b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2e64de-1e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632605026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605026, "uuid": "6bc8854a-492c-44b2-9310-573f58057372", "comment": "Malware payload (RedLineStealer)", "value": "840de5d15f06f650173d0320b55477c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605026, "uuid": "e2407698-c68e-4668-b7d8-93f8f58e5b2b", "comment": "Malware payload (RedLineStealer)", "value": "5484ffbb09d6886470562a882bcee4e31905cb20f01597cb2b6ed66c9d748736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605026, "uuid": "d3040959-372d-4aec-82e6-8f178e95d382", "comment": "Malware payload (RedLineStealer)", "value": "8cb78de38d75376ae044be2f0493fcfa2ebe21b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605026, "uuid": "6474ff0e-8393-433d-893c-92ed81d2fe75", "comment": "Malware payload (RedLineStealer)", "value": "215ac18761899f724813f5e39652d934aa76f6da72db6d69558f2b2afde770c71968f0d2e91953bd3080cddeea5a4f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605026, "uuid": "3b6213f4-898f-47f7-a72c-810d1cb4e2d3", "value": "T19324E02066FDC4F2E7B719B4E934D7A1253FB8736B70858A728407AD5E213D08A7A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605026, "uuid": "8b4471cb-dd42-48e3-8f5c-cc77e09f8ab5", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605026, "uuid": "0a3ed6b6-65e1-4849-960e-23bddb62a69e", "value": "6144:aB+cbF3m8HEcD9V1whA+fIDLkt+2bO49eU:aB+cI8p9V1Gzt+xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605026, "uuid": "9f79a04c-990e-4588-95b1-1b155bb4b63f", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605026, "uuid": "b8a12acd-66b5-480a-a0a5-ffc4de00d2f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605026, "uuid": "74608799-43a1-4ec9-ac8d-55cd4f7a4158", "value": "840de5d15f06f650173d0320b55477c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622eeb18-1dd7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557144, "uuid": "236b5b03-0ea5-4832-928f-4c8c49cf39a6", "comment": "Malware payload (RedLineStealer)", "value": "4fa2f0b9cfd2544d8ed9ec922e80a521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557144, "uuid": "d8e19ea8-8c7a-4eb7-9efe-dc285dce6152", "comment": "Malware payload (RedLineStealer)", "value": "555dd78ae57d3a34f8c9bf6a4c896dbc765454ab6eaa12c84ea9631301c97be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557144, "uuid": "149b5921-1960-4cb1-ae48-2a72abfc8908", "comment": "Malware payload (RedLineStealer)", "value": "a43325c3a9208d6cdfae0cbd082cda652d03ec63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557144, "uuid": "56b88bb9-5777-4243-b8f3-c705d47c4e59", "comment": "Malware payload (RedLineStealer)", "value": "d7b5aa12a311fc03550182db2c63ea4e8bbb78f72096fc1ee77388fd803abc3027956a29a6a2bb67290f1c1bc5fd5037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557144, "uuid": "e189d88a-868c-41f7-a988-d4aa7aeee2d8", "value": "T1D524D03079E1C432D3E75AF0CC75D3A46F3FB8232A75818A7A5816AA5E327D15939323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557144, "uuid": "9544455f-e94e-454f-95eb-678144bdf92d", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557144, "uuid": "a3453cd1-e490-441b-b4f1-b565eac409a9", "value": "3072:5B+CvVzj+8mw8z/g5zfQUgtvbJVEc0/a1/XPi5hcaLzucn3K/D5eALyGIGRY5:5B+OzjXQqzfQlt6c71yr7nTn3qfNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557144, "uuid": "d6a7aa22-9a8e-4f70-b9e6-9f707a340dc4", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557144, "uuid": "8f4b6078-9118-4ab1-99d2-532ec1672000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557144, "uuid": "d1446122-02c4-4a98-b334-d5d744ab1fd4", "value": "4fa2f0b9cfd2544d8ed9ec922e80a521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b173dc28-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562860, "uuid": "d237c38a-55a8-4698-ba59-da18d5a2d317", "comment": "Malware payload (RedLineStealer)", "value": "a3288ea4ec5d7be75044a2cbc0b111b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562860, "uuid": "ebfb2126-0ffc-4c55-8002-3999ff0cc2ab", "comment": "Malware payload (RedLineStealer)", "value": "567bca315477953823cfc51ec1a736c79ad8389cc0b0d0f4fad240372118aa61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562860, "uuid": "f329b784-5b0c-4afa-8350-aeb4e8b648d6", "comment": "Malware payload (RedLineStealer)", "value": "8650aa914774bfa16268c2bbfb63d1ac24cb5fc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562860, "uuid": "4d560272-1721-494e-b463-fc72672cd39c", "comment": "Malware payload (RedLineStealer)", "value": "60569a513e90b2fa3a41d900e491f6d0e11a979be1eb4efb837bb59207317dd5bd21e9ab3e8462ff7aaa94f1b3c0dae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562860, "uuid": "805014af-fb90-4a21-b188-b34830b670e7", "value": "T1A374AE20A6A0C036E5B752F749BAD3A8F93D7E71FB2091CB22D126FA56342D49C31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562860, "uuid": "b09215ba-7237-448b-b555-feacf474241c", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562860, "uuid": "9a37164c-e5da-4219-85a1-a2e447c66a2a", "value": "6144:igrfeeSsAckLVemgC826eTGI02TnKZLEvrUi8HVC:15SsAckL9v8Te/jWFmsHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562860, "uuid": "fbba6d9f-3fcf-4c04-a6cf-87808fadc79f", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562860, "uuid": "9d4a3246-f767-4c26-bb24-76040dbd37d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562860, "uuid": "dc6585cb-f3d7-441a-8d50-fb4f42fc95d1", "value": "a3288ea4ec5d7be75044a2cbc0b111b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd9ec63-1e50-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632609237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609237, "uuid": "324c9ac6-401e-4fed-abcd-9a040da1bc56", "comment": "Malware payload (RedLineStealer)", "value": "115dc413a4acca54e7248a0c2093e784", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609237, "uuid": "4a5763b0-808e-4cad-b71c-c3a55daa648e", "comment": "Malware payload (RedLineStealer)", "value": "56c5a8642b999065ce73f5a07bb3bd112a63b8ce13a43f65f2396692b8de274d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609237, "uuid": "8f93fc38-02a6-4efa-bf43-766163068c7b", "comment": "Malware payload (RedLineStealer)", "value": "62e2b6a9453548fc2dd48d2b0a3895b9ec42d331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609237, "uuid": "b7872984-27b6-43d8-9096-52cdf596bf1b", "comment": "Malware payload (RedLineStealer)", "value": "c8862ae656785d9e1e595db590afeeb1073d8d580aac7a15e0a0d4e5c712685c4e5b9e9137420e1a0e8101628106a46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609237, "uuid": "f2f423a5-6f7a-4e58-966e-d105fba4f830", "value": "T1C044DF20B6A2D532E3E3453159788ED5653FFC221D73815BF60E166E4E62EC25AE230F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609237, "uuid": "6addc667-e8e8-45c1-81f8-60208b9c07ae", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609237, "uuid": "cf3af63d-a0b2-4444-9fb3-133bc658be34", "value": "3072:O1c4aVgU3skDp7vfLu7b0wgFikl5JEX+Un7jdo5IIBcn7QTaO5bVejSS9H6l:O19QgUhHL0sFJ5JIW5IIM7Qe3jSEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632609237, "uuid": "fdf8cc7c-8492-44ad-ae43-35bb4f3c3aac", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632609237, "uuid": "203344d0-b0b4-49b4-ac9d-597630980751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609237, "uuid": "3c502089-e3d5-4e12-a552-7aef04a99270", "value": "115dc413a4acca54e7248a0c2093e784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0638eb35-1de8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632564291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564291, "uuid": "2d1eaa6d-2104-457a-9b0b-677619d58dda", "comment": "Malware payload (Gafgyt)", "value": "ba2d304c7d7ada25056f414029394752", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564291, "uuid": "089d2ccd-d0e6-41ec-95f8-74774643bdc0", "comment": "Malware payload (Gafgyt)", "value": "56f10c611a3a30fd71ec8bbae173fa0195356e5173c5b4c4429326e8e8323ca3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564291, "uuid": "85109e4d-96f1-461f-a537-03bf1124e5a1", "comment": "Malware payload (Gafgyt)", "value": "c0d9d5d1fdfdc1cbf2e40c55eaf0d6a852e628b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564291, "uuid": "4f004fdf-06f0-4f94-bba9-e018057e4170", "comment": "Malware payload (Gafgyt)", "value": "b7a4a77ca5fdfc4bd01dc4acaa267d3e7b32f89f3d64dbbacdc8c122870f71b4a3b5b16b70c4bdc2925c89f139668817", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564291, "uuid": "01927332-69d1-4249-9f98-2e0e2d6ce1bd", "value": "T13F93F8A2B901EF77F40AA77A04D34B257270FBB64A531622731739A6AE321D47823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564291, "uuid": "e6c55e16-dc28-4ef1-a309-f7a2aaca0d71", "value": "1536:oIaSaMZQlCJ8aq1UGbmiQm7r0NBye9Qbv4F2y2/gH+Da2jTmQ9VqXjewfNLe:lclCHqXbHTvzbv4Ay2/zxmQ9VqXywfN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564291, "uuid": "4b10585c-5cba-4e59-b157-536222e809d6", "value": 93887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564291, "uuid": "4bf28087-cb02-4918-8885-66fcfe421d33", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564291, "uuid": "1f3c41d3-3be4-4105-aa09-f1012ff30a61", "value": "ba2d304c7d7ada25056f414029394752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca94a503-1da4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632535415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535415, "uuid": "f3fc9920-fe49-4c1a-b9c4-5148caa24ed9", "comment": "Malware payload (Gafgyt)", "value": "8e6cd029f1ff8302a1c28fa9603a11c2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535415, "uuid": "9c6a0be0-758d-490a-91de-f745c08b7677", "comment": "Malware payload (Gafgyt)", "value": "587c5bb88672b2c5e78099c9b49411a75331ac6ea416203de77c3818ab9bb254", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535415, "uuid": "f6af35c9-fe6d-48e7-907b-71776fc44996", "comment": "Malware payload (Gafgyt)", "value": "254dc4b06664a2c61aa4bb454e37389e34a745d5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535415, "uuid": "a1c0d5ae-ac1a-4361-80f2-7e11e07e42e2", "comment": "Malware payload (Gafgyt)", "value": "da2b1c19d4d76cedd72802caec970bbcf12d3a9d000ea76d687e18e5e3edbf548974246c7a6554d68f9b72dd3233a953", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535415, "uuid": "3d81e7e0-d7cb-4933-8edc-3a8e6399e2b0", "value": "T1BEA3F627F243C67BC08352F42ADA9E229C2374FD1762620633F47EE43B565DA2D19E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535415, "uuid": "13d817f5-304c-48f6-a670-6972e4e35a98", "value": "3072:x3ZnZCf/Ppi52zNysPJaX+mriuOgL+ZYDe:ePpQ2YaaX+mriuOgL+ZYDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632535415, "uuid": "b5430239-bf01-4f0e-be8a-95a34750306f", "value": 98718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632535415, "uuid": "a66a2b3c-af7c-40a1-969f-8fefde6370bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535415, "uuid": "d296967e-47aa-4cd7-a3de-1770b7024f79", "value": "8e6cd029f1ff8302a1c28fa9603a11c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb691ca-1e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632613189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613189, "uuid": "fd3bf9fd-4c19-43db-aa6a-5076eba186c2", "comment": "Malware payload (RedLineStealer)", "value": "e437f1175308b1a0f1cd114c23c9b6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613189, "uuid": "6a2bdd59-5157-4253-a75c-547b382c14f8", "comment": "Malware payload (RedLineStealer)", "value": "59ea25bd3196784b7a97b1765093e126d79f70afc6b5be69e922704b532c2135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613189, "uuid": "a1d5bc1e-a436-4bfe-b20d-b0263283eb70", "comment": "Malware payload (RedLineStealer)", "value": "499d2abd36571a199bd0e6c388d37ad34ed2d476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613189, "uuid": "ac4f7dcd-aa42-4c2e-bcc9-a5f53422a722", "comment": "Malware payload (RedLineStealer)", "value": "76f24c21e3fe0fc0e036a01ae6ebf5a0f4cc452775f7f520aa82cc7b7db80253b693378c2530788a527e5f65f35602d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613189, "uuid": "e56607ee-2597-48b4-934e-0c7db90ca76e", "value": "T18144D021F6E19832D7E30A7D6935DAA1567BBC325E7781CBF25C1B4E1F3028289E5342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613189, "uuid": "02a001aa-7bfd-4762-a3ac-3ebb7d617c09", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613189, "uuid": "1760e97d-e9a5-4ff1-90bd-3cf61175e60d", "value": "6144:cBIBRVLyUUvOvvNU47RF1Gy/mKb+ahM26MwEad:vLyUx1VAyezahUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613189, "uuid": "45ff4480-4bc6-40f6-8b87-af4ebd9a006d", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613189, "uuid": "a6c9f7be-08fe-4a73-a929-6e021775497f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613189, "uuid": "7335c04a-1b20-4d88-aa65-0890c0f11e43", "value": "e437f1175308b1a0f1cd114c23c9b6e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4410795a-1e17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632584581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584581, "uuid": "8c5b7b48-b828-4a27-88bc-6da26b83fee5", "comment": "Malware payload (Gafgyt)", "value": "daca094f8280bb38af090f2a9a99e001", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584581, "uuid": "aac3a34c-68bf-416b-9dfd-7f5daa872129", "comment": "Malware payload (Gafgyt)", "value": "5abdd0ac57555d32224abc81f014d55472d6f5af91eff8582b0b0f95facfc519", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584581, "uuid": "53aa74c2-7ed7-45c6-9ec2-14b753b0e234", "comment": "Malware payload (Gafgyt)", "value": "bda5edc780799855df5b3b2c09d2c94a4008a69c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584581, "uuid": "1b190dbb-6557-4a90-b513-7d5b56bfccd6", "comment": "Malware payload (Gafgyt)", "value": "800a84daf11fb0fe3825f1f3bc8b05bf39158726ad7396948fd000d6eb163cc33865b79517c9848ba169da77d5475dce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584581, "uuid": "aa5cf8a7-e5f4-42f3-bee3-9953029200bf", "value": "T15C930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584581, "uuid": "3558057d-256b-45d7-bfaf-84321c237059", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOx7ePczYrmREqQ4b/X7XSee:OQ2HYBv1WTuePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584581, "uuid": "f6e05c32-bd8c-4438-8f4c-d8af299647de", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584581, "uuid": "aadc31de-221f-4192-83be-c3e12aeeb022", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584581, "uuid": "59ec6e0c-66ad-49f4-912d-967b3b9b9dd8", "value": "daca094f8280bb38af090f2a9a99e001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6797c029-1e58-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632612558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612558, "uuid": "63ddd494-aeec-4fab-a5ae-20039c484f0a", "comment": "Malware payload (RedLineStealer)", "value": "2f900301bdd4d05254a78fadb0a66d4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612558, "uuid": "5db65950-a472-4cb6-b886-cc2784ffd9fd", "comment": "Malware payload (RedLineStealer)", "value": "5b7748ccd360a28204c2841e21b919447e2a44eb184363a9220da89c09e44237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612558, "uuid": "95eefc27-a20d-44f4-aa19-2f283dc7b5e0", "comment": "Malware payload (RedLineStealer)", "value": "eea0830e2414c6467b62c96761b26b29265ecd13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612558, "uuid": "dc31e6ab-54cf-43e1-9da2-d39fa8eefc88", "comment": "Malware payload (RedLineStealer)", "value": "b38a581e90b7b8a66d6a722fd34693e77429185097faed20aabdcd8e2801a95ea6242589487361e29205523c37b2e1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612558, "uuid": "20dad9f5-f8dc-4742-860b-84ddd92a29a4", "value": "T1E744D01076A2C473D3E709754A75C3A9573BBC221E73850BF28DB75B5EB22824AE6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612558, "uuid": "215b4828-359f-4d8d-b6fa-be9ed56a00a2", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612558, "uuid": "e594fc3d-e762-41ba-a16e-a96d164bb016", "value": "3072:fE23g67CLYH1PmgYAd6+L1lDPBwTdwREryjnTvpclNwsw/CVd5bzk1eFpJ2S9H6t:fFg6uCPEOlDPmwREryXpNKtzkoJ2Ead", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632612558, "uuid": "a39f97a3-3980-4ca5-9612-09a876ed4d48", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632612558, "uuid": "1963240a-210e-427e-b031-9b8aa19e8158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612558, "uuid": "b6c3f72e-6598-4f40-8ce6-d2714588b9c1", "value": "2f900301bdd4d05254a78fadb0a66d4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ed77ac-1e23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632589998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589998, "uuid": "073d502a-dfdb-431a-af22-b780f1cddfb6", "comment": "Malware payload (RedLineStealer)", "value": "f87a5f1cf305071d780fba40e2b146a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589998, "uuid": "5b9c9457-369f-4e1d-ad89-08c608fc3fba", "comment": "Malware payload (RedLineStealer)", "value": "5bed06a09ea57592592927a8c57153877a04ad1134a0d7e8f4250b3fa69c5626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589998, "uuid": "fb882e6f-4a43-4720-96a8-01db43da7aae", "comment": "Malware payload (RedLineStealer)", "value": "ffb4f97eec8da49d407089a38a02bc693fae28e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589998, "uuid": "38f8962e-3187-47a7-9800-2fdbb83eb7d6", "comment": "Malware payload (RedLineStealer)", "value": "cb6e5aada16a91d1411c9f6dfa6af56c1b6b618b0907f1a83faf51207a27b0d0b77198c3bc60b3778963bbb792b3980a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589998, "uuid": "a82ca404-f7fa-4f38-8567-9a35ca407fd1", "value": "T10934E12066B2C432E2F7143479B88FE1993FB9722672864B7759572F5E332C19E26307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589998, "uuid": "f1c30d6f-e387-45e3-9f34-3721727c12d7", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589998, "uuid": "7bbb7f50-7dee-4c82-ba35-878a978e6a4f", "value": "3072:dOYP5A8IgG/D8DpHhCpvhlOePxPc0H3DUODC1UdxjWXaU5ZUSC6SYQ:dOp8bG/D8Dq9hAYESHCiT6XGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632589998, "uuid": "93d642b3-900e-4c97-92d8-ecd58f8808e9", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632589998, "uuid": "23e85edf-4620-4a48-818c-9728b500f4eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589998, "uuid": "5c06307e-0f7c-4f10-a544-fe5dbdc03a5f", "value": "f87a5f1cf305071d780fba40e2b146a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6db6bf-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563280, "uuid": "1f068d97-787d-4c43-b9cb-7bd252baee57", "comment": "Malware payload (RedLineStealer)", "value": "9639f4d2d804139b3e3a623e67e6e181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563280, "uuid": "10c60c8c-5b19-4e3f-a442-7b468dbfa1ba", "comment": "Malware payload (RedLineStealer)", "value": "5c0f127c7b5e81d79e32c43030436a7be0c8b2b5cacd0ae1ed9ce8eace97a5d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563280, "uuid": "7bcbb13c-7dee-45ba-99cd-1d6b43a05c18", "comment": "Malware payload (RedLineStealer)", "value": "b3ae0aab0f1df417be3cf80943ab9f70ca7238b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563280, "uuid": "3d8a6c7d-39f3-436c-9f40-3be73e636614", "comment": "Malware payload (RedLineStealer)", "value": "10436d6ae28d774b4659f6f422bea8e6534fab00915ea81f8209361a19f16ddea3fbda46f1df5d32d708401c042f62e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563280, "uuid": "a5f86925-b2df-45e7-8649-d57a71f1b3d2", "value": "T12984AE20BAE0C034F5F702F94AB9A3B8A93E7A715B3491CB62D517EA56342E4DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563280, "uuid": "16532d7f-37b9-4745-acf4-00323cb450e4", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563280, "uuid": "b93a80b6-2322-4a56-bdee-58c3aa09c7b2", "value": "6144:MoaBnL2OfIpa5KaMjF/VOLdFzvIOW0yNCA0wpcxmF4C9SNHyosIrag:KnL2OfIQ5yjGLdtIQdA0+qm0vsKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563280, "uuid": "15d5b488-551b-42df-8e5c-cf08c7858870", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563280, "uuid": "8a1c752a-5322-44f5-9a8a-bb36d0ff51b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563280, "uuid": "59016e27-8305-4dd2-9a56-b01587797bb7", "value": "9639f4d2d804139b3e3a623e67e6e181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e265563-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559660, "uuid": "f26bcf50-8ca2-49b8-a824-8331341311e5", "comment": "Malware payload (RedLineStealer)", "value": "87c41fc594c073a3a1f55a71845dad66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559660, "uuid": "5edca1bb-f0cd-4918-8b47-0327a79a0480", "comment": "Malware payload (RedLineStealer)", "value": "5cffc39cd5dcd571e6e0085fe9f5310742071cfcf0ba2f797651a47784721c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559660, "uuid": "a0cbd455-73b7-4013-9f79-d079279d2816", "comment": "Malware payload (RedLineStealer)", "value": "7d7c1009dc474866761660e34279960ed0042c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559660, "uuid": "9352be3d-8134-4a7b-b1dd-032fdd91ec4f", "comment": "Malware payload (RedLineStealer)", "value": "69e14e34649a769a76b07256839b1e82f9c8d609c2121859b4e80e8161af2fe536fcd8bc0de14928b262f55cd47d2be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559660, "uuid": "fbd4d37f-5732-4ba5-8553-ae355a47c5a0", "value": "T19674BF10B7E0C034F5B712FA49B983B8A92EBDB06B28D1CB67D519EA56746D0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559660, "uuid": "038baf61-d0a6-496c-8f59-cb0fcfe2b425", "value": "3791a43698849237226e5f1b2f617635", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559660, "uuid": "ca5ac668-1c1a-420b-80da-5f9296f18b04", "value": "6144:9tymbQLeEbRAzlNfRfctRSYjKUvlIcZFO2HWV:9tymbQLeEbENeSjUvl3fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559660, "uuid": "2d03f40e-e503-4367-aee6-d7d1bcb2355a", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559660, "uuid": "3d66546e-7208-431e-9c74-1353d33d868c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559660, "uuid": "16e98fd5-c98a-45be-a1cf-65c17bdbf84f", "value": "87c41fc594c073a3a1f55a71845dad66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85bf29-1e3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632600354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600354, "uuid": "86d28382-cf3f-46c2-9214-192be6e551aa", "comment": "Malware payload (RaccoonStealer)", "value": "aedde0143d0155d9776db4c26a697523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600354, "uuid": "764f58ba-3c63-4905-8d26-97e1e5cd94e6", "comment": "Malware payload (RaccoonStealer)", "value": "5d9c2b10d1a9afe00fac8a8d1320711943f73fa6652a830c730cf659a46f044b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600354, "uuid": "ce0fae8f-a228-475f-bc26-be0677c61107", "comment": "Malware payload (RaccoonStealer)", "value": "a74c8a9a8a75f2a9c2d9fdea1d27774a8d28c9f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600354, "uuid": "710a13e2-b0f9-491a-b141-dbd7998d8e3b", "comment": "Malware payload (RaccoonStealer)", "value": "1b8168f5fd3e2c7e34cf1c9f748da8803ef642bea20c3415c4a4b3f0d55ab2c466d90a0a922af2839f8e5dd018e4fe74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600354, "uuid": "42b72f9d-e14a-4122-bd39-9641ce59aa65", "value": "T10D940118F6F18072E3E696B45CB0D6B46A373CA93D74CDCA76505B5A0E323E24D613A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600354, "uuid": "cf41fce3-4c89-4179-8329-7efaa705e12c", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600354, "uuid": "e72c5b0c-2d16-4643-ada8-884055000699", "value": "6144:uo94VA142aeaO8p2IXffwsleFhNH+L//Kr5/Y/D+NnuzMfxKm7:uo9eA1Cni0fZlet+zKd/5nmMpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632600354, "uuid": "1bca51c0-9e24-4dda-a990-91377cb42b9f", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632600354, "uuid": "0d85db60-3677-486d-956e-b9cc72a9c7d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600354, "uuid": "d1589ea9-164a-47f2-a500-d4df78703330", "value": "aedde0143d0155d9776db4c26a697523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3114f693-1dd8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557491, "uuid": "6ade6ad9-5261-4e47-8364-f1a044c82653", "comment": "Malware payload (RedLineStealer)", "value": "132735d9dc97909c8b1dd1548bf8bfd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557491, "uuid": "572916bc-f385-4764-a7b1-cb967bc97273", "comment": "Malware payload (RedLineStealer)", "value": "5da1d5357f2cf53877151510c376adef77bb2a280a98b16a25fdba4e0506917d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557491, "uuid": "c802ba82-7781-4ee3-8d26-80472da92535", "comment": "Malware payload (RedLineStealer)", "value": "dc8cea12c72310db54b85719b9d27b885f0dc434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557491, "uuid": "22203da7-39ab-4e62-9236-525d6ac74379", "comment": "Malware payload (RedLineStealer)", "value": "368e7b4b251f27bdfe26cb25e14e69dc30b9a2e1771d59b15d19b0058ce3c0236d1c27a86e7b2df1b5aedb1ab30f851d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557491, "uuid": "20c26fb4-27b1-428d-9ce5-380babf8e367", "value": "T14F84C02077E0C038F5B703F64A7987B9AA3D7DB06B2881CB62D516EA56746E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557491, "uuid": "5f16732d-63c9-4681-8bb9-4fc4f28a4e36", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557491, "uuid": "24edca16-43c6-48ac-aa51-25d9c5cc1f1b", "value": "6144:0UTh9cNjfCl7bc/TTSxcwl6PBJtruLqnslB3WHA9ROZdGNpV9kJs:0UThMjfClE/1ZJdu4qROZMNpXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557491, "uuid": "5dd7a203-50f7-43b5-8739-ddaae5822ff4", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557491, "uuid": "0ff4a628-44f0-4de6-a150-384129012ea2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557491, "uuid": "6aae0b3f-1061-4569-b4aa-0a1acc667f2b", "value": "132735d9dc97909c8b1dd1548bf8bfd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c566ae4-1e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632604835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604835, "uuid": "f856107b-2500-410a-ab81-533a82e04d8e", "comment": "Malware payload (RaccoonStealer)", "value": "16dfcc1a6fe5886964156777a09da514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604835, "uuid": "e8aba592-127c-4b6d-aff1-7835397b4efc", "comment": "Malware payload (RaccoonStealer)", "value": "5ed39b2c2b58db059b65bd11c6783a1c65b9836143f2c4dfbde502ff685598db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604835, "uuid": "1d39a1ad-3a00-4c99-8c77-9fbe94dc9a12", "comment": "Malware payload (RaccoonStealer)", "value": "7b44e67532bec5477c7fef3470c14128fd161338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632604835, "uuid": "3fbddf45-b455-43c6-b4c1-9b080b5226ca", "comment": "Malware payload (RaccoonStealer)", "value": "189dfb0a4a969381f3161af4cb706dddcd7441db0fe49f182de40fe9b30b20b54c30e2bb23467a185a4aed3b47296c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604835, "uuid": "7dd62c6d-5766-4865-990d-e1342c8dc665", "value": "T1ACC38D21F2E0C432E7F789714835D6A04A3FB8722A74854B369F379E1E316C18A76367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604835, "uuid": "bbffd7d9-8bd5-49ea-993a-25d26e5c771c", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604835, "uuid": "80e9bc03-a3ac-46ae-8dbc-7c53951bf40c", "value": "1536:m9JkGm3ngaPY1V9sxLYPKZ9OdTLbOD5cvcdsENV1AcEI7a5Y4dC8:SJnm3OOYiZ9KfbOD5c/ElEI4Y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632604835, "uuid": "a410e1a7-5ee9-4b4c-8fb7-e36a8dca1844", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632604835, "uuid": "5f89bdb0-3d5a-45c4-bc49-b49728a46340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632604835, "uuid": "a8a329c6-a80b-4b50-b8c4-81a3bc4753be", "value": "16dfcc1a6fe5886964156777a09da514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d2acda-1df0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632567936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567936, "uuid": "d707e967-c43d-40ef-9c4e-992d20c5ecbc", "comment": "Malware payload (RaccoonStealer)", "value": "d0a02f12b667bb6d3755d7b65a56994a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567936, "uuid": "5d49862d-b40c-49b4-8d1b-f9a7dc5822a9", "comment": "Malware payload (RaccoonStealer)", "value": "5f15172014d5b28a6ef018dff8e184f8ccf6820720fac2c49114451255d89530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567936, "uuid": "200b413e-b85f-4ba1-a135-2974490b3fad", "comment": "Malware payload (RaccoonStealer)", "value": "bfd2445704cd4ddce886150c286c9a85a89ce718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567936, "uuid": "008a0309-c4d3-4f4f-b261-3b75764a34be", "comment": "Malware payload (RaccoonStealer)", "value": "4dffc1d16bda424bca586b228415b51bd8cc36ce6ffee699f68e1a20c684beddba3c1c9158293ceab452d897f494c7b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567936, "uuid": "d049d7a0-3260-4200-b886-58e9d6e93b5c", "value": "T152941225BDF3C033F2B76A300575E2E5693FBD626C34429EEA471B5A5E213D18A66303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567936, "uuid": "4a86d165-3402-47ca-aa54-8ac5e87d4c02", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567936, "uuid": "5ed4dfd9-90f7-46df-ba64-b9d00b165025", "value": "12288:io9bblO2Mg3I6pqaE+2v+wpGFJYkOE2vKoLyJ4wCt9:imbPjYGEuRECkyJZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632567936, "uuid": "96de563f-7957-4c91-9d7c-3f5877926c22", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632567936, "uuid": "6b8dfd08-1c34-4927-b448-316346236503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567936, "uuid": "447e53f4-38fd-4aa9-bb1d-2e3a8a069ac5", "value": "d0a02f12b667bb6d3755d7b65a56994a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bb8e56-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632552835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552835, "uuid": "44f60d6f-8dfd-404e-b33e-4d0249a61ed5", "comment": "Malware payload (DanaBot)", "value": "2e2d609a565abcde67ae2e4af22bb653", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552835, "uuid": "9dae37b6-792b-464e-94a8-68d3b7012e3b", "comment": "Malware payload (DanaBot)", "value": "5f377b98e0249019768632cbb967d9a4a678059ff13b9420d207c4ce2aa3e497", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552835, "uuid": "16883cf6-2f83-4130-ad64-1dbb02a1bd13", "comment": "Malware payload (DanaBot)", "value": "7b03b9aadc5e045ed2e2e8bc6d4a9fa9655cac04", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552835, "uuid": "994b78bf-1df5-4c2c-9c0f-c501cad469e9", "comment": "Malware payload (DanaBot)", "value": "8f64e55da34dea0d38237b62f2e44d811879aa3850519120c71c226fc65ae2d1cde6d94f56e564e6d97d2c7c285c8c59", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552835, "uuid": "fa194d82-691b-4592-92bb-54309ef2216d", "value": "T1A216338174F6EAE5C1AB21B0DD7AC11B4A1EFEF279A0172A0057F7CFB8844D6211994F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552835, "uuid": "62f56876-189b-41c7-a7bf-74df3528abbe", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552835, "uuid": "b906842b-99ce-44e7-8c1a-b28ead5bf81c", "value": "98304:KBZoNNogYHul6EYM/lDfoJeqvYyGkTSj5jEJMVJLX/pNq4NoIn:KBqNNog7ZFfoJe8PTejQuJLXxNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552835, "uuid": "652d2405-c228-40bf-ad21-6e3022ff102a", "value": 4400082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552835, "uuid": "544a7ba4-bc59-4953-b615-cd5d6c7f61cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552835, "uuid": "2611dd6b-972a-4f47-9132-c5a4adbdec06", "value": "2e2d609a565abcde67ae2e4af22bb653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bef518-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632605735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605735, "uuid": "a365670f-0140-495a-bfd5-24c9489b8223", "comment": "Malware payload", "value": "10632e6b4b53e172d642598df99d4270", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605735, "uuid": "804e69fc-47f1-4555-80e7-e532732ef8fb", "comment": "Malware payload", "value": "5f4d40d3ad5fdc4b90a5096fa2408ecc9c44a48af66ca3e8a899b0c9c05ba36a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605735, "uuid": "e533dd51-c481-481e-a682-543780456732", "comment": "Malware payload", "value": "d75006e2f6f67a712cf243da06e613d46b5485a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605735, "uuid": "f72d646c-df27-44ba-997a-375e5cfa0790", "comment": "Malware payload", "value": "37aae6a267a093db982199f053f544b108f35bad3b292fec22e7ed8973ad6910dbbb63ddb3b37c4c90a95187af2fdf1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605735, "uuid": "561b5bdf-3830-44d5-b35c-405172f1ad48", "value": "T1B4A33902E5518B13C0C3177ABB9F865937236BE8979B331266247FF42BC279E0E39915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605735, "uuid": "479911b7-5a46-43b3-88d8-725b9735a39d", "value": "3072:0ZCM485Gyu8a2rweLhShdpW0h0mOQfSlp3iA:0ZCM4Z8aGLhS/d0mOQfSj3iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605735, "uuid": "0d7ffd95-4cbf-489e-87e7-33ddad17bbf5", "value": 101065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605735, "uuid": "b8bbcbf4-d40a-4fb1-9ad3-95d57ff10630", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605735, "uuid": "a36964d4-e252-44b0-a615-3fed663936f8", "value": "10632e6b4b53e172d642598df99d4270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e6fe61-1e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632582871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582871, "uuid": "8fa56c8d-3ec0-4c5a-97c8-92876f31abcd", "comment": "Malware payload (RedLineStealer)", "value": "5acface314511e920f4b40a903054d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582871, "uuid": "151102b1-e25e-4353-8370-02ba9521b855", "comment": "Malware payload (RedLineStealer)", "value": "5f6faf0507fca9db0b364b6d4718b24eb3880054ecace3207de384e8037852b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582871, "uuid": "3d643453-0203-4fa1-9de7-c9ba0258e4d3", "comment": "Malware payload (RedLineStealer)", "value": "eba980b344129cd8347d54a68c267d2f817dd17c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582871, "uuid": "159e8d42-7148-4ec5-a158-c81b5e6135ee", "comment": "Malware payload (RedLineStealer)", "value": "22d5441e46d6a78cbfc57a80d69857ec550464ee3ffa73b04e92a8f26548938da710785c25e42b39ae19034162bf62a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582871, "uuid": "8560323d-ee77-4e29-ba75-83abf22404df", "value": "T15AC5D411B8A3C06BD46AC5B1CC2EEEFD4538BE51CE2C059732D6BF2F3B3028159A6955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582871, "uuid": "3f0accdf-5743-4872-aa9c-909843ca941e", "value": "d343580213f3aad4dfa075b33c6ed3fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582871, "uuid": "2bbea3f0-8cba-4629-9b29-e9380212858b", "value": "3072:jFjKpRgi5HW9JnBXvQcorrbWR9hcktkGifh4fhN:j5KpR3AJntorOFmfOhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632582871, "uuid": "37f6b9c6-981f-4e5e-a527-def7c939bc5c", "value": 2637312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632582871, "uuid": "fcc38102-c8fd-4f04-b80c-dd7badded819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582871, "uuid": "ef8e5b7d-4215-441e-9c62-6b8b92cd60f3", "value": "5acface314511e920f4b40a903054d72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b192e551-1e03-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632576175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576175, "uuid": "43e32a18-8132-4ae6-ba00-4f687de5fad7", "comment": "Malware payload", "value": "c9313fdabe53be2733a71d8e9d3a7929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576175, "uuid": "657f5694-bdbd-4330-9e8f-3054d0d2910a", "comment": "Malware payload", "value": "5fe5029a3ef82c8aa7fd19f4ed8d00e8a4015b3d4c1026dec92fe5413ef7e1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576175, "uuid": "6119f909-444c-473f-b890-ffd53e59977b", "comment": "Malware payload", "value": "80e81ca2d084a881766bbfccf33fec20fb2af575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576175, "uuid": "46d7fcbb-b343-404f-8645-13f1fb059a03", "comment": "Malware payload", "value": "59de306aab1801b13d55a49b33e540ce09c501b7443958aefaf4c832fb2b074d5bcc94ec8e5599f30c9b6b214d06d896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576175, "uuid": "d3134bb5-6d2d-42da-88c0-3a50597824f7", "value": "T12664BE2077A0C035F5F712F859B993A8A83D7AB1AB3441CF62E616ED26346E4DC31793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576175, "uuid": "a6a0b18a-a3a8-44a6-a242-d85966cfb7cb", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576175, "uuid": "0f9e128d-2898-466c-a21a-5caaf73ebc80", "value": "6144:3yZQKA87eepTU12F8EqnTTPtG/xWJUuCT/rtRSLxPc8:iZt7eeBUrEqT50xflGtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632576175, "uuid": "1d8bcfa1-4526-4ad7-90b3-81595093ff3d", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632576175, "uuid": "40867f1f-a95e-463d-a1e8-eb54bf854e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576175, "uuid": "753fa6c7-64b5-4ab3-9739-9e62ec208871", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc2bd87-1e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632613105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613105, "uuid": "670856f2-9b18-44ad-bec4-01299139e3f7", "comment": "Malware payload (RedLineStealer)", "value": "8f7ce8a7afcaddcd46e8aaf1831d305f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613105, "uuid": "8d92d00e-7ed4-4e9f-8800-027bfaa130ac", "comment": "Malware payload (RedLineStealer)", "value": "5ff8f533715ec3ad8f939927fdbc2912678092e4204777f9a14f3d2ff633341e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613105, "uuid": "ddbc5deb-945a-49da-87a8-ada6e22bcd0c", "comment": "Malware payload (RedLineStealer)", "value": "57d9a72f682178f1b9e91194acbac11672312451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613105, "uuid": "7398acef-bb9b-4974-8ba9-d8ee6815615c", "comment": "Malware payload (RedLineStealer)", "value": "7390b306c7d1b158d45c24e0f2a54ca82dc3865fe4cd198aa2592da678cec25bccb6f255a0cb9456393a69eb7b4b0acd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613105, "uuid": "37d8cfe5-b56f-40d2-83b6-f57938c66c7a", "value": "T10544E030B2E2E432E3A35A7059748691553BBD321EB3825BF74D2B6E2E327D256D1313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613105, "uuid": "448c0e4f-935d-44d6-b525-556d6c89762e", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613105, "uuid": "4654af9d-2c46-4342-8a26-6040b2a534fc", "value": "3072:VJMNwpa8PRN87dqOLzRikEx0IdaRK02t1obTxTVSsRhXa2gi+Dz4jsgD5S2KD8S3:V9LDZkESLXTdRhXa24ssHn8Ead", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613105, "uuid": "97c00b6d-f208-404b-802b-fa74e1c11e11", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613105, "uuid": "0a3b3f35-01cf-4612-9029-67214e4f4c02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613105, "uuid": "b00930f2-3a66-454f-acac-95fe01b5db57", "value": "8f7ce8a7afcaddcd46e8aaf1831d305f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758328a2-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632605709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605709, "uuid": "b8bf82b9-3020-417b-9bd3-40dc53545ad1", "comment": "Malware payload (Gafgyt)", "value": "cb70318a748349962f905ae8974c2a84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605709, "uuid": "22232b75-dfbc-46f7-aba5-bef44ff80257", "comment": "Malware payload (Gafgyt)", "value": "603eb127ad94c0df23c9bbdee209df561417cea26f0fe139c5ad113e53e3ac0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605709, "uuid": "14021071-1083-44ef-8452-876f90b3619e", "comment": "Malware payload (Gafgyt)", "value": "b8e86c89a1a0effdde64204bbae35c6240604972", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605709, "uuid": "10382af3-db6c-4bee-85a0-511382fb13df", "comment": "Malware payload (Gafgyt)", "value": "8557e03740176374a1c6a8a8dd436c593fe7e6eaafc8582e2771365f9f83a2382224267afcda4139a11003d8c49725ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605709, "uuid": "1b4ebdb8-7624-4a9a-ada4-b8e3db20a8f1", "value": "T1F5530902EA42CBB3D4831BB9069B5E151A31F99A1F2B9F56B32C7DF49B020C87117B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605709, "uuid": "2252fe68-7167-49de-8294-a968e77cbe0d", "value": "1536:/pXN8zDMr0IeoXc+W6uPPWOJmxIXV9MjwFEQdR:9N8zDMQIeFHXn9mKXV9M0FEQdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605709, "uuid": "2e7dd9aa-53fb-4158-a1e3-e8aaac86d52c", "value": 64072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605709, "uuid": "1f37c410-4d3a-4a41-9cc2-3d29c20c6ec0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605709, "uuid": "7dafb3fa-1264-433f-81ea-6a4836115854", "value": "cb70318a748349962f905ae8974c2a84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9294c2-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562669, "uuid": "4b68c158-3666-499f-9ef7-3ca8f3ad48be", "comment": "Malware payload (RedLineStealer)", "value": "459dffe42938bb2ca4620b299c447ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562669, "uuid": "2e4f4200-bd49-4c08-8964-86f9ee2315a1", "comment": "Malware payload (RedLineStealer)", "value": "60595b6c6de942a30a61cb02b27b2dfec3cb76ee4751a68b8d92feefda02f78e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562669, "uuid": "f83c87ed-ab75-49d0-8edb-df3d048b6210", "comment": "Malware payload (RedLineStealer)", "value": "80e9b2d1c4e708cc2761d46badb995624c474669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562669, "uuid": "6a3ad8a2-d8dc-41fe-82d1-fe034a94d62f", "comment": "Malware payload (RedLineStealer)", "value": "66595e5954bd0b37ad321db03aa7a848bc43ec447c8e3e03bb9536c1c0cfd382e5dff95aeadab62b2d62374105bbef51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562669, "uuid": "a90add02-6298-4029-9207-598c8d9b09ed", "value": "T19B74CF20B6A0C032F5BB16F819B98368A93D7AB16B3480CB52D656FE67307E4DD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562669, "uuid": "0dcb1561-0375-4021-9f51-c34bca0f3623", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562669, "uuid": "29c7c006-2120-4f80-bfd6-ddae36548302", "value": "6144:GUZQu/nfFjxMr7qw7gAAK+iibqNMpNSmHgpxfZzuT/w6IN9esu:JZNfFjxMrWVAAHXbaH6INIsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562669, "uuid": "d04408ce-965a-4c1f-83d2-fba44caf10ff", "value": 340136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562669, "uuid": "a60f0038-4f51-4f77-b8b6-b68b9810b1b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562669, "uuid": "b78554b2-d755-4323-ac6b-3d43e4dd9607", "value": "459dffe42938bb2ca4620b299c447ab4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759c6851-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632605710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605710, "uuid": "cf547a72-4485-44c4-be3e-2bbbf3be414c", "comment": "Malware payload (Gafgyt)", "value": "90a8a33dc1a88e1ecf352bcc180f4896", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605710, "uuid": "4e7873a9-5475-495d-bfc8-e4be709bf4fd", "comment": "Malware payload (Gafgyt)", "value": "60b2c3cdadba289e3b9b26e7e6ebf9f6e9afc958bfed792cfbe16f597ffa31a4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605710, "uuid": "9c4dc9a6-00b4-453a-9549-6205ad6f0c86", "comment": "Malware payload (Gafgyt)", "value": "b5e06bd0574565f67ef9878bd8b4217e19163ba6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605710, "uuid": "c4112f31-874d-43ef-b5ba-432d924cfc81", "comment": "Malware payload (Gafgyt)", "value": "496c273f2fed6e8716e766d6b01a444ded9f812dfc755c056b5506ab8faf13dafd6ff5851944face368a871df4779455", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605710, "uuid": "500086c0-5b7d-4333-b756-01ce6e321d99", "value": "T142733B23B582CA7FC4A743B51BDBDA350823B8B51B23621973F8BDE92F469C91D19704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605710, "uuid": "bd279a47-ad77-4582-8b67-304fb6f37bdd", "value": "1536:k3dKLScP5g5eJpAXHEs38+05ToXCOifV8mwIDW9pjQTOaTn:EcP544AXHEYV06XHJmzDW9pkTOaTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605710, "uuid": "5bba191a-78b6-46ec-96e5-65cff890cf9a", "value": 74903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605710, "uuid": "0d82e992-8087-449b-abcb-47f4571c56e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605710, "uuid": "ffa7d081-0e75-4807-bb9f-697d08951eb6", "value": "90a8a33dc1a88e1ecf352bcc180f4896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fda846e-1de6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563448, "uuid": "3335f874-dcd1-4277-afa9-39e583ceda6f", "comment": "Malware payload (RedLineStealer)", "value": "8cd6a0f9c54968b2003415a62a6ce8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563448, "uuid": "4d40d20d-9201-466d-9c6d-11d3143497d6", "comment": "Malware payload (RedLineStealer)", "value": "61167f2be099b7bf668e25a470119adfa0c409c2e5c059ad1a016c14dd168f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563448, "uuid": "5660e028-deec-4229-b7f4-594304c1f5f0", "comment": "Malware payload (RedLineStealer)", "value": "ea5bacbba4ebceacf4f7c547fc840d03fb8654f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563448, "uuid": "c7b96c51-46dd-4ee8-9629-b5820cfebb64", "comment": "Malware payload (RedLineStealer)", "value": "bddfbce7bf55b2deeed31d1e6618f25ec38673c9b85b12bcd7f2e3eee056358f3ebd543bc356d1762c70eee083b79538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563448, "uuid": "48fbf5a1-8bf7-426a-9e7a-27f41b33b4fc", "value": "T17924BE113EBCD872D4950A30486ACBE4EA7FFD617A20114B37983B6FEE703912276359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563448, "uuid": "62d97f3e-9a45-4713-b9b2-eba93be43420", "value": "4b405a935ba1896da801696a6c1a4ade", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563448, "uuid": "39547001-a9ce-467f-9ffb-d10c95eccead", "value": "3072:VnV2TpS2xfwfsxiYS52wRTsScsYh6gSVywo3c+:WT/pwfAiT7knGyHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563448, "uuid": "a7900051-80fa-4016-b180-ed296aca1339", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563448, "uuid": "3f882077-effe-4746-a739-3feaee4ac1d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563448, "uuid": "d3ac6473-c21e-45ca-acce-ff69e1a916e1", "value": "61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3371bff4-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561790, "uuid": "d85c64db-b093-4f75-9923-40fd65c49b98", "comment": "Malware payload (RedLineStealer)", "value": "813f3797469656b3bf44abc0e979677d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561790, "uuid": "fb1f1063-9b81-4d5f-9a82-9d68061ebf7b", "comment": "Malware payload (RedLineStealer)", "value": "6156888192510a62cc139a1095349e42ad34adc2f62c69c5dd9642ad51ecfcd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561790, "uuid": "a59ba57c-7c59-4185-8dc4-8ab0b9a9b537", "comment": "Malware payload (RedLineStealer)", "value": "d0d0d92f1eb2f1531b7d288a051dc2f6cc207ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561790, "uuid": "a6bc78b1-4e57-4b5d-902e-cc26096fec99", "comment": "Malware payload (RedLineStealer)", "value": "8b5f325648fafb18bb8c13102319bc6e5d77c7192297098777dab84c9a52b0c6a765543b0b14ab6fed4587f1c920d7e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561790, "uuid": "469fdd85-b01d-4aad-9a7f-3829dc61fba8", "value": "T1EDC412513CD1D173C6B36A719974D2947A3EF4735DB8908F2BA4163A6F102E28E3A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561790, "uuid": "012a14ed-6ae7-43e2-90a3-1afaa02ba8ff", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561790, "uuid": "b1dce1c8-8b3c-4403-835c-2f34fe3674a6", "value": "6144:EtDjlfv9pgOYf6yv50cY/l9ktdAI3Uzw/DfmD9dTSUAammkT/nrYc6Y0kxe03YEC:E2flRwlG7AuhTSbSUJmjyR031TWfPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561790, "uuid": "ea1cbd0c-ec67-42e0-ac0c-81127e87e93e", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561790, "uuid": "2f89c56e-af78-43ca-865a-f7dbd7e9e5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561790, "uuid": "69b94d0e-8740-4711-83d3-66db5a980a3a", "value": "6156888192510a62cc139a1095349e42ad34adc2f62c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61096eb-1dda-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632558680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558680, "uuid": "4c845dba-43ab-4281-ae53-b51b152c6a78", "comment": "Malware payload", "value": "27bbe943a597c2cad1344386a5f142e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558680, "uuid": "3d4ae74a-256a-45dc-8b3f-f41efecf5210", "comment": "Malware payload", "value": "619701c24d6e3258ac8b6799c444436d3873faff9230b20d0ca2c382cb8c7f25", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558680, "uuid": "7d93896d-6122-4618-a8a3-b60466d876c3", "comment": "Malware payload", "value": "792e7d177311e7ae108a8a53ac1ab8271c7ff8e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558680, "uuid": "943ebbd5-c022-45c9-944c-2f75b638b7e9", "comment": "Malware payload", "value": "66bb3afacc7fc1e683bec8344870a80af230751020a313a86de1b45c81336e6f5f0d7fa7aa69a732eeea835372392757", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558680, "uuid": "1fe3e14f-3464-499c-a04e-389d7a0c34f5", "value": "T16BE34C76F1D08837E0772E7CCD565294683FBE613E29741E6AE41D0C4B3E68269293CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558680, "uuid": "0099aa50-f3a1-4a65-8c18-ea47be9f7747", "value": "144e231939ba849d62b8075b2b766cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558680, "uuid": "dc6ffab9-03af-490c-9fc6-32d2ef190b22", "value": "3072:bNdBpH2L2vQVkzbi0kws/Gvdwi7nYJ/pvL7FgzmKd2APAwwaEOMUPD:BXpqVkzudpz7DK7Pae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558680, "uuid": "00c9d66c-260e-4b7e-a8ca-c0a4a8a10f80", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558680, "uuid": "95554af3-541e-4d4e-8150-642c49103a9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558680, "uuid": "68a3005f-dd46-471f-81b9-078c283a68fc", "value": "SecuriteInfo.com.Trojan.Malware.300983.susgen.21023.4556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ff53cf-1d9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532374, "uuid": "c0664b6c-e2c4-471e-9c19-3164180c9be9", "comment": "Malware payload (Mirai)", "value": "172f551660519182910a0ab427e0a0e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532374, "uuid": "4a668f23-1a86-4d97-b144-5e393b8be2ce", "comment": "Malware payload (Mirai)", "value": "623c1be2ea7a5c324425c1800954bca19d9d96d7d03725ad43d8b47de9a9c6f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532374, "uuid": "260ee96c-0763-4949-bd44-955f4dc4550d", "comment": "Malware payload (Mirai)", "value": "8b32396ed8e087f77cb7fe72bd9b3fcd2168a15d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532374, "uuid": "6cee56f6-7d00-4a42-8be6-0f69a5d902f1", "comment": "Malware payload (Mirai)", "value": "53d7d13fa715e98322f69617feefdd0b9bc3c7edbea4150e9f13f9efb30f5a1593d162899e4c8c57816f5df11ffe3ffc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532374, "uuid": "62ba470c-bbf9-423b-bf3c-34f384d00968", "value": "T16AB309B3B804EEA6F40AE67604C34B257E30BFA74E531666731739679E362D42827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532374, "uuid": "f1062e34-1856-4abd-952d-06a669598a70", "value": "3072:EsnQGXzjvFTHN/2DRyet9smm/QcuqBkcFJNZ:EmTzjvFTtKyebsmm/QcuqBkcFJNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532374, "uuid": "a79cadf3-1e63-49f1-8bf6-44c44b4299a3", "value": 116204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532374, "uuid": "57b9dd93-fb39-4aa5-bb14-3835b8accc1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532374, "uuid": "50cfcd28-def5-40a3-a342-6a7180bda966", "value": "172f551660519182910a0ab427e0a0e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb318de-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563307, "uuid": "f8cb7841-8003-4a0b-a1a7-a613a472f924", "comment": "Malware payload (RedLineStealer)", "value": "03d98e1b4b8ea9a949ded0be147793bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563307, "uuid": "77edb34e-57f2-4e40-ba74-655426d7a562", "comment": "Malware payload (RedLineStealer)", "value": "62ca6e54fa1a2d0dc255f288afacfa7d6b42500d60f23cb957e0297e5928ca42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563307, "uuid": "e819c8b0-e17a-4a0b-8aa2-9b6d3a7369c3", "comment": "Malware payload (RedLineStealer)", "value": "08e4339a28d6cfa05061295c020814e09593163c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563307, "uuid": "68fa3d5d-7744-409f-a427-79f2cb8d8949", "comment": "Malware payload (RedLineStealer)", "value": "db08e7b19204e604f74b2b98b9348ad7cc00eb0dddb919ca119a09303268ff4f0a0c03e2acdae40b42c19f9bd399c234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563307, "uuid": "a85d9aaa-afb5-421f-a826-69d531a3d31a", "value": "T1C674C020B6E0C034E5B355F949BA93A9AB3D7D71AB3491CF61D526EE26342E4DC30B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563307, "uuid": "4c812a67-c2ba-484c-bed6-d9d6040e5a28", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563307, "uuid": "723242cf-6fed-49c1-8268-befff92a79b9", "value": "6144:Uxeqeqy2yK5YLbeFgCRXNe7ZShU4AkGjF/356br8edUZhMc:HOy2yK5YLIvRdetShTAtiIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563307, "uuid": "f6ac1e43-b4eb-47fc-a591-48e95d0db6f3", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563307, "uuid": "8fa7c20d-8b7c-440e-b493-b1cbe8e891b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563307, "uuid": "bfeb60b9-97c3-4ea5-ae0c-e87a202f2bcc", "value": "03d98e1b4b8ea9a949ded0be147793bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12972c48-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601249, "uuid": "fb8a0fcf-d1e2-479e-9f4a-77f20cfb1443", "comment": "Malware payload", "value": "e2f97a7e3611d9ce763f1c5c2f097ec8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601249, "uuid": "7193430c-771d-44b5-ac4f-0d890f20a8e0", "comment": "Malware payload", "value": "62d1c61f26968cf5778c56267519b78d05e9a2cad40d3a7f8699fb4f2f09a50e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601249, "uuid": "e38f3e91-5079-4924-9b50-4cefb1e00122", "comment": "Malware payload", "value": "76b94878f84cb201700949e0e12563d9d7f8038c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601249, "uuid": "1556bdd3-a941-4c2b-97f3-5ad77a729bb9", "comment": "Malware payload", "value": "a36b82e1748c61b37bf0e83eadbc9d235aec2aefbe09c64a554a587df51107f8c5b89b30488027108d26190e0d8c8fa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601249, "uuid": "5930240b-315f-4586-89e3-2590f302e56c", "value": "T17203D08CF0903EAEDF5CED3CA2BE0F326C586886B65E835C97010D95DB8468778D15B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601249, "uuid": "0b50181c-b7ea-4cc1-858d-3da69a650622", "value": "768:k5MObrpmLTNYi8nM89k3XqeryFAG9sWa3wPSWR0nVRAravR:kaO3ELTNsnVCaeryxVag6VRA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601249, "uuid": "99957bd5-603f-432d-a6d8-dfda8d9b6787", "value": 39316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601249, "uuid": "c89a3c2b-b41b-459f-803d-cec01a27d663", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601249, "uuid": "fc044aa9-b938-40e8-b3f2-98e25d0b7a75", "value": "e2f97a7e3611d9ce763f1c5c2f097ec8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236f2217-1ddb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632558757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558757, "uuid": "c4228c69-513a-4ca3-b81a-ba1c9cc0a4ee", "comment": "Malware payload (Gafgyt)", "value": "1d7d3c27ee97297681cdfc35f3f9e0b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558757, "uuid": "3fdf0a78-5d2c-42f3-948f-7cd4c15904b4", "comment": "Malware payload (Gafgyt)", "value": "63c9c79c746127db35ec97ea4c60ac5daed39005b88f9aa8bdf5d237b465798f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558757, "uuid": "3d109169-34e1-48c4-bad0-b1fa36e33c56", "comment": "Malware payload (Gafgyt)", "value": "88e7fd7c669c054ecf2e346258fd8e310e1ab087", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558757, "uuid": "8e8fe7fe-213f-4100-9539-526147804266", "comment": "Malware payload (Gafgyt)", "value": "9feef706064219237f109489b720d1a3115fe0834cbf35d1858874819b88196031f87945781e40d727a6940e0068c50d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558757, "uuid": "829d8275-9dcd-4735-acd5-ae7685f6eee6", "value": "T14B735B45A680D6F7D14306F1069BAFA8033AFD3A1ABBEE85F3587CF48B710847925719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558757, "uuid": "8b4eb7c0-71bc-4533-b452-402be52454ec", "value": "1536:8L4IwQ7y6stOSV9zyjeYwMcp5WLfuBs1T2T/O/s1w2l09RLZ5:8Ld7x+R9zyjeYwMcmLfGSTu/v1w2u95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558757, "uuid": "d5598988-b2f2-4a1c-80e5-554a5b1b0ba6", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558757, "uuid": "97707257-03f4-4c1c-ab15-bcfdb64bd3df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558757, "uuid": "e3531444-7738-4bf0-a475-403fcacc41b6", "value": "1d7d3c27ee97297681cdfc35f3f9e0b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1527c6-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632556946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556946, "uuid": "acb53ca9-2af7-401a-9e27-154fd26d007a", "comment": "Malware payload (Squirrelwaffle)", "value": "6484d8ffd4a6de7947534571e9907b4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556946, "uuid": "bdaa7661-2e06-4c6f-a1e0-e30c0b4317ac", "comment": "Malware payload (Squirrelwaffle)", "value": "64a6039b2b3a347312f56170b5eb7deebe6d37ef6fb414fb929e84be4799dfa5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556946, "uuid": "3132d5c6-c0ec-48a4-a879-725ab5d166a1", "comment": "Malware payload (Squirrelwaffle)", "value": "41e1cbd037698c3329db4edfe4e6b28b0654e94c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556946, "uuid": "58e17e97-0be9-445b-b11b-92525fe763bf", "comment": "Malware payload (Squirrelwaffle)", "value": "c8cd382ab1c88564e47b316615c4dbfab6a3a9e96034c0bcbf8ab71b483913cbf7ea342d5098b7936d80d38ebaef7bcc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556946, "uuid": "341e24f9-675e-4b6c-a0d7-9a0de0feb8b0", "value": "T10864F6A5BD4D8C33FDD8363152836E1C691A3BD3B16C328F326EF6146967F44A892E50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556946, "uuid": "b3aa4e19-4d20-48c6-8e1d-41c645b4be05", "value": "6527345f9aee9363b094aad01304de88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556946, "uuid": "c7a7586b-40db-4266-89e7-dde087ee210a", "value": "6144:9/st+16ZWiobj+n5QZRO0Xj/Ee+aRLvccAOPyI:A+QoOaEFA7RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556946, "uuid": "3aea13aa-26a8-4ccd-9e98-ef80d49ba7b5", "value": 330189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556946, "uuid": "f2c6a30b-ef71-46e7-9875-d6fcbcd30ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556946, "uuid": "5885757f-e4ff-4566-bff6-42695e89ee08", "value": "6484d8ffd4a6de7947534571e9907b4e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c95851c-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632552947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552947, "uuid": "e67b5fb1-9183-464c-b336-a09ed57ef3c2", "comment": "Malware payload (RemcosRAT)", "value": "e4913299b50af4a70c4571bb94f0ecbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552947, "uuid": "0daa845c-c7b5-45c5-9cd5-462408ca4c8b", "comment": "Malware payload (RemcosRAT)", "value": "64ab30a7095b8e4a29d1373cba9f6c5e278312bcb81ae7899df976ade451532a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552947, "uuid": "74649c5c-98db-446b-9ee2-110550516866", "comment": "Malware payload (RemcosRAT)", "value": "e6ff3e815754d09f96803b3839d9e7bb9bd547e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552947, "uuid": "e2b8e9e3-87a6-445c-904a-80fb38e419de", "comment": "Malware payload (RemcosRAT)", "value": "6ad66b62da2331fcfdb29b4e7cfa15a05166bba63c6d660ca1cb410a94b73cc7bdadf26e9eb348eb9e41570ae01c167c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552947, "uuid": "2cbf5850-465c-47b0-8b63-a197a6f9785d", "value": "T1CAA4234076C186F7CA9A017059F2D734FBBBD7161697454BAFB00E677C092C2CB2E296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552947, "uuid": "4dc7a11f-0967-4838-83d2-3c77b751e84e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552947, "uuid": "0035be2a-358d-447c-a471-4b709e606ca9", "value": "12288:/HNFqm8/cQZFw9rtuOhfOGEjxvw/DVF3YBXLQVgnH:/HNb4cQzghfOLNYbH3YBXnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552947, "uuid": "7c58cc6a-a7d2-40d8-94d7-ecf7eaf4ed10", "value": 480777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552947, "uuid": "ed1de20f-c42f-40e6-9682-73ad0883f6ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552947, "uuid": "b7e43a8b-e77f-490e-b93b-ef045da559ce", "value": "e4913299b50af4a70c4571bb94f0ecbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e61867-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561796, "uuid": "53930138-a7e0-40fd-82d4-1f4980b3124a", "comment": "Malware payload (RedLineStealer)", "value": "7d1bdbc4dd1832947e0976c7d03d74bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561796, "uuid": "216d68d1-78a4-47c1-b529-d7bcbadfbeb2", "comment": "Malware payload (RedLineStealer)", "value": "64e32b211244d8d23437946d8bf6baed157d7d480b9a603ecc37241df64e0288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561796, "uuid": "c259e245-32d3-4361-89f0-1f3c5d441d28", "comment": "Malware payload (RedLineStealer)", "value": "d12f5526653e2e3d39c1e57cb113477bd3e917b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561796, "uuid": "c74544f4-9cfe-4b36-bf04-7c37290f1c32", "comment": "Malware payload (RedLineStealer)", "value": "4c7964b25dd50d792c8527051b07c888723e5406703cc9ebff1ea8b7a7ba3eb0fcfed897baba99f83392593e28ce53ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561796, "uuid": "5b5abe71-38e4-454f-824e-761cdd28ea93", "value": "T19AC402227DB0E172C5EF7572553092D4093BB873AE79464A279C2A7DAF313B08A31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561796, "uuid": "94a47400-bf88-40b9-8ba6-96275c76fed1", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561796, "uuid": "92985047-d182-4b93-b2dd-ee6bf82af328", "value": "12288:M59P8+OjN6aBXYH9NIbtOGlcCUwKSQFz:MT8+OxBq9Obrl8Hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561796, "uuid": "106dcb41-5fde-4b11-b7ad-6b650238a786", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561796, "uuid": "2bdb46b9-9eed-4d06-b954-5e27df443c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561796, "uuid": "ab7fe0bf-a059-417b-ac23-e7e5fa0e989b", "value": "7d1bdbc4dd1832947e0976c7d03d74bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33a1b28-1e22-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632589546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589546, "uuid": "eb196669-f4cb-4868-9328-53b9fb618a65", "comment": "Malware payload", "value": "eb5dbb3297e66e4074290a369be74144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589546, "uuid": "472050df-3d5c-4879-bf83-9fd878d26822", "comment": "Malware payload", "value": "64ed3e89fb128c7331af068406ef798501349167efda88d24b7cdde2dcd7b489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589546, "uuid": "bead639a-9442-4c7d-a475-24c06e51e9f1", "comment": "Malware payload", "value": "b796feff2a7b73b3c18dda6155aeb6ed8dfc4d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589546, "uuid": "74cddc90-fd46-41e6-8c9c-cb97358ed3b9", "comment": "Malware payload", "value": "5d3a599a228b601b332f9dde82d4ffef23268d0033bb9fe84d1990fd9d62d64f76aa6a47e482fd22c32b0ee99c7587fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589546, "uuid": "06158850-f3a1-4961-b2b6-c1a5df312d57", "value": "T18BA423A0DC51CC47C46F7EB0C25110165A9E1D6F1A8FFF9922B633BDEF08224A559CE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589546, "uuid": "9eb0f919-ec8f-4df7-b3e1-88e34681f4c0", "value": "5a793c1af998657d8cb142c6b1ce3fb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589546, "uuid": "03956ae0-9bf3-44dd-978c-99b4f3e7c11b", "value": "12288:GR7f00UEB2qyJWbmpmSJpV+l6O97XFNnxa9SsrVM5UeR6C:iU2qRVOTPaD6RP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632589546, "uuid": "107eaa42-9097-4f8a-93f9-0e51b27ac4a4", "value": 480352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632589546, "uuid": "7d30e362-4c3d-4040-ace5-b535ad13f4b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589546, "uuid": "911235da-771b-4f4b-85af-186415747f9b", "value": "eb5dbb3297e66e4074290a369be74144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a321d8-1dcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632553630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553630, "uuid": "4b593e12-0637-4018-8715-5fb76065a9fc", "comment": "Malware payload (RedLineStealer)", "value": "00c00c2c46b200dff27b45fdfa7442f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553630, "uuid": "3d64394e-3cd8-46ea-8d4c-469e1cee6624", "comment": "Malware payload (RedLineStealer)", "value": "654565b89c65e142f50bb95331ade59623700eaee14fc56dea8a09a07c5b0378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553630, "uuid": "6b20a0eb-054d-4ab2-a5d1-41a6d1ffbc4d", "comment": "Malware payload (RedLineStealer)", "value": "4ef68914072d866742afabaa4ffcc66e87fd2383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553630, "uuid": "a238c256-2b34-42f8-ac67-23d2f1058dca", "comment": "Malware payload (RedLineStealer)", "value": "8a202edba3f2dcd0acb050e41156f4da0b888fcb68857cc7bf4ad3fa1c2e163f3b686d89a81c5b8d30f97062a66fcea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553630, "uuid": "9cc980c7-0d77-4b4d-b6fe-50eab8014581", "value": "T1BB74AE10B6F0C034F6B712F949B992B4A83EBDB16B3485CB62D52AEA56747D4CC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553630, "uuid": "5a424e91-8260-4374-99fd-07059c51ebc3", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553630, "uuid": "70cc8b3f-1a85-45b4-9528-50b30e1d8373", "value": "6144:foybGo/GYbZZOv7F6tGFvWROdm856AnMz5adbl:foybGo/GYbY7YG4MxE5wbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632553630, "uuid": "c4436b99-936b-4c78-b0fb-e0671d49d463", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632553630, "uuid": "10328bc5-7f7e-4f94-9f8e-b2fc14a9f5ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553630, "uuid": "90d330db-f2d1-47b5-8b6b-ad4f896854ee", "value": "00c00c2c46b200dff27b45fdfa7442f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0055316-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632552550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552550, "uuid": "d26f7c76-0a1c-4dac-bf1f-f11d5681cba7", "comment": "Malware payload (Squirrelwaffle)", "value": "7a78cf8402e1a9484ade92d7b18310b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552550, "uuid": "ad86d47b-4c96-497c-ab48-28f8c30e9072", "comment": "Malware payload (Squirrelwaffle)", "value": "6597115cdbfcefaddf4c268c43c705077fc0d0079a65ffa972e1c096451385e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552550, "uuid": "c0c4eecb-a1d4-4d60-affa-60c745e65f43", "comment": "Malware payload (Squirrelwaffle)", "value": "bb581cde975ecf44a01b92bf97c7dca681c9591e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552550, "uuid": "3341e544-2fb3-43cd-837d-ece9ffd2afa3", "comment": "Malware payload (Squirrelwaffle)", "value": "8f7d1a8d6ab76ea9e96a287756a6ff58812f430dc6dfb9bf7b6bf789f243c9c9c84b60434196b9e846b63a60d5df96af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552550, "uuid": "e448d359-03fb-45f0-84d1-459ca10d9128", "value": "T1C7B4BF2E7ED6E261C83C1978C892C9F67178B869AD24D6833AD53F3F59F30C0186715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552550, "uuid": "e3dcf336-9a4e-4e45-aa95-899bacf5eed5", "value": "b26423d4dee498862b9d2df8c7549de2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552550, "uuid": "a176bb31-705f-40e6-9b28-e50f84f8c1d0", "value": "12288:PpXuXXZxPJ52IeRM+2hVo8Zk5TnjakaSwGWZcoA5iqs7aV:PpXEPJ8zuVLk5TnjUSWZcoA5iteV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552550, "uuid": "f23ed847-a359-47f0-a1d9-c120cbd192b5", "value": 542419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552550, "uuid": "34376329-2a68-4dc0-b3d0-1c5de28c0474", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552550, "uuid": "c46742c8-69aa-48fa-8a60-9d5055ca7032", "value": "7a78cf8402e1a9484ade92d7b18310b4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f832a0db-1dda-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632558684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558684, "uuid": "6522deb7-91a3-4cd0-a695-9fa4c1664ede", "comment": "Malware payload", "value": "5ff71d0267800cf2dbafd576e92dbb58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558684, "uuid": "b07605a5-f122-486f-8d46-eeb71150ad2f", "comment": "Malware payload", "value": "6623615786644df6ba14bc095724f1a89f0e16906a8d5c9989d1cec71722b7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558684, "uuid": "2cf88112-3531-40d5-acdf-a36414dd5e3b", "comment": "Malware payload", "value": "cfa2e2cbe8af3bddb15c5db31c7901f4014b8fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558684, "uuid": "6c77c4dc-78fa-4ea6-bd9c-e3ed45cd267d", "comment": "Malware payload", "value": "fa704c11a7c1a9342beaa0c1af9eb0f98d121e435203a80faf2a3567223ab95f275e444457cab41ab38335fdcea0cffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558684, "uuid": "7d7a5c30-2a36-469b-8b5a-ca14378fb34b", "value": "T1BC85CE115F94C466E8AAC934B5A4D9F2DBF5FC991F20B2EB5254B3500E72FC0E92C329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558684, "uuid": "d04850cf-ed7b-43a8-b441-4752508ba826", "value": "b7f4ecbf66157d7e821ae8c1962b57c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558684, "uuid": "4989b2bb-92d7-46e9-9f21-1fd0e836452d", "value": "24576:15/qMd8YLOxLYZ6hwICbghTP+Se3y8NzpvyFnYJ11c:vrd8Y6ASwISghajyuo1Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558684, "uuid": "e889989c-484f-4cbb-bdbf-6b7f650d3d4f", "value": 1820152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558684, "uuid": "1c322997-b928-462d-9730-ef818847ab0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558684, "uuid": "0af81c35-b451-4e20-9a4d-a6223ae70f90", "value": "SecuriteInfo.com.W32.AIDetect.malware2.23423.1039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e7a305-1dde-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632560189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560189, "uuid": "25791212-022b-449b-8ac0-e796a7892bcc", "comment": "Malware payload (RedLineStealer)", "value": "a33010faebf7dc39eadbb3b4e5b5c8d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560189, "uuid": "d814fe51-6a85-4fe3-b1c8-59f5d7c58230", "comment": "Malware payload (RedLineStealer)", "value": "6689cd6f4c80d327a0129bf829883a8c4f52116d7c91b4677a34b1d851793c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560189, "uuid": "619c49c8-0272-4252-b4e1-5c51f45e84be", "comment": "Malware payload (RedLineStealer)", "value": "ef7ca80dabeeeacc0651104f555c1084ffeceb6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560189, "uuid": "c7317676-dc7e-474d-9560-b136273ee92d", "comment": "Malware payload (RedLineStealer)", "value": "c5d87c3e5eab5b93d96fbada73a9d3aa3d9bc958ee8a7e3ee487a8f69643bc33251c51bc1158e247b7d3cf4cbf5af0b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560189, "uuid": "b87287c0-a6fc-4008-803f-2c9671a7e420", "value": "T13E64CF20B6A0C035F5BB52F855B993B8B83D3EB19B3451CB92D616FA16386E8DC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560189, "uuid": "1aa20961-db17-4c48-b525-b4d1349305a5", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560189, "uuid": "04dbf91e-fd86-4955-9d69-32d3e91a27aa", "value": "6144:W7ZQS9UHvQGLJy2U3UIJGSTx7lLAhwHykyxPHfz0:6Z6QGLJyQIJL7KGyke3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632560189, "uuid": "64d9c53a-23fc-41a0-a44b-c566b1c2294a", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632560189, "uuid": "b46812fd-b767-4707-b0c3-be6b887ffdfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560189, "uuid": "c2f596cc-b5ad-48bc-b638-e1b61f39b9a7", "value": "a33010faebf7dc39eadbb3b4e5b5c8d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a9b7d7-1e5a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632613278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613278, "uuid": "bff43996-eaaf-4489-9ecc-b544f488ff40", "comment": "Malware payload (RaccoonStealer)", "value": "facbbe7161be596196bbed8f85dd386a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613278, "uuid": "5783c446-011d-488e-ae79-9dd3a7214303", "comment": "Malware payload (RaccoonStealer)", "value": "68c8034c163f04c237fae46f45b55ec1799f6305aa8bf3b2cc477a403c44fc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613278, "uuid": "fe906a91-6239-4708-bdd2-0cc6b2cd4b3b", "comment": "Malware payload (RaccoonStealer)", "value": "a44807108a5825a3b69b9ecdbf8880bbb9425100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613278, "uuid": "4e38b92d-5d5b-45ae-b866-418061bf5e6c", "comment": "Malware payload (RaccoonStealer)", "value": "7afce1dc85e0098a333dc335d3eb92916a32dbfa65cbf43e5231dc731e6263a0be3a0f4bdbc681cc2114c47d43e06473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613278, "uuid": "b0d88f41-b05c-4e65-906e-2c1d79dd8866", "value": "T14C94F111E9A1C431E7B3163A4E29EDA4963F78211C73C14FF99C57690EF22829AD135F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613278, "uuid": "c97f6041-9440-4e8c-86bb-0e0c3576f700", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613278, "uuid": "6f347a22-be51-4f4c-82b9-844caa2397b8", "value": "12288:JVLdvlM//+g4MJsFAzoNcAs+eoGB1hqd:JVLdvly4EzoNcA1eDpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613278, "uuid": "76739365-5e43-498e-80a7-5ea1777d7389", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613278, "uuid": "b70bbb96-b032-4b45-b0aa-8d6b96ab49dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613278, "uuid": "d0f126ab-d8d1-4e78-88d7-61aef7d918ff", "value": "facbbe7161be596196bbed8f85dd386a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee94a6a-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601269, "uuid": "2961b624-7627-4d6f-804c-7915659a400f", "comment": "Malware payload", "value": "a8d825ba74cd57feaa1d0e854d01c869", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601269, "uuid": "e4a5c0b8-4d2f-4632-9227-9df387b15489", "comment": "Malware payload", "value": "69c04906d610e72713b5cb35be9c4f87bc35feec76e1a63b4a7a5669f5fbdc2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601269, "uuid": "3669f2e3-bdf7-42fb-8dac-85cd1631b065", "comment": "Malware payload", "value": "a3d2a27d6d4fa966bc5eaa37c87cf409778c4983", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601269, "uuid": "1f2cfb0a-6f82-49a2-951d-5ca1fd388532", "comment": "Malware payload", "value": "4ed9589871773215c615d547e66775ef326d310071f0b96431d451474028ba2628e801059f9b77aea5ae5696829e6006", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601269, "uuid": "39f6a4f2-cf4e-4fbf-9f42-21aa9381681c", "value": "T1DF03F1704BC31A33E5406C74E8A9D37C631958B4F16834FBA900625CB2D69932FFA2F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601269, "uuid": "c1f7065e-e24c-40e2-a607-d089a1c7df4b", "value": "768:+9f80RqOwV/xN3hqMI2BsokIbW+CAh2i7HBsS34B44i+3UlzWby8jYSwNpEI:+9f8EwhxxJsVIbUAD72x442wjYhpEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601269, "uuid": "e12fbead-8269-4d3c-a1da-060bdcdfc493", "value": 38816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601269, "uuid": "3cdef62e-7957-4314-b5d3-e381e646e91b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601269, "uuid": "d6431d66-198a-4f7a-a43c-8ea6d37b6a93", "value": "a8d825ba74cd57feaa1d0e854d01c869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217a8c1d-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601274, "uuid": "ca01dcc7-ecba-4dc7-b1e7-a328d2a21a61", "comment": "Malware payload", "value": "bcd65ae31ac10fd3b62c04593e2933ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601274, "uuid": "4668e1f7-724c-46c8-b7ab-1c4a21b162b6", "comment": "Malware payload", "value": "6ac4aca627c699360a6f55c6693e39104e65c87033260db3c540a4f7e56eaf9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601274, "uuid": "c0f86e25-ce48-4264-aca4-c096ae59be76", "comment": "Malware payload", "value": "52e9638c225f2e04cea2c1ddbd3b7df205574dda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601274, "uuid": "e07c6fbb-431a-499b-970c-8f187151adff", "comment": "Malware payload", "value": "d37682cf3a2ad972e98896d6dad22addbe668bee3ea3a00f622368a6ee4dd78d11aa06c3fb08c404d7f72471885f2947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601274, "uuid": "6942c9e5-b629-43a3-af5b-d2eca949f6d2", "value": "T17EB2CF6E8991FE8DCEAC68FD015E17311EA59142600E4ACD93546E48FAAD94FF20FC70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601274, "uuid": "89ab2ded-ad89-4065-9536-2f050c07324f", "value": "384:sCkDr8SPSVls74Uwa5tnmvYVyyAF6CRznjN9XLlK/MNukg6x/w8hoqIvSRWGVCkD:tkVPSbscUwaDmvYVylFPbxtpXNzgasvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601274, "uuid": "82672ef7-58c3-4b29-a35a-20406ed73b78", "value": 24380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601274, "uuid": "66b66d7b-f5a8-4551-9467-04bf7d4f892c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601274, "uuid": "37842b32-077e-42b6-9d35-f340c7848c8d", "value": "bcd65ae31ac10fd3b62c04593e2933ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db594c7-1e3b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632600032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600032, "uuid": "00ef27d8-e8e1-47b3-9acf-22c0a6b0e381", "comment": "Malware payload (RedLineStealer)", "value": "1c4184b36326d3237e17d0108f45c29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600032, "uuid": "a9485418-5c79-4433-bfe0-15fe53d05094", "comment": "Malware payload (RedLineStealer)", "value": "6ad5c7104dffd7303b340f2ad71c356549bc100eb887330b75729faebc715bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600032, "uuid": "99e00126-651f-4ac3-8ec2-fcfc2114c42e", "comment": "Malware payload (RedLineStealer)", "value": "c7a73c4708ee0d0ccdec545dbb117549c45846dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600032, "uuid": "50c9fd8d-636b-47ba-8fc6-954b3cd618c4", "comment": "Malware payload (RedLineStealer)", "value": "9e524d6a4490a89a6ffd656a6c41edee5eaa28511e2b1bb7d70355bc03d0417efa16bfb7dd64857b3bacd44de353b663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600032, "uuid": "949f5dba-ec55-4fd6-86b9-b3976dc45497", "value": "T11EE39D1C76B1D432D3E3D5B14925C6A1563BB8322E37894FF64C1B7E1E32291DAE2392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600032, "uuid": "c7d843fc-7765-439e-b12f-15b9469fa123", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600032, "uuid": "a61f55a4-b7a0-4c3f-8576-0403c42471a8", "value": "3072:KD1mCJ3QB4yIv7qFh5AaStocd2S9H6dYe:00Cl0Iv7XaSCBEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632600032, "uuid": "022c74fd-69d9-43de-b53b-e280d1f52814", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632600032, "uuid": "79a13610-45b3-426b-b64f-31b7083c0f6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600032, "uuid": "05875a30-8a9d-4e00-9d7f-04a2d1e1bcf3", "value": "1c4184b36326d3237e17d0108f45c29b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2109540-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563291, "uuid": "a67e1a2e-302d-4680-b179-2c51d7ab8223", "comment": "Malware payload (RedLineStealer)", "value": "2747385504590aebc93265335fe0d848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563291, "uuid": "4e458a18-3759-48af-acfd-a7542210fbc5", "comment": "Malware payload (RedLineStealer)", "value": "6b05bfcfb7cd6b3e58eaec8396806e26fc029cfeda688c3be6d940c0d4b54a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563291, "uuid": "5993fc15-320d-4c74-b759-40a8e4e91a40", "comment": "Malware payload (RedLineStealer)", "value": "20e49c3b0c0a68b91ea611efddab211a2011412f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563291, "uuid": "c96a2181-aac3-4dce-b952-086e724b49f6", "comment": "Malware payload (RedLineStealer)", "value": "713805c1dc27cfc8f465f12bd1ee9ef7ad90d5082ea288269da155b782def42f6392fe5f7ca41e16cdb58720bac32cba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563291, "uuid": "adda2477-85d2-4fd1-8d01-e02eca04141f", "value": "T15584AE20BAE0C038F1F712F489BA93A8A93D7E715B3451CF62D516EA26346E8DD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563291, "uuid": "5df5fa0b-77ca-4355-8a59-181c37c189b9", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563291, "uuid": "eb5edbb9-c1e5-4605-a750-057c984f5bcf", "value": "6144:mjXS6Mn1IGZ55aBIF/V1QwF4d+B+qI3heK6TylHvtO1AhZzlRh5s:uS6Mn1IW5SIdQwSdFFeK6SPtOO/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563291, "uuid": "6717f590-bbbf-4046-a77d-c98dd28d679e", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563291, "uuid": "6de32100-f56e-4cf9-bc3b-eeef1ba1ac43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563291, "uuid": "7e494a13-95af-4d02-9b4d-febed7fc3d24", "value": "2747385504590aebc93265335fe0d848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a04682b-1dd7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632557103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557103, "uuid": "10db41c2-91e3-4bc7-8ab7-918c1d72a5fd", "comment": "Malware payload", "value": "0ad6beff5dc6704a93dc36ea43dc739c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557103, "uuid": "7ecca545-8692-4de8-a027-e0881eb2327a", "comment": "Malware payload", "value": "6b364b7c12a4e4d7f7275006be3adc70984086843f1cd013b2745ecbbb8fca00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557103, "uuid": "b45c0030-1562-45ff-b139-dc8f634582cf", "comment": "Malware payload", "value": "b4536a89dbaa58deb5c5ef299d71982259521d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557103, "uuid": "3f7213d4-2065-49e5-8a67-552d856fedb2", "comment": "Malware payload", "value": "d8f693476703a1aa43f84207c95da86eb671a6f045b69d452f929d50463e99b0929703a52cc51ba3e93bd6ddf57186f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557103, "uuid": "05c8dbad-3401-4b14-9166-6f3e9491fe59", "value": "T12925B3A5A90D4873F8AA237516C71D5DEA543F83B06D304F715AB92E39BBBC0F886D04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557103, "uuid": "edb4dca9-00b9-4ee7-8b9e-77790f385caf", "value": "15cdf6e35545e491e70d9cafb0fc7871", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557103, "uuid": "079328e7-6729-41b9-99d7-43780d3a7e05", "value": "3072:CORDINSkUIWnxw8CmtqvylJ10nkcvryr5dqT0NMdIp2uogBpUDZyL+UoPxwAnjac:Ti+qg0vryiT0NMd+2u/NLGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557103, "uuid": "977a3651-c269-49a9-af4e-35dd5f75ec97", "value": 1040347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557103, "uuid": "be152d68-9bbc-4382-8280-d570988923a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557103, "uuid": "e532b811-c6dd-4e7e-80ff-6e7dfb809da5", "value": "0ad6beff5dc6704a93dc36ea43dc739c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77bdf00-1e30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632595539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595539, "uuid": "dd7c7a48-26d7-4bfb-9a20-0c9969288f80", "comment": "Malware payload (RaccoonStealer)", "value": "e78f84c1d23a3b331d2d61f91a67ce3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595539, "uuid": "2112de0b-e9ab-4090-9b05-c44fc8662e7c", "comment": "Malware payload (RaccoonStealer)", "value": "6b418bc5a432d6905894fab49501e93def7963490451b07a55376ee666b205a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595539, "uuid": "aaccf4d4-5e8c-4ae0-9acf-c53457405322", "comment": "Malware payload (RaccoonStealer)", "value": "e9edbf2d0ddf3a934e1f640a0d5f7d3f5704747a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595539, "uuid": "8d30696f-1d4e-4d9f-b4a4-d39b3e082f89", "comment": "Malware payload (RaccoonStealer)", "value": "ebed1b19f1bf067901c358229a23b50ad370f03a9715555ed117ce78bf06ed4f404d2a8ce5b6a0a50efa2ace228e921e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595539, "uuid": "df8731a0-b8b0-41e4-b4f3-27ca99e3ee2f", "value": "T13A94011CF6A2E432E7A74D368C74D7A56E2BBD202D33400AE33DD66E1E917C046E9356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595539, "uuid": "f4db8226-4beb-45c8-ae4d-a6119254154c", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595539, "uuid": "b7934b7c-60d2-48a6-82e9-04cda8874eef", "value": "6144:x73hB9x1KzCtoHhW9KspfUwAtWTxswdCCckDDktriKzhf/oWyItmjKFCCrzX86Pr:nBf1ztghWqMmwdCCckieKuw3jT8Kk8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632595539, "uuid": "b8d8fab2-aec7-41bb-960d-3f18b7a42df8", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632595539, "uuid": "7af6817b-fe99-4ac1-a86e-c35722dfb3bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595539, "uuid": "7c434e42-fa30-4949-a8a6-c162ef563e59", "value": "e78f84c1d23a3b331d2d61f91a67ce3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bc471e-1de1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561389, "uuid": "6bd1c8d6-6289-4d5b-93de-65542e6a7777", "comment": "Malware payload (RedLineStealer)", "value": "f58680d9dbf3c52caa5759fb8184938e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561389, "uuid": "ab0eb74a-bf28-41cd-b20d-c2be9af2394f", "comment": "Malware payload (RedLineStealer)", "value": "6c08e9388d4e86230391c95e9c2282ec38c3e84f20fd12da4058cd523d3256ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561389, "uuid": "1c75ed3f-7929-445d-af45-ca9aaa948169", "comment": "Malware payload (RedLineStealer)", "value": "3eb1cfa8f4afc2cd3b0bd92adc38fae198099371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561389, "uuid": "a9ea1d9e-ad54-4344-bbe5-f23722f55f06", "comment": "Malware payload (RedLineStealer)", "value": "10db3cbc0c345e2aa5bb934d9bbb9ccbd34d674791679a67117c7384ea8ca27fde850bef2810fb8cb9cf2629699f31df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561389, "uuid": "c0710c4a-c18c-4b31-b9bc-c0876e397b50", "value": "T16D24E02276E19432D3635EB595B4E3E21A3FB4233B70418B6B74DA6D5E323E08B65307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561389, "uuid": "8b4dac69-1937-46a5-9231-798432630ba7", "value": "f7987bf55fcab080da60dcb9686a7f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561389, "uuid": "2ca9a321-e2bc-40bc-9d8b-588f1e781c62", "value": "3072:g4665PcRjy5E7eGMfc0UaFbtbZDWyd4am40/XWercjdXXZ8B9/+H7554oF94:g45Pc45Elb6V9ZDWnamFOccjdXCBN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561389, "uuid": "f853e8d2-e6ec-4cb9-8676-ea6d0f418b40", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561389, "uuid": "5fbe0562-7281-4093-9ff7-1bad8bd1050d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561389, "uuid": "ac025301-fa30-4e8b-a409-b5950bb4d027", "value": "f58680d9dbf3c52caa5759fb8184938e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f8c98f-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632552889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552889, "uuid": "0080f802-686b-4a0e-be82-a137a755ddc2", "comment": "Malware payload (AgentTesla)", "value": "75dfe11bddb6f033d9ee8a1e43cc7290", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552889, "uuid": "67f6e53d-79e6-4cff-b21d-713af7fb5b65", "comment": "Malware payload (AgentTesla)", "value": "6c1676f79f63cbdec39729132c45174758cdec115734d52397d2fb5508fc5f67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552889, "uuid": "ffb4829a-f355-4168-814c-ab3317a4b0c5", "comment": "Malware payload (AgentTesla)", "value": "8d82d5d580d3b7552e4e885e660410ee0a713261", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552889, "uuid": "4c983765-8ff1-46d7-bd33-f6adef34a7e3", "comment": "Malware payload (AgentTesla)", "value": "352d9ecbcb3acc1c730726cb692afbdcd20d3ff5a3e533cec5e11ab78c2ffa8776a93544002e22ad75ec63dd41814edf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552889, "uuid": "69bbac02-ce1f-4a65-b78c-7073ed14abd0", "value": "T1EDA4F001A7DCDAAFE3685A3499106D6085A7C3DD21A3DA4AEC5940B13EDA34CFB11FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552889, "uuid": "2d7578a7-2b68-4ace-a35d-91f6aadc9bcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552889, "uuid": "97305ed6-f7a6-46c1-8852-0e8b17c95367", "value": "12288:+GEsSGcCe0vFe5fFdhylDsXYu4yMCXsPvrbF:+G7FYylIX2kIvnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552889, "uuid": "0d149394-60f1-420c-812c-9b06ff3a9e21", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552889, "uuid": "52b7eeea-300b-416f-8765-d3d28cc21b68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552889, "uuid": "99a08ad8-a659-4c96-8921-8c94441b19bf", "value": "75dfe11bddb6f033d9ee8a1e43cc7290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c98d84-1e58-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632612552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612552, "uuid": "f6c3c896-3cee-4d8a-a1a4-d6f22ac7f945", "comment": "Malware payload (RedLineStealer)", "value": "8a2cf5781e56ec17091e4376c29d570f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612552, "uuid": "5b1d6e92-5609-4f61-8c7b-9fb3da5a6087", "comment": "Malware payload (RedLineStealer)", "value": "6c55f1e4632628cd96e7f2eb86d52c158ff8f5e36a2220c18aacebee375a6354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612552, "uuid": "9c4092cd-fc6b-4348-a494-e89782a8c7d4", "comment": "Malware payload (RedLineStealer)", "value": "26b23dad4dfb96aad8fd08a4a86c73c525acaf3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612552, "uuid": "8f8d1bb9-ec5d-4268-81b4-66bb965581dc", "comment": "Malware payload (RedLineStealer)", "value": "d84cddc97d38d3181d0d0eacf97d19e8cea1ab1fa39b10d3a5339c65cb03c2de319dfb5ef68832d0edb59ce45f230525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612552, "uuid": "7fd0ea7f-3a44-468d-9622-90852607f96a", "value": "T12544D021BAB1C036D3E709F059778394593BB8225E6B854FF64D1F0A6E236C14AE63D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612552, "uuid": "a759051f-1baf-436c-b4e0-5d65ba35118a", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612552, "uuid": "0f481abb-0022-4e9a-8c42-ec07ae2e51ac", "value": "6144:bn5zo5xcpBtFURIJauLbuMrkk81tdF5Ead:j5zPpBDXdLbuMr6Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632612552, "uuid": "6355de75-43c4-4d53-af4f-df8a9c141208", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632612552, "uuid": "a849c662-903f-4758-8bf8-845ab23beaab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612552, "uuid": "640e1713-8aee-4772-8295-f6a071ab3f46", "value": "8a2cf5781e56ec17091e4376c29d570f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84b159c-1da4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632535411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535411, "uuid": "e2ecebe7-3b23-472f-8ab8-d07162d3bfbf", "comment": "Malware payload (Gafgyt)", "value": "15dff130c3146ff20237eaa368e2e900", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535411, "uuid": "413cf9b5-c518-496c-9f94-61b8b9f81e62", "comment": "Malware payload (Gafgyt)", "value": "6c7aa270ec4fed2385da0b54be5d3aefb008244556f954731f41523845d530e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535411, "uuid": "1c0a5461-f174-4153-a441-6ac913642066", "comment": "Malware payload (Gafgyt)", "value": "886f2f69d2d895cff3277016ebf777ad9df1fbde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535411, "uuid": "e04182fe-8c8b-41dc-906f-6e90fb0fd838", "comment": "Malware payload (Gafgyt)", "value": "54e9231062795f4f6fa5fc083ad984d00dd6e6854a373372ef55209041e87127fdf323f98a86addd86614339b68a8d16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535411, "uuid": "6e67e86b-fdb0-40a7-8616-057c9722e04b", "value": "T13DD3A46AFB218FB7C84FCE73059A8901149D95CA52D86F6BB2B4C66CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535411, "uuid": "b8382ba2-4e50-4418-b967-8a0c5b5ad572", "value": "1536:Do3eTzJUyk77mFybTMN4ZdCT6XzQNwjyUsqDuKYiAUhLUmkVmYFxkCIvETe:DoL/bT84sVeyUujMxUmkAYFxkTvETe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632535411, "uuid": "93945018-f54b-48d3-80fe-6806c38b90b8", "value": 130391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632535411, "uuid": "ffadb22f-9cd6-49cf-8833-6445f82454e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535411, "uuid": "3f3be2e6-58a2-4896-b877-3e6cf1a4f44a", "value": "15dff130c3146ff20237eaa368e2e900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b063e742-1e20-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632588628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588628, "uuid": "352a3c11-31bf-41fc-bdb6-5c2d0e5ea5fc", "comment": "Malware payload (RaccoonStealer)", "value": "9f7a60816d26ea906a8d11681294c2db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588628, "uuid": "f9a191c6-d213-4d2d-8620-bf8e47247bfc", "comment": "Malware payload (RaccoonStealer)", "value": "6d0abd2378cf7fa2853d1b190c359ef7b256c83144b1aeae3af3036a6418554a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588628, "uuid": "ab48b29c-c1f8-4372-aaa3-3a74df0deccd", "comment": "Malware payload (RaccoonStealer)", "value": "7fbc89da016525023bc5fa34cd0bafa622c0d54a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588628, "uuid": "16b962b0-a8be-4a93-800f-83ac29b6a562", "comment": "Malware payload (RaccoonStealer)", "value": "71ceeccbc8697a47c23ad44bc5beb8e0792156b66385551f958c654dbbff24c82b0aad4c261b3b467899c338faa52955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588628, "uuid": "21978458-7f06-4075-8b6b-07b71edff6e4", "value": "T1EC94022AFA919036D3A326384972E74A4A3F7DF51A70824F7A88675E1F317E14D21733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588628, "uuid": "d559ee4e-9d4e-49a0-bb82-99b74718eb8c", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588628, "uuid": "2dff6d9b-6dc5-440f-b5de-e63e9fe27989", "value": "6144:Ho94m6fL750kSAxG+uXVW0hZN2110tjBCqWfIRbGVHlyrsUqsJSDi7YXNXxOXGkj:Ho9ZivF9GbFW+NLjBCDpllyqcSL7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632588628, "uuid": "ba694511-9176-451c-842f-547e6c3a7a54", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632588628, "uuid": "fb254989-049d-40b7-99c7-fd4a5f8f3b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588628, "uuid": "4253ec7b-1919-4a7f-a447-9b102900b15b", "value": "9f7a60816d26ea906a8d11681294c2db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcaeac83-1e17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632584837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584837, "uuid": "0570333a-b68d-4dbc-9407-421e57caccfb", "comment": "Malware payload (Gafgyt)", "value": "39f22a5bb5797834aca0f056f921662d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584837, "uuid": "76267139-78dd-4792-a990-d3813564919f", "comment": "Malware payload (Gafgyt)", "value": "6d50a4659f604bea00566ad88721a698cbee54b922adac2ec2abf6ce5ca2606b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584837, "uuid": "5ae6838d-cf45-4113-a8a3-2d0e83d8b9d8", "comment": "Malware payload (Gafgyt)", "value": "57fd011bd9c0bcc34ba477888907059fcec6e4e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584837, "uuid": "2dd6285c-a832-483f-945b-d21f7abbcb7e", "comment": "Malware payload (Gafgyt)", "value": "655ef7413cc472184f2c3d65be81d6bf23245bc67d2f8a708f5ddaf0c922fccd8875318832d858b0fbceaf8ac35dec13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584837, "uuid": "caa51db2-78a6-49d6-916e-c67c07a1812d", "value": "T110B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584837, "uuid": "75b69a50-dbad-47c1-9f26-4bf4bf13953d", "value": "3072:R/4tNF9U4vvSKw6J73x8UmkiSFxfKxbXe:BUNFK+S8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584837, "uuid": "e7eefac3-7f0c-4585-979e-5d680833096b", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584837, "uuid": "3db68e23-5921-4d9b-9d59-1ecd59addb42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584837, "uuid": "a277a427-1dee-4aa9-8f07-696ee3df9eb1", "value": "39f22a5bb5797834aca0f056f921662d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390feadb-1e17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632584563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584563, "uuid": "1f1854ff-f753-4e4f-b5d5-de622d48852e", "comment": "Malware payload (Gafgyt)", "value": "1dcd6c1e5339ece7b2f34a882ed99aa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584563, "uuid": "de01f4ed-a61b-4289-9ace-62f02f3bfad6", "comment": "Malware payload (Gafgyt)", "value": "6dff6c65387e4f695d63c0d786f052741b45c28da10bf70c0d99fca3737f7dd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584563, "uuid": "a89e3966-0e85-4022-9bba-df8a48b08603", "comment": "Malware payload (Gafgyt)", "value": "090e4326c4a155eeb255636864be7162aa203418", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584563, "uuid": "fd6d7571-8a80-4317-87b4-7a61c981d4d2", "comment": "Malware payload (Gafgyt)", "value": "3641b06758ec2706b38557e8a3db8a9855342224c45d3698cba1bbce33f61131f86cac81ab08025caac7a8bc39a62911", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584563, "uuid": "afaa1046-cffc-4a0e-b244-68b59a820dfe", "value": "T1D0E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584563, "uuid": "05c3f198-878b-469e-9903-58055fc8f3fa", "value": "3072:fuNaNpF4uVN++dkhnxZQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnHQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584563, "uuid": "8a4285d9-5ad9-4d4d-ba9e-4e74dc065000", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584563, "uuid": "f608f61d-7d0b-49f5-bc03-f82aa633c751", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584563, "uuid": "9f73c7eb-71ad-42ac-b399-e57b94de3e40", "value": "1dcd6c1e5339ece7b2f34a882ed99aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a7cd5a-1e17-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632584575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584575, "uuid": "5b82b0a8-593b-4145-8a97-b287fa3d2000", "comment": "Malware payload", "value": "6fc61238f3963f22d39ee924acdc6d79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584575, "uuid": "b095433c-b120-4288-b0a4-c4644e3365ef", "comment": "Malware payload", "value": "6e12f09ce0623d3e7503fb3d03c3a607f2018e7ce58c9edd5d2699398c106894", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584575, "uuid": "6eb54e55-431f-4fe4-a327-82f5ec812195", "comment": "Malware payload", "value": "8bbf3e6f175c8f7d556a210cdb5f32dd00be27ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584575, "uuid": "40c84e8b-01ff-48df-a9f4-ee9eac88e015", "comment": "Malware payload", "value": "9573f077e6eb1afda573685e29ed8c5c60f2105ae269227ccb797b896eba6ae8ca2a6e769ca01730e1fa2254796d94b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584575, "uuid": "be6eeb84-9e07-480a-9415-09915da7f72f", "value": "T159930892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584575, "uuid": "0c695014-6536-45da-8de0-ac2aa2c82981", "value": "1536:4mZMaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gw62f7vTmQ9VqXjewf2Le:v7p09W6KTG/IB6Yy365NfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584575, "uuid": "7e1c325e-ceb6-4235-9e4f-3ec1c7567eb0", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584575, "uuid": "ee8d0bb7-fa3c-4c0a-a7b9-47189360e268", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584575, "uuid": "2c50e205-c627-4bec-9aa9-7d0cc1557f70", "value": "6fc61238f3963f22d39ee924acdc6d79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb86328-1ddb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632559014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559014, "uuid": "9b1e7af1-0a65-4c7d-a065-886940fdc594", "comment": "Malware payload (CobaltStrike)", "value": "d98901a284f924809400353db8ae4efb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559014, "uuid": "52886645-ff14-4cb9-aa0b-f858b0a4aa2d", "comment": "Malware payload (CobaltStrike)", "value": "6fff5bed3149cccf6836a0c7345eda9a00eb3d010f4e9717793d137b4c33ead9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559014, "uuid": "f6df4139-1c0e-4af5-a764-4ad77b62fbaf", "comment": "Malware payload (CobaltStrike)", "value": "755778b022b69bac6212f58be05f92d12815290b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559014, "uuid": "05ed5fbc-795f-422e-8c5e-bb1efaa96169", "comment": "Malware payload (CobaltStrike)", "value": "46c9b6531678bc58607dd32343815d67915646949f7c640a1367d83bcceec73d33a0b5fea9d9b9e7fb94dcbc88cd58e9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559014, "uuid": "934c5a6c-e360-4544-a916-a940534866cd", "value": "T1C324D0352F542899F42971B1A8FB45F4FF1186732A18F9E02DF9C5B549E1234B3B08AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559014, "uuid": "0e1f723a-faac-431a-8a32-31f77b8fcb6a", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559014, "uuid": "e89ade6d-f018-410c-ace1-73f7896f64ce", "value": "3072:S+qXdmGc5E3paLHcOTBUxXvy1K+bb96JQ6lrUBrpICUmgR4GhchSHpqu+:SBmGcO3peHcOoXvr+H9GrYn5scwHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559014, "uuid": "276920f7-acca-4bee-8da5-f7a033905dda", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559014, "uuid": "fd85bcf6-cbbc-477c-867d-d4a63a2ef358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559014, "uuid": "0939a87a-4fef-4f36-9e96-5ec3679eedf9", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296c9481-1e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632582818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582818, "uuid": "5a712064-a018-4a85-9a66-2df3f7665b74", "comment": "Malware payload (RedLineStealer)", "value": "c5e9eebe8461f25771db0333b7e421c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582818, "uuid": "e2a443e6-8c7b-4858-b110-74735bb355b7", "comment": "Malware payload (RedLineStealer)", "value": "72a81cf41c1864616767dd1f11e17d02f41b944502d6ce938ff463d592f2e97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582818, "uuid": "be6a4fbb-259a-4221-8df3-93ba26e88b55", "comment": "Malware payload (RedLineStealer)", "value": "7549526366d68a69b2686122753aac1c6ccd6f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582818, "uuid": "179f7b59-99bc-44ad-9362-9109cd7b6b00", "comment": "Malware payload (RedLineStealer)", "value": "f77db747c427e0c264401e2f0e098338c2770f1b5a6092d9509af03f4a651c326b3e7e4d414993fcfa75fc51fc44ecaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582818, "uuid": "ecad8da2-7c43-4087-a4a0-c78334365799", "value": "T19744E05176B2C032D3D34775393086A5963BBDB22DF3816BF75D064E6E322C19AEA342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582818, "uuid": "2b7e0201-6469-4895-a527-3a17aef9d985", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582818, "uuid": "01aab2ef-3767-4d22-b019-e6a479501826", "value": "6144:58VWjm+tKPKbV6VyUJqC1oDBP1gwgUEad:y8K+pbVQxEzl14+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632582818, "uuid": "5a15ca4d-5fc4-4f08-b3cf-7d5e3db130e8", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632582818, "uuid": "6f60f066-ebbc-41d6-9ee4-27eb99c27238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582818, "uuid": "b5630a0c-b279-473d-b003-4f7650038e9e", "value": "c5e9eebe8461f25771db0333b7e421c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a716bb-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601648, "uuid": "799f19f7-04b5-49ba-91fc-9de762e737b9", "comment": "Malware payload", "value": "66fe557dd45de8d4f1b335130fb37fc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601648, "uuid": "d485e40f-c786-4d11-9be5-8c3d0513155f", "comment": "Malware payload", "value": "73374b4bfe2d36850ac5e52266bd6115e5596343a87aaa556ef40381ee2b7415", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601648, "uuid": "ab45956d-0b24-43f8-b65f-5c32153a13df", "comment": "Malware payload", "value": "94ade8ed55b8ecad4b3e80788f404dd063a24b4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601648, "uuid": "5a6f099b-9353-4a7a-b70e-c3ecb929e4d8", "comment": "Malware payload", "value": "fb1e1d4d7bb07720279b2cd4ba4e3bdfe7dce7a0b27d9aa243cae24f5b08ffc445e8ef12c85ae07405ae88d36dd3b36c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601648, "uuid": "593cefba-3ca5-46c9-a913-177fd2a33b56", "value": "T15043F11A0DB42B32EEBE9579593E40F763FF7BC842DAFA0108557BD952111A19B3F808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601648, "uuid": "73538b3d-0379-456d-923e-13d183ed2116", "value": "768:+uagAYgCNuljVFR/s9VixwJvprDD6lQGpVF0X0QyQoMq3U7yFHv2kWVSfTvAJC/a:+DFYVN2jvNs9VNLaQGpM0QyOuGc5i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601648, "uuid": "22c13e4f-0d17-403e-9c56-e24118849f98", "value": 58112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601648, "uuid": "3ff3ca98-31f1-4a78-86f8-0dfe75e183f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601648, "uuid": "7bfe2a7d-02eb-43cc-9849-61a611f6f5f7", "value": "66fe557dd45de8d4f1b335130fb37fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d300456-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562665, "uuid": "2431fd4a-50fa-4d95-8853-32fc6ef0d9a2", "comment": "Malware payload (RedLineStealer)", "value": "24eadca90f3ad48ce5ba6a7fbd62a5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562665, "uuid": "879ab1db-0a0c-43f8-b17e-6e4be3c03a41", "comment": "Malware payload (RedLineStealer)", "value": "73a37cdd1ab22c16783ec5f50d4f5ef8d1bb63e13ca3ef4851ec6e6582dc434a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562665, "uuid": "c1c2eac6-e4d7-49ef-bb57-d747681c378e", "comment": "Malware payload (RedLineStealer)", "value": "4868bfc54b094a5df2cb92a52abaead5dda003fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562665, "uuid": "4f4da0a4-673f-46c8-a087-a66587decb75", "comment": "Malware payload (RedLineStealer)", "value": "0fd240245858f2ce237faf059a4f7c7a6829fb758df2669507ceefc6c5cb1d08df899bafde740c8ae393c758c36aac7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562665, "uuid": "0ed61390-bae5-4994-b906-4f3af5360b5c", "value": "T13CE4F121B7E0C035F6F711FA09FA83A4652EBE726B2895CF22C516EA55746E4DD30383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562665, "uuid": "e407f551-9be3-448b-ad1e-99f9e850e7b9", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562665, "uuid": "8701d56c-9327-4f09-9764-c8d3b14ae363", "value": "12288:jLIvIGQrbOsK3M9yrCINN91Tt6LTSAFsI5oWpRSpyHwprBHFfS/R:WxQrbO3M9yWIt1T4LhFsOoWpMllfSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562665, "uuid": "e398064a-77fc-4571-95bb-a84ee151cd62", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562665, "uuid": "7e7116eb-0554-4bbf-b1ed-ed2905315863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562665, "uuid": "77233444-ea95-47d3-8164-f5db3bdb8736", "value": "24eadca90f3ad48ce5ba6a7fbd62a5f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97392154-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632552938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552938, "uuid": "43ace2c6-737a-46f9-8448-2618bf091757", "comment": "Malware payload (DanaBot)", "value": "d31ea57359444cbd1c944e906e7ae813", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552938, "uuid": "71afaad6-c8f4-471e-ac80-934fa71297a0", "comment": "Malware payload (DanaBot)", "value": "73e761de4a8be29d7dc04e48a47f417917cf2f37a27dfb9db45069d4ccb66cec", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552938, "uuid": "a9963f24-81f9-4ebe-bc80-3276eb8d437c", "comment": "Malware payload (DanaBot)", "value": "60751d59e2bfb960a37ad3877f74ca47be135a76", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552938, "uuid": "7dc96a1d-67e7-4b33-aac3-7b3cb3fc883a", "comment": "Malware payload (DanaBot)", "value": "00f1df6d54b8d6517f314c1091e354537e5aa31f55d8843c9642b179482bdb9e7ec3155cafa7160947b527d282a9bd3f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552938, "uuid": "433ff06b-68a6-4519-9004-8761f74e2c39", "value": "T1E145232176E0C030FAB726FA99B483797A1D7E70AB7885C763D60AEA56745E0DC30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552938, "uuid": "47ad872b-249b-468d-abe9-b6142ee632b6", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552938, "uuid": "f51fb429-377d-4895-9723-a91ca337f698", "value": "24576:Hfy1/eDZpqs3J+XuHb1int+8bcyLiIB5A7sjciACW+PQf:8Wt+MJint+83iIjA8bW+Yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552938, "uuid": "403a4be6-970e-43f0-8fbe-013817037b18", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552938, "uuid": "08d4d81f-999c-47d0-9458-b8de11488a31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552938, "uuid": "4399ce30-96d9-4eb3-9b31-df56a90b8dd6", "value": "d31ea57359444cbd1c944e906e7ae813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a668c9-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561713, "uuid": "c7465584-bcef-494a-8cc0-efce52d7bfde", "comment": "Malware payload (RedLineStealer)", "value": "724727cfab8c3667315c0056ced13c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561713, "uuid": "2056b5c5-2a88-4029-8b16-025a4362bb49", "comment": "Malware payload (RedLineStealer)", "value": "75265a03a1da1b65099e41f7c298b89188c9904380cec4756242a784bcd2112f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561713, "uuid": "3ea60e3e-f1fe-43b8-a569-5209df525e81", "comment": "Malware payload (RedLineStealer)", "value": "13f51d8e4a80f108c52949e2b2e11843074746c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561713, "uuid": "59a7903d-4e18-427f-a08c-f29dc1d714d1", "comment": "Malware payload (RedLineStealer)", "value": "dfdcf2984adfd61e5b2f78deaebfeaf78649fb56a7da3e9f2ebff4075bc9e8894d683820263c61933da4da28c713140a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561713, "uuid": "46cd8f88-4c4c-44cc-8245-0f77dce4a125", "value": "T11344DF2231B0F833CAE35D708870C7956E3AB5621E7D518BE76C166A6F3D6B08B25317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561713, "uuid": "08b86930-9736-4112-b811-23843dfeb04c", "value": "35a9ffa8a278dd991d1bdc58cc30f2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561713, "uuid": "3825f516-5eb0-4477-abab-71df48650874", "value": "3072:gADm8UnFpN0sjhGiA38kCJf4l79UCEBQ01duvnaukeTGCAyUZF1Sa5gZOiCfrIX:LExXGiXhf09UCSQKdaaDURkFqwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561713, "uuid": "0ef81f9b-aa1e-4fef-b949-a60e86429f2a", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561713, "uuid": "c40bd77f-bad8-4e60-b4c2-d1dd1c5ecd30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561713, "uuid": "6c1217cf-f111-4edd-b02a-b025896bf25f", "value": "724727cfab8c3667315c0056ced13c3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09376d72-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561719, "uuid": "3b35ee77-f5f8-4e5e-942a-480613ecec46", "comment": "Malware payload (RedLineStealer)", "value": "af65025a05e9c53dcbc381bd658742bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561719, "uuid": "da75f7fd-9f64-4790-9c75-a2c1c89fb7fe", "comment": "Malware payload (RedLineStealer)", "value": "7528f5fc6feac45e0e9d7e8e2f2e050f73da78d65937db34595904a284ca2f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561719, "uuid": "cea51376-4e1e-45b5-9b08-ec9e4c630231", "comment": "Malware payload (RedLineStealer)", "value": "2e0b910448e10a430d60fa4b2b680928459d86d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561719, "uuid": "390359f3-b25e-4f4f-9416-db7c55806e93", "comment": "Malware payload (RedLineStealer)", "value": "843200e409be2cf35198bf0ffb8a260ea38f66a5b8b884bff39f725eea266ef0f692a8796f4d3501dc246f526ffdee1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561719, "uuid": "97f8086f-dcac-46ac-a86a-9c19db40826f", "value": "T15744E02236F0C832D6A36573B830C6D55E7FB4332A74414F67A82E6DEF212C18A65327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561719, "uuid": "82ba9369-500a-476c-b932-9553a17ceb60", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561719, "uuid": "dd506144-3722-44e4-9745-e1b02a0e974f", "value": "3072:YSHnyc3JKC63qP84+TN/4quQEr5t3ySGf43pC2hpL2qJvJOLdakxnv5wAgJu//3X:2Idim84o4qbaTR5p9hp8ryAgU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561719, "uuid": "41cf9801-04c9-48f5-acbb-b42ec0761b27", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561719, "uuid": "e14f5f3c-fe9d-4eae-b904-f4fccea422c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561719, "uuid": "e8bd17f0-6cfb-43c4-960e-67f4c2947cdf", "value": "af65025a05e9c53dcbc381bd658742bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e39dc3-1da4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632535142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535142, "uuid": "96b7b854-52e2-42c5-9ade-d45611c7f33e", "comment": "Malware payload (Gafgyt)", "value": "03d55426a9636f76684b8de22521d3d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535142, "uuid": "3142f07b-2eb3-4beb-8bc8-71c5551906d7", "comment": "Malware payload (Gafgyt)", "value": "759fcd47ebfc2bb64f4e4d77f6bb7df8600db1b8e05a103cc84436e5dbd331c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535142, "uuid": "1f478762-2e0f-410e-9ca9-b9a18befeb79", "comment": "Malware payload (Gafgyt)", "value": "3ab211106b2047b13070d2100a92ab790601fabe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535142, "uuid": "a42dc399-a750-4d06-ae53-5cf3e394e7aa", "comment": "Malware payload (Gafgyt)", "value": "177ddbab172e03aceca49a2315182ce0d3bc772b169f5e13901e7ac4a4faf24e62ef7754c571dd67df26bd79b682d951", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535142, "uuid": "37999b96-1bbc-4351-8fc0-df9c6e361d76", "value": "T1DAA33917B21D0B53C0DB59B028EB2FF19B68B5E013A36181762BAFE017735B62513F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535142, "uuid": "d80e9bdc-79ae-4908-a78d-f3acacb00f78", "value": "1536:KQkP1T3q27KeQHeLTA/Ykcbh30qqaf80K9/EmL4nVqwjEUf/ze:KDt5K4/xkcbh3E5t9/EmUnVqwYUf/ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632535142, "uuid": "ee1aad7c-f782-420a-813f-8e84acfb966c", "value": 98859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632535142, "uuid": "7a45ded5-e0c9-4f65-a57b-349f6e98a692", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535142, "uuid": "ab1121f4-60b7-4c39-84d9-4b5e06887f9a", "value": "03d55426a9636f76684b8de22521d3d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c4aec7-1e22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632589423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589423, "uuid": "ef8e3e7e-b12f-4e16-ba4e-2cbb38a84ce5", "comment": "Malware payload (RedLineStealer)", "value": "c6696c19a3ffd8ae5eaefd1623d89263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589423, "uuid": "09811ce0-c99e-4050-ad0e-6b1a6a6ac17f", "comment": "Malware payload (RedLineStealer)", "value": "76b3e64f7c7b992d9886e2078c3159789a7545555ce91a76d1265a1d8aaa20ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589423, "uuid": "6652dfbc-0cb8-4f66-995c-ffa31faa73b8", "comment": "Malware payload (RedLineStealer)", "value": "bb02fe7af3ab9c92be9a6de11dc72b3ef628edb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589423, "uuid": "17285beb-c5b6-42af-b641-edee2db7d866", "comment": "Malware payload (RedLineStealer)", "value": "6e2b219a90de81287b049256396ce9f024501031e27c43c0118f7e5eb1a2998364b8eb37bdd00a479c2b63b6a399c163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589423, "uuid": "1e397059-b4ba-4540-aef6-eb8e25b4fda0", "value": "T11D44D02076B1D032E7A34B70D934C6A066FB7C226E77465BF74D075B8E322D14AE2396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589423, "uuid": "464183bd-ab20-4625-9d46-41eaf9d0d133", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589423, "uuid": "a5841960-3e71-471c-9962-ea30fbaabaa6", "value": "6144:vd8XNDZf2QkKDd/mhHz98e7doexIEEad:1MDJDJMHCe7lIud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632589423, "uuid": "16db5852-b66f-4ae4-8ef6-6beb67619c2f", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632589423, "uuid": "781b8703-db20-41de-8be6-50d3f000eb4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589423, "uuid": "62c39026-c1e1-4692-a35e-f775b27ae889", "value": "c6696c19a3ffd8ae5eaefd1623d89263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ecede6-1e40-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632602429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602429, "uuid": "974176ac-32e6-48d7-8faa-f9cb97a7f217", "comment": "Malware payload", "value": "eda77d6797a5c358892fce3f5758ef9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602429, "uuid": "bec8288a-c76a-4382-8b4c-2c78970277c0", "comment": "Malware payload", "value": "76b841aa9d84e435e332612cb6874899db6283b55d24cc359e80088c3c16d8e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602429, "uuid": "e4d540e6-7942-44d8-a901-759dc4fbf981", "comment": "Malware payload", "value": "941a7b8595522e954c85e506c1d699383b76bd27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602429, "uuid": "2ed9525e-ea2b-4dd9-b976-2d4d59a7467b", "comment": "Malware payload", "value": "955bbce22a9fa29def39e5979dc09810dd729cc39722826791a566cdd819613fb8bf335a54dfd495ce88a31dfc987f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602429, "uuid": "1f11a02c-927f-47c2-be5f-b414e30ef28c", "value": "T106A2E1D082C564B2D3F029BFFA594386533A1DA8F49A613D6624437C8EED7A23275C93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602429, "uuid": "055e48df-f13b-4a67-bcbe-75de4c22afaa", "value": "384:IkNIx6FE/QaFK5XBprIpeXxU1OiAZ2frg+3M/l1nE6LmdGUPC:i6Ra+vIpTouzSXhL3UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602429, "uuid": "15cf69a5-60b2-4607-8bf9-dcda517905f9", "value": 23272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602429, "uuid": "9d11d3c8-8027-4cf1-926b-419f4ba3a540", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602429, "uuid": "9de8c4e8-a21f-4791-a1fa-f90a32d3a873", "value": "eda77d6797a5c358892fce3f5758ef9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2513de64-1e52-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632609869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609869, "uuid": "634a699a-d705-4133-8b24-152d2e500fda", "comment": "Malware payload (RedLineStealer)", "value": "901caa99d3803e47a9fd31d101f323e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609869, "uuid": "1d16477a-d3d1-4af0-97f6-64f58ec91d6e", "comment": "Malware payload (RedLineStealer)", "value": "770a75002164e25891b3663582594cf2a82867ca3b734cc9b366784a252c7e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609869, "uuid": "5ef6dcb1-c7bf-494e-9d11-c1f5a21d66e1", "comment": "Malware payload (RedLineStealer)", "value": "7e01765a560fa71b59e8af56213b5234781640e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632609869, "uuid": "ff83e4a2-7ca2-4ada-809e-963bd30452e0", "comment": "Malware payload (RedLineStealer)", "value": "0aec416f3e898a257c258ad31b754d127b641a3a3d4b183062373b2b16ecdb8024d987c3d3d99ae8b5879f992537940c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609869, "uuid": "8021badf-ec43-42df-8325-f2599d235dc9", "value": "T1E3C39D7175FDC036E3F756755879C7A4AA3BBC326A70854B3628125E4E32FD08A22363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609869, "uuid": "b6b0ee82-f4f0-46c8-9f0f-910d17a852b9", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609869, "uuid": "12a7cbfa-c55e-427f-9833-ce16d2860acc", "value": "1536:vLYEnaH7daP+68SCNgfm1lILddVKbDPtpd5tCD5P5efDtau1a5Y4dC8:8EabiSI5W/ToD5Be7txmY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632609869, "uuid": "1cb908b7-fa3c-4735-8889-328ccba88a26", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632609869, "uuid": "115d6ca2-fa28-4e56-bfb5-dd05fcd67f61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632609869, "uuid": "0f32de54-6b02-4205-9aa9-2258baa4da55", "value": "901caa99d3803e47a9fd31d101f323e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6ae26f-1df5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632570048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570048, "uuid": "4b330e6c-56d1-4617-8eb4-226bec357761", "comment": "Malware payload (ArkeiStealer)", "value": "deaa16397cd0faa00d666c1b7c7ae5be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570048, "uuid": "d9e85575-4b7b-4c06-ae10-8a73b54f6621", "comment": "Malware payload (ArkeiStealer)", "value": "77b939e01043d645167be729a1b86cb3ba785696a935d188540cfcc2df779492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570048, "uuid": "ee0b3428-750d-4a2a-849f-89abe9e76f0d", "comment": "Malware payload (ArkeiStealer)", "value": "f8b08c6a8605e1353303cbe7465f3bb3e63b3733", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570048, "uuid": "ba49c260-038a-42f6-b9be-13ce5fac641d", "comment": "Malware payload (ArkeiStealer)", "value": "99cd898699576031ec63898537f5f31df5df600a815b2faee4b4de49427a245cb7e223aac9a42425526c640eaffa34ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570048, "uuid": "011cafb8-5b34-4be0-bd79-7595936bc119", "value": "T1F6D412107392E036E3E30B35453AC6A5657B7C322E6B448AF71C335D6E616C1EBEAB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570048, "uuid": "4950238f-fe6a-4ba4-8427-76d37686317f", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570048, "uuid": "bc1f5ab3-5d69-426f-a3c6-9e0aa11d0227", "value": "12288:vNny7DBH8fXBEJM8/nUrXf0/DkDl2Or/VCG3awofFhpOfVZ+x4K5/Sd:vlclH8fWL/nUrX5DlHbVCExotc+x4KFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632570048, "uuid": "adc183cc-aded-46a3-a115-6994c43a1656", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632570048, "uuid": "aa60b793-f462-42fd-ac90-1f6d6fff0872", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570048, "uuid": "c43210c7-1151-4392-848e-a853d7b99c6e", "value": "deaa16397cd0faa00d666c1b7c7ae5be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cb9456-1e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632605361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605361, "uuid": "01774348-985d-4714-957a-a0c4af14a8a6", "comment": "Malware payload", "value": "f272a4b098cd65d85e5728a9510e5477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605361, "uuid": "9808bec8-3ad1-4ed6-815c-96abfb5efd95", "comment": "Malware payload", "value": "77d3e2da1400ff395d2aa94b5467fc9362f23ba7a5f4f78e1604ba144a5b09f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605361, "uuid": "69940bf5-a643-452d-b5ba-bfd40614b9f7", "comment": "Malware payload", "value": "842e71b2f6888967f4d745acce394cb721a2a326", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605361, "uuid": "a43a80fc-d193-46fc-81e1-650f0df9db00", "comment": "Malware payload", "value": "01a9ddeb2e4754e10982ed0fe571e9f11e90156f77473cba15e157f9738219d6b2ecc937d17116136b2911609cb6da17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605361, "uuid": "d559a859-e0bb-46a2-9b8a-50f5b9258ef5", "value": "T1A593FA07FB11CEB7C85FCD7306AA8A0124CEB59612A4672B72B4DA6CB74798E0CD3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605361, "uuid": "344a996d-a015-4e87-b6b7-d9e43887d693", "value": "1536:nAsJi1voZzfeJTpUxwL6dEcuJiKllbkGnYmMrmz87Fc2CubFL2:nQ1gMtU9dBKl9fnYrmz87Fc21bFL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605361, "uuid": "b8358c2e-8890-446a-b660-b3dd5bac83d4", "value": 94776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605361, "uuid": "df205459-a67f-4bf6-a76d-79d09151cbcf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605361, "uuid": "a6ee17c4-cb8e-4f9c-a5ad-412b4a7e68ad", "value": "f272a4b098cd65d85e5728a9510e5477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1c9fd0-1e4d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632607846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607846, "uuid": "91c58708-f620-4d52-b5a1-a6c8d074cc44", "comment": "Malware payload (RaccoonStealer)", "value": "86777af057f2bb4768d9ed1af78f21ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607846, "uuid": "83d6672d-7a0e-4119-a9a4-72776815fa94", "comment": "Malware payload (RaccoonStealer)", "value": "784be80268709918a578161d13f1557104af4b5c148fed3735eb0e687ace7ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607846, "uuid": "47682010-1e32-4b1a-9b85-c4c118033755", "comment": "Malware payload (RaccoonStealer)", "value": "62544ef531b82abc37ca984fbfafcde8f6e38496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607846, "uuid": "df28a947-15a3-4047-9e3f-f0e7b18c3a02", "comment": "Malware payload (RaccoonStealer)", "value": "088ba8a038f17d412b9a08051031c2f2f09ce49e14274305f41b5178fe06cb6112eb323398c0c7a91e7a835d5503ba02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607846, "uuid": "851e36db-51a5-48cd-862b-6c13921af1ba", "value": "T15F940253B760D037C3A74A762A6CF330553B797A2E27894AFBAC178E1D7129046F6312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607846, "uuid": "c409a69c-7191-4066-872b-0b631ece9bd4", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607846, "uuid": "563b0eb2-c9d4-42f8-a58a-8190126fd823", "value": "6144:RPnUfYWslYjZ9/GE5l9+W5srexyLfYU5uaoDzoi1UjQRILhU7XEad:afUlC5GE5+ojxyLfYU45Dz31U+Ii7xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632607846, "uuid": "4095c2b3-252d-47bb-bc69-e1dee8369ab0", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632607846, "uuid": "4adfa069-5ef7-41ee-9499-e3d8f45273a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607846, "uuid": "f8560a0d-ccb8-481f-8536-6cbc2066847d", "value": "86777af057f2bb4768d9ed1af78f21ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387cf27d-1dcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632553638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553638, "uuid": "00d34418-f61e-4ede-b815-bcbd9540b713", "comment": "Malware payload (Quakbot)", "value": "04f2b9c1c5cb0f6274a44de86c2e9004", "object_relation": "md5", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553638, "uuid": "885d26ed-9ce4-4736-a070-b6ad66f9db5c", "comment": "Malware payload (Quakbot)", "value": "787ec180686bf54c8ab4a78294b86f85f189191b4694485f1fe16c64037522e1", "object_relation": "sha256", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553638, "uuid": "7b8d3601-fb66-4718-a91a-5921c7eb5f8d", "comment": "Malware payload (Quakbot)", "value": "54584a1842091f5bf5914a91c072843a9266a16e", "object_relation": "sha1", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553638, "uuid": "681257e8-4dc0-4332-b6bf-340a7d9c25f5", "comment": "Malware payload (Quakbot)", "value": "e9b5870bd3f3926c779b82caa1a0e9cc12eaa259f04c40c5ee369993c65236f7aa6bd3af23b4e4f5863857c0b472e8de", "object_relation": "sha3-384", "Tag": [ { "name": "1632302707", "colour": "#D4C521", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553638, "uuid": "82654e42-d84f-40f5-9c3b-90bb54153767", "value": "T144C4AE19BEC3D1A1C83C187488A1C9F27638B865AD54D6473AE93F3F5EB31C25C560AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553638, "uuid": "5ba88f53-e190-4420-9c99-e4bbe3139cf4", "value": "027524c1b132b878765c94631d07a5af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553638, "uuid": "97921a6a-3dda-4a03-93d4-230505be51d8", "value": "12288:W1ghp5DubQKErdxA+PM5miTrqZj1kENwNmhxOwNU:ldrvo5T+ZjHNwKOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632553638, "uuid": "6ba94ceb-aab9-4837-a8ab-000b8f93154c", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632553638, "uuid": "0f2de541-ef79-41bf-a197-be0b4205d708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553638, "uuid": "34f7a661-21c9-4312-b913-d232c3db58e2", "value": "04f2b9c1c5cb0f6274a44de86c2e9004.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a8b172-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632573652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573652, "uuid": "58d90ccf-8ad6-473d-8019-58b378bc82ec", "comment": "Malware payload (Squirrelwaffle)", "value": "d7f8b6db493ef9c5fdf59720b5b93a5c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573652, "uuid": "45623cc2-96d6-458e-9740-fce256d0c36e", "comment": "Malware payload (Squirrelwaffle)", "value": "78ad49a1684e7879a7235f4bcf734e1580470643513cf666a3ae68ab62b3730c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573652, "uuid": "b0a22971-6a85-43d9-8770-65c9fdcd3d77", "comment": "Malware payload (Squirrelwaffle)", "value": "2f96d3bd85816147d05665ab07ff31bc52ddfe93", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573652, "uuid": "9442832e-4a6a-44d2-a592-e80d344db37d", "comment": "Malware payload (Squirrelwaffle)", "value": "038a841f30e8021c7f779105c95d694f7b68adec2a0e1ddf2921529f2e4c270c5b92c6b1d5c50125322c95c9758bf3ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573652, "uuid": "ae1b6ed9-793b-45c7-8daa-fb4882ef0ac2", "value": "T1FFC4BF2E7ED6E261C83C1978C892C9F67178B869AD24D6833AD53F3F59F30C0186715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573652, "uuid": "1cde8ff7-2cfc-45d3-89d8-b8cdf0a4c584", "value": "b26423d4dee498862b9d2df8c7549de2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573652, "uuid": "ae01c0af-21ac-4d31-a394-aea069ea473b", "value": "12288:PpXuXXZxPJ52IeRM+2hVo8Zk5TnjakaSwGWZcoA5iqs7aV:PpXEPJ8zuVLk5TnjUSWZcoA5iteV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573652, "uuid": "cd7df9cd-b824-4ace-9839-2b875e584c24", "value": 547882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573652, "uuid": "df95fab5-7453-48f7-a62f-e8743e3fe210", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573652, "uuid": "e24695c2-89c1-4b79-aeb4-ac5b197085cd", "value": "d7f8b6db493ef9c5fdf59720b5b93a5c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2973d90-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632556957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556957, "uuid": "2f6b8d07-057f-4dcc-aabd-afa7849f90cf", "comment": "Malware payload (TrickBot)", "value": "051c20fd814ac34ffcfadd56ec872be0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556957, "uuid": "106abf7f-d958-4ab3-a2cd-0bc2188f6b1f", "comment": "Malware payload (TrickBot)", "value": "7aa215495949e721b9ae8b3b28cb728ac3b3240438e67f2cc4f3be2711d3d319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556957, "uuid": "dcf9cb2f-ecfd-4641-8af5-c4fbb6e859c9", "comment": "Malware payload (TrickBot)", "value": "6d4d301594ba01b9e4d8eac59dc839090f090fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556957, "uuid": "00203aea-04da-4cb2-8f22-bd966664cb29", "comment": "Malware payload (TrickBot)", "value": "fb8f3e6da7103f865fd9e13083b7d2af7f3fdf3f375332006b89252820f45c0bb7e0da917fe974ebf4fba32354e8f8a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556957, "uuid": "572bbc1f-7be2-45e2-a632-da9df5deb066", "value": "T149B4D03535E08973D16319308EFD07E963B9BCA147B2958F8F902F0D3C7E556A43A2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556957, "uuid": "a7659bb5-5273-4f62-be49-a4c3d8899224", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556957, "uuid": "27a2aa12-c304-4396-8a11-d7ae3ee00511", "value": "12288:cbVMh0tRyr3W3SZniM+uwkMx8nXoTT0WJZmo:WMh0tRy53lY8X2xJZmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556957, "uuid": "75eda751-6076-463e-9ec8-a33865a92fb7", "value": 528443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556957, "uuid": "cddef5f5-31fe-4a26-a61f-a0ab9bc34911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556957, "uuid": "2141507d-572b-41b1-a15a-f75e6c9cbc59", "value": "051c20fd814ac34ffcfadd56ec872be0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80ca15f-1e39-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632599405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "5ce7d4b6-eeae-4756-9efd-43f18de3c28d", "comment": "Malware payload", "value": "98a099e3fad4d781a34e3310aa24e1e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "a6d25b5d-1929-4857-9b19-5f5f39e13146", "comment": "Malware payload", "value": "7b271f465eede9ce24c3b7dd4c254309243bad9929109ae0abd102cccc7b96c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "776f5f9f-3894-47bc-a3c3-1381bd5bfb43", "comment": "Malware payload", "value": "7767f3a3e6667fb36e2416be01eed8722b36e293", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "91541bb5-8495-4471-a0b6-4a7a739e69a6", "comment": "Malware payload", "value": "d6c88b838b81a6d8a9704201b008062d5508d006b12a7823cd257b6e43f91f753b2f19bfa9b8d7aa90c4c3f32d6ad53a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599405, "uuid": "ddf8aec3-340d-4d92-b00a-41aec2523588", "value": "T185A34D6B6E209B28F79C973106FB6D24834A23E726E5D64AD19FC6001E3131D5C4FAF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599405, "uuid": "7bb6201e-180c-42c8-a15f-3ae32dc018ae", "value": "1536:VbkcdtV+bq7esYjEpBHXpBGXpB7pBdpB/XpBCc0F1JgrU4tsxI1OVdjxGbdNGFbG:VdH+cP0D53CcA1JgrUTnVNgDGFb1laWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632599405, "uuid": "5c9e188c-80f0-42f2-9219-b615e870a67b", "value": 99784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632599405, "uuid": "c582cbdb-ba65-4be8-93a2-8ed2d2e0a9ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599405, "uuid": "95e1c5bc-8b13-4e5d-b680-9f03f653af7f", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e0bfc8-1de9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632564955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564955, "uuid": "5f5e0dc5-7c2b-4c4c-8b1c-0b9c7043ba03", "comment": "Malware payload (RedLineStealer)", "value": "bf4a47885e07edbaa479bcf96063c708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564955, "uuid": "4f8e121a-2e2f-40d2-b614-e2270972ad64", "comment": "Malware payload (RedLineStealer)", "value": "7b8924763243c8a87fda3d4903d9c1a61d5fbf5677dc8e0bf2064202e7969e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564955, "uuid": "d85e3850-4e89-4146-b5f1-b52686729e0d", "comment": "Malware payload (RedLineStealer)", "value": "1ec537652c3e2e3cd13811d2fca70f2d5abade59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564955, "uuid": "cfd1a2db-f617-4c62-93f3-07d7eefb4799", "comment": "Malware payload (RedLineStealer)", "value": "20bb2e0f04213bc203d73e850b42d9a9c5a382af1db2a9d0abd2d7befd974267f70a2fabe219be054ee36ce9901f001d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564955, "uuid": "eb6cb180-dba4-402d-9be7-4756af0aaeb9", "value": "T1F6349E20AAA0C035F4F702F959BA93BCA93D7E719B3451CB62D616FE26346E49C30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564955, "uuid": "ea4f1919-eb8c-4197-a3ab-4c120d799301", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564955, "uuid": "f12aa2f7-0f5d-4b65-9088-49644ffff5ac", "value": "6144:JHZQItUDBJiPT/u22H3s0KIjTyaeNcoF:xZiJiPLuG0KTNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564955, "uuid": "7b7b00bd-844c-4384-9249-b56ac153a84d", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564955, "uuid": "6a4f1661-30ff-4d8c-aa34-542143d71948", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564955, "uuid": "d5b16ae6-0faa-4f55-89a3-953ca4d2828f", "value": "1ec537652c3e2e3cd13811d2fca70f2d5abade59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98490976-1e55-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632611351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611351, "uuid": "94881c18-b2c6-4bb8-83ab-8707d2daa521", "comment": "Malware payload (RedLineStealer)", "value": "b82226a97ad636ad175942efe9a3e53f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611351, "uuid": "9475979f-5cb6-44a9-8daf-88c978f7bfc1", "comment": "Malware payload (RedLineStealer)", "value": "7c2082318eca3dd9227c54251d81cb752482086eff02965356b0777516fece32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611351, "uuid": "70b49c58-63c0-42da-8299-e3994dcfa184", "comment": "Malware payload (RedLineStealer)", "value": "656717ddba31d87a0bc47eabeb3e0adc4ac76f2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611351, "uuid": "5a847b08-f33b-4f51-9ab0-7c90673d184f", "comment": "Malware payload (RedLineStealer)", "value": "d2a36d456d73b03618f9d7a385900f064625044ef4f7ec57803bf3b0d400f556f5f0db4b8f7fa4ef94d012e67d1b3d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611351, "uuid": "40cc51c0-c453-4047-ac06-05f68da525db", "value": "T17D44E0B176A2D071E3E71970483583A56E3BBC23EE73421AF67C175E5E2239196E6303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611351, "uuid": "4a9254c0-d579-48ec-a0eb-38c7deff0ee7", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611351, "uuid": "051470f7-9990-4cea-bf6a-4da23e6047fc", "value": "6144:EJN4ikgCGnlRWwi04AwGklnH+BzC1uj6Ead:uNPSET5i0f7klnH+BzKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632611351, "uuid": "4adafb8f-fb2b-4811-ac34-a14a42fb78fc", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632611351, "uuid": "46bd0193-0ec4-4645-8f5c-92d305cbcffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611351, "uuid": "19d7abc7-1b2a-475f-a3cf-2feb144140d5", "value": "b82226a97ad636ad175942efe9a3e53f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4354430b-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1632552797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552797, "uuid": "fdcfedc6-6fd2-4f3f-9f28-b879c5d16073", "comment": "Malware payload (CryptBot)", "value": "43448c9a46ec426c441e7941fb7de077", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552797, "uuid": "40fe165c-80fe-40f1-831a-2ef42d3e3a88", "comment": "Malware payload (CryptBot)", "value": "7d228085018d1f8ffdd1765cbc892a3c6886d81a156e25d053737597a6566112", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552797, "uuid": "92339803-d599-444f-84a8-66aa735db1c6", "comment": "Malware payload (CryptBot)", "value": "2e62e4661fc6aa3f1eb7a2028a9d3cc72eda1c23", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552797, "uuid": "23e27e7f-f811-4027-8770-6a19143602dc", "comment": "Malware payload (CryptBot)", "value": "d05d1c5953a4f8ccf63f5e85b2d73fa9157a5142f1da9c915419f381e5b43d52a1e2824e26df180ae45e4d0e12e88411", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552797, "uuid": "c19b3aa5-2054-4b9f-8ab4-c3213b0c3586", "value": "T15284CF10B7A0C034F2B713F545B993B8AA2DBDB15B6884CF67D516EA5764AE0CC3039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552797, "uuid": "342c98f2-fe34-46a8-a242-2c530aa28343", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552797, "uuid": "9cdd9949-9858-491c-8255-7980d00a1245", "value": "6144:FiHqMf9R1/8BUSEpgC1K08j83lmcImGzv8ZLDot:FiHqMfH1/dSi1K0d1mCqvEct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552797, "uuid": "2330994a-9d3d-4635-ad3a-d54eff49553a", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552797, "uuid": "e5b58519-7d06-4342-b8d5-94570145e919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552797, "uuid": "cba04322-08c5-4ac7-a3d4-ecc253ff951d", "value": "43448c9a46ec426c441e7941fb7de077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99a1bd4-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632552566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552566, "uuid": "f7da9912-b16f-4617-a74b-53f34a16f37e", "comment": "Malware payload (Stop)", "value": "8040071b467298ae58dc7adc5b58a2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552566, "uuid": "da15cb8e-2f86-4eeb-82de-ccecfb50dc2b", "comment": "Malware payload (Stop)", "value": "7d992557f91aed01868636656b536282273feea15fc95f3bf4a42f4b7443fa77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552566, "uuid": "05b923e0-07eb-4cd1-a6ed-82d24e731cd6", "comment": "Malware payload (Stop)", "value": "2da6c984afd17193ba7aae3d554e44aebda4cc14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552566, "uuid": "d499e87b-9506-4344-876f-fb9667ff4920", "comment": "Malware payload (Stop)", "value": "8f40e1404bfe6ae7a035225100097f732c980965c14f815bb4c8636ff2f19025a0a30034e8fe166c2844456c52092be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552566, "uuid": "ad5f9e36-4af0-488d-b56f-1f04f1fbc613", "value": "T14B05023063E0C039F0B712F659BA97BAA52D79B1AB2451CB93D257EB4634AE4DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552566, "uuid": "2bdb5327-a28d-47dd-8a35-341a9025e765", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552566, "uuid": "38219a36-9888-4440-b1bc-62be320ccfd5", "value": "12288:YhfukjqzlcLA/VxL4SNnTADyQtNjR78TlJMcSK2TSXR47nrjfVU8+PbGb:ij8l74SdnWNjRcnC6228Mba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552566, "uuid": "fda49d32-1d43-4f16-a6bf-dd9ff9d85ca4", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552566, "uuid": "1bce069a-5f88-4d64-bafe-97ce8c35387b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552566, "uuid": "231e1d8d-85eb-4315-bdbe-300445d817f1", "value": "8040071b467298ae58dc7adc5b58a2e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed98344-1d9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632532630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532630, "uuid": "86223667-f702-4324-abd7-d18c4eaf05b4", "comment": "Malware payload (Gafgyt)", "value": "16d7c4f663ed12a7a05d1850dc153aa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532630, "uuid": "90451b2e-c40f-498a-bd10-5819ba2bb111", "comment": "Malware payload (Gafgyt)", "value": "7dbc74bee523b982cef7a096053470c16c810c86b951e10a45f0b2fdfcf0cc09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532630, "uuid": "a1c68eea-2614-4571-b22d-28b1443f3c84", "comment": "Malware payload (Gafgyt)", "value": "95e168036b1dba2d664c83ea656204af0fc6d826", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532630, "uuid": "d25fb927-3500-4042-a633-6e9bdd6a17b7", "comment": "Malware payload (Gafgyt)", "value": "229493ce8cc535f9e89c64b3a3e784784232365ce8b87924806a8c0804c7ba1d68eb47404863e344c5b764adc7b2b893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532630, "uuid": "6fe139d5-d10e-44a7-8120-baccec656987", "value": "T166043A34D650471BC1E227BAE68B424E3B234F57A3D733198938BBB43FD27A95E22511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532630, "uuid": "58909142-f80d-4f42-ab39-95148d0993f5", "value": "3072:8fGI0cYalwrFpJxlmczx0b1aumjRZM/9H5UmUwwFY7kZNQ:81YalwrFpvlD0boumjjM/9H5UmUwwFYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532630, "uuid": "d30ea62e-6424-4585-a0e7-c10495b9a8f8", "value": 181045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532630, "uuid": "a873f706-4a48-4950-8e93-1ce830981896", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532630, "uuid": "9e1895b4-fb94-4ce2-9398-e2afd6b2e83c", "value": "16d7c4f663ed12a7a05d1850dc153aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fc84aa-1e31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632595701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595701, "uuid": "19cb6e3b-eaf2-454c-82e7-3003a3231e5f", "comment": "Malware payload (RedLineStealer)", "value": "345b088a2dc1b73eae9a364dbafa7873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595701, "uuid": "03554338-282b-454f-b255-15d31ae2b341", "comment": "Malware payload (RedLineStealer)", "value": "7df2379bcb4fa416143303da3115a1d90d90dca0339e018901f811ec02f5b6cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595701, "uuid": "68ae9614-0c4f-478d-9810-8e051caa7522", "comment": "Malware payload (RedLineStealer)", "value": "e3fadd79dad1b28aeb32757ff5e9c8960b17d455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632595701, "uuid": "04f5ea35-d8ce-40ac-961c-1ef8565a6efb", "comment": "Malware payload (RedLineStealer)", "value": "b6fb1924287b846a6d67529d76390be017e9593d27239ede54bc3aae65247550f226e512b18ee3140fa893513dc45fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595701, "uuid": "508c70fb-a23d-4017-b546-eeb9f2164ada", "value": "T10F44E12176AAC431D3E7453519B9D2A06B3BBC223F73454BF61C1B5E6E71E818AE3312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595701, "uuid": "6b476555-0fab-42a0-89f6-56dda3fcc337", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595701, "uuid": "53941107-4c9d-42d5-af26-84897567a4c3", "value": "3072:gEFA0b2U8kijLL2jVUfazLm/bNBxakh6jnNvEksEhzZMiROzELf1V5KVyANXuBS3:gnwteLIVUfV/EkaNsmzZM4AN2Ead", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632595701, "uuid": "dd072db6-605f-4a43-9221-1ef42e8391b5", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632595701, "uuid": "eb1aa517-7fad-4b56-a69c-ff8938b3e222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632595701, "uuid": "c92b9bb1-fed7-4883-81d3-bf0bd1f82d66", "value": "345b088a2dc1b73eae9a364dbafa7873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b92be9-1e40-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632602435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602435, "uuid": "9937e6ea-09af-410c-8b7e-d36c2d3a2f54", "comment": "Malware payload", "value": "d97bb56ff90628d4a7393cee6c29a09c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602435, "uuid": "51dbeb4c-7789-48d0-899c-a163593b4e02", "comment": "Malware payload", "value": "7ecf2a7bc07823b4236ce7429b743cd62bc8839dc5f9e379666500f3b0a22fae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602435, "uuid": "bd2fd3b4-b670-4da3-ac02-465452ae4706", "comment": "Malware payload", "value": "797fd690abaf0d1e3bf9dfa319d47db72a5445c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602435, "uuid": "6f462751-7122-475c-9805-f5bfcf1c9df2", "comment": "Malware payload", "value": "ab798976dad9bc22e2859d8f519edf373a3e195f3ae7e95bf3b48c6e5461737c5bd9aea1ab8d6e9bc7f6f811a7fcbf55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602435, "uuid": "a6be7b68-623d-4ed3-be12-ea1175400d81", "value": "T102B2090177180E87E2E31DB02F3F1BE597DA8E4220786158B99BBF85D270D324096EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602435, "uuid": "0031cc9a-b8a6-4694-8810-c093d74e3527", "value": "768:EWyKpbrjFRpv/Mrb+p32QXRhonS0ivgtpHY:EWpbdRJCQUnwGHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602435, "uuid": "8d0ee826-4f95-4f46-8590-945e5ccd3780", "value": 25528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602435, "uuid": "e154a3bb-b4cf-482e-94f1-5676b77ac66f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602435, "uuid": "0781d7cb-0e41-4be3-9c6a-9c24d4e4178c", "value": "d97bb56ff90628d4a7393cee6c29a09c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07764bc-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565409, "uuid": "3af53858-4268-472e-a54e-328b439b59c6", "comment": "Malware payload (RedLineStealer)", "value": "69a1d114e5a10c4dca5e18d62deb95c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565409, "uuid": "c489eba4-3759-49dc-8e68-c9be64d8680f", "comment": "Malware payload (RedLineStealer)", "value": "7f272dc930b81820579f57be5c3cf8f1a87fe6fe2fbd3e631b27957eae6f6f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565409, "uuid": "d8610411-57ae-4e1c-a50b-ac3a0d007149", "comment": "Malware payload (RedLineStealer)", "value": "d25aaa843a63307d902ab49e86598e4ab4d4a508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565409, "uuid": "ffe57fe2-5404-41f4-8c71-982f433dfcaa", "comment": "Malware payload (RedLineStealer)", "value": "c3c5d66a93d2fa35555b2a37b307871c572f2a73ce5f2bc6597333c47618bdd8eabf4f68a22e731e9b1541b7a058af2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565409, "uuid": "fbc10c60-7697-4add-9cc8-beb469e7720e", "value": "T1AE64E10139A0CF32C99311714F61EBA46A7B79225A718387275E36AEFF3138077E6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565409, "uuid": "92283b56-e22f-4a8e-ad17-af99050b0880", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565409, "uuid": "64c49c33-e3b0-4f53-9d02-ea78eaa2cfca", "value": "6144:+yUyLeyinWd6q0dFHslV+v0fXjsWmiATFCBwjtw:jteXtqgGX+vmA5CBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565409, "uuid": "676a4f61-2743-4ade-ba94-d8af9fe37cbb", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565409, "uuid": "825c02ec-a4c5-4d5f-b9ea-d0ee5d21adc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565409, "uuid": "72d29427-845e-49ed-a745-c3b1872c513f", "value": "69a1d114e5a10c4dca5e18d62deb95c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1c69ef-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632552728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552728, "uuid": "8275035e-edbb-487a-b114-faea44c6e8c5", "comment": "Malware payload (DanaBot)", "value": "3ea6629e2077a7bf19696f4fcf9ee1e2", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552728, "uuid": "b8d68e3f-ae2b-47d5-8878-88fc2aab90cc", "comment": "Malware payload (DanaBot)", "value": "8174054c67035ea2aef476a22bb14270d36299cc62adfd2dc2900a7686ce156e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552728, "uuid": "05a21812-45ab-4575-a3ce-d6b35b64bdd8", "comment": "Malware payload (DanaBot)", "value": "3378a9ab21aac783831cf57d820fad369d435e6a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552728, "uuid": "7c6ca1d3-7eb6-4b80-a6a1-060d25a9ebe4", "comment": "Malware payload (DanaBot)", "value": "a674384204d7c8e4c76013f1166ef6bd39aaab10ac281acce9eaa67b48c346c6d305651190cc74de9668af1efaa4687e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552728, "uuid": "34753a80-8324-413c-9900-1f71f6f2e7c3", "value": "T13C451210B6E0C03DF5BB13BA49BE57B8A52D3DB07B2845CB52D626DA41A42F4DD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552728, "uuid": "4dbce9b5-0349-4960-a3f6-33a210bd9e95", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552728, "uuid": "15475b26-b9b7-4514-809e-ad1044d96b85", "value": "24576:Xj7ljBKdIp7Jj4cu572oegsoY6J2qo4R6QcW3B2ETqraFJNP3v4w6cJt:1B627Jm0gknqo4NcMJeoJew6qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552728, "uuid": "67bb046a-c803-4cf5-bd5f-b3a7eb5d2767", "value": 1203712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552728, "uuid": "ebd84c93-ae63-489d-aa8d-fa1b20d64fe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552728, "uuid": "0af9a52f-57cf-4d40-b5de-8819eded04af", "value": "3ea6629e2077a7bf19696f4fcf9ee1e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3edf290-1df6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1632570622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570622, "uuid": "5cb203ab-f52a-4e09-8893-2bee9fefec7a", "comment": "Malware payload (Tofsee)", "value": "71120847eff09db71c9795b44128a24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570622, "uuid": "9dec54bf-d688-49c0-adeb-0ebd4beb5510", "comment": "Malware payload (Tofsee)", "value": "8350538160b089becbb7142d16ecf8089b16fbf11ead40dc1169a9e6104c0304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570622, "uuid": "66e31570-09f4-4229-9579-cf2f40460ab2", "comment": "Malware payload (Tofsee)", "value": "1a63abea5fbfb65d786aee239428a06c74f8051e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570622, "uuid": "a32c6382-116d-48c3-89ea-8f1c9baadd1d", "comment": "Malware payload (Tofsee)", "value": "19c4e0a373086a670e5a46d5c547c479526eb83599716dca58ea5c33817db15ad435d871769ccd81677fd48c4ed004a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570622, "uuid": "09b0ec56-1beb-4d79-84fe-33dc1b90c74a", "value": "T13EE38C1076A1C432E3A315715D6586A19A3BBC323E77CD7BF64C275E4E22281CBE6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570622, "uuid": "692b4046-63a7-442f-9318-9ced30a0e08a", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570622, "uuid": "67cc2906-6348-4e2f-a2ea-12d973be8392", "value": "3072:vDD1mCNnuV9s9UW70V8u5pGzxuIwRS9H6dYe:f0CNOW7uexuFREad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632570622, "uuid": "eb6f9ff5-5d29-49b1-a2b9-3f9ef7e7d5ea", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632570622, "uuid": "e0929340-c286-408b-8957-0a8c7e442306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570622, "uuid": "27b30853-f3e8-4c78-bdbb-75c976cb8e6a", "value": "71120847eff09db71c9795b44128a24a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f2d741-1e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632596387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596387, "uuid": "39ae2a72-888b-4478-b409-9523c7109c91", "comment": "Malware payload", "value": "85d9793efd6bf81da4a96c6223417b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false }, { "name": "ta428", "colour": "#94C18D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596387, "uuid": "2db014eb-0ab8-46a3-b868-cf940639904a", "comment": "Malware payload", "value": "8454f09eeeb0e8114ac51a84ca74a99d0266448bd0ce28ccc0597340dc4c4026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false }, { "name": "ta428", "colour": "#94C18D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596387, "uuid": "335bbd5a-28e5-439e-8deb-a2a5dc11c9e7", "comment": "Malware payload", "value": "307cf3b5b2ee6c978bdb8521288810bd87ff7087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false }, { "name": "ta428", "colour": "#94C18D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632596387, "uuid": "45734c2c-3e2b-469f-b985-8a1e23878cb9", "comment": "Malware payload", "value": "edf36c986ecdb300196f2257990d3015b11e9784dc3a97c8d64f3bab0f04ddd9e1dea70b381cf105e12af676b8c2801d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ncctrojan", "colour": "#CB0EDB", "exportable": true, "hide_tag": false }, { "name": "ta428", "colour": "#94C18D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596387, "uuid": "66b596d4-ad87-4b61-9823-c86d4349ac43", "value": "T139420A05B78C87F7E8EC07750D73460413B4F2129C22EB9E5DCA669A6ACB78485923D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596387, "uuid": "7f46cee6-721c-41e9-bc14-a6e0091dd066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596387, "uuid": "52191556-862f-4f9e-9103-c8e9cff61163", "value": "192:8enBHH34yx/7y/WACRGHvKuaaqXCxTDvi+cRtXGeT08I/I4:HBHFEWBRLL0Dvi+cDqdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632596387, "uuid": "2e641c5b-57ce-4ce5-8b6a-e06a76550d91", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632596387, "uuid": "b7b919f2-a935-4563-ae19-00933855f8c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632596387, "uuid": "eb71d949-82f5-4331-b07c-7ea4c7d83e8f", "value": "#nccTrojan.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740bc82b-1e23-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632589816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589816, "uuid": "4935c62e-3b00-478a-b6a1-0b014166fe9c", "comment": "Malware payload", "value": "60b9d476ed937d310d54ae0e35973974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589816, "uuid": "dfe1b1a2-b1cf-46fd-86d2-9ca8efd45af6", "comment": "Malware payload", "value": "8497b714d64bbe043d4ef481a213eca88cc48a1dc98ad43443433c35e4af211a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589816, "uuid": "3fd3574e-5251-477b-aa49-d3edee937f89", "comment": "Malware payload", "value": "1f45480e1c3f7899a46500b83538643ecae76687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589816, "uuid": "02478916-d75c-48cd-ac10-b498aa7ce513", "comment": "Malware payload", "value": "ffd792385b627db106d0f3ca3bf1bf90b28711d11f3ed60ba76d5ca934d858866aa218df5ac5b174c8555700f771028b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589816, "uuid": "f7c7b7d7-778a-427b-925b-b17f7f06c653", "value": "T1A0A49D5973A904F8E0B3C17CC9935A06E67678160361D7EF03A8D6762F236E05E7EB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589816, "uuid": "1a7c2bda-d661-427b-bf43-3acde23b913e", "value": "300d321731799d078aeaa3f624037f49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589816, "uuid": "8f22ed04-0408-4370-bc36-16191d8af9a8", "value": "12288:TBc28BcwtHkJ3iX8jpPfw+oaq79TxoK+Fq/8j:tc2I16yX8jpPfw+oa2TxdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632589816, "uuid": "713f3655-742e-4b0a-9c1b-e1247d6afb5e", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632589816, "uuid": "b4addc4f-fde9-4077-8200-b53bba4ea144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589816, "uuid": "750c03ff-7600-4f40-8fb7-87346115baa5", "value": "60b9d476ed937d310d54ae0e35973974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bc656c-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559913, "uuid": "9e65b8c4-e9c5-4a4e-88ae-b9ecdd762ae0", "comment": "Malware payload (RedLineStealer)", "value": "5517794843a452782920419d3d61307c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559913, "uuid": "262e8685-e01f-4c2b-9561-63bf1ac59316", "comment": "Malware payload (RedLineStealer)", "value": "850bf204d10192a6b10d5ccb364fc8a515cfd63bd178ce7e54f664c7c582785c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559913, "uuid": "7978873d-1c9c-4da5-ae27-f115f7ec2154", "comment": "Malware payload (RedLineStealer)", "value": "126e82e20622465e8c70e8b90f4ee9f510b4951e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559913, "uuid": "39d8ec4d-d6ba-4341-b067-c637a3ab39dc", "comment": "Malware payload (RedLineStealer)", "value": "ca91c0ee86b13536e8d8cbaf428acc9697b974ad3acb5f6a07f74ccf584ff3642c1b6fd6125da58ed35ebeb8baf46078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559913, "uuid": "50430b47-5b84-4fdb-a7e4-5395bb36bed5", "value": "T1A224E02035F8D532E7BFCAB58571C7D65A7B78232E60859EE630164E1E722C09AF5303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559913, "uuid": "51fdb9ea-6bb0-459c-9ad8-8dca1c45bfc5", "value": "47bd1659724c857851ce24d0b21faf34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559913, "uuid": "b6db3f90-f03a-4754-80e6-dfc9f4270e7d", "value": "3072:2sZGD5U2TGhhdtIqXg+AXrr40Ixj5K450U6HUKRR7LlFw+8I5drZ:2sZQ5erAXrbIxEOW0KRRVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559913, "uuid": "e3cc94f9-3c05-43c8-b8b6-023628c10586", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559913, "uuid": "fb981cde-d0dd-4e11-a1dc-a0de6bcfb4ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559913, "uuid": "d440f9b3-08ee-4593-8815-5824bc31e8af", "value": "5517794843a452782920419d3d61307c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c974bf45-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556888, "uuid": "dda242b6-a90f-4328-990a-829252c95ed6", "comment": "Malware payload (RedLineStealer)", "value": "37b31d4764962fa9127fb3952f3e634f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556888, "uuid": "92fc90ab-a3c8-46b0-95e9-3a7049fc411f", "comment": "Malware payload (RedLineStealer)", "value": "862f175e35e5afb0468f7c073346599588d9798521ffd2e2423c88f39aab787e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556888, "uuid": "0803208f-f544-40f6-9d21-e9601aec4f6c", "comment": "Malware payload (RedLineStealer)", "value": "6b8a4fa568998381f8f2c790f378d54fcf827d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556888, "uuid": "07e1a143-8412-42c9-81fc-e2f51f0acbe2", "comment": "Malware payload (RedLineStealer)", "value": "a60a1435ded02d1be017ee4161094da2312912fb7e0c2376e4773f4b010ba2f83dd021447cb844ecd1e356f160c4a192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556888, "uuid": "05ebf302-3c2e-4f0d-b6d5-244bcaa67bb4", "value": "T10C34E121A6E5D832D6FB4A395B71C3542A3FBCA3AE70838F6649578E0F213C1B915317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556888, "uuid": "bba5e4e0-242a-429b-8633-b8ae8465d576", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556888, "uuid": "26c84e3f-562f-4123-ab5b-dab080fa5ec9", "value": "3072:tuYIbfb5E4uSK4QJdqHaAIGGl+9yKNBdtbiwEZn/M/sD5JgkPU1Y5:tuYIbfbj30dJhvKNBPWlnn81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556888, "uuid": "be3cc7a9-d4b0-4556-aef5-4ea8812546c3", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556888, "uuid": "c3b85028-f074-4a4d-b48a-a3a6f401a23d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556888, "uuid": "8893f83e-ee50-4566-8f62-b90774a99141", "value": "37b31d4764962fa9127fb3952f3e634f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7407c825-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562328, "uuid": "da3647d4-da98-43e1-a4e2-f253de1e04f6", "comment": "Malware payload (RedLineStealer)", "value": "ca95a48c9f7b81d825f0995befb2b2d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562328, "uuid": "c9b08ebc-71ac-42bd-990a-41e5e6bd6d97", "comment": "Malware payload (RedLineStealer)", "value": "86c9ebeb1c7d914bcf6ab2d787496d8f01f3d51fe965b29a6a2e4476b9435f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562328, "uuid": "e8a1466c-de41-4381-8c42-52c73483db9c", "comment": "Malware payload (RedLineStealer)", "value": "bd3634c09302389d99be2bbffc158b3a4b8bf8cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562328, "uuid": "c0ff419a-9e53-4cba-91b1-ffcc4e069e49", "comment": "Malware payload (RedLineStealer)", "value": "a9792dcc0c099d0568842d78ba62a7c355b799ab9ee8b46a06062c9b491aeabf1b89c2495c0478ae1bdb117d4414481f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562328, "uuid": "9d42f10f-bf7f-489a-98ea-b4023e3f0d96", "value": "T14C74AE10B6F0C034F2F712BA59B993B9A53ABDB16B3885CF62D41AEA56746D0CD30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562328, "uuid": "cfaa60bf-6af7-428c-8340-a1c6f587d8f0", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562328, "uuid": "98ae0421-1e0a-40b7-b84d-ba9368cb2726", "value": "6144:6l8hmoRkhbBZ/3stt/fshYZGbxJPM7vuDh+yT:6l8hmoRkhbvsPf1w9JkKDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562328, "uuid": "d06a32d6-01ec-4226-b608-69ee86ddedb8", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562328, "uuid": "0f69fe02-9059-40f0-9608-2ee1aced51d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562328, "uuid": "5c10f3a4-7e5f-4b7e-b65b-e994b482a567", "value": "ca95a48c9f7b81d825f0995befb2b2d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d0bf38-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565411, "uuid": "d3f7872b-bf4c-4916-937c-8249e20ded11", "comment": "Malware payload (RedLineStealer)", "value": "3096b380281ffacbe99ca2e612ad3226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565411, "uuid": "1c56be8f-0bc3-4bd7-8077-6d016be97e33", "comment": "Malware payload (RedLineStealer)", "value": "86e970f14ae822ee0f4a3f6601a1bfac4b5d9885358679a0e016f486f7f34207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565411, "uuid": "dec519b8-43e8-4de4-beba-3c0a36cd4913", "comment": "Malware payload (RedLineStealer)", "value": "8075bff6efa5f4aac16453a976d5ed3cb678c73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565411, "uuid": "1ec6862d-150c-420d-bfa4-fa69b1d8f793", "comment": "Malware payload (RedLineStealer)", "value": "a2016495add49be9978f8bb1db4b1d421449bb3537a3b40e6dfb53ab5410516480039fa19307b498771c708f2e0a3646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565411, "uuid": "6c9da6f7-5cbc-4b28-83f1-b0122f8448e7", "value": "T10B34E02171F1C072E6E389356974B3A16A3FB8621B7286DB7B59132E5E323C19772313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565411, "uuid": "7730a5e8-e878-4950-9b9b-28dd0198f5e4", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565411, "uuid": "1d1fc3dc-eea2-4cb9-b572-3ec4d4b8b8fe", "value": "6144:Iu956byLjWUyEZrn/jKiStFqG42MMIBO:IfKtZr2iStoGqTBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565411, "uuid": "0beeccad-7aeb-4be5-98ac-0ca1f1d7b7aa", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565411, "uuid": "1b2a4049-90a9-4dea-acf2-4db043db44cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565411, "uuid": "830f7375-9f3a-48e5-b7a6-c7373b6b51bf", "value": "3096b380281ffacbe99ca2e612ad3226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26791831-1e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632580237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580237, "uuid": "aa8e8c9b-2493-47fe-abf6-5d5d3c1d20cb", "comment": "Malware payload (RaccoonStealer)", "value": "885cb6e5ebea328d840713882a7ff412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580237, "uuid": "22e133bc-20ac-49da-8d3f-89d5ac447745", "comment": "Malware payload (RaccoonStealer)", "value": "8705fa55cba407024395f636436eb29457d26c954ea2d581d0d19afade1ee3ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580237, "uuid": "22e76b9d-6d9f-4884-98d6-d679cc63b822", "comment": "Malware payload (RaccoonStealer)", "value": "7a8f0cfa23054e9bf2a16222d9a02aa80546d55a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580237, "uuid": "dbd158e0-135b-46b0-b6a6-1f7134dc6117", "comment": "Malware payload (RaccoonStealer)", "value": "75a80570542c35a59d2b9ae41404f549764d822b4f717663fadc73484741b088439be6c77f267da502e1e79f2a400ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580237, "uuid": "9e521653-b68a-40d8-aaee-b9ec0d0c53c5", "value": "T1AEC4F220A3E0C035F4F712F659BA97B9B92D79B16B2840CB92D627EA56785F0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580237, "uuid": "c774a8e0-e6be-46dc-a280-fbdf4cb6a12e", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580237, "uuid": "632f2c4f-3f60-4b53-8930-1d15bd5fad9e", "value": "12288:IUC4zjfxlJH1ZgQ+oWw/8jrtzi7/JM9tSb:PjJlXZgOWw0jdiTu9Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632580237, "uuid": "a5ef8213-2a61-4f8e-a428-4187cad99f68", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632580237, "uuid": "0ff1ef29-325e-42a3-8a8e-69eff3cb8c46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580237, "uuid": "0d03d015-c7e2-4f06-aa76-4b79ae3cdb16", "value": "8705fa55cba407024395f636436eb29457d26c954ea2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a5cc57-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562027, "uuid": "72240997-3557-4167-8683-21531decde6b", "comment": "Malware payload (RedLineStealer)", "value": "ba63a377d5bbcba91c89f77bd31313db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562027, "uuid": "7d1da5ee-974b-4e99-b37c-84887fedc412", "comment": "Malware payload (RedLineStealer)", "value": "8759db21d8300d0db85fb67560ed9d0553d8f93d8f92e669e6757e742cc0db3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562027, "uuid": "2630dae9-9a77-4433-8f54-a3ae991e6fde", "comment": "Malware payload (RedLineStealer)", "value": "c873f22e4d08480f632f6335febf4ed873b2ef7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562027, "uuid": "a10573fa-269b-4d1f-ba9f-57d48a69ca9b", "comment": "Malware payload (RedLineStealer)", "value": "244950ef995a55885fa5a9c2c77b154863094653e81c80f217ca00bec7507ec18bb72b2bad2bfd1c9b38989560cf316d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562027, "uuid": "a7d25768-5ac9-49ba-b815-9e34529dd0eb", "value": "T16D74AD11B7F0C034F6F706B949B993B8A93AB9B16B3485CF62D426EA26746D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562027, "uuid": "4187e93a-ce5c-4702-8cfb-26f256e6e94a", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562027, "uuid": "b2894be6-8eec-4bed-91a7-beab23209d97", "value": "6144:OVAmSLoN0ybBZ5/pw6Cw+BbDC3pGtToKuYmE7:OVAmSLoN0ybBpGDCtKufE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562027, "uuid": "e60e5c2e-405c-4552-a4a7-935ec4d80bbe", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562027, "uuid": "ad3ef0bf-9972-4bbe-9791-981c11153523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562027, "uuid": "17300235-e964-4a98-8e7c-a22137862770", "value": "ba63a377d5bbcba91c89f77bd31313db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a06e3c-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "eb50c26a-ba59-4c6c-93c6-760109117241", "comment": "Malware payload (Gafgyt)", "value": "a9f25d0545e52fee2099453c3428710d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "c2eb9b68-055c-42e7-88cb-405a0da18d46", "comment": "Malware payload (Gafgyt)", "value": "87ef4750e85c5d9e14ab78db941f502f849ef85ee901caa029edd63921d2b879", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "0e04405f-e8f4-476b-a805-ce309afb3375", "comment": "Malware payload (Gafgyt)", "value": "4f1368aa44c974e6aaa71d598a434ddcd80aba55", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "49fbbfaa-9e73-4c5a-8545-f9e049fc4a46", "comment": "Malware payload (Gafgyt)", "value": "86f035c29bf8a0cc99cd8f922f50496319649424353b24f767bcfa03b19fa811f3a6f0fca8bf58956297b8680f955e82", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "ddb3c459-6182-481a-8a1b-ba6c480deb12", "value": "T1869329239762C67BC0C756F82BDB95629923B47D0B37321A73E8BCE81B169C85D6D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "2f92a344-ea1d-4948-a35d-c51e2a3f839f", "value": "1536:07v2Y3l+AfJFbwRuthaVPP6monND2gR3RNTXPwXmoIYuOVje+Z8ne:6Xl+AfJZ5thaVPyLZ2ghRxfemrYuOVyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563404, "uuid": "d35753ba-c62a-493e-9974-9e0f1e80b51e", "value": 90187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563404, "uuid": "410b5fb4-25f9-4170-84c1-5fbbda98d7af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "59238c80-46b5-45ba-8ca2-b8037d5289b8", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a88901f-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562607, "uuid": "ddb6cd6b-81ea-48ca-bce5-9de8f41ebeb7", "comment": "Malware payload (RedLineStealer)", "value": "9f7ff49ca6de1f5fba7ebbaf5ab207a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562607, "uuid": "ea0130ba-c7a5-402a-bd19-78f9bc075fb2", "comment": "Malware payload (RedLineStealer)", "value": "88808ea675c3ba3518ca7ab7b48e65e6a9a0127e33fc5148822039ded25399dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562607, "uuid": "6f19e7bd-3208-498f-b522-7243e3294743", "comment": "Malware payload (RedLineStealer)", "value": "63e21433593eca715c1ff9e490a08bdad7fc473d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562607, "uuid": "3c72faca-557c-4b87-831a-dbfae38c4d70", "comment": "Malware payload (RedLineStealer)", "value": "dcee7a36f439eb5831503713a7f24cf33f4ad297b4b5bf9d854e739dda608615b291bedb5a431dd72b373eeaa3b04ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562607, "uuid": "5c43c790-31e7-4318-bfcb-29c238980154", "value": "T17474AE10BBE0C034F6F712B949BA93B8693ABDB16B3481CF62D516EA56746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562607, "uuid": "41d50f14-8466-4c35-800a-6b476c373f57", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562607, "uuid": "0cdbc73a-5ef2-4a86-8763-e0abc02881ec", "value": "6144:HaUoIYQ7bQ3G7QNfpB7ox38K1BUiwwnY3xegCWPc:HaUoIYQ7bX7k8x3djUfwYxyWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562607, "uuid": "f7f21617-26eb-4f83-a2e2-2f4fc72fd9ad", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562607, "uuid": "2bcf721a-5b2d-4b8e-b4df-545334e0d433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562607, "uuid": "467e5182-32db-45a9-b838-ef70018f7108", "value": "9f7ff49ca6de1f5fba7ebbaf5ab207a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37e9edf-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562112, "uuid": "31914bf1-8be2-45aa-ba80-6dbbf2fd4359", "comment": "Malware payload (RedLineStealer)", "value": "75c2173c3357e93dfb1c7cae3cf06ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562112, "uuid": "f1c5c140-d102-4acd-ac8a-5a3fd8ae8d76", "comment": "Malware payload (RedLineStealer)", "value": "88d7f8a03335116550843fc11f768b259a7cfbf7b4d79a4d089db721fb131432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562112, "uuid": "78e91cea-39ee-424e-8603-54592d072342", "comment": "Malware payload (RedLineStealer)", "value": "1f9e9b7c7dfbcbc2d15bc98e44e969e93f11ad24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562112, "uuid": "8f6538ab-b325-4f3e-969b-7de923dc39c7", "comment": "Malware payload (RedLineStealer)", "value": "b397f73e76d4ff9b7ab1e272ab2627292207f397d8ef7d32f669a6dd6796131fb0e6b9ffe828cc567865a47d60daaf55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562112, "uuid": "e9cd8877-eed7-4645-a685-f4e25626f9f8", "value": "T1BCD38077416150A6C5B82730F4A95F0B7E6CDE241D80B2D8F04EB2EADD3CA4D8EF5265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562112, "uuid": "8ce5d8ff-0e47-490f-9816-f8ec6a374765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562112, "uuid": "bdefe80f-467a-47e6-9cc0-e68d1724063d", "value": "1536:+Dl7qK9VRnl8TOqORld3hJVBV8dEwYYe:+x7qK1mTOHVh/UhYYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562112, "uuid": "d0755bff-4bf2-4044-af4d-f968fa1081d6", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562112, "uuid": "cb7367da-1ab3-444e-a2bb-0fcde698a66e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562112, "uuid": "628ac158-7ec8-4715-ac50-bddab99381cc", "value": "75c2173c3357e93dfb1c7cae3cf06ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936bf764-1e5a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632613491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613491, "uuid": "c3ee1a34-b55c-4c8e-a8a6-d041a26240fd", "comment": "Malware payload (CoinMiner)", "value": "a88886756e87735339ab0d3d553263f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613491, "uuid": "5dd69836-8e6b-42bd-83db-2f4ef4d566e8", "comment": "Malware payload (CoinMiner)", "value": "89bad428ef1f3d8d2217fa8fbf5421824383232f60c1d72fb4ad80ee0c56663f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613491, "uuid": "aa670396-d3f7-4c82-942c-55f7a934a694", "comment": "Malware payload (CoinMiner)", "value": "affbfe893d1da0c3120a2228eebba1814984be41", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613491, "uuid": "ace33603-c0c6-467b-8c89-f1b066ee1a01", "comment": "Malware payload (CoinMiner)", "value": "fab8ce4813c3dc003b85ac183abe91a30da7e7d93c233e447aae00cb556e224d1a2e44e3f08577410eb83a6b1f37547e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613491, "uuid": "a1d86f60-a438-4684-9f34-eed7f7df7f41", "value": "T1EBE39D2076E8C0B2D3A3163549759BE16A3BBC727E73994BF25C175E1E312C18AE2353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613491, "uuid": "724de2d7-69c6-483d-ba09-976804bc11be", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613491, "uuid": "646c1f7a-60f7-4281-858c-89352104ec93", "value": "1536:0SmkQu2XBbAfpKmKPpo5wAEATetdPTIJ5PTvML58WbP0Lx/b91vF3iW0zT+RooRT:2D1mixPdTgvML5pbPwx3SX/S9H6dYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613491, "uuid": "7721fe0f-977e-45dd-bfd4-cf167c673e15", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613491, "uuid": "efbd3b93-b937-4916-87d9-629709cf247a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613491, "uuid": "6a0915f3-9eef-4fd8-ab31-7917c2b16502", "value": "a88886756e87735339ab0d3d553263f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d46a34-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601259, "uuid": "a9992e4b-f9d1-48e3-99c9-6a10fc3d583d", "comment": "Malware payload", "value": "284f95e2ad2ca570cd03a0f42c3f5d0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601259, "uuid": "b020e5ca-cc9c-4e11-aaae-8da1ed67d02d", "comment": "Malware payload", "value": "89d9e28f3f7118f83adeade56a0caae79d583efda93e7ad9a18e2fc2501da554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601259, "uuid": "050a6c8c-a98e-4c52-9288-b60f1d17abdc", "comment": "Malware payload", "value": "74de9e789175eac292547e438c6dce872200d48c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601259, "uuid": "a1799e2d-080e-4027-9fbe-70b403962a2f", "comment": "Malware payload", "value": "f55bce756fa9939cfbec40a41253b51bb20e7589a772ccb888d25f4bbcd60771e0736dd5b037f92da25186aceb56a8ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601259, "uuid": "158ff977-56b2-4dab-83ee-398d24ca56dc", "value": "T199F2F12065466164E2231C3199CDC182F39D8B3AAACB7427179410FFFF9A85309F7B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601259, "uuid": "4a2ac8a1-aba1-487f-823b-be917d6a8cc9", "value": "768:hzxQKKqdDkDBcpUtGFYQuHaDQxmw0vM3UtENoonpXDZOv8k:RtYDB/twYxmw0OpF+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601259, "uuid": "d8864b45-f23e-4e19-bc9a-10fe9fc68a62", "value": 36564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601259, "uuid": "5968f162-d378-40e6-a27e-8a67788301bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601259, "uuid": "d99b737e-83c0-4ca0-92d8-8d778150d8a4", "value": "284f95e2ad2ca570cd03a0f42c3f5d0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ed803e-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559271, "uuid": "d17ea3a9-c53a-4ff4-b2e6-7f4020664e63", "comment": "Malware payload (RedLineStealer)", "value": "229684c098983536196cbb531cd52c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559271, "uuid": "2aae8685-159a-4199-934c-820d643c8a7b", "comment": "Malware payload (RedLineStealer)", "value": "8a084943c9646b225021d55f472e2d10633079a2158b08564163f3602b237360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559271, "uuid": "a803f50a-d5ac-46ab-9fb2-8871d14cfe79", "comment": "Malware payload (RedLineStealer)", "value": "f76d263f42f11565cb5d8bd6176d39b46fb19660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559271, "uuid": "2e92a3c8-4ca6-4209-93c0-ade6263ffa0c", "comment": "Malware payload (RedLineStealer)", "value": "a367a1e5a0c44aafbcbbd08372a6eabe9feb20654b9c542f9ccfe4a306e8c7ca76558e714ebe790a9be1fad547347141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559271, "uuid": "6626750e-ebc7-49dd-982b-b458423b0dee", "value": "T16274CF20B7E0C034F2B723B989FA93A8A52D7DB05B7495CB63D116EA56746E0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559271, "uuid": "0a62d6b5-ae3d-41e1-b6f2-1c32f4adce08", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559271, "uuid": "f8841de1-e358-41af-b312-121d2a4488eb", "value": "6144:HYBAZfeX1/ABoF4xjd49qUaP8nwscfGwuNBtZuF:HYBAZf81/9FSdMqynwscfGwuNfZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559271, "uuid": "42e3e663-9af1-4de4-8f71-4b7a3d0c6e0a", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559271, "uuid": "0d430926-33e0-418b-90b5-fe0f63801f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559271, "uuid": "88819e45-b1c9-4bb0-9eba-2dd5e6a05aa1", "value": "229684c098983536196cbb531cd52c29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0773839-1dc4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632549088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632549088, "uuid": "ebefc53e-e148-4c2b-96f0-7c2c0cbb9fe6", "comment": "Malware payload (Mirai)", "value": "0b3daf4040c547e44dd61d8abf2dd47f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632549088, "uuid": "adf3b3e2-1ca5-4a6c-9396-63faf32acc5a", "comment": "Malware payload (Mirai)", "value": "8ab7efd6a9d143717a4a6bd182170b2347652e302deb1e41fc533006e63b90f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632549088, "uuid": "3f329151-446c-4b31-87ab-1fd7498a91d4", "comment": "Malware payload (Mirai)", "value": "5577a6dbf329bfc8dfbab1fc23e82ef3be8cda7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632549088, "uuid": "770a068e-ca51-4b71-bb1b-a75592066ce3", "comment": "Malware payload (Mirai)", "value": "cccd9f6123de95d2d06060676283db4c5ae3cefd3968ede4699e3c236582141c1972c8588042d3e9214226610ad59d10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632549088, "uuid": "988e97a6-0ac1-4edf-a7e1-35f6219cb90b", "value": "T1ED64F1CAFF11AD3AE9C006757AAF074DB3759BA9D3C3F140F250C61A3999185AF76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632549088, "uuid": "7407aad0-4b1b-4855-a971-82c9e0ca9807", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiolsKqqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiQsKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632549088, "uuid": "f5ccf9c2-1519-42d8-8976-0f96a6549c60", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632549088, "uuid": "3b960c56-dd91-4145-bac9-e996d07b1f2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632549088, "uuid": "75064bbc-947c-4e7f-867a-e21782d523b7", "value": "0b3daf4040c547e44dd61d8abf2dd47f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636ebefc-1dd7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557146, "uuid": "44a1bc28-d0b3-4e15-a2e8-2105769b86c5", "comment": "Malware payload (RedLineStealer)", "value": "6b372844c175aec62acc6cc18e1f8006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557146, "uuid": "8f690ecc-e8eb-43e6-a60c-160f746ddb60", "comment": "Malware payload (RedLineStealer)", "value": "8b0d5e431a0e9caab067ece82c2898714b34ee4da850586b4353ead178a1c67e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557146, "uuid": "ab3bd649-ec1d-4fba-9fb5-e05fe19627c1", "comment": "Malware payload (RedLineStealer)", "value": "d2dba224689f9c3a2e5a3c1840a8d05e65208c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557146, "uuid": "7f03cdaa-1c20-4783-8bf5-9ce845373f2b", "comment": "Malware payload (RedLineStealer)", "value": "a56de37e7f70f0b034c1bce8058482be1c52bd7664eb2a2fa0ec3de065c47061661bea60c79b4e81b467bffbcd35a420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557146, "uuid": "013d5946-61a9-4650-a937-55f88f46e2fe", "value": "T1BA74CF2067E0C039F5B713F54AB997B8A93D7AB06B3881CF62D616EA52746E4DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557146, "uuid": "ecc68728-ae79-43ff-bb96-49ae2ccd073a", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557146, "uuid": "8c96395b-f655-442d-8b9c-2c7310ff3772", "value": "6144:c2DsTSujX+adglCbYDl79eb37tbO6/ZNXqLm3NghreUSO1W:c2DsHjXslHD3IRbOeNX9CreOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557146, "uuid": "37b7eba9-5c62-441d-a8e6-5766aa3d6ca9", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557146, "uuid": "eb524967-30ae-4db8-91d5-0a4317b7f983", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557146, "uuid": "bffcb599-9d51-41ec-acaf-b10dbc321e0d", "value": "6b372844c175aec62acc6cc18e1f8006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af19bd9a-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562856, "uuid": "c829b484-e833-4722-af16-ad9395033bde", "comment": "Malware payload (RedLineStealer)", "value": "b346456e52dfdf75a814a210a345c3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562856, "uuid": "703fde69-07f1-47b1-a45c-a839bd4525ba", "comment": "Malware payload (RedLineStealer)", "value": "8c090756d9d2fd2ec61c57a020f7bee34581ea0f82b56558606317dc160f2e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562856, "uuid": "cb717523-1227-42db-ae3e-5ee43dd459cf", "comment": "Malware payload (RedLineStealer)", "value": "e3b686b13b6c924ec5405bef40a5802518f6a1f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562856, "uuid": "3dd1eff5-88e3-4722-8214-ec3ae0ed49d5", "comment": "Malware payload (RedLineStealer)", "value": "f9e9529e10f25ce093fe7a4fd5b515a5d0413ae901582af5fd25d7c740dee77513af922595859a36fa01ea38c9ab1fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562856, "uuid": "181d4759-690c-42ce-8ce8-a496186671a7", "value": "T12D84BE20B6E0C034F5F712F846BA97B8A93E79B16B3490CF62E516FA16346E49C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562856, "uuid": "b357f346-00ca-482d-b0ff-e19a9300f048", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562856, "uuid": "03d63359-c59b-4d21-a271-b91df3dda44e", "value": "6144:Hz3+asgyI/U5paaPFvlS2fREAzwIivWN8cTCHvzzpwDPckKWZLt:7+asgyIs5pP62fHcSBizq0k15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562856, "uuid": "8e47d14c-5a32-4b7e-846f-2cfaa6655485", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562856, "uuid": "4cfb7e5d-0b72-4595-956b-431c5cc7ca1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562856, "uuid": "aca7d071-5bdf-473a-bed0-01946d862a95", "value": "b346456e52dfdf75a814a210a345c3d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55949698-1d9e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532641, "uuid": "01dcefc7-f974-44ce-b971-b23eb00e737d", "comment": "Malware payload (Mirai)", "value": "aea0fb5c593de7f9d8082813a0cd8f02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532641, "uuid": "0a2dddf4-2630-49b4-aae1-e450dfdb45d0", "comment": "Malware payload (Mirai)", "value": "8c68268a56e72e609a11901b90e92dbfd54e54a65d7e8ee2346a47138e36c621", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532641, "uuid": "dabee9f5-da7d-457d-abe6-2c001b0f4c0a", "comment": "Malware payload (Mirai)", "value": "69f564b1a7f9ae9b63620d6a2a6826e53b9da584", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532641, "uuid": "338f824f-835d-45dc-a220-b6786c53b7bc", "comment": "Malware payload (Mirai)", "value": "529abff9047915407216d4b06ce25a8cc75dd5851162a8caaa6d19c914e093947264ae007be6c28963b3e24a71375d63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532641, "uuid": "b9ab5597-100f-43c2-927f-99e3bde6a41e", "value": "T1B1B318736B1C0743C49B6AF02DA727F18F69BE7312E611C4A10AFEC01772AB52522F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532641, "uuid": "294aa3fc-928a-49ea-9e53-7389da59ad76", "value": "3072:p1hQEPpabONMinbm77yFcamm/QcuqmOcF5NZ:p1hQEPoiNMibm7bamm/QcuqmOcF5NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532641, "uuid": "dce85dca-54c0-4ffe-b6ea-9a7df03444b9", "value": 116541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532641, "uuid": "85db8bbf-0a99-41a7-8eb2-c7be23ffd4fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532641, "uuid": "9fc19b01-ba41-4554-a8e5-a36c98e2aab8", "value": "aea0fb5c593de7f9d8082813a0cd8f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e7b87a-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573627, "uuid": "5c977000-3a59-48a3-b7d7-be24cbadfdb5", "comment": "Malware payload (Mirai)", "value": "8bd3838b9c69a4b9c263a084867618fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573627, "uuid": "c49eda95-1206-487b-83ba-bd6aed8f86bd", "comment": "Malware payload (Mirai)", "value": "8c8c6cf0a007936b2b08c5a6eb293243caa3cba3c792c4bbff81645529bfc30f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573627, "uuid": "6ecb8067-f7da-482e-9a86-999d4f9c6ae6", "comment": "Malware payload (Mirai)", "value": "9d4b9ce38d44112d3c2d1f4ae1d3222b85145cfc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573627, "uuid": "fcca1701-302c-45dd-b8b9-f7d9d970c1b2", "comment": "Malware payload (Mirai)", "value": "87751e084dfb088642c53acda95c178bf28a0a63a1e20846f1b87e113e96f0638b4cf5eb78bd09ba77e8cf81d7a50b1c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573627, "uuid": "e98ad708-c50c-494b-a816-4f62209db5b8", "value": "T160C34B46FA418B03C4D5177ABA9F42493323E754E3DB330699189FB43F86BAE4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573627, "uuid": "f2304d62-defa-4257-97f8-ad65f5d1e022", "value": "3072:P/b+oFkC5PsUnIXWMqVasJn0wn+lkEM/9v7V:P/NFkC5PsgIXWMqV3JT+l3M/9jV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573627, "uuid": "ba25350d-7340-45e8-ac1a-401a07404cd8", "value": 129709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573627, "uuid": "8bd81838-045c-4d0b-a1dd-08f9e41d165c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573627, "uuid": "17223be6-96d0-4f24-abad-126af1ae1fc0", "value": "arm7-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6375c98-1e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632613227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613227, "uuid": "ca934649-d983-4e9a-98c0-f4f93d5f2e75", "comment": "Malware payload (NanoCore)", "value": "9b9bda366e3cc1eba3bab1e7f4d0ca92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613227, "uuid": "e3d8b69f-ea49-42d7-bb7a-de02b4d48eff", "comment": "Malware payload (NanoCore)", "value": "8cd15630736a9214c5750e04b66e3507a121f2516e380d8931455cae4bd8548c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613227, "uuid": "b89cf479-2ef6-44db-b0ea-88b6ae7776ac", "comment": "Malware payload (NanoCore)", "value": "414dc20084eefa0edf5cffb636e2c05db1d1da30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613227, "uuid": "61abe3f2-91bb-469a-8859-785a530589cd", "comment": "Malware payload (NanoCore)", "value": "33ee0b582f7f4cb2286825da8bfc9bcaa26751a8b53a7ace07a456e7dcaa732187a70e54e8ba962b1a5dd160432b63e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613227, "uuid": "7ab4c456-87e5-45d4-aa2b-c46a5db85cd4", "value": "T14F44120A12C09E7BF3D1B3312FB5B679E376662A0819564747E89F3E36ACF8582051C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613227, "uuid": "89f12832-c970-421b-923b-c66be116f8f8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613227, "uuid": "b1cd9f15-4881-4db2-a3b4-4a7546a9f466", "value": "6144:Z8LxBTG2RbFJdCQS3PLsf7sJLzZb4axqppKfqB24WDybQOHRCBc:QPrCQS3PAf7gLR3qpYqBkD8HRCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613227, "uuid": "c665ce45-ef59-4a88-b81a-d00341c2ccdf", "value": 254456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613227, "uuid": "7e4c6cb5-48a0-4be6-8212-de20a5dd2c5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613227, "uuid": "0fa9eece-582c-4ab1-8928-0f9f5a191dcb", "value": "9b9bda366e3cc1eba3bab1e7f4d0ca92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a759c-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562858, "uuid": "355a3936-e978-47b0-8078-c27da9c19aa4", "comment": "Malware payload (RedLineStealer)", "value": "5af07f212e8a95bf474043ef7bfc66e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562858, "uuid": "19416617-090d-4a99-99a3-9458ffc13adf", "comment": "Malware payload (RedLineStealer)", "value": "8cd6bd2b6b54f07317e7ce2c579e028d4e9f52a776b8327461258c7f1fadeec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562858, "uuid": "34e93edd-1cb8-44ab-88cf-e3d66b65522c", "comment": "Malware payload (RedLineStealer)", "value": "07de3eb29d2e8847625c3d6764962fac01b63767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562858, "uuid": "34dd93d7-3876-4c4e-a0d4-64af59d28947", "comment": "Malware payload (RedLineStealer)", "value": "84d3fd582de3888462fa0eb9b6229508204e04a6d1d95b7ae2a3388a3f501dcad2993ecb4759fb85220261f01619f04a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562858, "uuid": "0825787e-cbd7-431d-a761-583b8cfa6189", "value": "T12194AF20BAE0C435E5F742F449B99BA8A93D7D715B3740CB72D126EE26386E4AC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562858, "uuid": "45383a1f-19bf-490b-888d-c1ac8fb55205", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562858, "uuid": "40e7da88-87b9-483e-82ff-2abd2dfc543e", "value": "6144:ooZSdPxV6Q5RCkf3LItJSsYiK502pGZHXp6j2txU4M2:BSdPPP5Df7IusYZ50wI3ZXlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562858, "uuid": "1812aa44-6b8f-4e3a-957d-9f660c3cd4a1", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562858, "uuid": "dcfe16d5-8492-48dc-9e21-10eac01aab47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562858, "uuid": "e28d12ee-5753-4f94-bb97-f576714fe43b", "value": "5af07f212e8a95bf474043ef7bfc66e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9870e63-1e4d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632607998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607998, "uuid": "c82c16ce-443a-428e-a128-f42e97b9fbaf", "comment": "Malware payload (RedLineStealer)", "value": "64c3457508b575b0112f1283d2b72295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607998, "uuid": "576ea34f-25e1-4174-ad61-af2a383be207", "comment": "Malware payload (RedLineStealer)", "value": "8dd4a666f6669e21075b7246364464cb88a5e1f9624543d825efb71bbf9970c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607998, "uuid": "1dca3c37-c8e8-4cbf-a6fa-e6ef6bf69b83", "comment": "Malware payload (RedLineStealer)", "value": "c497794b4e5915bd60120ba44206245a2d97804f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607998, "uuid": "01485420-7d77-4b95-b9ba-b0a67dc67ef2", "comment": "Malware payload (RedLineStealer)", "value": "2c4b11772bf97b3f21233c1108c5c363edc7b73a7efd3b813abca2058fd533b99d7e7e78630e45591016573fbf2d0034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607998, "uuid": "d4c3791c-296f-4f0f-a7e6-dada3c6036ee", "value": "T1E044E03172A2C032D7E3093459B187A5563BBC621E73869FFA5D235B6E313929BD2313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607998, "uuid": "df73028b-ddd6-485e-a4fd-02684db33697", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607998, "uuid": "205b096e-d98d-43a9-9d40-35d7f3451509", "value": "6144:0itdZFV36t2qElubLbb6JKYjaX+FHEad:XV3R3ubb6JFS+Fhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632607998, "uuid": "3e9f4efe-3a1e-4a02-a553-e2fc87a0a717", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632607998, "uuid": "fb736779-9bf3-4ce9-92c0-a9e28d29d747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607998, "uuid": "cb50aa3f-9293-46d0-a8bc-72b14b7166f1", "value": "64c3457508b575b0112f1283d2b72295.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da76d92-1dda-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632558452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558452, "uuid": "cb1578fb-f536-4a05-9851-869835b80854", "comment": "Malware payload (Gafgyt)", "value": "060d1e7b14fa3ee07dd169ae7a08f061", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558452, "uuid": "8741f99a-23fe-48ae-99c0-943895b2ea54", "comment": "Malware payload (Gafgyt)", "value": "8eb1fee8f373b85653e69624e011d9daed1cc42be18ad9513460c2fe3a4a1da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558452, "uuid": "7ab1dae2-b39e-4883-a335-e57bc2be6290", "comment": "Malware payload (Gafgyt)", "value": "cf7c2ed7daf466461b7aafc6d17e9c6dadb2bad6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558452, "uuid": "5b85eee0-13ad-4bb9-87b3-ba299353fb61", "comment": "Malware payload (Gafgyt)", "value": "dfc3b81f30f767139df63bee67a0936d98c9cb3f87e801f30a7231dc1cbddcbad491dffdd7b04ce5f5e9a8648b443d4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558452, "uuid": "4cd2126a-04ed-4521-b0fa-521415b26413", "value": "T1BE9319A2FD01EF66F00A8A3A05C707346630FF660B931E7173577A669A762D47427F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558452, "uuid": "64537618-9805-4204-8df3-83f4429bf645", "value": "1536:vocXHCo7cxCAPY4H8G3rghCvIQuU3771VLb0w7eeM7xFZfbIHUIN:voc3JQ041mCQQXDb0w7eeQrZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558452, "uuid": "7f926c28-db90-4b31-8f21-5033e3f03bad", "value": 89345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558452, "uuid": "2195bbbb-9893-4e18-b470-8cc6dd8a6096", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558452, "uuid": "f1439b46-9ccc-4868-b7fe-d541d7d3b916", "value": "060d1e7b14fa3ee07dd169ae7a08f061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ecbe0d-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561715, "uuid": "504ff3dd-89e9-4dac-96e9-60f4cd18400c", "comment": "Malware payload (RedLineStealer)", "value": "546865eb2d178b0497d85caf901d2f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561715, "uuid": "14967967-bd24-4dc5-a9a1-ec123c2c8a1e", "comment": "Malware payload (RedLineStealer)", "value": "8fd38c86cbdd533c83f806abd789ec59f1345279c1b99768b633c12f58251e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561715, "uuid": "a3a0c50f-d0c9-4cd4-9025-a01ef098d51f", "comment": "Malware payload (RedLineStealer)", "value": "89de51b1365666134d46bf6a16cd797dd64032fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561715, "uuid": "4c885f68-34fa-4df7-a7d2-50a6f9b98c7e", "comment": "Malware payload (RedLineStealer)", "value": "1fc5c22f7034a0e84a77fc51a3c9bbc0dfac23cca941535627988875a9ebcb20989448bb3b4a9bf343ceeeb5f96c3179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561715, "uuid": "0e00adf7-3094-455d-bcca-c864a110e0e3", "value": "T13F44DF1275F1CC32D5FB59308870C7945E3FB5236EB7C08A2768EA6EBE216D08A25357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561715, "uuid": "d0718aab-ec4d-452d-85a7-7cb7223849fc", "value": "35a9ffa8a278dd991d1bdc58cc30f2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561715, "uuid": "ff7a7528-4915-4549-81b7-5531cee8a60e", "value": "6144:nEx/1g/OqfgxKrcDoDELBiyw3Cb0EgP1e:CcOGrckDCBMWmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561715, "uuid": "5a30d17e-ac92-4eec-a3be-82dbbf717942", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561715, "uuid": "a5422f2d-7c7a-4b2b-a068-0807225af634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561715, "uuid": "af4d0f8d-f577-4547-991e-3931dea36513", "value": "546865eb2d178b0497d85caf901d2f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8c05a5-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632552702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552702, "uuid": "681883e5-dc3d-4ebb-ab90-62a400f59a51", "comment": "Malware payload (Smoke Loader)", "value": "48dd852dff677f29ee557343c11db0a8", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552702, "uuid": "355a3afc-9935-416a-a9b3-e485939957ec", "comment": "Malware payload (Smoke Loader)", "value": "8fe0e96079608b65906be8b65e589d44d73d1b46de789752c5ec47e79d3976c6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552702, "uuid": "6d882bfe-1c7e-4dab-9f37-7a99b99a335c", "comment": "Malware payload (Smoke Loader)", "value": "b76942602379e3aaf567f9244f2d480acba20fce", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552702, "uuid": "eef88c20-61b4-4e22-97e6-a986535ba6d3", "comment": "Malware payload (Smoke Loader)", "value": "596fcfc96f7aef39b53dba69e22568889811a4312fabbd07a8b5caed861553c12239a22fcedadbe40c827dee5b6e7780", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552702, "uuid": "a2d9acf1-32a9-492d-8d9d-a99706b2b6df", "value": "T10054AE20B7E0C039F4B712F649BA87B9A93D7DB06B2891CF52D616EA56346E4DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552702, "uuid": "bbd87a44-47ab-46d0-9b68-95fe2ca2a7e2", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552702, "uuid": "d2a6f595-eb4b-4d88-8b93-7150bf439565", "value": "3072:dEt7/Ec8xTe/jmYt/l2BFX/bwu0ay/MDVuWTnG/bRrhmhVGzizWpm5ejH:dY7FOe/jm4l2bvb2aTnGTRkhwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552702, "uuid": "c6031b31-e525-4802-ad99-e03aa73742e6", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552702, "uuid": "6cec96d9-d980-4a4a-985c-fea48ee7e3f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552702, "uuid": "4950db2d-d6f1-41db-90ef-60003a07a87e", "value": "48dd852dff677f29ee557343c11db0a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5aa245a-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "86de27ed-1837-45c0-a879-6b25e8f0e581", "comment": "Malware payload (Gafgyt)", "value": "8de79e80f45240c4b2f01463ac5e1b62", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "543dcdc4-fe6a-47a5-9db0-706c4647bf01", "comment": "Malware payload (Gafgyt)", "value": "901133468c121b84d5ed1fa5743f7d7de1f235d2c37175b087bff0cf32910d56", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "f5749b6b-b0ec-4ffb-a3c0-19b1950ff4d2", "comment": "Malware payload (Gafgyt)", "value": "db33c5673d1296b3931a72a0c1313af979b23341", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "68f67e28-46fe-4b01-9f56-5ac74a21c836", "comment": "Malware payload (Gafgyt)", "value": "832588af547b30b06b32efe0aab615b1b0006935fd6c186e4eb000c2a0bbd80834053d0aea12a9a680e13cec09cd4b05", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "157fac30-4e24-4917-96b0-affb6b58a2da", "value": "T144C3B76A7E21EFFEE16887310BF35F70C395219626919386E26CE7581E7128C2C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "ea619bc6-bf90-4c16-b64f-99a55d261d22", "value": "1536:q7jO1Texq+Df8M2rK5wiNUzn6jClhedEZv7SeM30EnUmkiSFxfC7xoXe:dsh7Uzn6jCld+eM30EnUmkiSFxfKxoXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563404, "uuid": "f0d7f99e-0912-4892-9d45-4029e49a9a2e", "value": 121527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563404, "uuid": "4e135992-7b69-4a63-a175-457354870dde", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "335d8108-8825-400f-94db-f1c16f31d516", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbf1b0a-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632556974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556974, "uuid": "53a26991-0058-4741-9507-03f866bcf149", "comment": "Malware payload (Quakbot)", "value": "4a07ae0410c8238d0d657cd057963646", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556974, "uuid": "6722d4d8-5a1c-4cd0-b6d4-d53b8cb49c11", "comment": "Malware payload (Quakbot)", "value": "901c1e9a4daf9000c13a6a17acfe5c4e703b8ecf505cf8681aaffd0fa2efe593", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556974, "uuid": "198965ac-3ad1-4fbb-bdb9-0f4577c73f87", "comment": "Malware payload (Quakbot)", "value": "2a53e53a9aae9466593046889a50bf7252d0ea50", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556974, "uuid": "b0bcdbfa-7663-453c-80cc-3902a0c984b0", "comment": "Malware payload (Quakbot)", "value": "5e8666d874f1f8d9678606d441eb63f45b22b3b313d172ceee6e2208ef985f5d3ddd234338defbcc12d509fa0314785b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama103", "colour": "#87BD55", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556974, "uuid": "1f88febc-a209-417e-84a8-bcfb4590c467", "value": "T1BAB4AF2EBED2D151C83819B9CD92C8E672387865AE18D2533AD53F3F69F74D11C4A08E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556974, "uuid": "19eabbdc-4d77-4674-bbb5-87318f43aff3", "value": "55e63e10220d9780afbfa2f458c9d3dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556974, "uuid": "ec84a296-006f-4c50-9a3b-7d4234006e7d", "value": "6144:bbqzVbbUYjG8AClk8+j05KhoSiMsJZuSsnDxeHakVqhhmaM+5Vg0nKH5PnFyun9:XqxgYjG8ACv+AKhpsJZRXH52LMcg5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556974, "uuid": "d1e82401-60a2-4d88-9206-91bae89215f8", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556974, "uuid": "bb6cad9e-3d93-4af8-a2b2-c91d73c9b207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556974, "uuid": "bb2efc91-6c89-470e-bc88-e64fa9f154c1", "value": "4a07ae0410c8238d0d657cd057963646.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af96cf6e-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563287, "uuid": "e37d5939-42d8-4f80-b669-bd2eb3ad7be9", "comment": "Malware payload (RedLineStealer)", "value": "2b70ffee936338fb5c805bedb47a7d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563287, "uuid": "c438fd93-0717-45e6-be22-1e4a2c6df6e7", "comment": "Malware payload (RedLineStealer)", "value": "9064579436a6920bf6b3219a2252437c17e671e7aeca84333d52cb7f6b70a8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563287, "uuid": "15ff568c-5d2e-46c6-8f1f-30713a725e7f", "comment": "Malware payload (RedLineStealer)", "value": "d44bd04443066dcf253c6fe81f4bd57c9fe5da4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563287, "uuid": "b927496c-bed2-46b6-b9bb-66410d1c8971", "comment": "Malware payload (RedLineStealer)", "value": "df1bceb8b8b649ed9a5395fa60872147b264aab31115db6342d75bc8a05c4f5c3fc59c4817bb21a18ee1da26b792b3bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563287, "uuid": "2d9b7bf1-94fe-4a02-a5a7-5e1fe77c3b45", "value": "T1FE84AE20BAE0C035F2F712F98AB993A8A93D7DB15B3451CF62D516EA26346E4DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563287, "uuid": "3bbbb249-656f-48e2-b1c4-8dbd544ff669", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563287, "uuid": "50b56c4a-a2a8-4e7e-877e-5e94e5279eb6", "value": "6144:2SQdtskkIda5SaaPF/VYj3FwYTdKs3MSo2SEn3UAxA7SYLW:odtskkIU5MPwj3jZRZ1SE33zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563287, "uuid": "49c6ac3b-4306-4c2c-8e1a-e926ca2d3292", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563287, "uuid": "489094a8-fc0e-427d-b305-c4209f6104a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563287, "uuid": "015d4c0c-c007-4a1a-8544-93ecf25559d5", "value": "2b70ffee936338fb5c805bedb47a7d11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f503db-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632552750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552750, "uuid": "ee1aec19-7c0f-4e93-9908-33bae0e6eb68", "comment": "Malware payload (RedLineStealer)", "value": "865450e2890b7aba5925375f5d41c933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552750, "uuid": "25852a58-5f68-4c27-a993-42d4272d95f0", "comment": "Malware payload (RedLineStealer)", "value": "90ec027aaeb78b54645176eac81991a7b6cc4d24d0eaa0d765265b2693069eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552750, "uuid": "02032c52-a124-497f-9e2a-138d8453329a", "comment": "Malware payload (RedLineStealer)", "value": "329f1f423fe8b246469c5e51ca90bc70a72471e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552750, "uuid": "77d0f3bb-6e33-4e64-acb8-d6a2d66847dd", "comment": "Malware payload (RedLineStealer)", "value": "837507f405734d0463e41242da257085cfa4140b9c5f19205041b0b14cc1f6d7d349b9514f9df2da767200cf30e9b7c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552750, "uuid": "f30c20d1-55c8-4bfc-ae38-614a499daf71", "value": "T14CA3402751605065C9FD1730E8285F077E28DE240E41B2ECA14EB2FA8E7DA9DCEF5672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552750, "uuid": "f0def2a8-9d91-4511-9634-c6ca0525331b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552750, "uuid": "e1d2ed3c-55e4-4b65-94b2-741ad0dad219", "value": "768:mC8GOoqxyUneTVBxuKehwNBdG9QW27nwbYYe:wGObiVGKesBdGVbYYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552750, "uuid": "fae10805-d33e-4ccc-8ac4-0eac1cceb33e", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552750, "uuid": "b690d77d-14c0-4f11-8bba-755f74035bc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552750, "uuid": "8cdee56a-b197-4e28-aa6e-56041b85aeda", "value": "865450e2890b7aba5925375f5d41c933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d7cf71-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573629, "uuid": "f9c9381c-aeaa-413a-9994-19571d027e40", "comment": "Malware payload (Mirai)", "value": "fedfef065087a51d57ab819d25a2dd62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573629, "uuid": "89296bc9-e6df-4c0f-9d2a-c481282159ba", "comment": "Malware payload (Mirai)", "value": "913f452a22c17cc53f46ccbaa64e550d6c7e855323eb4ab7e25fb58844f8ce18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573629, "uuid": "9ff28c4b-24ec-44b5-b270-7ac31655e358", "comment": "Malware payload (Mirai)", "value": "49f4dc29674b139ad2b70d0bcf1b5a0d31c579ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573629, "uuid": "85bed2be-fcc8-4c44-a9fa-8df717f7c3ac", "comment": "Malware payload (Mirai)", "value": "dc466a11f5e9c0ea56312ea99a48af523ccdced359e6e00b6827820725fe8e3b4a9b28961b6fd769d59d600bfd1bc2d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573629, "uuid": "ea9bf32f-5f50-41d9-aaf2-d8e29446b0f9", "value": "T117C33B46FA418B03C4D52776BA9F42493323E754E3DB330699189FB43F86BAE4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573629, "uuid": "46ed250b-ca5a-4699-90d7-2f008dfe1ae1", "value": "3072:P/b+oFkC5PsUnIXWMqVasJn0wn+ruVxVv7V:P/NFkC5PsgIXWMqV3JT+ruVxVjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573629, "uuid": "976f12c6-2694-4ea7-9d45-fdc0ec3e7b7f", "value": 129709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573629, "uuid": "ef574f0a-2740-4f61-b0f5-37cc8644a4b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573629, "uuid": "82a98f06-d050-4ab0-8875-5fbe3b6e6941", "value": "arm6-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b58127a-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632605719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605719, "uuid": "353ad52d-44ad-4a2d-8858-bd6e2b43ce79", "comment": "Malware payload", "value": "09a6d11a279af1646a85940574a51919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605719, "uuid": "4f77aa89-e94c-471b-b8c9-7cfb7f2bc096", "comment": "Malware payload", "value": "91c9fb1cb38dfeefd5704a4c07b5eae2b14d9e1a7a44b4b0145a386cd79ba0c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605719, "uuid": "bc92ed60-11c2-4e58-8010-131a011a8b0c", "comment": "Malware payload", "value": "c0a2fa705346d822c47fcd03a8fdde7babf70c0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605719, "uuid": "b98c7360-c6d7-4180-8bec-1df1cb454d0c", "comment": "Malware payload", "value": "74da10993e95cdbb15136ced29cf7153e1e6bc524b7e932a5a098344b76874f7bfd5dc6a01384e0438f3addd6e1bf04c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605719, "uuid": "d28ae6bb-2e9a-4d58-8391-11a29db59f38", "value": "T1B7634A07B31E0B53C19B6EF02DEB2BF14BA6F9D116A7A280B11DBED41772AB02411F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605719, "uuid": "9753f932-d8d8-4213-81c0-8162bfd9536c", "value": "1536:i3yIhk8ovVAdARsM8m5A9Fn6qoqSLAFfmIEVhrjYfEfln:iif8AWy8spT8fmIEVhrsfEfln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605719, "uuid": "58851695-8857-43a2-b6cb-bc4709fcd23d", "value": 72601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605719, "uuid": "b264151a-1774-4792-837d-02f4967f4873", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605719, "uuid": "ce053cfc-8869-4050-ab43-e6f45f346a97", "value": "09a6d11a279af1646a85940574a51919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de70495d-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632552628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552628, "uuid": "6e38f171-6867-4f3b-b9dd-2865d364524b", "comment": "Malware payload (RedLineStealer)", "value": "1ca5f33ffb87f631cf17e4fcd06eafc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552628, "uuid": "a110015c-71ee-42d4-afba-85a4c01290c9", "comment": "Malware payload (RedLineStealer)", "value": "922295fc8e35b0c40119f965ae4f9f00a4d585ec0fbccd14c34b4c1a3f012cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552628, "uuid": "da8a36b5-ff62-4adb-84d4-d89a3e67ced3", "comment": "Malware payload (RedLineStealer)", "value": "e6038ac9324ee7aa092ab754c48a5d97983d5319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552628, "uuid": "0ad06a1c-8612-41fc-a9bd-365ae567833b", "comment": "Malware payload (RedLineStealer)", "value": "3e3cfcd2c756735dc9bf9e264c519bcb8cc6bd22d8d07d3b0d20cc9588c335aa59662951aef7f58ec8074ecdf4f7a426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552628, "uuid": "aaa8d0f5-b36f-4c4e-b2b9-bd2613ac6bcc", "value": "T11674C020B7E0C039F4B702F659BA87B9A52D7AB06B3880CF63D516EA56746E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552628, "uuid": "8c14984c-d7d2-48f6-b7ac-2736712e16c5", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552628, "uuid": "b1c2d0db-3ab6-42fb-9f80-6ea2aa21f663", "value": "6144:52b7z0RjfglbbQLgqMLoujb4iz9coRdgQe1bIXAhkf:52b7ejfgl4LCLFj9gQe9IXEkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552628, "uuid": "300f0792-a24d-46aa-a8c2-a0d4156ffb83", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552628, "uuid": "6574acd1-2d91-428f-9935-7121cb7b600b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552628, "uuid": "478df16e-5f2a-414d-858a-a9c54bf33203", "value": "1ca5f33ffb87f631cf17e4fcd06eafc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1233eb-1da4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632535147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535147, "uuid": "a985d4eb-608f-4cc8-8ba0-a3b914d049fd", "comment": "Malware payload (Gafgyt)", "value": "c51ed102ae0fa011b37a7059bf5429c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535147, "uuid": "41998a96-f056-473c-8283-f3ea771bc19c", "comment": "Malware payload (Gafgyt)", "value": "92660e03f488193ccca226b7d0fe3a2387b9b8dfa17d87937d8c142c10763438", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535147, "uuid": "4aeeb2a9-5f2e-47c0-8d37-05cca21b8aaa", "comment": "Malware payload (Gafgyt)", "value": "857671ac4b469496bed98ff9a86be53a5e932ee4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535147, "uuid": "dc50e039-b7fd-44d3-a3b4-952d8a9f9c17", "comment": "Malware payload (Gafgyt)", "value": "ea5201cbe73dc6609e61c11b8cd374e8aedc432a665792798880493fc65b6e71a8414a6f830039689ae67d901857a800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535147, "uuid": "ba391d8d-dbd3-4c62-abd1-1cd0abd4d65b", "value": "T106B3F709F8418727C2D327BAF68E4B5D3F3516E463DB33116A347EB42BC27992D29960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535147, "uuid": "034cfcc9-6716-41da-9841-4b9fd88d6fbd", "value": "1536:ud2kVmb3G/zAvM08q6x9ZmKY/rP04OzYvwL7iVFc3duHvkBA20amcn3rQASWaUXB:6VEGrAvp6RkPbwL7BgmmG3rQASjUXvee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632535147, "uuid": "e900354b-6a1f-4326-8929-53e52b9fd9b9", "value": 112758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632535147, "uuid": "742c4fb9-3742-4a7f-b6e6-5d236db4596b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535147, "uuid": "496855a2-2fa2-43f0-8626-86c3692ec565", "value": "c51ed102ae0fa011b37a7059bf5429c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ac9415-1df6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632570362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570362, "uuid": "7c1c24a0-810b-4324-a97e-003b74389336", "comment": "Malware payload (RaccoonStealer)", "value": "5bb2e362bc3eae0b373be653c16a4329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570362, "uuid": "425e5b7d-c36c-4e64-8781-d70cd1e2585d", "comment": "Malware payload (RaccoonStealer)", "value": "93593190f1fa26e73781fbe8993fdbbb536a2f2566ec67edf06bb9a0fdc9998d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570362, "uuid": "c6636b81-6372-47e3-977a-a41f30f96b32", "comment": "Malware payload (RaccoonStealer)", "value": "ff8ce9404f90ac2baa54aab816f01d92d3396847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570362, "uuid": "8c572f85-81c2-4f56-8a6e-572d80f34fc7", "comment": "Malware payload (RaccoonStealer)", "value": "572d259a97ea3db30698d50ee0bb49eaad0d509ccddc9d72938ece0bd8c3c7ea589fcb499657465d602e67e700abd601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570362, "uuid": "23c12b37-706b-4765-bf98-c0fc072ab97c", "value": "T11C9401A0F991D139D3A799310D33D3A5222FBCE2AD3B455AF68C160E4D326F186E6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570362, "uuid": "5dd84453-a4d7-49bb-81ce-ec854271ca57", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570362, "uuid": "55fd7042-d20c-4e92-96a6-8fb187f43411", "value": "12288:FJSiXBBOWBXCxEv7mC8MmzIoSTqKHwA+Rd:nXRBbHhVkIoiqQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632570362, "uuid": "ed518968-a104-4d78-ba9f-dd18541594e4", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632570362, "uuid": "e9bd9671-fae4-4ed3-8a24-e7e2d5ce9b94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570362, "uuid": "6fc31d0f-a805-4ae6-b9ee-2f1aed35621c", "value": "5bb2e362bc3eae0b373be653c16a4329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34e3418-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563293, "uuid": "6b67e9b8-fc97-4da5-a573-5613a207dafc", "comment": "Malware payload (RedLineStealer)", "value": "29417bfbdde45ffc6c831d1246e23530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563293, "uuid": "17982864-384c-46d7-b343-547cdf0acb66", "comment": "Malware payload (RedLineStealer)", "value": "93774a97b7a8eed2e72d4433ac1141cb95a016d994beae69c7607c75835b6a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563293, "uuid": "037cd7a1-7007-42bd-aba5-20dc2ab3a2ea", "comment": "Malware payload (RedLineStealer)", "value": "bcf3711be3c4d108b0a30a64ff0c69949d1d4509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563293, "uuid": "29d53bf0-ea54-4711-8940-4d727e64a6c3", "comment": "Malware payload (RedLineStealer)", "value": "02bd78e765a5c46d89d8f50c573881c3ffd54aad894a7a1bc588d7368d8116ce7986da1d6f0bf7be89997ab7e865db36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563293, "uuid": "d65434b5-6620-47fb-97fa-54f06ba3e73a", "value": "T1BF84AE20BAE0C035F5F712F889B993A8A93E79B19B3491CB62D516EE16347E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563293, "uuid": "e054a709-dbc8-4020-92a8-8a41c5ff867a", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563293, "uuid": "a9f41991-c596-4e29-836a-b33679124cb4", "value": "6144:Yj2qa32rIJX5waePF/VmTtFL0tmr5UY3Pe9f5hLYL3m3C4KAj84sclSCZ:dqa32rI956POTtUS5TGlnC32HbsgSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563293, "uuid": "47cb054a-3e89-4c89-a35b-69f904abca9a", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563293, "uuid": "8f373805-f3b2-4a1c-a417-a74b75ae30a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563293, "uuid": "7576c92f-dc8d-40a5-b717-caad8094e82d", "value": "29417bfbdde45ffc6c831d1246e23530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f24929d-1e0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632580707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580707, "uuid": "57338fcf-634e-4a9d-adb4-2b9208835882", "comment": "Malware payload", "value": "8d7a4f475bf40c11f8456c0c8f44e425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580707, "uuid": "a7b56208-274d-4c60-9c12-dbae129a49ed", "comment": "Malware payload", "value": "93a8a0e7224464a3d7e87aea3e99e265729f7cb18e0054bb9847f2ee0e6b4db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580707, "uuid": "8ed94029-6d77-4aab-98a6-63a71e990748", "comment": "Malware payload", "value": "ea29ff987c014e027ceebe8ee44a381ce8aae499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580707, "uuid": "e6ebb952-f335-4878-9991-ffe715b5b447", "comment": "Malware payload", "value": "c07692dc4945fe3f07cb7fcd6b0716aaef86d26f5eba9c990a1ecab705b294d4b023a16df8178241c052899d7c34d753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580707, "uuid": "731ed955-59c2-4056-a190-d3a55bfd9f58", "value": "T151347D1079E28432C17319350DFAE7B529BEB5610E758E6F37D80B6D8F74182B232A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580707, "uuid": "33450c11-86bc-4a24-be83-7a4ec5281437", "value": "aad05474bfee082c9529c0427d51edae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580707, "uuid": "eb4af671-2c6a-45d1-8570-7f798da73038", "value": "3072:J8OEBgGymQSnG78jiqQC2mCdMZrfFXM5sslRahnLseywO6hylpL40Z9mFFAg0Fuy:pGyAnAjvCf8pRYnLsO0rgFAO/QcuaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632580707, "uuid": "fb3c6879-0d50-4f1f-9530-d2b3516c47f7", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632580707, "uuid": "2cea9f09-427d-4003-bf64-a0b9da9df24d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580707, "uuid": "33d13799-893f-465f-a3c1-31a44a98b1b8", "value": "93a8a0e7224464a3d7e87aea3e99e265729f7cb18e0054bb9847f2ee0e6b4db5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2d4c1c-1e16-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632584217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584217, "uuid": "ad6ce4dc-290e-4dcd-bf74-1cbcdeba3e14", "comment": "Malware payload (Gafgyt)", "value": "0da92651498bc116b0cb8d735be14e4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584217, "uuid": "2190aef3-1a2b-447d-be48-dccf6c8da9db", "comment": "Malware payload (Gafgyt)", "value": "9522f81b57a9033a5b9673a9e5b90b1e1f51ab1ba08749d7cc533874a4409234", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584217, "uuid": "62a06fa4-0f20-4a91-b93e-02c9a4ff71fd", "comment": "Malware payload (Gafgyt)", "value": "2a60416522041544e2ae63662c9cfd7e42b6f892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584217, "uuid": "bb59ad18-2424-47cf-a162-6ca4be6f4d7c", "comment": "Malware payload (Gafgyt)", "value": "d0067420c1c20293cf3e6ea074849dfc3bb74297bba98d45c40b958b6be7e193b5986957b60eba3e303b37cd7ccd2713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584217, "uuid": "17ba0973-b140-436d-8a53-87a214c25d42", "value": "T1B7B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584217, "uuid": "3873df9c-4269-4a8e-a5bc-7542ffac834c", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2O8N2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreFNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584217, "uuid": "7fa7fcf4-b8f3-4cc8-bd41-b027a6e071b3", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584217, "uuid": "8cfb693c-2941-41cf-b42c-00c556b7291f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584217, "uuid": "dcc879ac-4e9e-468b-9d4b-39810d7d3f5f", "value": "0da92651498bc116b0cb8d735be14e4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf8ac9b-1e4c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632607252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607252, "uuid": "707af9e0-2637-4473-b94c-b4aa2a3270bc", "comment": "Malware payload (RaccoonStealer)", "value": "05efb99eaef063c9f393067c3e081c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607252, "uuid": "bde0602b-e799-4ff3-a62f-36fce41fbea3", "comment": "Malware payload (RaccoonStealer)", "value": "97a681f3d9aa34f1975a5ebf188ce6a1de9089f52a29d9dd912bc8dd61cb9d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607252, "uuid": "fb6b6f96-59a3-49a3-bf03-c9657b842477", "comment": "Malware payload (RaccoonStealer)", "value": "7bd78b32625a8d0a927b051515139423046538e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632607252, "uuid": "21c914f5-f491-4421-a46e-2cc3d8b2fe6b", "comment": "Malware payload (RaccoonStealer)", "value": "4ed7bc233e03fa385539697853e606f6ceba132fa4e4655acfec685287746d8b98bd76a9d74b14e4af6c660e0c196597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607252, "uuid": "067bca05-c27b-461c-b53d-df0afa892afe", "value": "T1449402F1B5E2E03AC3E25972CF25D391463B79622D23860EE76C171E1F2139166EE316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607252, "uuid": "5b54e76b-d3f8-46eb-846d-d75ef9bf2c39", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607252, "uuid": "05fa2abc-b239-46e8-8e27-30237a970848", "value": "6144:3Pw/OnwBmBRg8QzUie1Pu92hXbfz6d9UNLZVj+sZFN9slIbNVn5Ead:jnwIBRg8Q4ie1WwhXL2bS+sZF3sId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632607252, "uuid": "ac1beccf-aaf4-4214-b15f-e2c89db2dc7c", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632607252, "uuid": "f0526040-d98a-41d6-bd22-23625a28f1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632607252, "uuid": "cf5b74c6-74bd-47b4-bb01-be69babb93cc", "value": "05efb99eaef063c9f393067c3e081c1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e94e2ec-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559312, "uuid": "3f5f99e4-4462-4c93-898b-0d400c34281b", "comment": "Malware payload (RedLineStealer)", "value": "373fb623c2f094b4c2c6f612b05b0a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559312, "uuid": "989534a7-757f-49c9-86b0-9be1f6beec00", "comment": "Malware payload (RedLineStealer)", "value": "97e26db316059a3660d3912d74e7d546f2a830d5c016daa883bf97b2aa5967cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559312, "uuid": "ca40e071-bdd7-49c0-9472-0071e775474d", "comment": "Malware payload (RedLineStealer)", "value": "d4a5903625bee3add36c1b20394508983f1af34d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559312, "uuid": "a6eb97f5-ee32-4ca8-948d-c1afaff58b4c", "comment": "Malware payload (RedLineStealer)", "value": "5a875607bd2118e31668384e5b480e6fb0824862462af8a00b138d956ef023320888ef75cb9e88862bc597bd9d1df55e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559312, "uuid": "adbedbfd-37e5-4978-b843-4e6ada854065", "value": "T15584C020B7E0C030F1B712F595B993B9AA2D7DB05B68D4CFA6D516EA12B46E0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559312, "uuid": "7e69aab1-9134-4478-bf58-91ea5a32e4c2", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559312, "uuid": "b5813e96-baad-4a96-a213-9da1f85d98ab", "value": "6144:RDBHAGfE01/8BBhzY4t51LUdjandyA2woIqkfX7:RDBHAGfJ1/Qhtt3IundyA27IqkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559312, "uuid": "33dc4a08-87fb-4d07-91a6-0f5a5bf5a6a7", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559312, "uuid": "bcff88e3-2e38-4e26-ab3c-d7bb48163586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559312, "uuid": "e46fc681-55d8-4117-8142-cd658e951123", "value": "373fb623c2f094b4c2c6f612b05b0a4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fdd494-1e15-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632583826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583826, "uuid": "5388f31b-7c94-48a0-9f78-e51f3db80081", "comment": "Malware payload (RaccoonStealer)", "value": "19b5efa2112f1ce81ceded6d3fed0124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583826, "uuid": "0eea5eb7-ec79-490f-89fc-9286638ba576", "comment": "Malware payload (RaccoonStealer)", "value": "985ff16dbca5cdfc7db559267eb2ab19fcdd0a4b3c103399989af3c6d4094ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583826, "uuid": "eb6b2821-af19-46ea-a79c-ec3f54513c06", "comment": "Malware payload (RaccoonStealer)", "value": "70f50da97520cab33d2a12e7c9ae642668f8491c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583826, "uuid": "b86dd4d7-d5af-4314-af19-77f1326bc42a", "comment": "Malware payload (RaccoonStealer)", "value": "4724e09147acac85a4af9bf6b6ee93f6ba8e79cdd5d015d0bc4e162e56a4f71ed4cbdfa8ad1655e3a58e27511086debe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583826, "uuid": "73e093c1-6cdf-48c3-aa8a-45d6d4a83a99", "value": "T1279412A47AE1C032D1F796766D39C971BA3FB4336934814A3F8D368B1E216D4DA26703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583826, "uuid": "c8d3349c-7958-44bb-8c15-f088f3eec3b2", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583826, "uuid": "135937a3-015c-45f1-a50a-bad3a83d2ac0", "value": "6144:gTMOUj1zETanTYaVhRpJOA/eRphVobKLisC1xJg1ri1NhGZbitHNHZa:u8VtJIRimefgUtibitHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632583826, "uuid": "550f9366-5720-4c37-ba18-5eb359d46e9f", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632583826, "uuid": "b10ca9a4-2e53-4d8e-a737-51a333d2e23a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583826, "uuid": "3716a8e6-b9b6-4354-88d8-476e23663e1c", "value": "19b5efa2112f1ce81ceded6d3fed0124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0575a55c-1e53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632610246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610246, "uuid": "f2c510ae-0883-4a61-ba37-86b2ce46ac44", "comment": "Malware payload (RaccoonStealer)", "value": "436a9d01e4384a9be90339fa4c0c92ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610246, "uuid": "5df0860c-b0e7-4a06-8551-ddee1ef0dd57", "comment": "Malware payload (RaccoonStealer)", "value": "9a1d08d8158e5278734fc0a434e73ca6279e7586b0c1dfc3f7d71c6c76a9de0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610246, "uuid": "c95b6dd0-a473-4e94-a350-2b8110fcc01f", "comment": "Malware payload (RaccoonStealer)", "value": "19421cca9409d625931049eaa7d509eb7f677115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632610246, "uuid": "98d4b051-d0a1-47de-ab5d-fbb677c30a67", "comment": "Malware payload (RaccoonStealer)", "value": "da1f97dcdebf9baff92fe4d875e8a9f39933eb1731cd7dcc2f4b959eeedd17bd84892cc400a4cadbacd376b48b3d5661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610246, "uuid": "392fad25-9a81-40d9-a6f1-3fe686173cce", "value": "T1E0940255BAF1B032E7E3547089A8CEF12A77BAE37571814B36471AAE1E313D15E22307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610246, "uuid": "bdb788da-2337-41ef-a1b5-2f265cea30e5", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610246, "uuid": "5ed3e957-487e-4556-80aa-d91566e6f1ba", "value": "12288:Ho9d56sMjfsYEL7gqcC1yxuqD844uAD8Fj+BLU:Hs51qrM7gnClG84w/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632610246, "uuid": "2b246e03-464b-46ce-9ee9-3a0e2c174139", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632610246, "uuid": "b75671a0-0dc0-4518-be96-f9979bab7830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632610246, "uuid": "5c2faa15-6887-46f2-a48c-c9d11410c13a", "value": "436a9d01e4384a9be90339fa4c0c92ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86faef8-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556859, "uuid": "4b56b598-18fc-454e-b6af-743861303b9c", "comment": "Malware payload (RedLineStealer)", "value": "d6e4d3fc9d81955aa6c823beae7d95a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556859, "uuid": "b522af92-d3ef-4e70-afb2-55da27ca0cbc", "comment": "Malware payload (RedLineStealer)", "value": "9ce6fba75012e1a220c2536e8351768962c4fb4a6374f99fc65e6a3937781054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556859, "uuid": "f2a22a59-c7f6-4c33-ad74-4ab368460d2c", "comment": "Malware payload (RedLineStealer)", "value": "06c5a92c6692f5f7779527f783e0b801ae0f93a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556859, "uuid": "ab9c5c9e-e464-4282-93cf-d2af2c5b0ef4", "comment": "Malware payload (RedLineStealer)", "value": "ed36d18ccdee59780298bc3e3fc9784ef5ff0a2651a6440da5285abbbc9c48a09d2497ef692f70a9b45d8e82c89bf9ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556859, "uuid": "007d74ee-58e1-49a2-9298-36922bd23cc1", "value": "T10874D02077E0C035F5B703F659BA93B9A92D7DB0AB2890CB92D517EA52786E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556859, "uuid": "babaaa3d-2511-43f5-bcbb-2009d35cb179", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556859, "uuid": "9dd0b0a6-b97d-41d4-94e5-b347547101f1", "value": "6144:ZRb7g0jjhilabOLRgtKKBkGxjsHj+2abJgGzaXHn4:ZRb7LjhillLpNYQHj+2AaXn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556859, "uuid": "7a62bc8e-767e-4b5d-9153-817232b56976", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556859, "uuid": "fa72a67d-2b7b-42bb-b4d2-ca7485a892c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556859, "uuid": "908cfe87-1c96-402b-8a80-5962cf7d7ba2", "value": "d6e4d3fc9d81955aa6c823beae7d95a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27daaaea-1e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632580239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580239, "uuid": "5abe301e-ffe8-451a-94cb-556e9d5d1c31", "comment": "Malware payload (RaccoonStealer)", "value": "e3b7419b91b0d34a844d551bd187ed0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580239, "uuid": "4fd02766-588a-4b7d-894a-47ee31c56fa4", "comment": "Malware payload (RaccoonStealer)", "value": "9cf88fe1e26029814e2d6877bd98604c88350d1899cd8adaa40dd7bf4b0303c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580239, "uuid": "d0c4d7e8-c2e6-43eb-a723-927670507dfc", "comment": "Malware payload (RaccoonStealer)", "value": "3639b6d6237b381f63c8555a0de2dd55155e3388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580239, "uuid": "6c77304a-a9db-4fb0-bfcb-e03e8bb4c191", "comment": "Malware payload (RaccoonStealer)", "value": "4da11876e77386c80ffa6133b8c65d5dc12dcf353713ef56346b91b33b47f809540755004d78990249964b9af213c78a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580239, "uuid": "b136545d-06ce-426c-b57f-3509a26fcdb0", "value": "T10A941290BBA1C032DEE795315A78C364AE3F7D728175524F7A981A2ECF202D5BE11723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580239, "uuid": "8c7887fb-fe6b-4ed5-a3af-78fdacffd211", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580239, "uuid": "014803f3-1107-498a-900a-a8901c1ba8bf", "value": "6144:ez4sIw9EM7JZ+Tmsxp1WrROjmmadv+rcuh3UCQR/5csz26c:PqqM7j+TmQC0ad213UlRUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632580239, "uuid": "7c124f80-955c-4613-b284-36d603181cf2", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632580239, "uuid": "4a37db8e-e84a-4a81-9ce0-89d86e3234e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580239, "uuid": "3967bbb9-d81e-4306-96f0-2a4dfc543d0b", "value": "e3b7419b91b0d34a844d551bd187ed0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1717814-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573625, "uuid": "d2aac474-548f-45e2-b971-572c7764be07", "comment": "Malware payload (Mirai)", "value": "e1f88f9e0cafc3a6fe24829a5dfddd4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573625, "uuid": "5def4cbd-d95e-48b5-ac0a-29bd1a1c1cc3", "comment": "Malware payload (Mirai)", "value": "9d8f1cba27e82c19c5dad78ce0966939dc1eab12da58a58786f1bf5a87e4cefb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573625, "uuid": "d7bd6def-3927-4d89-8eff-ca9450d094bc", "comment": "Malware payload (Mirai)", "value": "4f78fa8f4180427ec5a83eef311fa83b0aeeb67f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573625, "uuid": "5f24b403-3ec1-4a02-a26c-7425bc0abc5e", "comment": "Malware payload (Mirai)", "value": "e085cb1c87440f223280eac92350e2e0237a036a2988cb01db74f97ec785a0550229859ec5f14a641a0cb23481a17b03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573625, "uuid": "b194dbf7-26ef-4c25-aed6-5cb4bcfcf82d", "value": "T1F5231882BCC2991AC6D0A376FA7E11CE3321B3E9D1CB3617CD215F007A8562F0D67A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573625, "uuid": "c7ff9d1d-c21e-4d38-8c1b-82816c99f693", "value": "768:wY3DAbMcvmtb9jhWVHBu3552bNCVMkfO3jW+pSMBMuobPSWBkBNRu:TTEfmRbkHB+2bNCVMHTW4SqMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573625, "uuid": "b218fbf2-cad3-470f-ab48-7ceda6c79e3a", "value": 48000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573625, "uuid": "34de0f90-919b-4686-ad66-bf9943047d5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573625, "uuid": "ad2849dc-500c-435c-ac29-41fba593ec6e", "value": "arm5-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7efee02-1da2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632534605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534605, "uuid": "c0a16e0e-a4fc-467a-82c2-00c02f63de75", "comment": "Malware payload (Mirai)", "value": "8f11ed86e67a6297fcc7ed93920b6766", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534605, "uuid": "d3983e1a-2628-4879-aefe-7c3df37a7423", "comment": "Malware payload (Mirai)", "value": "9fa4aea9ccd5251c673b6cd4c14e584565566a166207a4f93ee22c2aa75f468d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534605, "uuid": "615ef5be-09d0-4a3e-b31b-68cc2db225e2", "comment": "Malware payload (Mirai)", "value": "3a49c08f9c5424fa0ed3c2dcb8778b4d86588d67", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534605, "uuid": "cd61fa0e-3299-4e4b-94fa-6f7510e67a08", "comment": "Malware payload (Mirai)", "value": "6412c3a1564d4b9d9956649e5217470479c1aca8b86e070b97e27eaaf4bf7a321bd995daf5acb8863dafd63a0441c464", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534605, "uuid": "aa775db2-3b15-4ae5-9d39-b7ea820ad9dc", "value": "T159C2D15191B844F1D9AD8376A02FB70F797872A4B2409CB5EAD8193DA4C1E393F38293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534605, "uuid": "8c9132e7-b06b-468f-a096-0e9d36d121e1", "value": "384:McpxiFZsuTsH+Mn3IA4Y/ndsB3qdP+hoqVUgs/pSTa++u3OxW6IANaNJawcudoDQ:DC/su/DAxPa9etqnbcuyD7UHQRjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632534605, "uuid": "a2935b27-ff6c-4c99-9542-8ea7739578e4", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632534605, "uuid": "7327c5ff-96f8-4ae4-8006-13007999cc3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534605, "uuid": "8a8ed7fd-f547-4522-abd2-a87d0a37a91a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adec1c98-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632559848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559848, "uuid": "609bfcdc-5eef-426b-9462-a22b1bfcae05", "comment": "Malware payload (RaccoonStealer)", "value": "35a5c8a4c179260ded7e3714b4775c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559848, "uuid": "03b2937d-c273-4ddc-aa42-59af2c0c3a69", "comment": "Malware payload (RaccoonStealer)", "value": "9fdb5071e972fe5d8405483510379cc201167f6dc98817a6bea366e5fc672a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559848, "uuid": "6c001cd4-9ae2-484e-a304-e87a543ccb83", "comment": "Malware payload (RaccoonStealer)", "value": "c2c3aa2fbdd21227cca3b5657da4ded9947fff00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559848, "uuid": "733c41a9-4952-40f9-982a-abd7d8613bb4", "comment": "Malware payload (RaccoonStealer)", "value": "72530a900c96d8286233d52753efd55885532b603b464db45f581cc4b29cdcc356c8e69919c5827eb6bfade522ad587d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559848, "uuid": "0f0dfe9d-c698-45ca-9791-ba1310a13f9b", "value": "T173940211B6B1843EE3D246705D21C25156FB7DA33A30850B3B99176E2F722D16A27FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559848, "uuid": "9ba4b661-a139-45b3-a451-3155d13d9a9c", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559848, "uuid": "f3e5b593-0571-40cc-ab67-7a2a1068303f", "value": "6144:Qo947jDL3S6mS+u9XDSOzhXh3B7B38rVma8A2vEHv2Vmjd5UQ1OSAYLks9c:Qo9qVL+u9zS2vt8rVyATDUQ1OkLkIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559848, "uuid": "0691c394-91f5-4f3a-8cdd-f7714c84ec75", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559848, "uuid": "97d2c0b6-17d8-4594-9da7-a5d9842af67c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559848, "uuid": "8b595db4-f429-4e1f-8980-e681baaf7b00", "value": "35a5c8a4c179260ded7e3714b4775c44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4f43d2-1e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632605345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605345, "uuid": "f9016f5e-667c-4cdb-b883-48902cd0aba4", "comment": "Malware payload (Gafgyt)", "value": "cb87e16416e0b43324394ac1ba18d572", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605345, "uuid": "c84bdc53-3c52-42a3-8bd6-8f1df43a4ae8", "comment": "Malware payload (Gafgyt)", "value": "a1ad29c9a80b14f6a0a3cd37b6dc34974dca0b3b8c26cba823b7c48ef3c864ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605345, "uuid": "2f7da664-1bd4-4729-b54e-8b98a1d294fd", "comment": "Malware payload (Gafgyt)", "value": "b08039d55fa692a2ad6b199e18041336e4160ca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605345, "uuid": "38dbccef-5122-444c-8f17-7f5caea07ade", "comment": "Malware payload (Gafgyt)", "value": "fb9e5be6c636807d443411fb6d210ff2254c356811a81a67362093ca273bd0bd503f4851ee7c6dfb4f4c93dfd822ad15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605345, "uuid": "e8185900-775c-4968-8434-a3d8bb001b97", "value": "T102731A41F9418B17C2C327B6FBDF8B593B3566949B973302B7287EB42B837891E25610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605345, "uuid": "2c76cbdd-9575-4616-a603-a51ef941f176", "value": "1536:Zt1UoydnGzOK01XZtuq6CbOfJkaCpgT+NB4RSmlXqQzP/yYsLcn:wn1FOqHOf6aCpgz4mlXqQzPaYsLcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605345, "uuid": "376544d8-0f40-4c3f-a48e-5eabb78abe94", "value": 78374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605345, "uuid": "16686fc8-675a-4b49-871a-98f60e1a61a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605345, "uuid": "79ed4303-5d48-4a4b-a4ac-41e94590b15d", "value": "cb87e16416e0b43324394ac1ba18d572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e15445-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632601902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601902, "uuid": "30598923-3fcb-4a99-9dc2-7c44cf5b4d29", "comment": "Malware payload (Mirai)", "value": "578172148c22d9163108ed7dbde7531c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601902, "uuid": "e7da0ded-4347-46e9-b16c-a3e3a8168dca", "comment": "Malware payload (Mirai)", "value": "a35472f46746f0f8772b027f917578dbdebdbf877055d32ccd9079eee27d09cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601902, "uuid": "2414edd9-eb8f-4177-9b10-8830bf1841e8", "comment": "Malware payload (Mirai)", "value": "9dc961caf549596ef0c5c6f02b92baee55ffbe4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601902, "uuid": "75e32456-41ae-4432-ae92-7e83d3fc3bcc", "comment": "Malware payload (Mirai)", "value": "44dec20e53b5fdb686156741ad49475bb94f3d390a8d3ce47c59b6be587414bac6bbd73e1fc5091242867e638aeeb457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601902, "uuid": "511eb599-15a1-4a40-ad71-472cfb1cb541", "value": "T1A9B27C62F0212C78D81212F9B134AB7543536DF598921C76ADAEF5990473E8CF1CEBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601902, "uuid": "22ab020e-171f-4084-829c-dceacd375e0d", "value": "384:F7xakKhcE5cTFD/5h+KO29KMmTKCybEqyw8vIsKC+dOVVtD7Zt:FfKhcEm7pZYDeCuivxOOVVtD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601902, "uuid": "4291406f-33e0-483c-9342-2e2f32a27bcf", "value": 25188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601902, "uuid": "944f543b-3d56-4764-bda9-82ff6528175f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601902, "uuid": "963b4982-cdcf-4cfb-bb62-1dda04165c85", "value": "578172148c22d9163108ed7dbde7531c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f889f042-1da7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632536780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632536780, "uuid": "6c2f50aa-65a4-478d-bf66-73e86905eca1", "comment": "Malware payload (Mirai)", "value": "a6c0d5a21a88c5d8450782a457bf151e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632536780, "uuid": "646cdee8-88af-483d-a101-d7bb72414ff3", "comment": "Malware payload (Mirai)", "value": "a3e766980da654a7d5e1df393d008141fa56b2183bb0c4fb10fa6ff55e296c32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632536780, "uuid": "8dba0c3e-576b-4c4a-85b0-ee3db1cb43e8", "comment": "Malware payload (Mirai)", "value": "a463d1ea1b08ae1449d10d92d3ccd57a26c274c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632536780, "uuid": "1c70454e-357c-421b-a08b-2ad655d372e3", "comment": "Malware payload (Mirai)", "value": "28b4129914299e81c6f31f75731e44c55f6608cdb0e1d697443b32a395ab915402f5aa235b2879e3af3d14ec79f35a9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632536780, "uuid": "000218ea-f940-4d84-bf7e-f11680273410", "value": "T1A1736CBCF179AEC4D2514578B86499389B23F00A92E22EF7DDC4419FA897DE4F5087B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632536780, "uuid": "600f72fe-c339-4e97-8954-aaccf9f90f54", "value": "1536:naAYdWE1H05hcIwtw8tFz3e1KFfs3cNbXoSteIC2u:nxYYkH05r2z3e1Ef+SsSteI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632536780, "uuid": "c6d96085-9acf-4fc1-82b9-e251396f5a4a", "value": 78976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632536780, "uuid": "0568ab16-350e-44f5-bf81-0270e9020924", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632536780, "uuid": "70c8990b-d796-45ff-b0ad-64c650566c1f", "value": "a6c0d5a21a88c5d8450782a457bf151e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ca5c87-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632601821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601821, "uuid": "a66650a2-24c1-45b4-b25a-cabdfde68a8d", "comment": "Malware payload (RedLineStealer)", "value": "0c90ff848d05b4ea21c46896d421f825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601821, "uuid": "ab0067f6-be1f-4491-87f1-ae20e4a0dfb5", "comment": "Malware payload (RedLineStealer)", "value": "a4260ab00a78d568cc36ad8a43cff5633bfd365e34d2378ccc11f42a56067f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601821, "uuid": "68660603-c8f7-4942-bea7-b81758db3432", "comment": "Malware payload (RedLineStealer)", "value": "6567250aaccd8c2b2128407eba9f98bc7c30cecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601821, "uuid": "491cb7b9-3819-4b62-8a02-645e62b4cf83", "comment": "Malware payload (RedLineStealer)", "value": "6ad76f5b3dca2bf2a152e4aa747c31c01fb88df76cf63cb7814542f0b8dc654c406de3eba839814a3a9ae64dac55f3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601821, "uuid": "69c5cc13-e835-43b6-a64d-106927c56c68", "value": "T105C4122179B0D132D3E66D70512983A54E2B78306D77858AF7BCE79E2AB16D09BF0343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601821, "uuid": "3a67a344-3127-4457-8123-feb3c4677ac0", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601821, "uuid": "d64e743c-21d9-4947-8491-0b7923abf282", "value": "12288:j4Qgq4bYBN3bPGcePOcnRtuPGYnnFYMy9aolY0pS6SEebKkYYUCQ:j4Qt4sw2O9eFLo7b5SpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601821, "uuid": "ca264797-cda6-4da0-854a-acf2f72b99b1", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601821, "uuid": "be40444c-ad7b-4972-9ef3-7c2bc3fe8f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601821, "uuid": "bcaa60cb-3ef1-413a-b2ae-b942128e02e4", "value": "0c90ff848d05b4ea21c46896d421f825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bfd1f0-1dee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632567191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567191, "uuid": "0abfcb4c-1838-466d-8b14-8ae64f5c7a02", "comment": "Malware payload (RedLineStealer)", "value": "7ab5ef3521a43bc2739cd17fb35e45f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567191, "uuid": "610d94f7-ec76-4abf-9e27-09b21bb17323", "comment": "Malware payload (RedLineStealer)", "value": "a50ad8a382eedfa222be8066f68ca04bf90b573feb8093a31420b44dd4b34651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567191, "uuid": "f4e1eacb-7d53-40ad-a90a-457dce37fea7", "comment": "Malware payload (RedLineStealer)", "value": "62dc5ec222c6570ae60a21cf263322c611426d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567191, "uuid": "c742216f-fc7c-4252-a1f1-f03eaf24d2a0", "comment": "Malware payload (RedLineStealer)", "value": "0e0c9e89729d03422076dec28cf350aab30dabcb64c6337634766036dcf29697e11ae19b20fa8282e8018eb67e009d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567191, "uuid": "5e25edb1-1f0c-4f01-a434-cb59e06ca358", "value": "T1E474C020A7E0C039F5B712F659BA97B9AA297DB06B3480CF53C517EA52386E5CC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567191, "uuid": "810a3065-7ca4-4026-a50f-f4482ab09b49", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567191, "uuid": "3fe48a8e-3a32-4624-9b65-41825a893f9e", "value": "6144:+zrdOcbjtslebiPvjRg1DcfYXBgK22/hv6F+4LxOmq:+zrddjtslNPqNcAL/hCFF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632567191, "uuid": "947ee67d-c71f-45c5-8604-235ebfc19b32", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632567191, "uuid": "e2a71e13-c756-4064-86bc-c273a2a22aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567191, "uuid": "b545bf54-8ad5-46b2-881b-a83ad3691fa1", "value": "7ab5ef3521a43bc2739cd17fb35e45f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c1a072-1e16-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632584205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584205, "uuid": "438abe46-761c-4dfd-bd5b-0a6357e2d46d", "comment": "Malware payload (Gafgyt)", "value": "ebc044714f85bf0e52e8fb3a33231a3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584205, "uuid": "e60c895d-992b-4fee-9a33-33d31c6d74e5", "comment": "Malware payload (Gafgyt)", "value": "a5678f20229dbf037906cd3e93b7a4f2edccef786646e68d2814b195ff068e84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584205, "uuid": "3c1c4849-52b0-4feb-b396-999b45823fe0", "comment": "Malware payload (Gafgyt)", "value": "cb2a8737b992c604e52f8e803e2325fe4e08c5a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632584205, "uuid": "29894fae-1dc2-49a1-a47e-80cea0ac2a3a", "comment": "Malware payload (Gafgyt)", "value": "951931ce33f600f9f3ecebe84e3c71e22a38ee9a88e800366d583b31ffdeda10f54c7b0b9689f27bfeed8c79c6e89042", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584205, "uuid": "8a08ecc1-26f3-4185-ae33-5b642dd552bc", "value": "T191733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584205, "uuid": "c4cdae1e-e8de-40fe-a93f-7680b947694d", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMtMmLI2VOCjXUfJRk:45omr0xKFn6J+O+MmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632584205, "uuid": "33096825-fadf-4739-95f1-8108034350b4", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632584205, "uuid": "c03c6f1c-b9a9-4f5b-ba60-77a8236d74b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632584205, "uuid": "054c5dd2-59f0-4960-8fea-f56693acb712", "value": "ebc044714f85bf0e52e8fb3a33231a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe0c0df-1e37-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632598479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598479, "uuid": "33bdbfa7-07fc-4bf2-813a-78f5bd9db0b1", "comment": "Malware payload", "value": "87b3904007bc405d6791945c6ffde246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598479, "uuid": "6e20b6b0-653c-400e-8da0-7708f85e3631", "comment": "Malware payload", "value": "a63c1c0e4e8ba031f52bb0da39001bf711d548b543c917b4292c5b23ee6971f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598479, "uuid": "14508dc5-7cdd-4fde-ad32-828d7b09c0ab", "comment": "Malware payload", "value": "410a7fb7aac0b78b1c81b78dd352a7a5867756fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598479, "uuid": "0d918348-e7ca-4968-801f-4db4568cf46d", "comment": "Malware payload", "value": "41851863e191e5c3817729515b2a19c2bd7d60d3181a3b1aeb10c49af2865180f3121e073bef85f4851780f3ac24ce7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598479, "uuid": "1ef901c7-dd77-4290-a101-f484b2e10bac", "value": "T1ED231C85F9919612C6E415BBBE0D038C772A57ACD1EF7203DE22AF613BDE41B0E7A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598479, "uuid": "9f258bba-2a52-47b6-be33-d56d606866c7", "value": "1536:2Azd7YajKPhxycq9Cv2iYEyMVIYWrFHOpnRr:2AxY4cB+iY7aTEFHOpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632598479, "uuid": "2da85cb0-56f0-4dc4-876e-fe9c2a2ee3b3", "value": 50080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632598479, "uuid": "fe498107-41ed-4b7b-a44d-580692aab13f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598479, "uuid": "706393a0-de48-4370-b63a-259ebd4d084b", "value": "87b3904007bc405d6791945c6ffde246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797f5d41-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562337, "uuid": "7c44ce6b-1048-48c4-bd8e-65e9a9deb9d3", "comment": "Malware payload (RedLineStealer)", "value": "ff7f5820aa1ce7ec7e254464402fb002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562337, "uuid": "729b1516-078b-4961-831e-01816293c1aa", "comment": "Malware payload (RedLineStealer)", "value": "a64c5905d68c68527c7d182293552c7dddb2175397e921a3cec9daf7e164a683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562337, "uuid": "e170ef0c-c45d-4025-9af2-0d81854b149a", "comment": "Malware payload (RedLineStealer)", "value": "1980f420e180309a370e14f9755cc06a6e6f379f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562337, "uuid": "0530a5d2-7623-4782-b71a-16436ecdc11e", "comment": "Malware payload (RedLineStealer)", "value": "f706aa0efce80306e39d1fafad1cefdd66bf24fd93e756dad93fdfbb6e8752c587e71e57481bd3b941cdbca58faf453e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562337, "uuid": "b57a568c-dd2d-4ba5-9699-6883ec1a814c", "value": "T17A74BE10B6E1C038F6F312F949BA93B8A93E7DB16B3481CF62D516EA56646E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562337, "uuid": "b9172a28-598b-4744-9f64-daacc53ff238", "value": "077da89a12148c6ee034067c75e2bb0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562337, "uuid": "a98c4be6-4010-4abe-aef1-7b6f90a4c659", "value": "6144:PZ025xk+bQc/Tbk0V9pENTM7JLlguTcjO8kphcVa1dS:PZ025xk+bVbZpuAfy62e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562337, "uuid": "0f7b9984-4c3e-479f-aeaa-c1243ef36d31", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562337, "uuid": "b472148b-11f8-40b1-aaec-d95df4bfdf6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562337, "uuid": "f88bb704-e8cd-4ed5-a8f9-37b232ff1bfe", "value": "ff7f5820aa1ce7ec7e254464402fb002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de961564-1e40-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632602450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602450, "uuid": "24b28698-b0d5-4b33-8db7-d4f87984577b", "comment": "Malware payload", "value": "2459f18f245442997cc66ff495ea655f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602450, "uuid": "2292c580-00f4-462e-816e-1c05db2c7cd5", "comment": "Malware payload", "value": "a65169b790ea6b4fb6f8be2cdb8356cb1bdae1afacabfc3fa4b5afb41938c5e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602450, "uuid": "1e1b168a-7592-4d1e-a4cc-ea459c5b0d25", "comment": "Malware payload", "value": "2567d43177d7659866dec5f74f6f623e0bcac84b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602450, "uuid": "143222e7-3f31-44e5-811b-dd9e57a4a9d2", "comment": "Malware payload", "value": "f4cf829117c478ed4bd061298e9a881c5795a510878fd183a2079eeef305471f7abfa3ca5a8c7b57b224a4443e895a23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602450, "uuid": "6dfd092d-82d0-46d3-940b-021d95628f13", "value": "T15BB2D13C070B24E2DA1A44F903E613E5ADE00763B15BDD06928056D2EAF95BD6D97FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602450, "uuid": "cee739d0-fad6-42dd-88cf-8ce2f7750af1", "value": "384:HVaMABppI4wEEzz3lhLTOZGKc2MBcYm+Ww779aLfBxJgGlzDpx+73sr8:HBOuV/nOGQCc9oILfrJgGlzDpxYsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602450, "uuid": "2ef17864-0f5d-4776-9833-2b6c759b0e9c", "value": 24156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602450, "uuid": "b8a9ab47-bd1e-4457-bd45-0c70e10fb9c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602450, "uuid": "e409c198-73f7-4bd1-be80-d4cbfb8d8b4b", "value": "2459f18f245442997cc66ff495ea655f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68440e5a-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632552859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552859, "uuid": "005e2db0-428b-4af4-a30d-27874b2e3ef7", "comment": "Malware payload (RedLineStealer)", "value": "7c079a286760499ffa5ad49513ea37f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552859, "uuid": "322a2655-e3af-4e50-a0d8-219ed00435f6", "comment": "Malware payload (RedLineStealer)", "value": "a6b1c71eb37fde7da57be8cb54e7433d40d1418425b69f37bb3ec74270bb6009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552859, "uuid": "9c2d658d-240e-4386-bcef-b40aaf9cc03c", "comment": "Malware payload (RedLineStealer)", "value": "4f7e7864715831c89bb28d7fb1b3ea1ecc080e30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552859, "uuid": "e0b0f841-f268-4c9b-ad04-f72e5cf2637e", "comment": "Malware payload (RedLineStealer)", "value": "d9e43b809cd462fdd51df03ef1ac70f633e94e1488d90ed0d5baa37eb175501c649bac4adc1fc9e8a8e3f99f6f3ef6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552859, "uuid": "126e627f-4caf-4f7d-ad47-310090cfe3b6", "value": "T13B84CF20B6E0C034F1B713F559BA93B9A92DBDB06B38C5CB63D516EA16A46E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552859, "uuid": "766a096c-20b0-43f8-9fef-d88e7beaf263", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552859, "uuid": "3c166c99-7907-4a75-922b-8a1fe31307ca", "value": "6144:OLWqsfIUk1/TBcKPG6wZukkPBFsg6fx5ojkRjOwVdeWH:OLWqsf5k1/iKhwusLf53rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552859, "uuid": "6b080022-2a96-4123-afba-54de4916e26a", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552859, "uuid": "aec8b4cc-bb49-4c22-8aa1-75286a314ed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552859, "uuid": "69b749e1-8d2e-4fd2-98c2-5915706e67c5", "value": "7c079a286760499ffa5ad49513ea37f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71202fe9-1e23-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632589811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589811, "uuid": "1a7fc849-6d65-4969-9f39-b7359f68b617", "comment": "Malware payload", "value": "666069add8f8c1c993c706817c1145c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589811, "uuid": "43e697ea-cff4-4a02-b53b-7bc570437485", "comment": "Malware payload", "value": "a7b2e91c63805cdbacd4d7904486e86cf4e5791a32491cd59589c29566d5034f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589811, "uuid": "8f75255f-7a39-4ae0-810d-3894bd259c04", "comment": "Malware payload", "value": "1504e8906dca683e357ff66614c775c3205082e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589811, "uuid": "0f72b3c5-3e56-464a-b24c-783bf4ad9230", "comment": "Malware payload", "value": "f6495ab14ce156cb27942d8b8722223224fd7053a576eac00323889e17d475c955ccc03904a49f3d1a9d2a877675e41b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589811, "uuid": "48071d61-414f-4645-aafd-9b5efae9d765", "value": "T11314EF1912E9D0F37177CABC03CAE635A427D5EB2E15683826D94088479DD81F8F72EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589811, "uuid": "0dd9f8e0-8cb2-4990-9dca-36957ef6952c", "value": "3072:LKh/XliiSGGg8ObUmvr5yafeDtoDRtfPn3Kmr+AD7rX52M0VfNnSG3xPSl1Lr1qg:LZGGg8Ob/6UDpzVUlru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632589811, "uuid": "99cee8de-7fac-4e60-8f11-44cae05a532e", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632589811, "uuid": "d49db985-1725-4c28-b846-2ae0afd62066", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589811, "uuid": "9e12d3a3-4c42-4fc6-8610-192c647cdf57", "value": "666069add8f8c1c993c706817c1145c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a89b383-1dd8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557507, "uuid": "a45d411c-f493-405c-bd76-cb6d4b6e1eb9", "comment": "Malware payload (RedLineStealer)", "value": "04b456ff36412c84821b0e945c24bc71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557507, "uuid": "d578103a-0b87-4f12-bbe9-7102396df10e", "comment": "Malware payload (RedLineStealer)", "value": "a7e4f1da0530887fb3c60141d8263cc9c92474067f9f8c6b9b65633a72bd87ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557507, "uuid": "4451dc74-a069-4f9f-834b-e9ceda85de42", "comment": "Malware payload (RedLineStealer)", "value": "640aec31c2ac988d7bc2ba39accd1399d68c7e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557507, "uuid": "908abed5-0583-4fb1-87db-f12460353e62", "comment": "Malware payload (RedLineStealer)", "value": "324eb3fdc270e14fc27b4a7993ebb28db9c9470cb2f72749c009bacb207a831f51cd4f94eafddfc7ae242fd7dee9f67b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557507, "uuid": "c1e08839-7a7e-4fb1-8453-6c06090b0885", "value": "T1A964BE20BBA0C035F5F712F85AB99368A43E7A709B3051CF52D616EE26346E4DD30B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557507, "uuid": "847fd0d9-6fa6-408f-ad8a-a67f80303b69", "value": "2d3e8f1de619588f819136537821e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557507, "uuid": "5d4ff91f-ef23-4219-8ddf-246290c96b3d", "value": "6144:wNZQtZa/fEK5uuWyF9L12P0TKIbywJLSjyYWf67fDwdfMP9UGLL8:qZb/fEK5uzIL12sWImzjyYWy7fyUPWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557507, "uuid": "8ee19858-cc65-43e4-bbb8-7ef0f3058d4b", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557507, "uuid": "f8497e24-9fc1-410f-93ae-b9800b839137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557507, "uuid": "3bf14487-d875-46c2-80cf-f5f93f202aac", "value": "04b456ff36412c84821b0e945c24bc71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c9213d-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563289, "uuid": "a181ea15-8814-4fb4-a3a0-e7c1c3913ae1", "comment": "Malware payload (RedLineStealer)", "value": "026b0fb8d20d79d5245fbc4488d33fc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563289, "uuid": "30c5c4d3-c13e-459f-94ef-fce7f85fb113", "comment": "Malware payload (RedLineStealer)", "value": "a828fcad7c030ff091ddb18c9025f338bf77cfc6e7f9c1dcdd059f44017a8f94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563289, "uuid": "f1736cad-33cf-42bc-b22b-a4a41f2150da", "comment": "Malware payload (RedLineStealer)", "value": "21ceaf4468ccfb0b952ff3e983b34e61817a75ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563289, "uuid": "abf97c26-170d-40e2-ba54-5546eccdd95a", "comment": "Malware payload (RedLineStealer)", "value": "81bcba67ce4ab943542b29de77eed149ab2e64622b79a3b37cba6386c3edb37e6fd65a564d9796f355c6ac9ab91b1ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563289, "uuid": "fb574ef8-5e17-4dd8-ab3d-b0dc6f164772", "value": "T17784AF30BAE0C034F5F716F889B993A8A93D7AB15B3481CB62D516EE26346E4DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563289, "uuid": "39a05cc2-914a-4992-8d16-82935165785b", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563289, "uuid": "a901b04c-0b02-422f-87bc-88609b6abe18", "value": "6144:diQNNMk/I9VN5CazPFvlTqDR0ZnlKUSPdc5o9s6j:7NNMk/IV5JPrqDenAUeFOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563289, "uuid": "3648a25b-d2e1-48a4-b794-3c58742709c6", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563289, "uuid": "4a0a57d9-3872-492d-a814-cb61be6774b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563289, "uuid": "f8f6bb71-bb6c-4724-a0d9-df844af72319", "value": "026b0fb8d20d79d5245fbc4488d33fc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849b2978-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632552477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552477, "uuid": "b846a516-2714-4c33-a84d-5a56a9ea0081", "comment": "Malware payload (ArkeiStealer)", "value": "6225a6207358eceb61f2f62b4354056c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552477, "uuid": "67601418-23da-4588-99cd-9633767b4dfd", "comment": "Malware payload (ArkeiStealer)", "value": "a852f675762788e471088ccc46a5d4b0d5ef31a6dc19e689f15368d17e371eba", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552477, "uuid": "78392702-34f6-4d17-8a00-7d00149a807c", "comment": "Malware payload (ArkeiStealer)", "value": "73a207589c94eb716200e7fb5e57b230ecd14ee0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552477, "uuid": "90c70be4-3a33-4c0b-ae7f-d904ad3d8cc7", "comment": "Malware payload (ArkeiStealer)", "value": "7151606b61364ab3fcfdfe67f047a47497968aa3888b6b4d7571105e826073ddc2c0069ed163bf972dd520a08df6967e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552477, "uuid": "4dc6baa9-4f18-455f-b1ab-5af6be6aa0ce", "value": "T15B65E0259281F437D1B3FA78DD969B7F9B3C7E103910080B6EE82D691B2A3C0B518767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552477, "uuid": "4704b797-c783-4305-a8fe-d442afa457c3", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552477, "uuid": "086a8e71-0e05-4cb0-809b-395a68937ef9", "value": "24576:HBuzcdGnDDV1EX9uOJwQ5No04Hoawhb5BJnXvxWmmq0LBPdchd:H2DvvgwQ5C04Ibb5BJXIVqMBPdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552477, "uuid": "5b2eb081-3216-47c0-9339-531f9a003ced", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552477, "uuid": "2e14de5b-ce96-47b5-a0ef-912703ee3e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552477, "uuid": "8c1c0926-4877-4d5b-aed2-5aa372550754", "value": "6225a6207358eceb61f2f62b4354056c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e011e96-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601912, "uuid": "c7b44c94-4c85-4e5f-aa49-b973c8f123c0", "comment": "Malware payload", "value": "8fef2315cc841ef2aa1019042781502f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601912, "uuid": "e7cc6b21-ba17-4248-8bf8-b93fde6ed127", "comment": "Malware payload", "value": "a94a0c3c6a85960c1eec3ec10b6ea3f5bf5d8fe8693616b317d5e1ec97388b01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601912, "uuid": "ac8846b5-e4b6-4c8b-9a32-a1516c959c9e", "comment": "Malware payload", "value": "de492aa11215fe6363f9b7cf8b8ff531ec2a63ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601912, "uuid": "6b8d6ff2-9a63-4627-bfb3-684e04a0ed82", "comment": "Malware payload", "value": "003fc3deb6f7ef85bcccfc928d89737f3577dbed95db6fa26a780de99a66a2b5b265a667bdc7f8b94eca21243dfc5904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601912, "uuid": "4e129dff-b4ca-4000-b113-8f3a2064949d", "value": "T105822B45BA835A45D4D0FF7D7E9F464D33324784C1AE230AE809EB245F8D95F8DA3A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601912, "uuid": "e5e5bf47-badc-47b9-9f6d-2a5897a3e917", "value": "384:7ZX/J6nxlx5WKsnKo+apl/nGHE5E63pEVRutniV8MCiSuUdXNG3qoZ:736nfhBinGcppETZiMgN6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601912, "uuid": "c6a466ff-4636-4ef3-b86e-7b1f0f07475d", "value": 17664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601912, "uuid": "322b9a40-ecc0-4fdc-b523-95eb026500c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601912, "uuid": "9e2c9c3b-4910-4818-9275-5bd3a98faa7e", "value": "8fef2315cc841ef2aa1019042781502f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eec2eb-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563265, "uuid": "dcddc82d-b59b-41e2-a95f-e18278e618a4", "comment": "Malware payload (RedLineStealer)", "value": "85c740b6a200070aa7da8ee1137fd3f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563265, "uuid": "1913cd76-fd96-453d-b336-26c228050c7f", "comment": "Malware payload (RedLineStealer)", "value": "a994447e2c9410646848bc384c99610e71975107fb6becd7202bb551a6841baf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563265, "uuid": "e0c084a2-c159-4246-a651-c058f4ec4937", "comment": "Malware payload (RedLineStealer)", "value": "f03e0cbf5fb1cc5ecd913946d2b269df870f0530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563265, "uuid": "a4d6e4e9-20e0-423d-9892-44e24cc40db0", "comment": "Malware payload (RedLineStealer)", "value": "9ebe393486cee3f0149f66639b810c65ff60293fc58edb8b1457711312f0d4072e7cd99c4c290f1c2d278ad167b89e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563265, "uuid": "1d2a6881-0059-4abc-95be-bf22a4c42497", "value": "T16984AE20BAA0C034F5F712F956BAD7ACA93E79B15B3451CB62D116EA22387E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563265, "uuid": "88a47c50-e895-48aa-8bab-85af20fc2112", "value": "a2bc3921f9c8d145b9a6f1e3eaf1f8a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563265, "uuid": "3b86aa30-b09c-4ba8-9213-8967091f2040", "value": "6144:qVJyxg0ocl0Yc3+sUWi724mXvaGz0emHbSWO/DVlrGoiu4U:uyxg0oclm+TWiq4nGz0edbDVlry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563265, "uuid": "45e4927c-3ed0-4ed7-9325-225029d18297", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563265, "uuid": "892d4448-cc9f-4cea-bdf5-bdf68a07e191", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563265, "uuid": "5727edec-8de0-41c1-941c-ffad3735b882", "value": "85c740b6a200070aa7da8ee1137fd3f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de8d7e7-1e1c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632586691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632586691, "uuid": "42ce32e6-b757-4880-8ec3-6ea2373a02ef", "comment": "Malware payload (RedLineStealer)", "value": "5c45069192500033a37be2c8c49c239e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632586691, "uuid": "495d758e-0ae4-40c4-bc57-929287f82a12", "comment": "Malware payload (RedLineStealer)", "value": "aa20d456afae22177e9155b5413f2b4493a751c11b5da94ae51a877157893505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632586691, "uuid": "5902fbb6-48a6-4534-a857-1223d5f86126", "comment": "Malware payload (RedLineStealer)", "value": "6d24eb2404a439f2cd8dc399c3725e0eca796458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632586691, "uuid": "b1a1c426-c482-4036-9f0c-f5b0c96246e3", "comment": "Malware payload (RedLineStealer)", "value": "a4cd474296a05370caab38879f10adebfc3de390097e32888fa1d902544f3ca8101ee83fd1c79a4736f31bf61b5849f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632586691, "uuid": "1b2549c3-ac8b-4bd0-9eef-f8caa9061035", "value": "T17C24EF203AF18036D2B779704974C3D1593BB973EB70B58B3A85226E1E713E29922F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632586691, "uuid": "8be5bf83-5e9e-4b00-a4ef-f10f46ca1706", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632586691, "uuid": "d5e3a389-5a86-4ea9-ab5e-b1dfe0eb4df6", "value": "3072:AGGKp7N9IcBUd4O0c5v1SedkG2m1I8Y5a6tfgrFV5RXqeyY5XTKoKPD5HuHMX1dH:AGGKp7HIX4Y5v1hqB0ia6gF1XqeEued", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632586691, "uuid": "c335e968-3c3f-4220-ba7d-4f630bb5a126", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632586691, "uuid": "10dfc4ff-3f56-4650-a324-b67c2da548fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632586691, "uuid": "10e83882-846d-4e7a-8df4-406e68b4bcb1", "value": "5c45069192500033a37be2c8c49c239e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cee6bf3-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559658, "uuid": "42afcd0e-61d4-4574-876e-97cc47826a92", "comment": "Malware payload (RedLineStealer)", "value": "461126e7c8a1fc97b4d99ef4463bcbe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559658, "uuid": "dcbdaa28-ede6-454a-b8b6-83f53ac734b5", "comment": "Malware payload (RedLineStealer)", "value": "aa29359f77026e826a01ca202aeac9817833df7f2a2b701fb4ae36e3a23e3256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559658, "uuid": "de055336-fa38-414c-ae3a-a06ef9f296fc", "comment": "Malware payload (RedLineStealer)", "value": "49169fae0ec8d8fb7318ce03a6ed21f42274e7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559658, "uuid": "9f0dea0f-7320-4882-80ad-25c5cabd1f6a", "comment": "Malware payload (RedLineStealer)", "value": "de4989124fbf86f8e5b66abb106468f214e65b0c9f17b565bb5ae8477ab1d4a46e130d356d4543b01e4b685734a81b0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559658, "uuid": "3ce95e06-e921-4194-8a95-3674f3ca97bf", "value": "T1C974BE20A7E0C034F5B712FA49BA93B8B92D7EB05B2885CB63D426EA52746D4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559658, "uuid": "949e5185-4f6f-4ac1-a1ea-59b49026958f", "value": "bafa6c1265d6e12ccec5d8ce52c0df70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559658, "uuid": "5ee94a50-1501-4ced-b0ff-f421294531b6", "value": "6144:uPkmKM6ffbd80eowi15rcEO8NfdzTMCMCQ:uPkmKM6ffbeobjlXMCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559658, "uuid": "f9e107e7-0fca-4c35-864f-fd962c386a49", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559658, "uuid": "991550e5-0e68-4765-bd92-7bbf9deacb55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559658, "uuid": "49bdca4d-f8cd-412f-9609-5d8800e7410d", "value": "461126e7c8a1fc97b4d99ef4463bcbe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21536205-1dd8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557465, "uuid": "1811320f-11c9-48af-8e69-35b440288651", "comment": "Malware payload (RedLineStealer)", "value": "bf15cb801b1919a71b0979efa22f4b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557465, "uuid": "9d81337f-172d-4e51-b59b-3d3bd401d373", "comment": "Malware payload (RedLineStealer)", "value": "ab3288194f8b5415adfd976b30e88cf5baacb4492c55420799dca60475a76933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557465, "uuid": "16d9c933-4c53-4861-8684-6ce4d0184d6c", "comment": "Malware payload (RedLineStealer)", "value": "544aa302f49a2509cd5faf42c424d38a03545fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557465, "uuid": "c3585043-8b01-47dd-8311-723812a1bf9d", "comment": "Malware payload (RedLineStealer)", "value": "f76f64c7dcbf6051aa5b70559ae1fa418f5f4fc95c0b7e2b67e84859f241ca1d2f558809d542142e29bb9283cd84abfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557465, "uuid": "893a0886-d157-44f7-bd4d-7f6f5213b9f8", "value": "T1EF74CF10BAE0C039F4B713F54AB6D7B8A92D7DB0AB2850CB62D527EA56746E1DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557465, "uuid": "89ffa690-bd2f-4ca0-9fd0-878534967c2e", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557465, "uuid": "75a9fe11-5aaa-429a-85d6-5e8a98e45be2", "value": "6144:hor9uc9j0glebPPyN0Kf4ZEWLJR/wlxOzdS1:hor9Tj0glcPzlEWdBQxOzdS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557465, "uuid": "0f11d764-539e-40f9-9907-977a6c3c883b", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557465, "uuid": "edfbee62-75dc-4560-b3f7-148f147614eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557465, "uuid": "e5ca35de-053e-4901-8a48-9fff0c3f2977", "value": "bf15cb801b1919a71b0979efa22f4b52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a67b5d7-1e35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632597504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597504, "uuid": "90cd618f-9841-413d-8efd-3905978d818e", "comment": "Malware payload (RedLineStealer)", "value": "cbc718109cc4c4e9e75554a535641291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597504, "uuid": "7ed2ae27-f1f8-4c84-88ba-151c91f085fb", "comment": "Malware payload (RedLineStealer)", "value": "ac38845908c54294fa984b785df1e51d263451ac1c1f7af1a96a4521d1245232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597504, "uuid": "f9b9ea88-8de8-4096-b205-4b1a31b4c909", "comment": "Malware payload (RedLineStealer)", "value": "45567043e73b64a99ed2473e6e02cfaaccdc45b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632597504, "uuid": "ee6f7343-baca-46cf-bf91-ce7edd9228d1", "comment": "Malware payload (RedLineStealer)", "value": "03c6e064dd23cf5fa6a5a1d1259b6392397a44cb29087e72836dd5dbe56f05037c257524f2dd6ef7b1a808d36f06e4b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597504, "uuid": "88635afa-43da-4c8f-9354-e3e25e1d683c", "value": "T1EC24D02136E5DC32F6A7B6708874DFA4297FF9632F70458B329516A90D213D19A3630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597504, "uuid": "eb645455-378c-4071-b498-941eb8c7a877", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597504, "uuid": "24d5e56b-ac85-4f91-830c-492814f320c9", "value": "3072:JB+Cx5KRluuOpi/vlRgsn7hAIoiNBvE9BHEr0Z8muA5Jzir2Bu4D57gnOfRdY5:JB+25GOWvlRgXI7gVP/5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632597504, "uuid": "cf9a662f-2207-4f93-8169-7c5aeb422b49", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632597504, "uuid": "d14b3a22-4c57-4f00-b57a-8da067e3c0d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632597504, "uuid": "33c80a58-12b9-4ef4-926e-70cbd208a37e", "value": "cbc718109cc4c4e9e75554a535641291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf31c388-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573621, "uuid": "c6447311-022c-4643-86e8-6c61ce4c1590", "comment": "Malware payload (Mirai)", "value": "fdfefc24813cc48f9642f8f4a76899e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573621, "uuid": "9b5a1c98-3fed-4b09-b294-cce55d3b14e7", "comment": "Malware payload (Mirai)", "value": "ae754be7ef391ac9a129608a2232461c45274d63a93beeee2a90d0b9363eddef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573621, "uuid": "deca3e6b-54ad-4197-a4c0-16c469453995", "comment": "Malware payload (Mirai)", "value": "feb046cc9173a3f656a01acb6d7584e9e9a56469", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573621, "uuid": "f0d1d280-681a-4df7-8b82-33a5e309c34e", "comment": "Malware payload (Mirai)", "value": "ddff398b2f7767b848d02dd7a5f9f08d4a99bdfed71e9f7302727cb64e37912a155eee5e13048cd24fd38dc0f197c882", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573621, "uuid": "6c507c4a-7263-456d-b416-8be7a637c47d", "value": "T19E336DC5AB43DAF5EC1609353133EF325B76E53E6028FD83C7959A33D886A02D106A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573621, "uuid": "b1ad3c47-6e9c-4a82-a9eb-198e23fd5846", "value": "768:uewl0dwW2RNjPxGaydPbQQ0OUyoe3U8HAARZePmGk1IAsu6tYl1GHTm:uFiUjJGaydPbT0OUy93jHxG7UsZq1GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573621, "uuid": "4c58c26a-7c86-4353-a7a4-168056fecc31", "value": 50224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573621, "uuid": "28daca7a-9498-46b7-8d47-0ee3a1966a08", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573621, "uuid": "a75829ee-e73b-465b-ab4d-54459c30851d", "value": "i586-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79460849-1d9f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632533131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632533131, "uuid": "38b816a4-4f3c-44e3-bb1e-d720a0db27cd", "comment": "Malware payload (RaccoonStealer)", "value": "6dce149ea3ce739198629464f458c5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632533131, "uuid": "794ce761-67a1-41db-bb57-f58d444b4426", "comment": "Malware payload (RaccoonStealer)", "value": "b0ab4c79f26b6b0bb66b0bc3f0df80d33b0779f1265f0e66df903483b30663d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632533131, "uuid": "b95ca349-ce52-4e17-8688-aac5d59506f6", "comment": "Malware payload (RaccoonStealer)", "value": "9b2739a12b265648fe5fc22054ece306174fc112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632533131, "uuid": "5235aac4-b4ed-441e-b311-a4328b443507", "comment": "Malware payload (RaccoonStealer)", "value": "310b149f357157a99a69dc136a91302be25494f180f28986de3da28156c365d41374542e47d99cfbb02811f7e53f88b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632533131, "uuid": "909f1966-eabc-45ff-a8c8-11906f41ecad", "value": "T131C4E120B3E0C039F5BB12F9457A97B8A92D7EB05B2850CF92D612EA53786E4DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632533131, "uuid": "d4628a48-726b-4035-8c64-593147f41db2", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632533131, "uuid": "04942a48-4eaf-4c4d-9a2c-a62c7b54ff9a", "value": "12288:kCfKxj7mlzjOe1jhSoShvjj4he1ccZIH:wjClWY09hjj5ccGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632533131, "uuid": "58e5a05f-ce40-40db-aeae-992456a10aa2", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632533131, "uuid": "a9cee0cf-ad8c-4b98-8034-5791e933a113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632533131, "uuid": "0cefdb85-41a9-477f-bd50-bc5a85aa3e88", "value": "6dce149ea3ce739198629464f458c5fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb12589-1e4e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632608141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608141, "uuid": "057b76e9-cf8f-422c-8b15-c5c4db541bb8", "comment": "Malware payload (RedLineStealer)", "value": "72772fc337ebd0ed0fa113f188264b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608141, "uuid": "231569c8-1c4d-419f-9e4b-5b516698dafc", "comment": "Malware payload (RedLineStealer)", "value": "b0b992aa050ddecbd7b0e049d45997843f1e03f29ddbf3e7970469d4251ed725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608141, "uuid": "afa9761a-a233-428d-9b62-318e12f2b337", "comment": "Malware payload (RedLineStealer)", "value": "e831cbbe747c34a82818e7ddae2a4f17a611fcce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608141, "uuid": "27cbcd3a-a8c8-47a9-a0c7-46b45299adb9", "comment": "Malware payload (RedLineStealer)", "value": "8cc6161384250d67f54fcba6d6e06c049f2cc7f58bf9f36bdbe8a2410cc6ef98b484df9d54a5367c21a68bcf9f7b9c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608141, "uuid": "ab247171-4cdb-4392-8aa2-23428c565c17", "value": "T197C4027076B0C171F3A758341A3586A0627BBD327D2B851BF58E136B5B30E718DE236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608141, "uuid": "7e12a0bc-31fc-46b3-814a-9c85a6d84a9f", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608141, "uuid": "de23bda7-938d-410d-80b3-784baa35c90a", "value": "12288:IhXe3JEWWqBoagrpCgpbGd4On735XATBO6qOQ:Ile3SfqgC4JaJXAgLOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632608141, "uuid": "7f641043-f1c9-44ac-b390-cecef20df2e1", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632608141, "uuid": "3e645ca8-1943-46de-8785-4c2ce3dd0a91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608141, "uuid": "9bbca713-b53a-483a-8bb0-54d20e0e434c", "value": "72772fc337ebd0ed0fa113f188264b51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03e119b-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562536, "uuid": "5d461195-1172-41e5-9ae9-ec217fa631eb", "comment": "Malware payload (RedLineStealer)", "value": "6264284080282718ac13143df1c35a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562536, "uuid": "8c86303c-de57-4d9d-bbc0-78793892f374", "comment": "Malware payload (RedLineStealer)", "value": "b1314d2cca0a80a4344112f543e6cb5d3b42a7ae45a052561f65b17cee675f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562536, "uuid": "8f8862dd-2ff8-46e2-ae2e-e6398e91d678", "comment": "Malware payload (RedLineStealer)", "value": "af053bf09bd0f8f599905a725a679ffbd9a5f740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562536, "uuid": "cbe0c704-c975-433c-b3dd-14020bb5de79", "comment": "Malware payload (RedLineStealer)", "value": "2b2ff7accaff14941a821496b905d7f09ed07b0f4226497d6750a9b8c5dfa8f839a62f2418cfefeeeb0f747ea34031bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562536, "uuid": "752412fe-d7a1-4e4b-b8f4-8879311e1944", "value": "T1E374BE10B6E1C034F6F712BA4AB993B8A53EBDB16B3485CF22D116EA56746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562536, "uuid": "ab889043-280b-491f-82fa-276e8f54b54c", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562536, "uuid": "97ca04d4-6408-494c-a4e4-bd91446de23b", "value": "6144:iygE1INQlbT3WW/5+aAUO9HbdsDS+SSdGgTVGwr:bgE1INQlbyW4pUo22+3Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562536, "uuid": "3041d52f-cfa9-4e02-bf38-27e94f7f4b27", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562536, "uuid": "1dce8c33-d353-48a2-ad44-40461cf3a6c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562536, "uuid": "097ad6e8-bbe1-4535-8e77-d005bb2918cc", "value": "6264284080282718ac13143df1c35a1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbec4145-1e49-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632606364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606364, "uuid": "83138bc8-bcdf-4311-b535-d3c866d5ed6e", "comment": "Malware payload (RedLineStealer)", "value": "e455f89ab212f639a54a37c7c645d251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606364, "uuid": "125a59b0-a69f-44c4-b27c-dc67154a0946", "comment": "Malware payload (RedLineStealer)", "value": "b1aecbd4a04e57f71d4f4ad42f54ccc36e01ae91051ef0ccc254534977f3e762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606364, "uuid": "408dafdb-df1b-458c-83bb-5599c3df57b8", "comment": "Malware payload (RedLineStealer)", "value": "fe3ecab7afb29f56c4ce5d05fa63ca9ddccc3289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606364, "uuid": "7564c410-3278-47f2-b8d9-299da13cc67c", "comment": "Malware payload (RedLineStealer)", "value": "e569580faf97cdfec0e30ea2b46d40f1be7bd2d97915dc75ed37e5f483038c3cea9e676d3acb3fdd5b7bc0d0e6ac0854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606364, "uuid": "2cb01bce-274b-4d40-85f8-c519cb75540c", "value": "T10CC4123576B1C972F7E631314A6AD2A0322AFC765D378106F10C136E5E232956EF731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606364, "uuid": "dbd1438c-dd6f-454b-83f0-2da4b1a9e9be", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606364, "uuid": "4dec550e-e47c-4dc1-bb7d-ab9997387ad9", "value": "12288:azHmT5Htg61U1zO0YoRnvqH57SZIgnT0Rg0T1FuaPSQQ:ajA1y61UE0NRI9KhT0l1PKQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632606364, "uuid": "90a55a1d-56f8-4dad-8b4a-9d5f67a4f92e", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632606364, "uuid": "9fc5fea9-61b6-4c6a-9a0b-31bee4cc05dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606364, "uuid": "ede96fa2-a095-4a69-bfaf-775d2383f9d3", "value": "e455f89ab212f639a54a37c7c645d251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cd45df-1e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632582816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582816, "uuid": "32518777-534e-42c7-a286-deb0031342a0", "comment": "Malware payload (RedLineStealer)", "value": "d8f467c3842005679b0d6ae60a6406ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582816, "uuid": "7db47e13-6287-4438-b1f0-6960c37b76ea", "comment": "Malware payload (RedLineStealer)", "value": "b1b3c08c25d857b496f6202e762a3c7bf6463d08144f9168851eb6c0ebd0a9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582816, "uuid": "bf10077c-a8ea-49bc-8939-071113cdd991", "comment": "Malware payload (RedLineStealer)", "value": "99060c27e136294b48b846c71fc806d7fe02626e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632582816, "uuid": "52ec11b9-55e2-45d9-a3af-a5978f2b9f61", "comment": "Malware payload (RedLineStealer)", "value": "70f129e53a5b986607a024fb39eb7d659a78fe3749c7f4da3e2d11dfefdb790a06a0552a4908e15ec32239ac48ea884a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582816, "uuid": "21c01fb5-1e69-4fe3-9dc2-428e18328ea0", "value": "T1B424E0203AA1D432E7F75AB45970D7946A7FB8733F75858B36101BAE5E222E1CB61303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582816, "uuid": "fd60ab36-0e73-4656-a067-a09fae2cb9af", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582816, "uuid": "59e2a871-cf97-4c81-ba8b-db45a59d5621", "value": "3072:sB+Ca5pkBZqh8uNAPl6yy5BFVXf3jG21twFQ9cbcGw06mN3CAeSOYMWR2+tD5G5N:sB+nrkBcGPlSV3/wMcbcjqyAeSO+iEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632582816, "uuid": "97dd3675-251a-4876-ab66-592bd53f6141", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632582816, "uuid": "8d870bc6-10e1-4088-813b-9e41da4c9450", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632582816, "uuid": "93af744b-9307-4a8b-b263-f3e107ce6e64", "value": "d8f467c3842005679b0d6ae60a6406ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1cabff-1dde-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632560137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560137, "uuid": "b9b8dd1d-7702-4338-b738-3a1081a92aa1", "comment": "Malware payload (RedLineStealer)", "value": "5cdc5bdac5766b46936c8413c3b0f242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560137, "uuid": "b82f6faf-7833-46f9-baca-4333cf42d236", "comment": "Malware payload (RedLineStealer)", "value": "b2bbf81e6846b2cb9f72eccbb9e04ad7ade462b048b8cd846db957c38a3c1ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560137, "uuid": "4a1ed4ba-b839-4865-9278-c5318cddecfd", "comment": "Malware payload (RedLineStealer)", "value": "af15451969921ad5b21fff671abe46c85c703353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560137, "uuid": "1607492c-796f-4eca-acff-7e256af0c85d", "comment": "Malware payload (RedLineStealer)", "value": "df34ce6ab5970663bd23fdd36ac2ddd510453925fa70b7d4089c66ad5eb2422a1692cded9ed4c013e38e4ee43eb2a400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560137, "uuid": "853a195c-3a81-4139-a309-ad4d56dcfa5a", "value": "T19B64E10135A0CB71C1970271BB1DD7E06A7AB8515FB2C387F7967B2EEF222C176A6205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560137, "uuid": "80b32c7b-d309-4564-8b71-0acb2546866a", "value": "cc09957b6a7030319b5e28e26ed6a721", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560137, "uuid": "ce2e89ca-9ba4-46ba-a9d3-9e5065faa75e", "value": "6144:5eTsviWpnkyYy0HVdsO3EVY5uvyFtATX+45XXSBwjtw:ETsBkNy08WEW5uarAD+45nSBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632560137, "uuid": "e78362d1-b120-41a5-922f-356c843ad7e0", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632560137, "uuid": "5cebb63b-6b53-499f-9c30-04ceedfc1131", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560137, "uuid": "ceda829f-a078-4ff9-b74b-5676552f62f8", "value": "5cdc5bdac5766b46936c8413c3b0f242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d29e97-1dd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632554553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632554553, "uuid": "b71f167a-c924-4846-9819-128cd8d24981", "comment": "Malware payload", "value": "e95d8d9363ca903f84337a8a9d23545e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632554553, "uuid": "1500e78d-50d1-4dc8-97d5-777ab0a57028", "comment": "Malware payload", "value": "b4a2f2ba614e61cbf32c4655a3f258657249270ac3fadc38804b420ea873f3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632554553, "uuid": "ed8679da-f045-49d4-91f7-1e723709103a", "comment": "Malware payload", "value": "3d4e02ddc925ab595980ac295d390ef12187ff79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632554553, "uuid": "6a8f4f50-5db6-441b-a6e6-177953da538d", "comment": "Malware payload", "value": "82a03b4b4e70610f16d66611e01b2b6931642293006632ed950b8147905751a903085c61db6b7d6cc8518c9a6a5b360c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632554553, "uuid": "db30ec60-bfea-489b-8eaa-184246af7f93", "value": "T105646B0973A40CF9E876823C8D42D675E672BC160361D7AF03E06E6B7E376915D3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632554553, "uuid": "90d10953-72e9-4c84-9dbb-4e75e442c887", "value": "ff5d15939639d39867e11a14d832950e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632554553, "uuid": "8f06a3d3-30c6-4055-8c62-4689b116ed85", "value": "6144:SKfT2rdKMNFTNXu1zQ8ien08ohjSaT/IHd:/2ZpyhTxokak9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632554553, "uuid": "4a6dad5e-f20f-4bb1-998b-1698d45c5508", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632554553, "uuid": "49cec86a-2899-46c5-b51b-6d426aece220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632554553, "uuid": "93bc1252-e491-4e4b-902a-ff7a58c9ee01", "value": "ExLoader Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56897c6-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563270, "uuid": "25754a4f-4870-4bf9-bc39-d58823405318", "comment": "Malware payload (RedLineStealer)", "value": "81d9ac77569efe0afad93b0254f45bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563270, "uuid": "b528d55e-8716-425c-8d64-74cf6b4bb9f2", "comment": "Malware payload (RedLineStealer)", "value": "b5166e35c23cdb13e9436deee60fd7910984504274e0717f9e43a789112e744f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563270, "uuid": "2eecdcf6-e560-403f-b28f-169f9797a600", "comment": "Malware payload (RedLineStealer)", "value": "7aefaa03091ce76962a600b830f7cc52bcc1efeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563270, "uuid": "2d797a99-4957-4689-ad83-86ceef9d58fe", "comment": "Malware payload (RedLineStealer)", "value": "4ea8d51a2e289de297d8e68c74f5ba399cc49a76fe37cbfedc6661103c0508fd9a2805a73e74222c265f0f6c63ae7be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563270, "uuid": "e525b1b9-339f-4dd5-848d-c47ae0fcb8e4", "value": "T10984BE30B6E0C035F1F712F88ABAA3ACA93E79715B7481CB62D516EA56346E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563270, "uuid": "d1764240-48b5-411b-936e-e5816973615c", "value": "0f0c12643909b692a9be3510bdc965e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563270, "uuid": "de1e87ad-f347-4894-80c8-ceed1e098152", "value": "6144:U+ooAPwLlUHBFT8auGE9zUW8ahwJdRKA0r2hBXRmn6NtX0Io0llT0TQjbP9rsV:MoAPwLlUhF69zwkwPITYLthodIbP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563270, "uuid": "cf1a5fcd-8faf-40e7-b11c-7eafcc30663d", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563270, "uuid": "e8d4d3ed-e01d-4f6f-84f5-9c73c119e4a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563270, "uuid": "17e0baa6-e8d7-45a0-955e-7334cb743f41", "value": "81d9ac77569efe0afad93b0254f45bee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5aeac33-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "23b122c8-3082-4cb7-b4ec-b81238dbf892", "comment": "Malware payload (Gafgyt)", "value": "60072b8cc0dd16ce2cad32d75fbb362f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "7d557327-64f4-4ccd-9604-02edbceb7167", "comment": "Malware payload (Gafgyt)", "value": "b51bc70d291e3857764d64593ab7e9be9f164d082240157e2bd59ba35add9620", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "d756bc90-3e0b-4c05-9b9f-ac45ddae36b9", "comment": "Malware payload (Gafgyt)", "value": "a77b5dcbb75e5fa20e015333b9ad6e1486427c73", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "2f8955cf-0b5e-44fa-b235-e2998767f5f2", "comment": "Malware payload (Gafgyt)", "value": "dc0bd7697a0ad98537ee2a8cbf737e7e0dcb62cce288aa0fdc9242bb6f23d6125213b9f37a35971d4712b5ec40d5f88a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "4527b838-a82b-46a4-8678-a31b2cdcc484", "value": "T114A31945F9408B57C2D327BAF78F439D37356A7857DB33116A287EB42BC27981E2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "452e6882-c0b4-4e3e-bb38-aa6c4e0c8098", "value": "1536:H4vfx4YPLu1OkOB8G8hZaJBPk704OLLvGA0PTik/yYgHEV75mCVrQAFW9OXpYe:BYCIkK6l7+L0PIH85mCVrQAFiOXpYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563404, "uuid": "022006c6-6397-4f30-8f06-088c26870073", "value": 104146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563404, "uuid": "e6ff9031-7235-42e3-b4ac-b77d324d2a9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "243e3970-7dc5-4cbe-8677-14e1106f313b", "value": "p-p.c-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86addb89-1e56-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632611751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611751, "uuid": "53a780af-55cd-4c4d-b4a5-ec7bbbf2a955", "comment": "Malware payload (RaccoonStealer)", "value": "4d2aa92f76bf0694af60ead4be23b0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611751, "uuid": "7bcc210f-c394-443f-89bc-3cabdeeb82d6", "comment": "Malware payload (RaccoonStealer)", "value": "b637814768f3706ea323695089b5e44daa869cee13f0d7a906fd238906d2c200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611751, "uuid": "2a9d6fe5-1c8e-4123-a4dc-30514fb371db", "comment": "Malware payload (RaccoonStealer)", "value": "89da469aa87293c5628513e102976ff2bbd8498f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611751, "uuid": "fd59b2fd-29cc-4e96-bc0f-6ff0ca643ba5", "comment": "Malware payload (RaccoonStealer)", "value": "bf08e187b4bb648cb16722b25c63ce7b397b12f28f647f7184fad907e8fa03902229bd8dd54f2cababd991be720134de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611751, "uuid": "d3bb9273-532b-4967-8ee9-3635074d610b", "value": "T1F4940160B9A0C4B3F7E350352D64DE91A67B38216DA7864BFBDC220A0DB13C197E1766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611751, "uuid": "8eb515ad-2fb8-475e-a4f8-fe2f55894bed", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611751, "uuid": "0887cba1-6434-4a58-97a9-641ae2089796", "value": "6144:eTh1LywfoE4B3c5eV6UnkBvX/LzQWiEWt5QoS3/be/eziAXItMXtrdhicEa:Q2wfoMeVR0vX//QWgt5Q0e+AYtm7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632611751, "uuid": "7153a624-7226-4c9d-aadd-6b15b84dfd82", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632611751, "uuid": "c76830c3-1198-4132-be03-c8855bd09e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611751, "uuid": "6498164e-ead6-4a50-877d-fd445dbc24e6", "value": "4d2aa92f76bf0694af60ead4be23b0a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b4c1e9-1d98-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632530149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632530149, "uuid": "7c6a7a29-4799-4595-83de-2e90913a01bd", "comment": "Malware payload (RedLineStealer)", "value": "2d98e607e0a3b22cd8364dc8db989550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632530149, "uuid": "c578913a-a730-4d8b-8dba-5e8d8b0dfa24", "comment": "Malware payload (RedLineStealer)", "value": "b81d5a21a963595ed6b0bf19c9516abe397193e0944778678faec646adfdd431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632530149, "uuid": "1d4af1d2-d643-4125-b843-b1ae4730886b", "comment": "Malware payload (RedLineStealer)", "value": "9be77e32ed96fa69074a5e63fb0e5dd54831aa27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632530149, "uuid": "4e14763f-85c0-4f9c-b031-8afbe8d8b62b", "comment": "Malware payload (RedLineStealer)", "value": "2622e4abef21f625e23403383b98504116168bc4ebfb00bafe85616f11eb6ac4f2bca3dc926276355a18bb4f6d56bd09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632530149, "uuid": "b857aee0-4903-46e8-afcd-198734bbd867", "value": "T16BE35C1023E88B15D7BF4BB5E430412583B5F25A6622DB7E4F9468DE1E33790EA027B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632530149, "uuid": "0f41c022-912f-4f9d-9483-85f9a952e590", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632530149, "uuid": "ae2eacde-443e-4ecc-b2cb-5027822353f1", "value": "3072:eySTHiX4qI2GnNAcMzW0KUZbr5zA2yNpBH+/oDhq3:ey+HiXsNAcMzW8Zb1APBeADhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632530149, "uuid": "d632aa20-d7c0-4238-a53f-9887058e5dc5", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632530149, "uuid": "5a5cc6b3-c826-445b-8fda-0a989379a298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632530149, "uuid": "40d09a36-3ebe-4ecb-a0c8-037d1bfb8de9", "value": "B81D5A21A963595ED6B0BF19C9516ABE397193E094477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30bc320-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556850, "uuid": "02a6f1d4-01de-4ec1-aeb6-3d0ddfcb0132", "comment": "Malware payload (RedLineStealer)", "value": "62cc664327ac7b9f985ed8d4716228f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556850, "uuid": "aaa100fd-6cd4-4b1d-9db6-edaaf3e3175d", "comment": "Malware payload (RedLineStealer)", "value": "b838906bb7a74ab26f67213e5e9f80fa251c0b443b7ea61cf20ce850d7ed9ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556850, "uuid": "a966bf1e-673e-4b8e-8994-a1e30e66a706", "comment": "Malware payload (RedLineStealer)", "value": "b3736d49ceebe7343c45573dbb19c7337e4660f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556850, "uuid": "843d9705-d189-47b0-a551-437d3563150e", "comment": "Malware payload (RedLineStealer)", "value": "de7035894f1423fabcffe163b244011ae7ce638ac815c2b2be0a06d26a4864cccba1eb05c6c45007666ccc8ca457fae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556850, "uuid": "8b3cfda0-7fef-40d8-82b5-1b0c253c2a28", "value": "T17224E02035B0C437D7E72AB47A3487A61A3F78F32F74828B2659D65E0D726E09A71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556850, "uuid": "79e684c8-c851-4180-b979-d08e740da025", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556850, "uuid": "b7d194cc-de41-405f-b0ad-5be2fdb98350", "value": "3072:hB+C5NLTHGBkRPb/2wZAiZCFHXe/jWywxN2yLUQNg+G9wJbWN8MD5l2FxEqy7CY5:hB+0nHGBt4Qu/anMsUr+GWJKv2FxEPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556850, "uuid": "06528dbc-b260-4efb-88a8-7c0409493df2", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556850, "uuid": "7c5d3482-769c-4009-84bd-f57a3e5b8797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556850, "uuid": "33ce41d7-9798-4887-8b31-156a7201d2ad", "value": "62cc664327ac7b9f985ed8d4716228f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79372c9f-1e23-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632589824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589824, "uuid": "c833473b-1367-4727-a47d-629b1e9f5d40", "comment": "Malware payload", "value": "3f2f9058302456de11a53ea5916bc0f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589824, "uuid": "abfdfd7c-0309-4561-9634-50fce08a80b4", "comment": "Malware payload", "value": "b89ac8d4220d77e1fb3ae83599039f18dbf2f3712eacab8031eadc2efe5ad568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589824, "uuid": "51f5f88d-18e6-49bb-8289-6c0c43fd2f6f", "comment": "Malware payload", "value": "11d6c7bb6253a6f143dc1d7d7ba14509c228b8c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589824, "uuid": "6793d37a-c998-4f2a-95e7-ed75f90acf01", "comment": "Malware payload", "value": "79401f1fef400ec00455df124f7924637cd110871db962c76a1ac96f63282b63f8319621ded519478594e1b5c19a4c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589824, "uuid": "28d14677-e5b9-4f57-b724-07f57a76e150", "value": "T1138423C573514431DDAE5DF9CC29A28B3C84D662526BC69FF27B4F311AB7E208079EA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589824, "uuid": "6995c5eb-8911-4035-95e5-a30c925498f1", "value": "aac01a222c27d95b764bdaf23c96c3d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589824, "uuid": "088aac7c-2cdf-4780-b23f-23be9486f294", "value": "6144:5eVJCi6lJ9XQEtY3iHIvLLEjUwjzaMdgpejXb8ayd/SeQUeHNmi/1l/JaclGrB5s:QVJdQHXtYSHoLU1vTdgbaGSmeHwi/L/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632589824, "uuid": "7fa007bb-b637-476d-9510-ceee10804913", "value": 391392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632589824, "uuid": "afd7c8db-5498-43c0-91de-72cb81eebb86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589824, "uuid": "56e7b9d9-5efc-4f38-ad2b-cbe5ecb25180", "value": "3f2f9058302456de11a53ea5916bc0f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b52fe2-1e58-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632612555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612555, "uuid": "c2dcdb65-361e-4875-8d89-006848344aac", "comment": "Malware payload (RedLineStealer)", "value": "a4d29b7aef2c400ee03326111b10e8d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612555, "uuid": "fb8fd3ed-b879-4f47-b5d0-fc8e84257685", "comment": "Malware payload (RedLineStealer)", "value": "b97b7257f159d038140038821c41e9af09dc8f127f9ff134e45593f1e53497ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612555, "uuid": "1687a5f6-e43f-4bb7-9293-e29f74df7726", "comment": "Malware payload (RedLineStealer)", "value": "2e758476a7b2defa03c23d2563611d9a7717558c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632612555, "uuid": "31f0b288-289d-4a0a-856d-6131dd4975fa", "comment": "Malware payload (RedLineStealer)", "value": "4fffcd12b76ac5cf12b4ebcea08db72a68b9a33dbb061382125b4b7e577a202abb5dc5f8f50509b0caa44810004b9d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612555, "uuid": "59fd062d-417f-4c27-8f71-03240b4ce71a", "value": "T19644D021B5A2D133E7B305755B64C2E0763FB8623D73CA5AE64C177E5E222D28AD1323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612555, "uuid": "446ac4d2-6950-462c-a67b-0122dc000934", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612555, "uuid": "e1d43293-df48-433f-a140-0e2cfd0ad5e4", "value": "3072:jF9djGQBebSqQyXCqfWnv+iAALOkJvYEsz4+SgT4OkcyW0uq5u5BS9H6dYe:jHdjGoebxF+nYAFvfcsc50MBEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632612555, "uuid": "5085ce02-a8c7-4d6f-b18b-51d16b4ab9d3", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632612555, "uuid": "28eee0e8-e6b2-42b9-93f9-be2a829e3a26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632612555, "uuid": "4fa8d82b-b07b-41d6-8af6-4965683b96af", "value": "a4d29b7aef2c400ee03326111b10e8d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b252ed74-1d9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632532368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532368, "uuid": "e04ad052-a160-4389-9907-c744ba917ae2", "comment": "Malware payload (Mirai)", "value": "f869372024369e7b01ff223261601501", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532368, "uuid": "301ca8e6-0394-470a-9997-f21fa482e759", "comment": "Malware payload (Mirai)", "value": "bacfbf84d9905300f9ae1b2102afd782fb2349796a9ae829b1fc69df60b739d2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532368, "uuid": "51fa3f4d-a871-4937-a2ac-32187ad82bec", "comment": "Malware payload (Mirai)", "value": "36bc4347b248985e175d7a1e0a91863131ecd237", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632532368, "uuid": "ada27693-451f-4f5e-9c50-102f921eb9a9", "comment": "Malware payload (Mirai)", "value": "d4c44d2a25e50bb6ff1a79b2ee8147ff679a376f843a186b749d31df0fa3016ef1d1b7828379d86b99a69e19dafb908c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532368, "uuid": "12f780d6-3859-40c7-8413-e1fda96314cd", "value": "T180B33937A291CA7AC08752B12BDB86A1DC23FDBF0B32225F73947D652B358C85E59701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532368, "uuid": "e7d6aced-c1da-460f-ac97-f8d20c0ed617", "value": "3072:hirvzBRg7KPlHpCres5Pisjmsxyx6222Peom7FnVq4JmKNBNZ:4ggvCSaxxyx6222Pzm7FnVq4JmKNBNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632532368, "uuid": "18d83d3c-d845-4704-9a77-2ea3341f78c4", "value": 115149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632532368, "uuid": "0b526cad-c54e-4a81-af49-d10ed008ffb6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632532368, "uuid": "b2016db7-ebc8-4287-a631-40aa191f61ee", "value": "f869372024369e7b01ff223261601501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7810130-1e39-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632599405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "2c212b67-1f2e-41ad-a47c-0bb63286a4a7", "comment": "Malware payload", "value": "ee53621fb1b7b92c096f2f1962f11638", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "d1a4ea1b-e6e0-4a1c-ac70-dd033d085587", "comment": "Malware payload", "value": "bafaab0e62850fa0d0838f106e929eb75cd65cd0617a6d747ec651f27fad8612", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "90418920-d7e9-4ee4-ae98-76dd9e11d196", "comment": "Malware payload", "value": "1a8df4a67fb09d39927d629e4dc8bb5f8ba5d1da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599405, "uuid": "e18f29e0-a87f-409a-af20-47f4eb26d4df", "comment": "Malware payload", "value": "353c68ce8bbea233c940784179f61fcb456e5802ba090eab31f5f87ae9c68b7e38398a865a5cbbc08c266b93536342bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599405, "uuid": "1ab18ad3-8159-4adc-99f8-32c2149c3c3f", "value": "T18F631706F9829F02D4D625BEFA8F114933136BBAE3FD7102DD209FA027D65DB0B66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599405, "uuid": "3a591c80-af42-4176-8618-4fe8f6eda28f", "value": "1536:tSnvqb50oOKKK/K5KdKEKK6a09NAymLxmKQBmll7JiHeMizVK:cq0KKK/K5KdKEKEsNAymLxmjA4eMcVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632599405, "uuid": "e6fb137b-dfc9-4454-91d4-481c3b42ef4d", "value": 67408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632599405, "uuid": "b2220837-fe71-4080-a83c-1e8d9ed5e08a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599405, "uuid": "f7c96331-9c69-43e2-9cc1-8745c87ff148", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704806ea-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562322, "uuid": "c3765638-1661-488f-a0f2-554b1af11de0", "comment": "Malware payload (RedLineStealer)", "value": "76d3112bdd64942cf2dd173e7d577b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562322, "uuid": "32490954-a5e8-43ac-ba59-7957581392ef", "comment": "Malware payload (RedLineStealer)", "value": "bba70301c4f84236193f94083c8aeef8b573acaf074e233e5f01487bd5ae9d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562322, "uuid": "c8cb80d2-1b34-4980-96e1-a965b614bc8f", "comment": "Malware payload (RedLineStealer)", "value": "5df6074890071aaf06b0103feee64b18f577b886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562322, "uuid": "04108250-449b-4d77-9cfc-1e7b4edd2f94", "comment": "Malware payload (RedLineStealer)", "value": "c5084da8251af91a6358ae496e8e884d2a03839707e5838337c1da752cb0d45c10e547751bc3f91e40a8b139b21c8681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562322, "uuid": "95cf7de8-f4f8-4f05-ad83-40be2cde9d06", "value": "T10E74AE10B6F0C034F6F312BA59B992B8A93EBDB1673895CF62D01AEA56746D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562322, "uuid": "54b56cbd-0e60-435c-a9d3-2f85ea552c0a", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562322, "uuid": "9d223df3-a41b-40a4-af4a-a2ee284ce8c6", "value": "6144:2Lk68oEhTb2ZJHNNgPcyxw6BNsUUTe6ugPycG6lw2zw8WB:2Lk68oEhTbENecb6LsdeDZ8w2fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562322, "uuid": "c2df061f-f8ef-4753-8cf8-b500fe561392", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562322, "uuid": "619a3fa3-3c7f-422e-b27e-d5c074687ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562322, "uuid": "34ff253e-1dd8-43ad-8c25-3e8a7cb707a8", "value": "76d3112bdd64942cf2dd173e7d577b2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e443b3a-1dea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632565190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565190, "uuid": "03b710c5-b078-4922-b931-9a82cdacfaa9", "comment": "Malware payload (RedLineStealer)", "value": "9535f08bd5920f84ac344f8884fe155d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565190, "uuid": "9816d39a-890f-4bce-887d-d3d5e5d3d8d2", "comment": "Malware payload (RedLineStealer)", "value": "bbe7d6e50b7b2229d023aa7170b52d2fa3e63646c6232c25102fa121d1a4534e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565190, "uuid": "f5f2f00b-42cd-49d0-8b51-a55dfe75acae", "comment": "Malware payload (RedLineStealer)", "value": "05acf56d12840558ebc17a138d4390dad7a96d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632565190, "uuid": "aaf24f21-e029-4ec8-b5ac-7eab942d34d2", "comment": "Malware payload (RedLineStealer)", "value": "966bb2f154ff88ea1641be549f0c7d9b83880d9a347f1dcdc883fcb02d6e2ef8e804e74b29ee721e9e9df0c51610aa84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565190, "uuid": "e6341a28-b9f9-49b0-b3e1-93e5d69726d6", "value": "T1A333D57701A190AAC1992331F4760F4B3AB8D6391981F68CB00BB2EEDC1D69D9EF5374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565190, "uuid": "770e4f3d-016d-436e-a5a2-9bc9f9f41218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565190, "uuid": "0d2904cb-7642-4422-b24d-98ca399e4268", "value": "768:FSjJeR0GQ8+cIFQpiMitcxZmWqwN5IVucTk4tayPxZrF9ajgE5eZpEEm+:FSjJeK8+cIFQQMitcxh1ERW9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632565190, "uuid": "077f86bd-7f7c-4961-9259-545f29e42cc2", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632565190, "uuid": "1d62cb19-1b0e-4fb9-a025-f83f6893988e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632565190, "uuid": "6f1f7ca9-ac62-46a9-903b-5c87b60d92b2", "value": "bbe7d6e50b7b2229d023aa7170b52d2fa3e63646c6232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabdc130-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601638, "uuid": "0bcbb332-19e4-4d30-8004-2dcc7903985f", "comment": "Malware payload", "value": "791e12f60c466e4dab190b995ca7a579", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601638, "uuid": "a36c9264-5508-41ea-abfc-291b087bc3ff", "comment": "Malware payload", "value": "bd1092f253be12d1e5e00b093bb873d768873b5adb3832ecff59dce6edfc17fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601638, "uuid": "2f26c246-41e6-4d6e-abac-a7dfcb41a614", "comment": "Malware payload", "value": "cd028d53e194194dd3792f666865b8076728c8f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601638, "uuid": "67726eb0-1dcb-4328-a033-f579d76ea58c", "comment": "Malware payload", "value": "f27cdb54e5ca8bf5fd91ce58d4202cc4dbd28bed0876cd91cdc62d32af7c312fea2cbf72af5a676285fcac0bc59d1aea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601638, "uuid": "29d4933a-4da8-40c4-a4f4-de167a587069", "value": "T1F7F2E159E0845AB9EB7F2E3A16FAFFC70FA000DA3AE787C5B1447E205A5533305069E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601638, "uuid": "0e758387-ac50-47cb-9540-55a8149f2bfa", "value": "768:2Ulctgo3ekTdcFCcoeE9AoT3v5bBBqpRqAZH0R3plgxtezd4uVcqgw02NWXa2J/Y:8Wo5TdmL2AonKlUR3plg2h4u+qgw06Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601638, "uuid": "ff6aaf04-3876-47a8-9330-b4958a1f22d6", "value": 35744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601638, "uuid": "60788654-562d-42ae-858f-a6acf1e45596", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601638, "uuid": "ee18db87-8d73-4c29-b0d6-2a0151a83e9d", "value": "791e12f60c466e4dab190b995ca7a579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7e9547-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573618, "uuid": "62d87fbf-738a-4198-8b99-3a03ad3602e2", "comment": "Malware payload (Mirai)", "value": "8322e40c64624e7d6a115f8794ba4ec9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573618, "uuid": "2f7ea18a-4d25-4476-8bbe-57d3c424931a", "comment": "Malware payload (Mirai)", "value": "bdf9cb0068db9a499152b74e688a34518825f6f811307d88f43759c136147771", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573618, "uuid": "03f6b35a-46c3-475b-a068-30a1c12200a8", "comment": "Malware payload (Mirai)", "value": "b181682253c68b4cec6768d434f88bf4817ae34b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573618, "uuid": "3579e693-feeb-428e-a913-3cdbf90cac6b", "comment": "Malware payload (Mirai)", "value": "89c5a9b08dc01e393d5993f82e5afdcde7ea30dc73dcb7d3dcfd90e13bfc496cf4ddeef6a08b9729cd67b3dc4a053e2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573618, "uuid": "c82121ed-6c18-4700-af08-04257d21f019", "value": "T1414329C4F94BD5F9D587583050A7F23FCE32D53940B0866DEF9AAF35DA3BA01921224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573618, "uuid": "619ea291-a117-4359-8244-90a439fd5835", "value": "1536:6zQh/UU+GPiT8O4e7jiQMGvk7iHOkmIqRjJqfFkJI5:4Qh3+GPiT8OhmAvk70xmr4ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573618, "uuid": "29aa6be5-1a0e-466d-9eef-3ef5d352dcbd", "value": 55792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573618, "uuid": "235081c4-efc7-4b06-a898-b33ec858bcf3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573618, "uuid": "a1e37400-a3a9-48b8-b2e5-7403e193c915", "value": "i686-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22751815-1da4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632535133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535133, "uuid": "d5b06925-204d-4fac-8f91-14b51e3364d4", "comment": "Malware payload (Gafgyt)", "value": "117916d91026d7c5c165aca385ef52cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535133, "uuid": "4ddd6d77-60d5-4997-b15d-310025b590e6", "comment": "Malware payload (Gafgyt)", "value": "be2e0264413dc0d489d9d30c3e1e692bfe9954f02f0a21b9fab7cb188f58ddcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535133, "uuid": "f74b7ee6-b552-4d57-8402-581e8c53078f", "comment": "Malware payload (Gafgyt)", "value": "bd3357e6824ccabe10de78729cb3c6eff1a8c9a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632535133, "uuid": "4267d511-9e60-44a6-8c28-a1667a7fbe74", "comment": "Malware payload (Gafgyt)", "value": "d0842a50473392658fea4aaac82b249baffd7e5d0dac4b4551adbee455357a84363d74e15205c269b9a821f2df2662e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535133, "uuid": "dd6fd835-41e3-440e-99a3-243cb011b468", "value": "T11AA30749F8414767C2D327BAF68E8B4E3F3516E463DB331166346EB42BC27992E25D20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535133, "uuid": "edf6f9a2-3c8b-4843-b61a-81825c5ef46d", "value": "1536:2dekVNJL7G/XujQLfBKdub62YJ1xEOAGq71aXgTj0mo4aqQ4k/EVXFke:yVfGvujQ7bK19q7ampaqQ4ksVXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632535133, "uuid": "a77dca4d-0fb4-4aaa-b8bf-95a4336d0133", "value": 105212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632535133, "uuid": "87882b14-6e51-410b-a1e8-97d2967b743a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632535133, "uuid": "fe61b541-04c8-4f9b-9693-3ae6957008a3", "value": "117916d91026d7c5c165aca385ef52cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033ce39f-1dfe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632573735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573735, "uuid": "7912f511-437d-4a91-8b9d-14a72820a570", "comment": "Malware payload (RemcosRAT)", "value": "3d5d8239652b5be0a2ff6a17d0321fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573735, "uuid": "b115e050-e2eb-45f9-b66c-bdae72f36087", "comment": "Malware payload (RemcosRAT)", "value": "bea16fcbe3fca90654deebc3cb31edf6f6c00a79c5ccc834b92754a90e55417b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573735, "uuid": "077b231c-b720-40ba-b1b7-41ea061b7522", "comment": "Malware payload (RemcosRAT)", "value": "71d28f09caa8dc8b82bea124f226b24edb1f891a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573735, "uuid": "c2649449-2488-4679-b993-a24914082931", "comment": "Malware payload (RemcosRAT)", "value": "ac57b801e478de07138d9e13434253cbff16be93ffcdb361798f7a555778578d31f5dd5493c70a4666eaf5a7d5eda8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573735, "uuid": "4237f69e-b01d-4a32-9fe2-8007e9534634", "value": "T130F46C25E5E14F3AD02F3B3DEC0766B948777E641C18BBDA27DC6C89BA34A80305519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573735, "uuid": "c7281961-2083-46e7-b65b-4c8a3a882767", "value": "f9c27c3e77fa39c083357a7072be3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573735, "uuid": "1a1f3ff9-888d-45e1-bae2-48b0e68add7b", "value": "12288:MwmGNncIMGFpukbg9m45hBVADS1gVEzidG81IoLq:M/dGFIknch8hVY67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573735, "uuid": "42e30f43-4370-4c45-89c8-94492bef7de6", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573735, "uuid": "e93555f3-5924-451e-b262-2e3212bb618f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573735, "uuid": "7e9b9d77-d1d1-4f17-a55c-25e7e6912756", "value": "3d5d8239652b5be0a2ff6a17d0321fd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42a0fc8-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563268, "uuid": "71f0916f-498e-45d8-b7bf-a969379da4be", "comment": "Malware payload (RedLineStealer)", "value": "07be0691693a1803d9165fa037945cef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563268, "uuid": "b0bc0031-40ae-4bdc-bea2-2ab3f5530c6b", "comment": "Malware payload (RedLineStealer)", "value": "c097983d884fc5f1c254dfc1df0d0ce2aff0e7f65558cfa00f0edb39cc5c0423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563268, "uuid": "7251a76b-26c5-4482-9bd5-8f1bfb1b1387", "comment": "Malware payload (RedLineStealer)", "value": "2411ff513a9c6e0c5725dc4d92d6134c4c1b6829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563268, "uuid": "ca10014b-55f1-4718-b281-afb243cbe7d2", "comment": "Malware payload (RedLineStealer)", "value": "9f0d6a5c992a199d56a33a0ca903b16ba572acffca0260d834a5db3a87abd6b921c2821b680c9cb9a82b4669f96d7b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563268, "uuid": "a25fd5df-9587-43ff-8ae2-65e2c63925ec", "value": "T1FF84BE20BAE0C035F4F712F946B997ADA53E79B15B2450CF62D226FA26386E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563268, "uuid": "9fd8ead7-cd11-4a29-bad9-0c097a31ada1", "value": "a2bc3921f9c8d145b9a6f1e3eaf1f8a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563268, "uuid": "ac9ffa86-3622-43ce-b002-5d2217f9ad7b", "value": "6144:I7BSOesi+l3YT31sFMvShwmX8ppKs3fZ68dxy4+StF:uSOesi+lg1uMvMw48ppKh8ufSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563268, "uuid": "eeef8ac8-5fde-46ec-914d-6297e8a4ead5", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563268, "uuid": "ded37515-78b2-426f-99a6-31520b13d69b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563268, "uuid": "3fa77cde-4c89-4aad-bc98-c1b67d02d12f", "value": "07be0691693a1803d9165fa037945cef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a346b290-1e20-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632588606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588606, "uuid": "d104a9f4-6da8-4bd4-a583-a94d4403b40f", "comment": "Malware payload", "value": "a9966773454863ed3506189de198b438", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588606, "uuid": "b7d719f4-471f-4e4f-ae0c-5075c1df7642", "comment": "Malware payload", "value": "c0a9ccc4ea4181d4b4b8ee945c4be7439d69e055ebd2984c64688a492e7a4a0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588606, "uuid": "2a4774f5-e182-4fb7-b4ef-90ca01b34c05", "comment": "Malware payload", "value": "938837bd9d04ed4e9e4c88e2996b270c3277e599", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632588606, "uuid": "46e6fc1a-a72b-4644-8222-19e6983a6797", "comment": "Malware payload", "value": "624b03ed800a47ca8bf4c210db3d6f3fb55e3cc614fb2c2ed42a34efed437d489c19050ee3e2e93d8019660c9e7f95df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588606, "uuid": "791709ea-4acd-40a9-b997-8ade9339e9bb", "value": "T193032AAAD113C9F1D90781B0615BD779FB35AD326021CC2EE7D479A6EC31A83D60631E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588606, "uuid": "5929db43-d616-43aa-832f-203d33e63da4", "value": "768:Fm96okbGuAJAUcdqimfxYLC4yyjl9KpZnvrwRFGHWT5:FDbGu474y2l9KXaG2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632588606, "uuid": "aaaf5215-ad9e-4732-8744-642eff0f5420", "value": 37820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632588606, "uuid": "5079e06f-b862-48c6-83a7-98765aec02b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632588606, "uuid": "55485399-dfac-40af-9d97-82a1cce151d8", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3c2f0e-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601644, "uuid": "163cac0f-c875-4278-9bff-382ad200a17e", "comment": "Malware payload", "value": "aa8f477d3b31e8af0d39a085d8082d43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601644, "uuid": "01ba165d-e786-4e98-b8e8-702f4da331cd", "comment": "Malware payload", "value": "c0b9e3400f2b4e5d0419e8b698504b408b174148ade0f92d4ec26ace66268f49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601644, "uuid": "6395426e-6464-4f81-943d-c597f736aedf", "comment": "Malware payload", "value": "d10ea24bf6c6445f4382fc7779fbe3dd900a2ad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601644, "uuid": "8ecf9c65-b75f-45a6-b0e1-975d5f63e0cb", "comment": "Malware payload", "value": "b7c02ee614da2aae7a83f290360d365b13ed0c77da128749e37f12cb78e863a9701dd0e11d52fdf472a97b563ba99a39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601644, "uuid": "a1cafc1e-0bcf-481b-90da-6890418198da", "value": "T18DF23A45F8416F15D4E0A1BEFE1D124D33231FB8E2DA3202AD157F357BAB89A4E2B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601644, "uuid": "25c6d10e-c59c-4519-a6ee-02e4e8207ef4", "value": "768:WHntd+GpVXQOL6pPnTbV6ZSeRYUyXCOIS83ChVD3AVe:WHnKQVXQGedzeRYn5I2D3AV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601644, "uuid": "521853af-9662-46c4-8c55-1e0a5740478e", "value": 37580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601644, "uuid": "99a0ff61-2eae-47a6-af60-003c6d51846c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601644, "uuid": "1cad337a-3275-441e-a401-765528cb28f4", "value": "aa8f477d3b31e8af0d39a085d8082d43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c7cf52-1dda-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632558682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558682, "uuid": "74e5ff3a-1b74-4d94-97ac-5127725af6d1", "comment": "Malware payload", "value": "8eec093666bb42468700b1486d957f5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558682, "uuid": "6d9720c0-d763-4ff9-a064-17802746e935", "comment": "Malware payload", "value": "c0d296731f07b969f565e58c9439033215a543b6565e05a9c1b58e5754471ea9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558682, "uuid": "5f4c2606-9fe5-4829-87f4-9d30626f62f2", "comment": "Malware payload", "value": "8f89f241274a659231b056ee8902949c2a8ec6af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558682, "uuid": "42ae8334-adf9-4803-92ba-0d06afbdd1f7", "comment": "Malware payload", "value": "3f4c8e22195e10fac1d35a659a507bc4ee8093603c0a821dce59f389b1357177c66040dd2400ffb8e760ebdcced580ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558682, "uuid": "96526c6d-ed05-4f51-ab17-c1d7b0221774", "value": "T1B8D2E95573F6217AE1DF8F719683F43657A027651BB371B09A18020790713F45C72E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558682, "uuid": "897c2c91-8085-4ff8-9ae7-9252865f7b04", "value": "96:Y8eOXwcOX7IpyN2Nxn6GuKM9sh1gdrNE/aP7FT9:FuJ2wK8hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558682, "uuid": "186d0c1f-a742-498e-819a-4d07c7f64748", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558682, "uuid": "d70bddc9-863c-4372-852f-079cb830b371", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558682, "uuid": "b5a2c291-8a20-416d-a7ab-812745026f4e", "value": "SecuriteInfo.com.Suspicious_GEN.F47V0211.30492.30730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd301a4-1ddb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632558959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558959, "uuid": "3b472108-b6ac-48e6-be7f-0d48a8e05d69", "comment": "Malware payload (RedLineStealer)", "value": "1e5d90ca18bb5ac92bad651ed7111b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558959, "uuid": "9a161b87-bac9-4b79-a5b3-ca0f1351534f", "comment": "Malware payload (RedLineStealer)", "value": "c26af87d6cf23825f4f7dedcfdeb27a300593ff5a8fbaa7f794aadf064db2f77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558959, "uuid": "f215e0d3-16b3-4a6f-bba0-06d8de9211cc", "comment": "Malware payload (RedLineStealer)", "value": "19bd0b4cb8cd40dc81a6117fba607c3b15bf3dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558959, "uuid": "c9d6e0e8-376b-4fb2-9146-3522b17f799f", "comment": "Malware payload (RedLineStealer)", "value": "f9f41ff3d4b36835eda9a9d394aa3424a650e0647f45d8afa673efaff0db9c5701b14d938e2d0e7f86aa94a8e9fa9b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558959, "uuid": "b923ca4b-fd15-454d-80b3-60227cf3a3f4", "value": "T16524D02036B0C03BD3B77A750674D2D0397B7833EBB5858B7689263E4E617C28A66357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558959, "uuid": "5cd7d659-f54c-4354-aee8-aa2666fcd8b5", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558959, "uuid": "9c8b0608-af5e-4dcd-ad57-99d16c833632", "value": "3072:RGb6KyeiLMJedGxAepD4GZLdF1hMycUNw5bB60NpsdjmdD5l2FY5:RGOKySedGxAKv/FfBcww5FfN+jMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558959, "uuid": "83cb2ea2-203b-4561-8e4d-87dd07d83974", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558959, "uuid": "c284fd87-0fb2-4330-9af9-1ce71b441d53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558959, "uuid": "c4548807-cf5d-4a01-893b-a78acb2e3214", "value": "1e5d90ca18bb5ac92bad651ed7111b6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6d2eb2-1da9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632537460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537460, "uuid": "3354f070-fb42-4406-a53c-428d17a06a88", "comment": "Malware payload (Mirai)", "value": "e8db5ed7edffc0d9cd6adaba63a4b287", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537460, "uuid": "fd073e4f-98a1-4738-bf39-234dbace607d", "comment": "Malware payload (Mirai)", "value": "c3d52b0d793f1042213649e329ccaf1bdf6172c4e401efc39918cc670d6090be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537460, "uuid": "096c06f7-ed71-4f84-806f-c5dbb77895eb", "comment": "Malware payload (Mirai)", "value": "fb1286c4d4478c093deafa2a6cbba7d10d882bea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537460, "uuid": "1d32f0f1-26ad-478e-ad79-343da433c0e7", "comment": "Malware payload (Mirai)", "value": "6bb3351420b494137086ed80d7194d94db2eb9d9c907f2493fe20b1fd1887315981ea0bc84625fd471b55ca7be1e2ee4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537460, "uuid": "5ae00b6b-01c4-4b7f-817e-446d291a24d7", "value": "T156D2D1EFE09524C2C6ECAC3A055E17F88864F2C073D99BEC23135CC5575DAD7294A62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537460, "uuid": "fa925b95-21ac-4a1a-a7d5-bb1de2eb48dc", "value": "768:H9Jd9zCnnaNq4pgFw+0iOXITr6p0SA0WA:H9JdmOqwgFJOXPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632537460, "uuid": "e6809ef0-6ad1-494e-bf63-f43e7ad08491", "value": 29608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632537460, "uuid": "b5ad6723-7c0e-46e6-ac51-9ab918ed1e28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537460, "uuid": "b223d949-0414-4a5f-bae8-da1b9c0349d3", "value": "e8db5ed7edffc0d9cd6adaba63a4b287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377c02ba-1e1d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632587137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587137, "uuid": "a75105d8-b796-4d2e-b51f-be13e0a85270", "comment": "Malware payload (RaccoonStealer)", "value": "195bc295a073ba88765d451b696eb5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587137, "uuid": "205bab1d-bc31-4cd8-9b83-d32f7918fe90", "comment": "Malware payload (RaccoonStealer)", "value": "c3f1a7f8584a3ace53e97f4b6289e13d3a41753364f12ae169c9fd4de2704610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587137, "uuid": "42eb1157-d467-402f-b2f9-821953e34e39", "comment": "Malware payload (RaccoonStealer)", "value": "49f5e0b95da48502c18f1421ec73fbc2882d81c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632587137, "uuid": "c37bbbf1-fefa-4aac-a0f5-20b837852055", "comment": "Malware payload (RaccoonStealer)", "value": "ed33f6b9fda1be50c3f1a2aae9df80887ae1bd70485639b9585645fdba08fee905c279ce88e55c620f046e58ad2d2ac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587137, "uuid": "b3c57da8-45c2-4148-ad11-926f7da520c6", "value": "T1E6940252BAA1D432E5E31ABC0D72C281593BBDA36B36814F39643B4F1F327E24D25356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587137, "uuid": "0b827f9e-8b17-4864-9ef8-8638eadfe428", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587137, "uuid": "f95be3d7-704a-4e1b-ad89-4adf74b89128", "value": "12288:0o9j/74GW4tpTaqDxUwqiBFLobGyYI3e+s:073OaYT97mNYI3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632587137, "uuid": "789076ab-89f2-4d13-a460-33fc15487be8", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632587137, "uuid": "6e4fe0c9-049b-4dc2-b063-841eab06b8c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632587137, "uuid": "09035e5f-2525-44a1-8f5f-7793f53deca9", "value": "195bc295a073ba88765d451b696eb5db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e301fa7-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562613, "uuid": "dcede393-49cb-4ced-a632-6a14582ab1ba", "comment": "Malware payload (RedLineStealer)", "value": "7fb35e896a40273d7820f0228fe97468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562613, "uuid": "c5e11f4e-0627-49b7-bb9f-f1cef9cc4200", "comment": "Malware payload (RedLineStealer)", "value": "c4071b2fe6d450b9286ec807f161d5458fd87a6d1da2db6e58b68b257cc3d734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562613, "uuid": "814a68e9-2a6d-4943-addd-e1ec79d8d616", "comment": "Malware payload (RedLineStealer)", "value": "a7c0644e26a8350e3af39375e84605aaff7ced63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562613, "uuid": "d728dbe6-044c-44f2-9a86-788a1899d9c1", "comment": "Malware payload (RedLineStealer)", "value": "df44628b9fe4af02de551a6e088b1f08a3d9c4b947327222f066e47385204d30f5ba81a57693608fe947a85532c89830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562613, "uuid": "6e2b5f26-907b-4b40-8847-18890cfc2ac8", "value": "T16484BF20B6A0C035F5F712F896BA93ACA92E7D715B3450CF62D126EA26387E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562613, "uuid": "e2e43d63-b318-4db0-a2ca-06a351936367", "value": "a2bc3921f9c8d145b9a6f1e3eaf1f8a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562613, "uuid": "65e98d9f-29bf-42e5-9320-e30f864e66ef", "value": "6144:w7Zlw68cFlyYV3ysb8adO6m0GbS5zhSLAAFUcgdwF5x8x5ieRsL:ulw68cFlpy88ao6GvCcR5x82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562613, "uuid": "e78323dd-d6bd-40b9-b5b3-8e3199180157", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562613, "uuid": "61c94408-e74b-4130-b8ec-5b582a6e1d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562613, "uuid": "fc3c1e47-df2b-41eb-8a2d-10d68a8aefdc", "value": "7fb35e896a40273d7820f0228fe97468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dea5aa-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559910, "uuid": "0a637f2b-b138-4e74-bb1a-a76f7830deaf", "comment": "Malware payload (RedLineStealer)", "value": "2643a63bc4e3cd71ccd297dcc5c1a198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559910, "uuid": "4d8dcc55-2fd5-4608-82e1-d8c3aadcb2da", "comment": "Malware payload (RedLineStealer)", "value": "c437ea9cd0f9243f3bef92fcaf98265e89fb6426f3e84cda7a1590bfefd94add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559910, "uuid": "1fffdd00-e030-49a2-9b62-b757cba5a393", "comment": "Malware payload (RedLineStealer)", "value": "69adebdaa61b16645c55dc695a9b63311e47b58d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559910, "uuid": "840b79c6-054d-4f76-880a-8903854ab39d", "comment": "Malware payload (RedLineStealer)", "value": "974436f79206ffbcbb4a209b7cf9b0ce0938b7be08aa77a2c836ed0980c5a8e571df6d354d49ff5d1646f6f38da6691a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559910, "uuid": "e7ee728a-990e-4c59-849f-970f5aa16fb1", "value": "T10624E02135E1C432E3E356B55AB4C7E05E7B79632FB4418B260437AE1FB22E0DA2531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559910, "uuid": "1745095a-1cf6-455d-a7f5-e07d04821ca5", "value": "47bd1659724c857851ce24d0b21faf34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559910, "uuid": "3e67dbb6-14ce-4aea-99f0-0da332ad6066", "value": "3072:/bqteaQUCU0J9KfSOtHpT8kw3imTRk5Be87G1YFrbLyI5LxvId8ndZ:/bqIaQUCU0KXtHpwz3SbeiGyJpxvNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559910, "uuid": "0d83a1a1-e6b8-4e29-83c4-1ceeeec464d2", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559910, "uuid": "1e533c2e-c6db-443e-aacf-5f811ce5c882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559910, "uuid": "6f3cd33d-ead9-424f-9fd8-cd2d18d9fb92", "value": "2643a63bc4e3cd71ccd297dcc5c1a198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20abec49-1ddb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632558752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558752, "uuid": "289bf857-e672-4510-8983-4f9aef1a61f9", "comment": "Malware payload (Gafgyt)", "value": "6d69127f5364c4dff8ffe5b36810cce2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558752, "uuid": "bc6ec182-c64a-43d5-be1d-ff581f870b2e", "comment": "Malware payload (Gafgyt)", "value": "c532c7cc2d548bbda289968e266adb0429762f472ec4e54a441fe95e335eefd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558752, "uuid": "0c370cdb-6e8c-4bd6-a530-a20bb0fc61c5", "comment": "Malware payload (Gafgyt)", "value": "929e40d23c52b64905b6dd8d939bcbc643c3e1e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558752, "uuid": "a5b5a4a7-1c06-46f8-acc2-34b8bd81995e", "comment": "Malware payload (Gafgyt)", "value": "f5a5f9c6f4d992393dea4ee1a42bdb87ced69981c05080ed5edb773266908481fa70bb17a7bab2f2cce5f9b0a8b0a16c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558752, "uuid": "e8b85139-8745-40e2-9675-d1f9c222a672", "value": "T116C3766A3E51BBBEE5A8873107F35F70C399299226A1D781E26CFA185F7128C1C5F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558752, "uuid": "87cca24f-104c-4472-b3af-436f00323b0b", "value": "1536:fVNy7KYv/VZKntVIEN1/NdNkRGzYQnRh2rKAPtXasu4e0eVlXUDfDNb5e+vg8:KDaBToqsu4e7XslI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558752, "uuid": "f3fd854c-0712-4c81-8560-d8c2854f65e6", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558752, "uuid": "a4a4d7b0-f6d2-49a8-bbf9-7d8d853bad6f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558752, "uuid": "8a331eb6-bdb2-4d9b-91c1-f0759e5798e1", "value": "6d69127f5364c4dff8ffe5b36810cce2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ccf38a-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559906, "uuid": "0f1e2add-62bf-4ce8-b292-7df2094f093b", "comment": "Malware payload (RedLineStealer)", "value": "9fa5fcb59ab66699388c7e8c54cbfac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559906, "uuid": "803bcbf6-e01f-4c67-a423-fa7f10377f90", "comment": "Malware payload (RedLineStealer)", "value": "c5441908492cad844096353ea8839c8000759f467d2ffb4ecd6437b5b151e84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559906, "uuid": "bb49391c-7586-4356-b9ef-c2d6d582c559", "comment": "Malware payload (RedLineStealer)", "value": "26f843f65d6036dd6e5c690a03736166d3313466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559906, "uuid": "2c30211b-3a45-456f-b437-6003ff6dcb64", "comment": "Malware payload (RedLineStealer)", "value": "baa76a0afdb769f799f2dd9102a1f570e371b8ecf113e6a7680a6ec577f31923fe19c3cd961400989657c9f77d3c8e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559906, "uuid": "b58eed28-6c67-4f55-9b2d-64ee94b7b9b5", "value": "T1AC74BF10B7E0C034F5B312FA4DB99278A92D7DB16B2885CF63D51AEA5674AE0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559906, "uuid": "45676b7b-8889-48a8-bad9-f923177ad521", "value": "110da1023e5bbd9b585d5ac7f21f7aaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559906, "uuid": "037c68ed-49b8-4e48-a32a-4436fc088c9d", "value": "3072:EkzfkqWi+M/PMWDPkaOMvb4uD1fgXS/Yqd09ZOycPyUFFFla7w/Pvc8jaMFoNyal:EkLkapPM/aDb9Z4i/6IVee0RhYQEz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559906, "uuid": "c78aa982-cd6f-4744-87ba-1f72992a29e3", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559906, "uuid": "b3d55b62-655b-49e9-aef9-46427795c698", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559906, "uuid": "58cae6dc-fca9-4d6c-ae76-dc9885f48e47", "value": "9fa5fcb59ab66699388c7e8c54cbfac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ad5287-1de9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632564953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564953, "uuid": "d0ec7637-ba6e-4416-a02e-cf89ab34854f", "comment": "Malware payload (RedLineStealer)", "value": "de17db0528befd61dc23638a2ba135c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564953, "uuid": "a5513724-95f2-416d-81b5-9bdfe8b1b3fb", "comment": "Malware payload (RedLineStealer)", "value": "c631cb26f2e253d64adb3caf2ef5f15930caf089a6dc9fa7e0ac2e9512cd57d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564953, "uuid": "1abd1f34-aa70-45ee-afe9-b451b8056b5c", "comment": "Malware payload (RedLineStealer)", "value": "25c17db05b9349749659e5b709c06acc1b156505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564953, "uuid": "dcdddada-2abc-4aaa-a8e6-7b84223f19ac", "comment": "Malware payload (RedLineStealer)", "value": "413cb84ea8d12dab395784d971f4472f34fe450e842ca5aea3edfec362277a909eff6310d71cb626529a404e97ef768b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564953, "uuid": "61d1c17c-f542-4e6b-bbd0-9661f82cd943", "value": "T176349E20B7A0C035F2F752F849B993A8A93E7E719B3490CB62D616EE16346E4DD31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564953, "uuid": "40373732-4e1f-4551-9638-d23ce40c459f", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564953, "uuid": "63b0f4bc-abb3-401d-a479-2cfb97f4200d", "value": "6144:lZZQBMaLy2W8E76aP7VAuStuGDRjFrG7O:jZ+Ly2W8EmSAuM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564953, "uuid": "7f2b61e4-d12d-4227-9829-7eabdac5a72a", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564953, "uuid": "2fd63d2f-c3f1-4fac-991b-8c1fe20e10c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564953, "uuid": "ed2162f0-0f21-4ca9-8ad3-add0fb2fe9c8", "value": "de17db0528befd61dc23638a2ba135c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ce10f4-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563274, "uuid": "f8e11f41-8db1-43b9-a1a2-95b2a85f5cc7", "comment": "Malware payload (RedLineStealer)", "value": "3976a85352f3bcc5fd330fe74f4918cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563274, "uuid": "33e1d51e-8718-4210-bd85-c238c8241c7f", "comment": "Malware payload (RedLineStealer)", "value": "c6359402ace7e52f44de8d02e051aa5146b4e74d54b085483b1c5106e5bfa5f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563274, "uuid": "ed587f3e-8cd1-484f-bbb7-bb4a075651ca", "comment": "Malware payload (RedLineStealer)", "value": "faa1ae6b512b90d38c98a917f5bb067dcdf573a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563274, "uuid": "c9851a87-299a-4c25-927c-d4aba338be62", "comment": "Malware payload (RedLineStealer)", "value": "1fd711a1dfb5f761447eecd6fbad63698d69a0dda3aa4264090818bd7565f74fbf92ee0a9539bffc7f0e1dc99fd89702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563274, "uuid": "61f331d0-ac6f-47ec-82d9-e1b0c3114a3b", "value": "T16A84AE20B6E0C039F1F712F84AB993B8A93E7971AB3551CB22D516EA26347E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563274, "uuid": "b137f133-ae68-4d58-b2f4-8fcfcdbea8fb", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563274, "uuid": "0d4b16b4-893a-4efb-a409-57aef6da4777", "value": "6144:IMmLv37GImrf5RarjF/VqYQFXSgt2GvmpLHzWx/Q2rfMdgx+z:WLv37GImj5EjSYQwg4pLqx/lodX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563274, "uuid": "4a57c2af-ae30-4711-9548-4c51a5b300c4", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563274, "uuid": "e8469158-bb6e-4312-b4c4-918a43a96e83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563274, "uuid": "d5feb6ca-562f-4ed4-a260-22804f5b0e0a", "value": "3976a85352f3bcc5fd330fe74f4918cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509edb2f-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559262, "uuid": "65cd5389-02a5-4924-bb67-71968e58040b", "comment": "Malware payload (RedLineStealer)", "value": "96a4602a632d5ccc6e7dd4a06daec5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559262, "uuid": "31efb5be-3632-41ee-8779-119e176a52a6", "comment": "Malware payload (RedLineStealer)", "value": "c66764b93df9c99eefa1b4de4103d468700df6e547e94d974d7fdb1bb658aa14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559262, "uuid": "bdfd7fc5-9f2b-4e7a-9074-d1c954dc904d", "comment": "Malware payload (RedLineStealer)", "value": "765576f3fced5e02def052800165047b4088b394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559262, "uuid": "b67b9751-bb96-4fb0-bdb7-45b9ca9cc960", "comment": "Malware payload (RedLineStealer)", "value": "d46882d9b157600c3e5eeadf437e90ad1188bf0516a7166bec686738bc22cd7473b43e5595f3992ad7ea08a62aecdd28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559262, "uuid": "074f7bad-1b1d-4dc2-b57f-d48e06af3714", "value": "T1E874C020B7E0C034F2F712FA49B593B8A92D7DB05B74C5CBA6D416EA5668AE0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559262, "uuid": "30326d53-df3e-4b2f-888a-b865cd64b554", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559262, "uuid": "5ed13f82-ec0e-4f01-8abf-01bdc9fa52a1", "value": "6144:b96esefdQ1/0BzD1mbUQzhgWRuxbsz5yGIygTBvIu5IDC:boesefK1/GD4UkgWRsM5yGIywg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559262, "uuid": "12e3dd35-6b27-41be-b921-1665098074a6", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559262, "uuid": "82bf8513-d459-45cc-84d0-c7fcdfc397bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559262, "uuid": "999c3149-2ea6-4c52-b72c-7c4866f84f8a", "value": "96a4602a632d5ccc6e7dd4a06daec5e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18542f2b-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632552725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552725, "uuid": "bc82363f-cfad-4209-944a-16e71f394ee3", "comment": "Malware payload (DanaBot)", "value": "41092e155288bb06940194a912bf502f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552725, "uuid": "8b05ce2c-7a6c-45d9-b99f-49760159bf1e", "comment": "Malware payload (DanaBot)", "value": "c70065fd9c7c6c59e0c27ad699f46466e8e1c261a89a689237ee51995868af2f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552725, "uuid": "2bb593ff-ada0-4294-8649-feabf10a6cd4", "comment": "Malware payload (DanaBot)", "value": "720e48bcfe932cd03acf0e16a934e32b4cfe7e2c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552725, "uuid": "c17dda63-0446-42d6-90fe-ea41b3c47579", "comment": "Malware payload (DanaBot)", "value": "c2c622d710b5ec902d07321fe16bd51c885908e0c36959690dc51724f718ca21579339a46b4f0d2275fed3f702a7afe5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552725, "uuid": "efb4b297-e413-4cb3-86e3-c9c9bb687fc4", "value": "T14F5633E4D34987EDF2EA88719C35EE2C052BBF1F183C0B1BAB8167896D902775509E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552725, "uuid": "89a2bb4c-50a5-40f4-95c9-cd570535aa1d", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552725, "uuid": "c955fda0-9679-4a55-bf75-af2ddfc027eb", "value": "196608:KPpJjd/LxQzwbV8mkJlv9DZ07e806ZFsDf1Kr87UT:o/1xQEbV8mkJlv9DZ07ekfsDfAr87UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552725, "uuid": "e2976115-15f2-4509-9c78-7a7a2eeb2eb4", "value": 6341899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552725, "uuid": "9d5561ac-0e45-4789-9628-141e34a05e33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552725, "uuid": "f5401688-63ab-4a13-980f-1b57124854ed", "value": "41092e155288bb06940194a912bf502f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6444e899-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563160, "uuid": "2bd202a8-008c-408e-90f8-a4699268aa45", "comment": "Malware payload (RedLineStealer)", "value": "a27dcfbcc523433fcf5b842c874059be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563160, "uuid": "cbd69d65-7a46-4306-95ba-5bba7b5af79f", "comment": "Malware payload (RedLineStealer)", "value": "c7c97db71d5a9d8a34bff71f075517b5e990c7ddf558a7a891d302e8284312b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563160, "uuid": "c291f97e-dcf2-4b03-9ad7-1f99ae995d71", "comment": "Malware payload (RedLineStealer)", "value": "828f0b5ddecf2ac23e96edbc4ee91d50b5bf819c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563160, "uuid": "6a1ae187-dff3-4c61-bf42-3f044f5a692f", "comment": "Malware payload (RedLineStealer)", "value": "85d62b0dd19ad96343322c9813374723c7d8755219edd217a3e98a3409c1549e8d8d36c9fe4097016576e7f20132cec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563160, "uuid": "1e88eae4-c50d-494c-886d-db07e5e07356", "value": "T1B4749E20B6A0CC35E5F711F449B9D3A8A93EBA715B2350CF62D1A6FA36346E49C30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563160, "uuid": "20f67578-d40c-4f1e-82ef-0a600da06026", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563160, "uuid": "dd4f337c-98e0-4773-91fc-127602a88c49", "value": "6144:Pyd9eOkLmpULDeFgCRt7RYSUM//CgrVOG7N26VWuVfJ1IjUeiv:IvkLmpULQvRsSBCgrIGhZVWuVfYj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563160, "uuid": "76082764-10ec-4a94-ba9b-a20ebc09bd98", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563160, "uuid": "86faaf94-de44-42c8-a789-8e12d776b70c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563160, "uuid": "0113da51-dcd8-421f-ab20-81e34d8f2ff4", "value": "a27dcfbcc523433fcf5b842c874059be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c593f6-1da2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632534603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534603, "uuid": "694e72f4-e75b-48d1-8a74-1b841fd160b4", "comment": "Malware payload (Mirai)", "value": "368158dfb6c35c8643c4de400c15d39c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534603, "uuid": "e7d94f8d-471c-4390-a0da-083d1a2e3790", "comment": "Malware payload (Mirai)", "value": "c886054400c987ccaaeedaa01c9e601820263fa37727c7c1c0450de402a65056", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534603, "uuid": "29d8dfc5-01a9-4f4a-8d30-1e24e8ca7290", "comment": "Malware payload (Mirai)", "value": "8a4b68b9a4af274e7114faf7f8e1a95cd2aea75e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632534603, "uuid": "01f8d43c-5f19-48dd-81d6-ba888de6f78c", "comment": "Malware payload (Mirai)", "value": "e7be516434855b8f357d28d942be9d4954622f96f82d5e16db60e8c762c2f3439c55b7865a101e3f567a3338efc1b5cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534603, "uuid": "c21916e2-8b84-4c63-96ee-0d1000afee6a", "value": "T1E333F232AF180D078861BC32A9B586A7A5FFD3BEE01E56F5E5034CBDA940D06E5E1943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534603, "uuid": "6017f1e7-dd55-4e9d-8d28-f5f778f62e5e", "value": "1536:CBd49Pl29hwd14wElc8y/T7zL4LAN/fBZ/q2lN:jPlRdFd8yr7zL4+JJq2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632534603, "uuid": "f4046b1a-cb3e-4d55-9dd2-e1a3e09a8f77", "value": 51692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632534603, "uuid": "12b884c9-6f0c-433a-8b47-77a939efd03c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632534603, "uuid": "56f19859-10d0-4147-9877-3385fd66e8d8", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efda725a-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632552657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552657, "uuid": "16262e32-eca9-4cd3-8b5a-ca50785c0034", "comment": "Malware payload (RedLineStealer)", "value": "ecbb7c679bfca4800622226a5d42b6be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552657, "uuid": "2d7371bc-3ac9-4828-9376-5ed4157462e2", "comment": "Malware payload (RedLineStealer)", "value": "c8b5d2344649034adbf12d74aaffcdc35ff13c2398acce155fc6e79d42f49dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552657, "uuid": "6c0c46ce-d13e-4b9c-bb73-5fe3b3817bd8", "comment": "Malware payload (RedLineStealer)", "value": "4ba5a1d19b07b11b97d4c7e6ff748e1b2098f68c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552657, "uuid": "1cf6a6a6-8ad5-4e0c-b63f-ce910cf0b4af", "comment": "Malware payload (RedLineStealer)", "value": "3738178c647896435292b5a413df751df02c2e74ed671a5b6460ee8bf0b02cba734062b6ca11d330d1eadc7c6d61f8ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552657, "uuid": "cd225398-9297-450c-aca1-fac0c5f557b1", "value": "T12274C020A7E0C039F9F712F549BA97B8A93D7EB05B2881CB53D616EA56746E0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552657, "uuid": "86698020-f4b1-492e-b4c2-c2f8ba51311c", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552657, "uuid": "f9de2421-44c3-43e8-89f2-dc083677e209", "value": "6144:uH/1OLLjtplebIP+4gV/CAzNQGFG1TLqkU/B7oBj:uH/1ijtpl7PpQ/jNW1Tua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552657, "uuid": "2d83bb87-c313-4167-b772-98c3c5c68e0d", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552657, "uuid": "fc16c144-4d6e-4ad7-9099-254da07025cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552657, "uuid": "da66b687-25eb-44c2-a16a-5bdc88d0e9d9", "value": "ecbb7c679bfca4800622226a5d42b6be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fb8ba6-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "8eba4e36-3c8c-4f8a-a101-8903ed8b9ad2", "comment": "Malware payload (Mirai)", "value": "d4d6378ea9212aa6b09c4ebc945f90a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "b160c66b-2bbd-443d-8833-d35db2e00974", "comment": "Malware payload (Mirai)", "value": "ca076dd32bf802d17ffd30c4e1b00df297538501067065c0c121afcfa61f924a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "3edb6071-a927-457e-8759-4015bea6392a", "comment": "Malware payload (Mirai)", "value": "15c3f63bf1a805a71bc5665fe1ae65476cdbc3bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573632, "uuid": "3a5fa866-00ca-4491-b908-bb04f70cd48c", "comment": "Malware payload (Mirai)", "value": "fbdd777e7a5703778b9180a571e9b07f026a508af5aebb4f1d49549bf20a83250932c299eff72dabd0b3ab3beb292025", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573632, "uuid": "639f3e2b-1259-4359-9600-4b5531d42d11", "value": "T156431A07A99481FCC05DC274437BB63AE86339BD0239B59727CCFE1B6D46E619E2D848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573632, "uuid": "fb767d27-f200-4d0b-93c1-a55a5842128b", "value": "768:h52wVbytUrXeOcsbzCZRa6wrGOxy7eubWxpAopH7jaxGluZx0mt87Hvy+JtA:6UbytKcsbmDa6gGOx1iCMGQZx67Hv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573632, "uuid": "86903cfb-dda5-4e3e-9988-7afdd326ae69", "value": 58624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573632, "uuid": "ecd4d591-b165-4a4d-90a7-c3e08723c966", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573632, "uuid": "86245d1c-df4b-497b-a9e2-8d44e6d248a8", "value": "x86_64-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c334edfd-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632573628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573628, "uuid": "530c419d-b6e7-4b34-8630-8e3595af767a", "comment": "Malware payload", "value": "15cd021ab83035e068b2e25f21e5b950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573628, "uuid": "6091c09c-93e6-4d20-b099-ed04ce86f944", "comment": "Malware payload", "value": "ca42d679800107fd959d600bda0b026fd1ef506b27ca270fd0af163ff71b5c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573628, "uuid": "f2bbbb8c-ae35-4519-a776-412e9949979c", "comment": "Malware payload", "value": "52d67d194758d1d28488e73725678b096a4d7615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573628, "uuid": "2797c8f4-e062-406c-9372-8ac062adc113", "comment": "Malware payload", "value": "fe2b3cc37fc2946be3f650d46e69ea4eb490fc11819a230f0fe5f5a2023d8a40e324c39de960302a7b712b4d9b3d1f54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573628, "uuid": "c2081f26-48b3-4730-a9a5-6b603300ef3b", "value": "T1A743D77741A184B6C0992734E8750F0F3A7CD6241981F69CF04AB6AEDC1D69D9EF83B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573628, "uuid": "1074f791-3184-49e2-a43b-2241a5186bc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573628, "uuid": "e860dae4-df0c-4331-8cd1-ace4423317a8", "value": "768:bGu1FWQyU9RXVf8f9ipZ2jVcATNVVb8i144KUISk3MuVfhkT+MnVhIaJ:bGu1o9UPXOf0jqV991ZKC4q9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573628, "uuid": "0bead611-d8c5-402d-876b-c1372190561a", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573628, "uuid": "8b813558-571b-4710-ab0b-29d93b6868bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573628, "uuid": "8324ea1e-6025-4bf0-a191-b953b70089c0", "value": "15cd021ab83035e068b2e25f21e5b950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4971cff-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632552665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552665, "uuid": "e155ab60-8f66-4b48-9f28-0c685dc1460a", "comment": "Malware payload (ArkeiStealer)", "value": "579af5bbde70d1cf1b845ddeaad10634", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552665, "uuid": "86f513eb-077c-42b0-b4b6-7bcef838615f", "comment": "Malware payload (ArkeiStealer)", "value": "ca54b1cb464fbb95c41aa8627f6358275adaf63f4b29d2a061d0837c3a0a5a4a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552665, "uuid": "49af590b-2155-4d25-a804-881a35213b49", "comment": "Malware payload (ArkeiStealer)", "value": "4583890a4ca1bd5f24d833c3e8aceafbe0364a4d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552665, "uuid": "7f61566d-7eff-46a9-9993-e77e9e8d66d2", "comment": "Malware payload (ArkeiStealer)", "value": "c1aef4bd9253123cd60fc181c843fdefa52501db66e1d5e4735e49783e5e30e8ea267361f21a3d0bdfed165fd3363351", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552665, "uuid": "ee8023fe-fd0f-4702-99d3-c7b2216806ac", "value": "T15865E0259281F437D1B3FA78DD969B7F9B3C7E103910080B6EE82D691B2A3C0B518767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552665, "uuid": "35fc681e-d49a-4e4d-b35a-3def028342dd", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552665, "uuid": "ff5f205a-e498-4e7f-bc21-0ec033fe4727", "value": "24576:HBuzcdGnDD+1EX9uOJwQ5No04Hoawhb5BJnXvxWmmq0LBPdchd:H2DMvgwQ5C04Ibb5BJXIVqMBPdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552665, "uuid": "c507ec11-608d-458c-b010-8d8b82318e22", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552665, "uuid": "35e3731c-11d3-4ece-a4ba-e509d4d1e012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552665, "uuid": "7abea597-d797-42c2-9117-31db87d03c11", "value": "579af5bbde70d1cf1b845ddeaad10634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437c3738-1de1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561387, "uuid": "14fbf6ce-c863-4560-8de1-660d15c44003", "comment": "Malware payload (RedLineStealer)", "value": "a8727429dceae997cd96f27c859fa5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561387, "uuid": "09a341fc-f8cb-459c-9b49-05fa34bc2e30", "comment": "Malware payload (RedLineStealer)", "value": "ca8b5c0cce982dfe096d2452c8393f899ca05390f7587f3f141bfff423e0c15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561387, "uuid": "21768a84-b553-4dde-bb99-ad66bef46846", "comment": "Malware payload (RedLineStealer)", "value": "2748e5e711ed1b9da63261aa76bf1adcbc38cdbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561387, "uuid": "98b4bd2a-ec8c-4912-82a0-0ef010df6e43", "comment": "Malware payload (RedLineStealer)", "value": "33ceb0167163590c0405d4f7b5ac47ebd6817b0bc0d4982acb0c774b242ee79104c8c6a2c71fc24a2522fd3a1375d2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561387, "uuid": "3b6d75c5-8992-46ed-858c-31b5d6eb6bee", "value": "T1B824E02037A1C432E7A35AB44774D7A5693FB9632B34878FFA4417AD1F31290BA29313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561387, "uuid": "c38659b9-e57d-4601-af1c-2a1675d3758e", "value": "f7987bf55fcab080da60dcb9686a7f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561387, "uuid": "b40e9e19-790f-4bdb-aac9-5c6890181c34", "value": "6144:PF4n5DSCEQZ69zM3n4bAS7Z4O9u1kWMExO:PF4ncxUqXxZzARMIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561387, "uuid": "46cc4050-1a45-4771-9751-981f8390f861", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561387, "uuid": "1934417b-1399-4906-8303-e966b47977df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561387, "uuid": "d4bf4e2c-beb9-4aed-9360-10fd8d78bafa", "value": "a8727429dceae997cd96f27c859fa5ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41949267-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562243, "uuid": "a0d82271-cdbb-43bf-86ae-cf9aa493ebb1", "comment": "Malware payload (RedLineStealer)", "value": "6d90aee5e9901823e9b528c32951ec62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562243, "uuid": "02dd47ae-00bc-49db-aaa4-8bb3e6f0b2ba", "comment": "Malware payload (RedLineStealer)", "value": "cae1a65947d12ad34738b6b2d181334b83f9d46aa4ef2cbe4cb5aa06e1e8b212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562243, "uuid": "95714349-b3c5-4942-82cc-6ceff00e1673", "comment": "Malware payload (RedLineStealer)", "value": "c8216f409bd644e410d05d7196dba033c80ea74d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562243, "uuid": "6ff93fc7-bbf7-4be4-8a28-1ae3b5b40e57", "comment": "Malware payload (RedLineStealer)", "value": "c9f564cb7b4546f5ff8559a8c4830107c1e6b98b69ff6a6a2b4415023d686db8234b1c678de1720ad698dadfc1fa5dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562243, "uuid": "d9b98136-5152-4f61-8f53-cc771fc3c97b", "value": "T1AB74BF10B7E0C034F6F712BA49B993B8A53E7EB15B3891CB62D116EA5674AE0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562243, "uuid": "97f593f6-4d89-4786-bd97-c0f01656bf66", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562243, "uuid": "c13a1698-afa2-4881-a348-47981451d463", "value": "6144:zacsjI+LQyb43IANdtXEp8iyu92JRjeewRe/Wk:zacsjI6Qyb9AxEiisPjeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562243, "uuid": "3166e901-3373-4d82-a40f-0448c89e8dd3", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562243, "uuid": "ca7ee204-c727-4563-ad29-2e913f38f0d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562243, "uuid": "99ecda78-8daf-406d-b5e2-f2a1604b410f", "value": "6d90aee5e9901823e9b528c32951ec62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e5ea2a-1e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632614084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632614084, "uuid": "538cb652-0025-4a11-b0c1-5c7497da15d6", "comment": "Malware payload (RedLineStealer)", "value": "a5c2424770ca5eda0f3fca37d21b2f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632614084, "uuid": "18c74f8b-ffc9-4f37-a67d-19f0ab3af7f9", "comment": "Malware payload (RedLineStealer)", "value": "cb75cabd323efda37ea874d4485351089f302f6317e847ee57ed6c35b5e2324e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632614084, "uuid": "54bf8a4d-3c05-43bc-98ca-233726ac91b5", "comment": "Malware payload (RedLineStealer)", "value": "f9c6321a8742c932f422257eda4fd9883a4a8152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632614084, "uuid": "04b5a886-e4d5-48f0-a00d-80310c05217f", "comment": "Malware payload (RedLineStealer)", "value": "77b0bcab24abdc555e8ffa3f574057eacdaa64c158dc5321e1d2173301712682ea4cadcb2fc730bbb1629731b9720f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632614084, "uuid": "9829858f-1715-4f23-b9a6-cd3bac6e3501", "value": "T12344D01176A2C0F2F3A355344934CAA16ABBF8722E77416AF6DD071E5E21EC15AE3343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632614084, "uuid": "56a152ce-d966-4627-8f85-c39dc53d4e0e", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632614084, "uuid": "2600a88e-ebf9-4c0e-8199-ed54b7ada71b", "value": "6144:gLbOb5QuV9VWE/DnTJ4/aaknzp/4miIZ3REad:AbO1B/DTnPzp/sgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632614084, "uuid": "41928b4d-7e7f-4a79-bb1d-0cea7681270b", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632614084, "uuid": "055814a0-1edc-4a8a-b93b-50a1c9ee9b45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632614084, "uuid": "dba47a21-f426-45d1-b528-18adabf21760", "value": "a5c2424770ca5eda0f3fca37d21b2f94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dd33e1-1e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632581140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632581140, "uuid": "b5f44e83-d847-47df-a46b-4dc9d08d3ab6", "comment": "Malware payload (RedLineStealer)", "value": "dae80efd55381efb1601863fe1c9ed11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632581140, "uuid": "b68b0dbb-58f7-4cc6-8c18-70dda2f4bd55", "comment": "Malware payload (RedLineStealer)", "value": "cc1cfd9bc9e43b89ce51fed951f5f259377feba4b103939a1e1cbba4a1f30f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632581140, "uuid": "9e22d5fb-9e7c-4169-8573-61f3874caf6a", "comment": "Malware payload (RedLineStealer)", "value": "febaca0e5c81525eb4cec64c8c8d49452a67dfed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632581140, "uuid": "10baecba-2465-49b6-b3b4-77daa3537496", "comment": "Malware payload (RedLineStealer)", "value": "6bfad6bafc665bc5a83c1543062d437ccad0193f96e0800095e6935f4b019c646581f6e62e722344105af15a2faa59a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632581140, "uuid": "e63fe32d-44d1-4418-b985-5da18a2a2bbc", "value": "T1D9C4022076E09A31DBAB59F0496A47605636BC32AD73954EF6CC1E9E2E233D14DF13C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632581140, "uuid": "e4ce9cdd-4654-4ea2-bcc7-15b3ee6f151e", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632581140, "uuid": "bf1ab771-9252-484e-8ef0-bcfd5cd09f9c", "value": "12288:8tA4hqgVXk/NIXi5qdxwqsZnILqb2Rf3fUC97if6DviIYQ:87hS/uyYdxUZnIAXiiIYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632581140, "uuid": "2350ed9c-1797-40b7-b1a2-5273841cc812", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632581140, "uuid": "b2ab63b4-7c69-4650-a310-64b8bff1bba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632581140, "uuid": "fcf9db30-bc53-435f-80e9-7be027cd3407", "value": "dae80efd55381efb1601863fe1c9ed11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548f1263-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559269, "uuid": "9c3517f7-e4a4-47d6-9b03-9e59121e0959", "comment": "Malware payload (RedLineStealer)", "value": "bbbb5345dab7da5b4f598e38ecce80b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559269, "uuid": "9b3e3036-a92a-4796-9f57-d6abdfe22f4d", "comment": "Malware payload (RedLineStealer)", "value": "cc5417559be2e6fcdb77b33dd9ce921ebcd79cdba558543a488f7da66675db33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559269, "uuid": "638fe089-42db-427f-8375-8dd5b2204719", "comment": "Malware payload (RedLineStealer)", "value": "4cb2d3f9042982f92ea8c0102206c0e3b77bb37c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559269, "uuid": "2e1d4334-762f-48fc-aa9b-e0a33dfccc57", "comment": "Malware payload (RedLineStealer)", "value": "02f5b210eba43ee5e062a2725e8e0a769fa91df2b49bb08d0911bafc1fdf9d25aae4fceb0dc6ddab7aaa4470a10cdbd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559269, "uuid": "30caecd0-13d9-4583-827f-1717a559a14c", "value": "T15074D020B7E0C030F5B712F949BA93B8A92D7DB05B64C5CBA3D51AEA56746E0CC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559269, "uuid": "ed80e02c-5f0f-457b-bf3b-a4c761a12758", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559269, "uuid": "28f88bb3-c415-4622-8647-7e40f131e12f", "value": "6144:w3yszfdY61/0BzDd3GdbR0/AfQlkc2/6VQ2Nn/8IT1GTi:w3yszfu61/GDCVfQlk76VHNnUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559269, "uuid": "5a9da2fc-e89d-4d60-a648-78be243edadc", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559269, "uuid": "19c73f64-c656-4f68-8708-cb1b17a65628", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559269, "uuid": "a3b425ab-7014-4e07-9aee-64d853fc5bad", "value": "bbbb5345dab7da5b4f598e38ecce80b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e17e5b-1de3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562333, "uuid": "5df4f899-4d70-41f4-aa53-8452dbb27bbc", "comment": "Malware payload (RedLineStealer)", "value": "a72a5032b2a147bcbc78be82d0b0074a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562333, "uuid": "72d47e63-2454-4fa4-b924-0593204cc6cc", "comment": "Malware payload (RedLineStealer)", "value": "ccae204ec6b7f3cdd4ca83428c39a77a6531e70e962ebfa564f811b6e2ebf6d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562333, "uuid": "82da1b41-0653-4c43-9e06-0bc1484d0bb6", "comment": "Malware payload (RedLineStealer)", "value": "53d464cac5ba72673321e2a9c10db1ba62db5ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562333, "uuid": "3769a79f-f8b3-471f-a085-7bb2ef088fa5", "comment": "Malware payload (RedLineStealer)", "value": "0e3268708ba22b159d2c5687fc510e66469e0dc2b0241fc8906c862341c848040f5f2c068dc4683d5cd5be74eb609c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562333, "uuid": "6e6dac80-49aa-44e8-8874-ca0785c4a429", "value": "T16274BE10B6F0C034F6F322B959B593B8A93E7EB1673885CB62D41AEA56746E0DD30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562333, "uuid": "861e09a1-1afe-4b67-a484-890279430769", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562333, "uuid": "d10e3c0e-a3ae-4d4e-aab9-beb8ce41e524", "value": "6144:B/kL4oHcTbZZPvSliZsK+I78UArSnMhg+UMZ7BAS:B/kL4oHcTb/SS+IA9hIMZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562333, "uuid": "9a4894c9-81e2-434f-9805-e91ff1afb94a", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562333, "uuid": "cab32f1f-3cdf-4d01-a74b-c1d486cbef83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562333, "uuid": "69598ec5-bce0-46b8-abc7-16a29d315933", "value": "a72a5032b2a147bcbc78be82d0b0074a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e508935b-1ddf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632560799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560799, "uuid": "705fb6f3-411a-4b68-9d16-cfa430f994e6", "comment": "Malware payload (RedLineStealer)", "value": "da5b714e8fb261395afab019d581bf02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560799, "uuid": "356532c5-885c-48c7-b311-e028a93c8f22", "comment": "Malware payload (RedLineStealer)", "value": "cd40126c1640d2b2f47cceef8792df3694f68fb0948be6420853914fa846d22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560799, "uuid": "478e2b66-b20c-433b-bae5-2977ebb42624", "comment": "Malware payload (RedLineStealer)", "value": "4bc57021999b36d620c395b1d34df65abb6429da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632560799, "uuid": "2b22c67c-1731-4a0b-a778-af3336506e8a", "comment": "Malware payload (RedLineStealer)", "value": "a419ad2961c5c6802e3017c0dbd8e3ca54fe7f6b17040c0f6138d5d73f25238666cc7c1c17c8785de8be52cb1ed04e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560799, "uuid": "c9f85034-999d-4d15-b8ed-42221b1b2ac9", "value": "T16124E07135A5C836F7A3D6B99A70C2D55A3BB9732B70868F2614169F0E702D0CA79333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560799, "uuid": "209ebde6-d92d-49ff-be58-72c6ee79ed03", "value": "5fbfc74c3ddccb96d094c58debd98462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560799, "uuid": "dd8deb17-da26-4ded-81e2-ac289d7f3b63", "value": "6144:C4NAY7kSA+n+lLZByQBoNLqtOoZbKETWE:C4NdYSml6bloZbBTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632560799, "uuid": "569dd864-a8c6-468a-a43f-b46be31b453f", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632560799, "uuid": "e4ae108a-814e-4e30-8b72-d9f697d43a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632560799, "uuid": "142208b5-24e4-45f0-a9da-3356381bd131", "value": "da5b714e8fb261395afab019d581bf02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691aea80-1e3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632600964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600964, "uuid": "fd15eed1-7c25-46bc-bd67-3bb6f6dabc8a", "comment": "Malware payload", "value": "c0562cf2c8cfd2c1040bff6dc1a85188", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600964, "uuid": "ffea5392-a97a-4eac-8fd4-6a622de9f95a", "comment": "Malware payload", "value": "cd46649a44ff5a074bcfdcd75a0d931f3d6a3ced09436209260a732bb4dfafef", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600964, "uuid": "36cd85d0-7a62-4b25-9ca2-d6f8349e5bb5", "comment": "Malware payload", "value": "3118519521a693e40828363b4e32d14f5d7dd43b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600964, "uuid": "f8ee8fd1-4f74-4f00-b35f-7b9f825f187d", "comment": "Malware payload", "value": "2879e6c6047f09d5b53177c1487156e0e556e8f9a5bc5f457e3c4c4bccc2b108e59c569edadcabc9ba4657a99343ba17", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600964, "uuid": "5a066a14-265e-4093-bbba-91c5424f4396", "value": "T18404130F1C29F2D5B4B420A4D75B0F818DF597EA1D83CBB8862B44DE78E45A013E56DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600964, "uuid": "14c253df-c9e5-4bb9-8db8-702f0115812e", "value": "3072:v+kxvk4S8Q4OMluJLmQQo01lSEL3OpL6hILNDvvjymE+qMnYd8IUduZ8X6x9g:vJFvBlGLmQPELZqLNDvOmXxMU8Kqxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632600964, "uuid": "a93d200a-d412-4907-bcde-9a64dbac48c3", "value": 174548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632600964, "uuid": "0ac652fe-782d-4afb-805f-c00c297baa43", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600964, "uuid": "f3bea7ee-a186-4bb0-a359-2d0a3eb3ea61", "value": "dhl paket.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b95c2c2-1e3f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601908, "uuid": "4e27e0b9-5367-4101-af61-4b638765139d", "comment": "Malware payload", "value": "026dbce83ee158785ab58eaafe75e970", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601908, "uuid": "e8098809-e8c7-4815-ac02-37598f2233ea", "comment": "Malware payload", "value": "cd6bb6d0446f6f3fe5784ef7d537087bf77de9f7122f496adf7b9b7a612090b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601908, "uuid": "061b3e55-1963-443d-956f-e7c109b3b928", "comment": "Malware payload", "value": "05c54158fd02c43bbf38c607b85dd1a443dcc7dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601908, "uuid": "7ab5c24c-e74e-4a93-9c4e-17423e0c3d90", "comment": "Malware payload", "value": "83ba72062e3dcd4c8a66ae408ab9ddc3e628d6720bb9e6bd1901517487693344c59575e52cee05111fb0bf51565b800e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601908, "uuid": "ac38c14f-1bd3-48d0-9954-bcdb6b8db6bf", "value": "T1D072D09A5419D816E196313D298FCA04B9B4F4E7060C7FD9013C69DA9BB2329C3B6B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601908, "uuid": "35ee48dd-5bf6-4c38-b29f-8f6fa40a7206", "value": "384:MJhoKVrkZHsNz0RsVhaje7p3sXcLvbxZJorgxDtDWl05dlKE:ooKhkZMvuedEelZGrCakj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601908, "uuid": "0ad237c1-4b49-4aea-a048-64161466ba6e", "value": 17516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601908, "uuid": "2b605fcd-f030-463f-ac61-95eb9634e151", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601908, "uuid": "ab5e93b1-6891-4460-ac48-92809b030f7b", "value": "026dbce83ee158785ab58eaafe75e970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327ee7b8-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632552769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552769, "uuid": "83d40f39-547b-4ef7-8dd1-0f45737ace74", "comment": "Malware payload (Stop)", "value": "934d07aaf47de3f555afa3dec8b0824a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552769, "uuid": "ef594e11-5b40-4d1a-8be5-bc6a61f6a08b", "comment": "Malware payload (Stop)", "value": "cdc23865fdb8dcc01cc7a43320b2960361d6d0d2eeba69f9093f3b9ac69daf91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552769, "uuid": "c39f028c-ba8d-4fe1-b489-f4e22ffd2166", "comment": "Malware payload (Stop)", "value": "235ce4b126348231e2328df90621c420770cb2d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552769, "uuid": "2c60be9b-feec-4d0a-8a11-11649c224ff2", "comment": "Malware payload (Stop)", "value": "371f24b4b6aad35b504abac892300626327226ebc41c4c962dbb16ebde89498e3194a2c94e56f3f25ff99924a06d0f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552769, "uuid": "e265090a-f3ea-4c73-95dd-b3b00e37c3d7", "value": "T17205121076A1C034F1BB22FA58B9D3B5A92DBCB02B7889CB67C516EA57B46D0DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552769, "uuid": "4836d579-b96b-44ab-9ebf-7c422d3ec867", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552769, "uuid": "f77e622b-bb1c-4134-9680-187176f64338", "value": "12288:7L6M2fa1/6Zij8lBe+Y2pZzL/60kOCIXIMWSbqLDj2lFPC+F5REE58DrttvrC1ws:gfa1/QlBHbC0kNMJ+Lelocj58j+1U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552769, "uuid": "7844fa85-7b13-4710-bc50-e62643a0b829", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552769, "uuid": "4c9b18e8-e151-464e-9c03-d51c536b3ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552769, "uuid": "2959b5aa-df0b-4c8c-bcf1-2de38658cd31", "value": "934d07aaf47de3f555afa3dec8b0824a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674d5c8b-1dda-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632558441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558441, "uuid": "3d4562d8-1f5d-4d95-a72c-c4e32fafcca8", "comment": "Malware payload (Gafgyt)", "value": "f730b86fc7d02baa46577b77216a140e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558441, "uuid": "abc3314b-b21c-45eb-8229-9f84e93b43e2", "comment": "Malware payload (Gafgyt)", "value": "ce5ff66446ce52708cff45b02475d8fee702b1cd258ec30811a8694597c719ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558441, "uuid": "a5a1f1a7-3290-451f-9f5e-0a0d58bc3318", "comment": "Malware payload (Gafgyt)", "value": "8f48996f91d52a3b39142221b55119b9e0aff14f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558441, "uuid": "3697134d-cd6f-401b-96de-8ae4219c0946", "comment": "Malware payload (Gafgyt)", "value": "6bca88e01fac1d6ecf22c495e25a8bfa0d8c10e217082494b64aa66cb13c097a59400ee83da5034fcd5a5abaa8fb5b53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558441, "uuid": "6040a7f6-d4e7-498a-8510-7288436b766c", "value": "T13CA3E704ED505737C2D23BFBF79A42CE77350E986B97334196293AF41BE5B982A39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558441, "uuid": "1631d84c-ea26-4513-97b0-e7eeb2b287a2", "value": "3072:vwbRuW1i4sB9xQMOvA9dHB1WoAgqNhQdaek85/R4I7uz9uyMnse:En85KI7uzuse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558441, "uuid": "e772afa2-57df-4ffc-a0e5-e70acde819e4", "value": 102051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558441, "uuid": "13a6ba19-2402-486a-af9e-bbee237c5f32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558441, "uuid": "3d270f6a-7f8f-43cd-9231-31e86d4dabec", "value": "f730b86fc7d02baa46577b77216a140e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3315afa-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563373, "uuid": "173ed77e-98d8-4b82-8fb4-0a2b5e2b2151", "comment": "Malware payload (RedLineStealer)", "value": "331ad3f4c9d14f480bad2dc82ae4f835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563373, "uuid": "056297f1-78cc-4640-81ff-afbcaecde761", "comment": "Malware payload (RedLineStealer)", "value": "ce6ebaabe86af1f46e1b41caa619bceff86cb6adb25970f2be869b059aa0ab2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563373, "uuid": "aed2dc47-0396-490a-92b1-015073c0c3f5", "comment": "Malware payload (RedLineStealer)", "value": "dc95902daf82c7e227f33bc6607c848f439f1bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563373, "uuid": "d9ca05f0-2b31-44dc-8790-d741764c1e33", "comment": "Malware payload (RedLineStealer)", "value": "30413007b52a287bb7ba212dc55331f756712124fea56970bbc5c11dfa705ca929118934c0a82726e6109482cc32a5b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563373, "uuid": "d21b6e95-f718-4892-bbef-1bebe6bfd13d", "value": "T14464E101BEA0CEB1C56315304864D2F066BAF861FAB5CD4B7B6DFA7E7E302805269357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563373, "uuid": "3a159695-d692-486b-92e9-7ca04056030b", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563373, "uuid": "5f6980aa-25a0-457a-aef4-1a4c7dac4e33", "value": "6144:3qR8nLUIvjkA42/uAulJ/uvH9G9viO26yg/vOpGSBwjt4:6R8n4MwA4uulJWG9vh29GSBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563373, "uuid": "32c11106-5c42-47ba-8989-a4ee6b8b5352", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563373, "uuid": "6b619554-6b3d-4968-a3a2-8ac17de6dce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563373, "uuid": "192b6cb6-b269-4c91-a0e7-5f9b67f80c76", "value": "331ad3f4c9d14f480bad2dc82ae4f835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196387fc-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562605, "uuid": "59f6ac4a-dfdb-499b-9cc3-ebf37ece2e9b", "comment": "Malware payload (RedLineStealer)", "value": "382a4cd701725c8135b1b2a12c1cd062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562605, "uuid": "de68eb3a-045f-469a-bb68-5f720591a4c7", "comment": "Malware payload (RedLineStealer)", "value": "ceaf665c59f5547aa310301162d1eaff533e9b093a96830c80bf5117eb7d2abc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562605, "uuid": "203df9a4-919f-4248-88c7-7af41b7657ff", "comment": "Malware payload (RedLineStealer)", "value": "caaa7f3eecbff34f59caf533f5019e4fdaf0e88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562605, "uuid": "ddb39598-1a2b-4605-acc8-a22d1ed552a7", "comment": "Malware payload (RedLineStealer)", "value": "5b48ccbe71bad43e8ad23adea411f3af3610842e88a6d4eede93d46d1a250fc2c1c2443df3bfec0a73a3925377556c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562605, "uuid": "be8f5f75-f5fb-4700-b18d-ce24313f6899", "value": "T16E74BE10BAE1C034F6F712B949F993B8A43EBD716B2496CF62D416EA16746E0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562605, "uuid": "b5b7b775-d284-4f65-b718-f7dd515bf0bb", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562605, "uuid": "d4388055-c4a0-452e-8254-dbc80d04e740", "value": "6144:3dDUCIAQFbx3AK9Qfi7AjMps8MhOzCdYyA0:NDUCIAQFbmK+aAksfOz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562605, "uuid": "ad56bc4a-6833-44a6-a63f-8bd73f1f61c7", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562605, "uuid": "d7dc514b-efdf-4042-b299-4de3a0c7a4b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562605, "uuid": "30771f9e-d212-4aa3-a4ff-af3b4096b3a0", "value": "382a4cd701725c8135b1b2a12c1cd062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a458cf1-1dda-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632558446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558446, "uuid": "bdaa834a-c296-41ed-a046-0c8aee2dfe0b", "comment": "Malware payload (Gafgyt)", "value": "9e9ee093814e434abc01db3f1517413d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558446, "uuid": "e4243c99-fb88-40b0-b887-d7733d02a89a", "comment": "Malware payload (Gafgyt)", "value": "cf51706500f5ea9efa60c93c8e5dbac14c13f5b12faeda089a36cb0db2a6116c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558446, "uuid": "9ad29234-796c-4d19-844b-9ea1a1208e00", "comment": "Malware payload (Gafgyt)", "value": "52e0a1434f518b73cee7edce0e1cd4f598c3b831", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558446, "uuid": "addf89fc-e1b4-4630-9a29-93122095eaaa", "comment": "Malware payload (Gafgyt)", "value": "4a8abfe4297ffadf601889e43849f43a9e1b902b51b7c68174f287a13a45f611bcbf744a51d54f1b15c88ebeb3562d2a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558446, "uuid": "ff12c6f8-d520-4256-a676-ff0cf80d79ce", "value": "T1D883082B5251C1BEC08346B12ADB9961AC73FC390B3662067395BE6D3F36CDC5E99342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558446, "uuid": "987978b5-3ef2-4eb0-bf88-5f64d62e7342", "value": "1536:qWu1gnLMtD2qtAoaEeo6GJ+NPyJax67m4fkr66dnj9wOreIpnKJRU:qH1gxq2Ljo6hPyo67zCbdnj9wOyIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558446, "uuid": "aeedba37-770e-41e4-99ea-46d02b15716f", "value": 88523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558446, "uuid": "405642c6-e44b-4472-ab26-8b69375f90b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558446, "uuid": "494f82b5-0a95-4714-8943-1f2be0728406", "value": "9e9ee093814e434abc01db3f1517413d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08e329e-1e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632605352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605352, "uuid": "6864c1b4-0007-4131-9f8c-a701f8d57410", "comment": "Malware payload", "value": "b4cd753794fc2493b337e4f46f56a4ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605352, "uuid": "a639b7e6-a2aa-4fab-a955-55e592b70963", "comment": "Malware payload", "value": "cf7543723195461987243b2909395e87da1222c899c46f516e29afbf98c356af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605352, "uuid": "ff74d3e9-25a6-442d-922c-9d17b08c5a1f", "comment": "Malware payload", "value": "aa5fddf38c5c89d89303845cf4c7fde687e80641", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605352, "uuid": "490d450d-b9d2-4ef4-9ae7-52d09b92ed49", "comment": "Malware payload", "value": "160e02b847a2309954455333ba19b632b09cb91187c937a357953407de40aad5750dd926381c458985e57c6ce8ef24e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605352, "uuid": "19ab5d4b-48bd-4ea9-9d0b-7ed747b3bd32", "value": "T1DD93C7267A11EFEBE0A9863007F39E3056D562D237A15386F26CDB1C1F6128D1C5FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605352, "uuid": "85de5990-0ebe-4793-b64a-6e69bfcf8faa", "value": "1536:el9JLd4EWGW4b8Pnft+QaB9lMeTdJZL7Smz87Fc2CubFL2:+mZtNU9lfHZL7Smz87Fc21bFL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605352, "uuid": "ecb3fe0a-ceb8-4de8-9bfd-13719ba2014a", "value": 94776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605352, "uuid": "10fa307d-1478-4a32-8c78-b1babf167141", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605352, "uuid": "ccfa3ae4-1a18-414d-b68f-8a5b7538d4f8", "value": "b4cd753794fc2493b337e4f46f56a4ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c72da39-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559282, "uuid": "12c28286-3739-4c74-ac46-1962921a016f", "comment": "Malware payload (RedLineStealer)", "value": "f6e9577f99ee8c90dccecd36875f0c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559282, "uuid": "b447cc06-0c68-4960-8b25-e79ccd2460ee", "comment": "Malware payload (RedLineStealer)", "value": "d0147cf80fda24d6c0b3358464909084a13fa07f17bf26040699f9926d1363f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559282, "uuid": "7bd317fc-0c0b-4cdb-bca0-4aea4913c5d9", "comment": "Malware payload (RedLineStealer)", "value": "2ed064668a2fa0494ba14ff5b007e149356a04f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559282, "uuid": "9ee7577d-d349-44c3-9d75-d776b6a0421f", "comment": "Malware payload (RedLineStealer)", "value": "1fb301aa51f301f19598bbe004b718c502e11756237528b13335d9da4c47ef4eaa1122c84cf63781f79004ffdc39719b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559282, "uuid": "2439372a-433e-4576-86bc-dd36ad341cc4", "value": "T15974D020BBE0C034F6B712F599B693B4692DBDB06B68D5CB67C516EA12746E0DC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559282, "uuid": "9304345e-0964-4a64-aa71-bb49b89ca7c5", "value": "658c49f2b142429657b3337ed8c9de9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559282, "uuid": "2d8de9c8-2200-477d-9add-29b97947e9e0", "value": "6144:bmaqsDhz1/wB0u3D7bglMVhPueokxSSYfGy98:bmaqsDB1/5u3zHhP5ocSsm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559282, "uuid": "87de8a55-4ab0-4551-a019-076078f5f586", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559282, "uuid": "6cba0cbe-ba46-4da9-9ba4-55f5c8972f53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559282, "uuid": "35053046-cbf5-4991-bc90-4155eef7303a", "value": "f6e9577f99ee8c90dccecd36875f0c36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e84568-1de1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561383, "uuid": "7dd856bf-0efc-4691-8309-eb111e5e595e", "comment": "Malware payload (RedLineStealer)", "value": "043a9270d0d9431fbaedaf7e56ff9207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561383, "uuid": "5a98b3c3-65b2-4da1-b785-dbe74689b50c", "comment": "Malware payload (RedLineStealer)", "value": "d04f18c2ac7d68f9edf2feff1b796a198de0c55977497b14d81f3a934d336ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561383, "uuid": "1414f2bc-5a33-4249-91d4-89873b81e649", "comment": "Malware payload (RedLineStealer)", "value": "2a0a985ce401cf5366436c2b9675e67dca3f6321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561383, "uuid": "f3909553-45ac-4f1b-84c0-63ace79a09e8", "comment": "Malware payload (RedLineStealer)", "value": "90bc7906636059970b52a9de7420cd03235672b5cd88a9559cb0608fee1b2e976f7e98e9207abee0f9a3049075c8080a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561383, "uuid": "35dfda5b-ec5e-4fa2-a2f0-85b4992a1702", "value": "T19324D02135F08432EAB31AB51B75C7E01B7FB8673AB3859B7A150A5E5E323D08A75343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561383, "uuid": "afb59b1c-2580-4cd2-9ce9-6bb9c5b76647", "value": "f7987bf55fcab080da60dcb9686a7f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561383, "uuid": "be98f453-803f-4bf1-9d5a-63442eebd55c", "value": "6144:Y4oeguMmVWLEEPkNVWx0miN+FYIB2ggf0F:Y4DLLVgQNVW5ikrgfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561383, "uuid": "aae6c719-1ac4-459c-b5b5-fe83a5978fcf", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561383, "uuid": "5ca09d32-b024-41c6-a4ce-dd6c0ea31f23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561383, "uuid": "91f56f53-3f01-46ed-add0-d17237ce2d41", "value": "043a9270d0d9431fbaedaf7e56ff9207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03266773-1de8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632564286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564286, "uuid": "cd5fe226-91ee-4ced-97f4-438ca400cfa6", "comment": "Malware payload (Gafgyt)", "value": "696810bcbff3e45ad6787ca0b8e266a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564286, "uuid": "c9d4e8c1-682e-43bd-8886-7d4a23d68fa6", "comment": "Malware payload (Gafgyt)", "value": "d078f3e65d8d48ef005e60caed2cff0923d23f9e6b774c5323a034ac7e2427a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564286, "uuid": "27495494-b967-4b2a-a0bc-aef16bae2b73", "comment": "Malware payload (Gafgyt)", "value": "99854177b94f3a6f8d4de76d75fdc07f578ad65b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564286, "uuid": "cf15c1e1-bd88-4739-8fc6-5af2cca83fc0", "comment": "Malware payload (Gafgyt)", "value": "f531e37671c2ec1e6513b8e756a647174e7aa4899f2a2ea1df1cfd465a9e984a1d0e41758dbad39820b1542e5497337b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564286, "uuid": "b43ad732-9c0f-4972-b525-55c3bbfa3156", "value": "T186834B43A9659FB7C1836EB935B759341713FC520B6B2B4A7029AAF4038F8CDB40E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564286, "uuid": "5bc9763d-f4b8-4930-888a-1f04ff81ce18", "value": "1536:bkAgMpvQe8zKewr4ERxnCFJTUCCAgd/gmj9VqYLe8fN6e:bX7vI2euRx2UCbg+mj9VqYq8fN6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564286, "uuid": "8551c71b-7b27-48c4-9533-5c4303f5e352", "value": 84553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564286, "uuid": "e1295d0f-acdd-43fa-8c4b-3f654b097750", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564286, "uuid": "21fca85d-9f30-4620-b9e4-c142cbd540e2", "value": "696810bcbff3e45ad6787ca0b8e266a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda3ee7a-1dd9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632558183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558183, "uuid": "fe3e4214-faf7-43f7-bbbe-e55fb03e967f", "comment": "Malware payload (Gafgyt)", "value": "c1d0b2b01200f860f250ddb2c5394151", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558183, "uuid": "5fa64158-8034-48b8-bc55-74cc957954b5", "comment": "Malware payload (Gafgyt)", "value": "d1e9acca0f97450fadef40f211b971c931d24f8d69d2d03867748b240a95cbc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558183, "uuid": "8bd0f574-9ee8-47a5-a062-c9b0bf75ec80", "comment": "Malware payload (Gafgyt)", "value": "6fd3a2a770bc333fc18b1ef9bf4f081b5c7b760c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632558183, "uuid": "6ee15951-7b53-4f1c-9543-94a9f513da77", "comment": "Malware payload (Gafgyt)", "value": "503d468f501bf771df41200cd99230bb8d89a37369e48374fdf5f7949de8cfe0e1ac3392f2bed9634c624bd22de6f20f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558183, "uuid": "76c73297-9b66-436f-a6c4-9c0abe4ddbc5", "value": "T110A3B53777270E63C0CA547101EB1331ABA9DE4438B94BD7A9917DA87F36E84341A3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558183, "uuid": "e406a7cd-7643-446a-8e9a-f1bf58078851", "value": "1536:2Iumxrup2cEeo95b/sLtStui7QgGjjzUI8:hrZeoPAL59jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632558183, "uuid": "eb7a65d8-eb90-482c-b2f4-1f5c6a3de971", "value": 102954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632558183, "uuid": "ce9f02d5-3f56-471c-918c-d9fbe8340310", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632558183, "uuid": "157a0ad6-b9a6-4e43-8d2d-e5a7cae80756", "value": "c1d0b2b01200f860f250ddb2c5394151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb8a538-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632605780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605780, "uuid": "c54239d3-7044-46b2-83f6-6777ab50293e", "comment": "Malware payload (RedLineStealer)", "value": "5fb865bdd91d46c9bd96b0cae60dcc86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605780, "uuid": "b95ae747-2cc1-4ebd-ad16-44f91265a83c", "comment": "Malware payload (RedLineStealer)", "value": "d2864e311effcef848301945da620b92d1a982dbe2a708e0e380370113e71577", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605780, "uuid": "74d54dbc-59cf-485f-bb0a-0f745e976903", "comment": "Malware payload (RedLineStealer)", "value": "9a050d47f03d39d56c90c0f8a7d0627c6e2f916d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605780, "uuid": "2e390dae-b77f-46a2-bfb9-1b1b9af5dbba", "comment": "Malware payload (RedLineStealer)", "value": "b97dae9b8eb796baf82a7f0f39bd4aa24817ce0cba6425bbbbd06e6c0466531823e10779093051c853bee07651743e85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605780, "uuid": "fb7f43ca-d4ca-4b50-b398-dc3f12116ca1", "value": "T1142633508B193998F285CE72C52BB5989BE4C17B04D0282BFF5D6F993C2E294DF35B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605780, "uuid": "da3c8838-9df6-47a3-9053-334ab6b87196", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605780, "uuid": "da8a4b38-3034-484e-969a-9d9668a2a0ac", "value": "98304:yW/caNkRxRkSwS4F5kY2iPf+BK//o+bT3WixmJzk:y1aoxM8iH+Q/tbT3Wvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605780, "uuid": "e432431d-c960-43ef-8b6b-2a571cb4bc92", "value": 4474604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605780, "uuid": "63a8f99f-a9f9-47e7-9989-46a350760e8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605780, "uuid": "fcae3852-60d0-408f-af16-0c9b4221f941", "value": "D2864E311EFFCEF848301945DA620B92D1A982DBE2A70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080e3f4f-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561717, "uuid": "3ba8821d-a0d7-455e-851b-8c11c18bae3a", "comment": "Malware payload (RedLineStealer)", "value": "ac63f9d68b021ddacbd8b54050b38822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561717, "uuid": "ce52d590-0297-4409-aec4-4d106148e85f", "comment": "Malware payload (RedLineStealer)", "value": "d39aa09721eb1f551bea8ab013373c474ee216b6186ae705ace4eafd56889f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561717, "uuid": "a2e79f55-d451-453c-84c2-6aae407fcef4", "comment": "Malware payload (RedLineStealer)", "value": "b6792ac0ecbb43d9da338538775448f7b6e92862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561717, "uuid": "d7e00081-cb64-4493-94d6-6b74aa3a8486", "comment": "Malware payload (RedLineStealer)", "value": "f49b1c3617d87462adc22096269823bd55a0aef3854df771b54fe58677907da070aea6e196cecf3b852ad5eee17a39b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561717, "uuid": "9bb5df95-29b8-46da-a522-efd9568c3d5c", "value": "T1B044D01236F0D932D6E369318870D6A05FBBB4335A67414F67A82B7E6F732D09A21317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561717, "uuid": "22e5f348-ef69-4f64-bea5-5c032a11e03e", "value": "35a9ffa8a278dd991d1bdc58cc30f2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561717, "uuid": "c5804589-8eb1-4b4e-9c11-408acfa635aa", "value": "3072:vABm8UnFpNmfOoDBL8GGoekTE6d5QdUCLtAaniAIC8UdLXbPCBTPc+ovDWJ9C87B:YEx+OoDN6opTEa0tQAdPWIzvCV7RxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561717, "uuid": "643aeb5f-94f9-46f1-acbd-60ecaf3f4cd7", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561717, "uuid": "02a54df4-4791-40ec-b46a-cd43ff816d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561717, "uuid": "ae339a8e-2f0f-4680-952e-bb4c7642f505", "value": "ac63f9d68b021ddacbd8b54050b38822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887c28d0-1dcb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632552054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552054, "uuid": "5c760a1c-33d3-41a7-8917-0820119812c0", "comment": "Malware payload (ArkeiStealer)", "value": "4e20122a4777478a3b0bcdd6c7ee35c9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552054, "uuid": "edac6c71-aca8-4278-b823-d871433ad0bc", "comment": "Malware payload (ArkeiStealer)", "value": "d3d844bca757cfac2bc5cd8cc9bd9d806358eb3af100fdecddb5d0848cd706af", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552054, "uuid": "831cfb62-4172-41d5-949a-57c584d67499", "comment": "Malware payload (ArkeiStealer)", "value": "1970e4b8d24dde794f3d79496e940f36a3b54cf8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552054, "uuid": "532b317e-46aa-4189-89f6-fb5c2635ddc0", "comment": "Malware payload (ArkeiStealer)", "value": "fd7038c2fd71e7893a6e0e3a3e6757519f2c12e66b3694b61fca80b124290e9c7a4e2ef92e56d8e7f1d98a169b34f709", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552054, "uuid": "392ac7ba-5a08-4db4-af08-5fec051be50d", "value": "T1442502161E6A4523F4510DB04BA065F91F7EBC2374926D0FEB49F9090CF2A4A69F0B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552054, "uuid": "61417e32-94d3-490b-b20e-5d194d3be404", "value": "31fdddb41123508749dd6c9468f73e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552054, "uuid": "b9e5e61d-a769-4a59-94e6-64ded0273aef", "value": "24576:k4D+rmH7mur5kbDg1I9acAjc36LbpBAUeh7CyCS/L6:bhbmur5kHgG9Wgo1inRL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552054, "uuid": "dbbf2dd9-4a9c-4e96-b5a0-a472ce6766f9", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552054, "uuid": "e99b19dc-2986-4419-a1c4-f74a6abf1bf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552054, "uuid": "90b80f62-9e58-4345-9677-918209960291", "value": "4e20122a4777478a3b0bcdd6c7ee35c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9479a704-1dff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632574408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632574408, "uuid": "46095ed3-333c-43b1-a163-7869ce774195", "comment": "Malware payload (RedLineStealer)", "value": "57bbb774ca3b060ddcd33009fd3eaf38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632574408, "uuid": "cedd585a-111e-4fe8-bb09-34c0a6ea35c2", "comment": "Malware payload (RedLineStealer)", "value": "d46e46901cf08216729ccd9f055707e08b2959aec13fd95a696d6379b28f8afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632574408, "uuid": "725931b5-c58d-453f-980a-3219ed418154", "comment": "Malware payload (RedLineStealer)", "value": "d9e73eca541cc03350bbcdc5ba8f7a98e9907e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632574408, "uuid": "20e13911-1c63-4ca5-9460-2460e70cc36e", "comment": "Malware payload (RedLineStealer)", "value": "af3b64b169bf718d58aa94ca054579816b56b6192a246dbc9f2e88ead37b28a1d2aaa4073ab12343a562ac7cbb054547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632574408, "uuid": "2cf8871c-95e1-42fb-8b25-02b5c9734c7e", "value": "T18B24D06039F1D832F6E75AB85471C7D16A3BB9633B7185CB6645078E5E303E18A2A333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632574408, "uuid": "60b03e48-73cf-4715-86d2-ee3069b3df71", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632574408, "uuid": "5403da62-3e5b-48fc-a2f3-b19dbe53a935", "value": "6144:5B+HvVTzmu1lB7ZG/n8CQM0v+vpeVGDRB:5B+H9f7B7ZGFQM0v+vpecVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632574408, "uuid": "141dc4b4-8b38-4c94-9479-9ad5e2048404", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632574408, "uuid": "b928a7e4-4a3f-4744-8d13-36bb4818f35b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632574408, "uuid": "212093f6-2e7b-4ab6-8492-730132753df1", "value": "57bbb774ca3b060ddcd33009fd3eaf38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a1d18e-1de8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632564585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564585, "uuid": "8e5cf1e0-8fc6-4fe7-b0ee-09664ca7e872", "comment": "Malware payload (RemcosRAT)", "value": "41d54244280dd5a221565c203f459f5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564585, "uuid": "69fd2a63-405c-41d0-b6f5-71b11e78d5b0", "comment": "Malware payload (RemcosRAT)", "value": "d4d4369d7a59f402fed23cc20953682d5a4a78610244fe987a6dda74615a54f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564585, "uuid": "7ffab4f2-2eb7-4548-911e-5622b126ef2d", "comment": "Malware payload (RemcosRAT)", "value": "f71f23e58f47b67ae52ea806ed776bb1131bfbf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564585, "uuid": "b8189dc0-9500-498e-94f1-68f169e650f3", "comment": "Malware payload (RemcosRAT)", "value": "9c77f0bd2ea365d4d30dad3f8127b93dd6381b3ae3dfdcbc2c44ca5338c39aff34cce73aa5d3034e25bfa7d0f9e27617", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564585, "uuid": "7ccdf8c6-c765-4131-85dd-b4de8d69ac3f", "value": "T1CCD4EF7F22C2BD83EF370D38D0041D5C8D577A679B60D089E9C61B8BA3A611DCB6E562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564585, "uuid": "c1285390-3430-4e11-9a22-83951a38b5c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564585, "uuid": "c201f8a2-20f5-4416-9db7-1fcabf0651ca", "value": "12288:X0SLgrTKOhVbgtF51DVisKJqBcAOF3SvQoR37rW2wg5fI436b:yruOhSF1KJq7OtS9RrrWrpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564585, "uuid": "90252660-cc02-4ad6-8010-906006b1aa19", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564585, "uuid": "2c4854b7-45cb-496f-a920-86288a1e3e1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564585, "uuid": "0a73eef1-63f4-4f52-a0b1-1150e630b21c", "value": "41d54244280dd5a221565c203f459f5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc4c8c6-1d96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632529249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529249, "uuid": "1d8d5508-2934-4af5-ad7a-3016598cc4c2", "comment": "Malware payload (Loki)", "value": "2cab3a06c98e06ccbd4d490fbda2a292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529249, "uuid": "262e4bcb-cf1d-4a18-b48d-9ca1a4a7ca22", "comment": "Malware payload (Loki)", "value": "d4dcaa41641bd14406b3fa2a1cee1e97de93329b9f901c650a87e7434676aed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529249, "uuid": "75eddab9-3a7a-42bf-90f9-bca2bb6ae3c3", "comment": "Malware payload (Loki)", "value": "6662a162b5001269466c660158c80211131c3e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529249, "uuid": "976aa826-ccce-4539-8961-d82f9fb1ca18", "comment": "Malware payload (Loki)", "value": "7ed986096eafdf021c39210de7c0f3f2b78e2f485d0a688913ca347c22950baf2c1da2efd4c049596ad6ee9615b93fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529249, "uuid": "40d149a8-9000-48f7-b0c7-351c223bc880", "value": "T18CA4E1789428F1F2D81DDFB2C4C47B9C93BB2CB26640846EA16ABB6514F0BD45E0671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529249, "uuid": "9c338b5e-2199-40ad-beb4-ee40014e414a", "value": "580d25bfc54f24a8d32e34f1b4909b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529249, "uuid": "13568ac7-0ff1-4dc1-be2a-de81bf1ecc7c", "value": "3072:opqkZhoRRRqCkdDjY+okPaHmWI0rqjf5Pas2MTQlhK29Z4NZDs+v3mmNh+tSelhW:WTW2Y+okPaHVI0rqj9yl2Oi+/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632529249, "uuid": "f3e1d9ad-aef8-429b-9333-af3a9a8f7cf6", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632529249, "uuid": "0d730755-b7f5-4e91-8740-c5f7f47da65b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529249, "uuid": "d7481483-d612-4391-b86a-1d49c1d99d0f", "value": "D4DCAA41641BD14406B3FA2A1CEE1E97DE93329B9F901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea52339-1def-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632567500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567500, "uuid": "6c79baba-c28f-4228-b4b8-6b7cb9f1c798", "comment": "Malware payload (RedLineStealer)", "value": "5e95f325e254147b40e46317ac424a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567500, "uuid": "128f7233-ccda-454a-8721-c62781823c66", "comment": "Malware payload (RedLineStealer)", "value": "d4e3f7e42537279ceb73f0545e28d28323635196a42b9fb9bc0584412d2968e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567500, "uuid": "a77a635c-ac28-4f28-a7d9-66b2e4b01ccb", "comment": "Malware payload (RedLineStealer)", "value": "4b383ba86ef02df8609a7a364ddd36025068deab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632567500, "uuid": "1aa57b4a-25d8-4a92-8a58-fcc59393f4a2", "comment": "Malware payload (RedLineStealer)", "value": "fe15ea4509b560c205fac479a1bbed0794c8e04901e65dcf7b1fa3b01d4b65947963e230a670629dc56e03ca4b7448cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567500, "uuid": "cb1a3bde-827c-4e38-a604-5c8a96ccfd64", "value": "T12A34D02076EDC032E2F70D7549B8C7A16B3BF8326AB6425B7755176E0D22EB14A63313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567500, "uuid": "29a178ea-6f5c-41ac-a63c-8603abb3c646", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567500, "uuid": "fe677c6a-78d0-46c9-806e-8447778cd684", "value": "6144:/Oa5iW2jEilJnReklOrN3WtOLORRDDb9YSxUZdZ:/55x2jBnRFlOJGFb9YSxGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632567500, "uuid": "97147fdc-9fe4-4234-a792-5ab7b9b143df", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632567500, "uuid": "0c2f23f9-e1e6-4180-bc1a-50a186ef3a6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632567500, "uuid": "e7c5211b-149a-42c8-a6d8-c46abb87938a", "value": "5e95f325e254147b40e46317ac424a35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3520e81c-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561793, "uuid": "a2429a4e-c215-4be5-bde4-264d527f62e0", "comment": "Malware payload (RedLineStealer)", "value": "fc2b84d5b90063ee6eea1e11a831f125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561793, "uuid": "efb25e63-ffaa-4f66-abdf-9876a1708123", "comment": "Malware payload (RedLineStealer)", "value": "d4fa7e3a47f4d62d9bc0c4608aad5b43fbcb3de3272c891439a3641957bb533d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561793, "uuid": "4bcfdf21-1158-472b-b29c-a2fec97389de", "comment": "Malware payload (RedLineStealer)", "value": "c40e56bc4c77630b51fbe8a45b608c98c19cd421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561793, "uuid": "2f2956ff-f33c-4d59-a374-7be0291d2870", "comment": "Malware payload (RedLineStealer)", "value": "08de7b8327dd00e3df9f3f01c5d12c25ef8259b55bed69d6b2d03e60d4f06df7836b6aac79cf35cb808f76e48876fab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561793, "uuid": "66270c96-5a9a-43be-8469-06ab24ca4f6f", "value": "T18324CF2136E1C032D6EB773448B4EBA14BBFB6626774D24F2B542A2E1F222D15A35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561793, "uuid": "b459ab6f-6fff-4113-8128-faabd604d29c", "value": "a33546f5b752a06a4745d4c8006e21b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561793, "uuid": "1fd88203-6e1b-4207-9a0e-972706a71e06", "value": "6144:S3lNW7Bm2U/8O+jS1Y9QVKS9MTIsm5yTk:WNUmV/J1Y9QfW8ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561793, "uuid": "2aec06b2-8400-41f0-9689-f94d620b6951", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561793, "uuid": "1226d897-4835-4e38-9ed8-6f0af3eb0949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561793, "uuid": "e98274bf-59f0-4201-8a2d-52d9a0ca9b8b", "value": "fc2b84d5b90063ee6eea1e11a831f125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf540232-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563313, "uuid": "1c2a9858-3647-43cc-a0c1-a53d8300b855", "comment": "Malware payload (RedLineStealer)", "value": "5ed546d5135ca653e9db4a06e418cc5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563313, "uuid": "1298b4e1-b6f7-4898-84c5-cadfaa82066f", "comment": "Malware payload (RedLineStealer)", "value": "d571f4c8d4e202e48bd37ec433a60a6fe8843d20b6afbc01c57e9cde330ed9dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563313, "uuid": "7aac0914-66aa-4e8e-8134-5ac46e253ece", "comment": "Malware payload (RedLineStealer)", "value": "62dce31fd5ce1aa4514479a3b11a08e7e80c9938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563313, "uuid": "08707b6f-d6ce-4730-8310-5593c801ae69", "comment": "Malware payload (RedLineStealer)", "value": "119c290b7813654ba7a3341f087c8cc3ec7e00840f752728e831f4fa63524f5c66e7fb875ef674dd4559e3feb322900c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563313, "uuid": "73ce3548-7309-4029-b948-88e3be85a3bf", "value": "T1BD74AE20B6A0C035E5B742F599BAA3A8A93F7DF15B3051CB12C526EE5E343E49C31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563313, "uuid": "1900a40d-b7ef-47fe-86d5-70db02d4efd5", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563313, "uuid": "b1f16e14-347f-4426-87e0-fc30371e8f61", "value": "6144:vB1/eOh2rID0LCeGgC6MMmdrBoQy9UiFSZq3fps9hTxUN66:Lph2rID0LUv6lKuUDkPUdo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563313, "uuid": "35ea99c9-2574-474a-a4d0-cccc823d9cac", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563313, "uuid": "97d183bc-6911-4383-9335-99636d2a9284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563313, "uuid": "88249a09-aa25-4b14-85c1-a63a676a41ae", "value": "5ed546d5135ca653e9db4a06e418cc5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ab727d-1de7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632563948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563948, "uuid": "019b1853-5a18-4fa0-9dd7-62d5ac57e375", "comment": "Malware payload (TrickBot)", "value": "9f9170d28c677db45ca2f70ac4978dfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563948, "uuid": "d5c840b7-9b4b-4a7c-b7df-934d59ff45f8", "comment": "Malware payload (TrickBot)", "value": "d5841612d37dc3f713e02b4ae2e71266aa504741f17891445a699a27bb32d0d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563948, "uuid": "a5a887fd-b8a3-4967-852e-c1a471708ad1", "comment": "Malware payload (TrickBot)", "value": "c0d6310c5acb63d928c5baa632cc1255ec8e8ed1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563948, "uuid": "4bd566f7-d3a1-440b-86de-43b873b1f19b", "comment": "Malware payload (TrickBot)", "value": "3258e48840e9fa8c7f3a483d1246f865106ea391124154dd449477700096207c7589fc3354f5618356e09643b7192184", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563948, "uuid": "a73c922e-c310-4d2d-88f5-6d1e02c1eb5e", "value": "T16BB4D03535E08973D16319308EFD07E963B9BCA147B2958F8F902F0D3C7E556A43A2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563948, "uuid": "8bb74cf1-4c77-4614-b79a-07611a049b59", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563948, "uuid": "c818a783-b184-4116-98fb-f47ecb19253c", "value": "12288:cbVMh0tRyr3W3SvniM+uwkMx8nXoTT0WJZmo:WMh0tRyL3lY8X2xJZmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563948, "uuid": "4ae405ce-ea11-48f0-92cb-e6d64a370659", "value": 528443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563948, "uuid": "d5e47e38-a67b-4d6c-891d-4f4ddfd8206a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563948, "uuid": "95491615-d045-4ed5-b5b4-805f1a0dac0c", "value": "9f9170d28c677db45ca2f70ac4978dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54279fd0-1dfe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632573871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573871, "uuid": "bc0ed797-32af-431e-a06a-4b388ce5f6f4", "comment": "Malware payload (RedLineStealer)", "value": "eed720b3e82eed96264b7cf46024010e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573871, "uuid": "d5ee9f68-f909-4635-8952-fabc458b5887", "comment": "Malware payload (RedLineStealer)", "value": "d5b86d16c66015ce8a4e662a901b32e566b30ca790feeaf357be69a8df68ba1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573871, "uuid": "4bfedd24-b4fd-4f52-ba54-5c8a201c6b2d", "comment": "Malware payload (RedLineStealer)", "value": "47af0159f808cf387e62420364a0aed42cbb2d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573871, "uuid": "720d100c-aa99-4cdf-9b2b-caa9525e3a41", "comment": "Malware payload (RedLineStealer)", "value": "c17cf835de9069f500b08eb4db48b2fb536ef3186bdfdf82f8df5dd9944139131eea001027ce761b88f9212395705b2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573871, "uuid": "8486f8ef-e83c-48d2-bea8-afdb611dacca", "value": "T1B034E01076B1C836E2F7587D5A78D2AD5A3FBC331A71924B77880B1E4E216C39B26707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573871, "uuid": "70b8fbec-6084-454f-9fea-8891b537506e", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573871, "uuid": "de55ac08-fa01-4e96-a356-a03c40eb2b69", "value": "3072:3s7z2Mq5q7C8FErBQF4j3MaXY0fEhVBval6xpMgvdIh6gium3/65zg0jrxY2:3s7z2T8u13MCySl6xpH26giufg0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573871, "uuid": "9cc68261-a539-4b94-97bb-3dd40b7e7d19", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573871, "uuid": "87a98ce1-86a5-4b80-8e0c-3e2a5205c78b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573871, "uuid": "023cc2c8-6bff-4f44-a597-d8cdd039e957", "value": "eed720b3e82eed96264b7cf46024010e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc54128-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562609, "uuid": "964f3e4f-f71d-4475-8c24-ec18e1b93aeb", "comment": "Malware payload (RedLineStealer)", "value": "c13d01aef5f56c6d55e056af409a7ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562609, "uuid": "daf483d6-1590-488f-bab8-559c30e5605c", "comment": "Malware payload (RedLineStealer)", "value": "d69529633bcde3ddf64bc73faffceefe9f84a5879ee1b22d87bfaf57173d4f8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562609, "uuid": "4b263c20-8132-41cd-960c-2ccb1ac98d0d", "comment": "Malware payload (RedLineStealer)", "value": "eb99dd61b50cdb8b2072572c82b0a46cdf57d31c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562609, "uuid": "0e2a52ee-f6d9-475b-96ab-937a3b84fda1", "comment": "Malware payload (RedLineStealer)", "value": "29e03aae65f6d94a36fe369edf37451427f114464cc0f6680d6e146f52a622fdaa416514853552dd24675d22a725b755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562609, "uuid": "d1ec0cca-8567-4f3e-92a1-20bb1ee45fe2", "value": "T14674AE1076F1C038F6F712B949B993B9A53E7DB16B3482CB62D41AEA1A746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562609, "uuid": "91aea449-963c-471a-addb-83cce1110d76", "value": "1f3d09de0e7da5c165527f71e6a1c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562609, "uuid": "47d54466-91e2-4438-bd95-42fae8cc4690", "value": "6144:V9wU1INQlbT3WVclhkEasWqz9UHn1egVrZ:rwU1INQlbSV0asOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562609, "uuid": "804fd495-dfa3-44be-8798-4fc701f83e0a", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562609, "uuid": "1943d43f-b442-4ed8-9108-f77f3d97b933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562609, "uuid": "cf9cf4b6-481c-4a84-be5e-ce447cf2fd04", "value": "c13d01aef5f56c6d55e056af409a7ae7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66be133d-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563165, "uuid": "af60d8a9-4024-48ff-9b6a-a66fb026975a", "comment": "Malware payload (RedLineStealer)", "value": "98c9d17d06b52192e9946fc7f4cba934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563165, "uuid": "34c17344-2930-402f-acf9-6e568c08af6d", "comment": "Malware payload (RedLineStealer)", "value": "d6e874d199b4b0dfbd26b186212e02e83d64870dba2c033f952004b47137fbe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563165, "uuid": "d5614f94-1448-4fc6-a382-6a6e0966a133", "comment": "Malware payload (RedLineStealer)", "value": "cda41e58c497c51691e741a76213cd085feac4a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563165, "uuid": "6c314447-e046-494f-8d6e-74c700af48d7", "comment": "Malware payload (RedLineStealer)", "value": "6ab18fbf9560442d1af862cecf6f8768a9bebce5d5b5d2bb2694c9ea9214f9afede16a0e12b779e4f6b2622229bf14f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563165, "uuid": "34810a32-75fe-4785-8b98-885d08314fa8", "value": "T18B74AE20A6A0C035EDBF12FC59B593A8AD3D7DB16B3050CB61D126EAD6386D4BC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563165, "uuid": "9e499109-7184-483f-bf7c-fd02b8194345", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563165, "uuid": "3f0cee11-dddf-4a8a-b92b-c4880ca47167", "value": "6144:2x+leqyWXy4LSe1gCnYTJhZhzLmIRbKmg7+xlC27UxOP/:ZjyWXy4LbvnmTZhmIlKmg7Wpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563165, "uuid": "7e9ebf3d-91dc-461b-ad2a-1ca4e9eee159", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563165, "uuid": "f81c816e-6a4b-4263-ac4e-a4ef3d0a23f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563165, "uuid": "c52388b9-1438-45dd-bfda-94f665b4d67f", "value": "98c9d17d06b52192e9946fc7f4cba934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374d7369-1dd7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632557072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557072, "uuid": "a622dae8-d7ea-4e3a-a2c1-86ff3c7a5223", "comment": "Malware payload (ArkeiStealer)", "value": "2433260019e2886c8fc0969cb076cc49", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557072, "uuid": "6348dcee-06ef-434e-978c-cebfe89977aa", "comment": "Malware payload (ArkeiStealer)", "value": "d81d318002da9fa030f20bfa0615bb895768e83a8a45ba3299ae85ded1c06537", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557072, "uuid": "21494d33-601a-4863-8b4c-b0cc4eb7e6d8", "comment": "Malware payload (ArkeiStealer)", "value": "cebc35a8212c2dc52d3e4bebd6c90d4ac868898c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557072, "uuid": "ad82e575-d95f-46f2-afba-ed5da0400268", "comment": "Malware payload (ArkeiStealer)", "value": "5527d547d2be509ffff112abfc339fd5d06776bdcb86ed6c36391a26961e3cfee94a6df2076a782947fbf7258c516c88", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557072, "uuid": "7f7ff9ae-2fad-44c9-be1f-f7786e80da21", "value": "T1D365E0259291F037D1B3FA78DD969B7F9B3C7E103910080B6EE82D681B2A3C1B519767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557072, "uuid": "deb978dd-f0ad-4336-9a4b-e63b6cea9980", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557072, "uuid": "91246851-2d1a-4b50-b67b-dd2b1804dca4", "value": "24576:HBuzcdGnDDP1EX9uOJwQ5No04Hoawhb5BJnXvxWmmq0LBPdchd:H2DdvgwQ5C04Ibb5BJXIVqMBPdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557072, "uuid": "99173cc5-1164-4457-8b36-c51b82e07a13", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557072, "uuid": "566d6f7c-9a2b-4556-a18d-7aa40a74706c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557072, "uuid": "ac3d9813-ff65-4210-aa57-951854f431d7", "value": "2433260019e2886c8fc0969cb076cc49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2050bb-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632552815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552815, "uuid": "603411b9-c51f-4489-8565-94ba67adb740", "comment": "Malware payload (TrickBot)", "value": "a3276a6edd8cdf35e28c69e98fac25a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lip124", "colour": "#BB00E6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552815, "uuid": "7a06404b-feb0-4b9e-bfde-229a0f056f52", "comment": "Malware payload (TrickBot)", "value": "d825da453d80559eabf1d90dc46af91ce1a05448b4583d963e6fd3d05f87f208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lip124", "colour": "#BB00E6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552815, "uuid": "8fbbf0af-0510-47a5-bb3b-1298358b8610", "comment": "Malware payload (TrickBot)", "value": "81c733ca47319a818bb1b9ef138c58bf4f715147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lip124", "colour": "#BB00E6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552815, "uuid": "124d3efc-fb03-41f1-8969-a91389bbdb45", "comment": "Malware payload (TrickBot)", "value": "d9b0bb84769d2c31f06b92ec0336973f8f0942b30b3462c29cf002b936ba5a897b046438b362645843a31a28a90c5e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lip124", "colour": "#BB00E6", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552815, "uuid": "0d6753f6-825f-44e2-9c19-e636f4f0132e", "value": "T1D474F10236D488BAE1E257320EBA57A8E7AAFC704B73C55F2B541A0DC8356918F35773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552815, "uuid": "98c3a129-d1c9-4c0b-80a5-42a280305fa9", "value": "4d85858bad44ef6cace325b0f2f52ab8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552815, "uuid": "72db78c6-1b1b-45a9-a8f6-019fecc4c1a2", "value": "6144:eYvQ/7nmUG0tkCxN08w6cVpsyAAtTaOM6hA6gWJSn0xpCpdB5:TQVt3xN08w6cpt2ZH6S0xpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552815, "uuid": "1152a6a5-a192-44e0-8759-8ce93999f650", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552815, "uuid": "6e9e4e44-5bbe-4338-839e-c4f462bc0a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552815, "uuid": "2e202a1a-6bf3-4b46-89f5-80dc8a2d2992", "value": "a3276a6edd8cdf35e28c69e98fac25a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407026a5-1e40-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632602184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602184, "uuid": "6807c9f4-6006-4424-b1f3-40f80758f786", "comment": "Malware payload (Gafgyt)", "value": "fa3a110d7f3026c3902a15e914a7facd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602184, "uuid": "3318fd62-e9f0-455d-954c-548c5f91787d", "comment": "Malware payload (Gafgyt)", "value": "d84549d3ef0b5ace709970d22f8524f607c6990f7043b2da9f77c31c5316df26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602184, "uuid": "46839682-f91f-4e8f-80d6-422dbffdc188", "comment": "Malware payload (Gafgyt)", "value": "df399bae1ebb2e8373d5153d8231a2c65f46e379", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602184, "uuid": "9412cc3c-57c6-4673-baa2-adaff154d880", "comment": "Malware payload (Gafgyt)", "value": "0f86fe5243f6538f3c0c144d0c4bd7c2b8cdbae1138bd7514112e4f1688ecf74e183c4d5aea3a983960dcaad813cf0bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602184, "uuid": "dea097c2-ab4d-40d4-845c-82848409ea9c", "value": "T121A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602184, "uuid": "4ca07ac9-43d2-4641-90c0-a62ce110084d", "value": "1536:xfRuqNM5h7t/RiRt4nNphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRWphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602184, "uuid": "104f6274-be33-4277-8b01-0fc64782ee40", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602184, "uuid": "e85865f8-9a23-4249-9f49-eda020fdd574", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602184, "uuid": "402f8dc6-c04e-49e7-ab0b-8d89626e59d7", "value": "fa3a110d7f3026c3902a15e914a7facd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3f56f9-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562023, "uuid": "1a665df7-232c-4aba-b12a-6f88d34574fc", "comment": "Malware payload (RedLineStealer)", "value": "469e5ac2ef00ba862952da86fd459600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562023, "uuid": "0ed65a25-062d-48ff-8717-682927413ec3", "comment": "Malware payload (RedLineStealer)", "value": "d997208b59dc3bae89ab68453b58ced90b1fe698d6e7385a6221d1b54698b000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562023, "uuid": "7a1e5cac-5c46-43e9-b2c1-5ca73566b50d", "comment": "Malware payload (RedLineStealer)", "value": "dae89dc8607ef7641aa42d10705d8aa2e850d18c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562023, "uuid": "1f4ab8b8-cf3f-42de-9502-b0b05727f43d", "comment": "Malware payload (RedLineStealer)", "value": "ebedf7eb6979ddc07ad07b9ee2c51ea213a1b01f4ec11d63fb6909bb84c94b8435dbf29baf9b37c500770443d4a4d5f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562023, "uuid": "7a1e8d07-9cb5-4919-9ad5-3fbcecd6f65e", "value": "T1B244D02131F0C432D5E366714830CA916ABFB5E32BB5854B77A42BEE5F322C35626367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562023, "uuid": "5c5d7065-9edc-41db-9908-b2779f894386", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562023, "uuid": "f860eca8-8303-4988-8722-85d393ef5d41", "value": "3072:6Swnyc3Jna/Cl0Gsaq+B7bs9I3bJKrwItKKstwx/KdOGlQUK6Jv5wXtBGnX:fIna/bGspEXs96buwgstwxQOVCAXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562023, "uuid": "d5a3b67e-a1e9-4e64-b2e0-7793a7a8d73e", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562023, "uuid": "8eda5e0a-e742-4e1a-846e-80dfb4f94f35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562023, "uuid": "2d2587c2-0997-4eb0-a1cb-73c2404f73cd", "value": "469e5ac2ef00ba862952da86fd459600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf6bc3e-1e49-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632606309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606309, "uuid": "83d7c7ad-9a44-4de0-b8e9-5b92d7a3d05d", "comment": "Malware payload (RedLineStealer)", "value": "3a632313c80a974c4f7ac8f456b3a72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606309, "uuid": "0bd7348c-a4fa-4165-887d-8e6d9d3f10f9", "comment": "Malware payload (RedLineStealer)", "value": "dad310f9c291800939286d91b2b3206ca1f53661eed6c9c819d269780eb37b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606309, "uuid": "548f5813-1632-40b1-95ed-c6be69044c25", "comment": "Malware payload (RedLineStealer)", "value": "032165f81544f62e12a88640d12613377a79b7b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632606309, "uuid": "b2bd9694-9d1f-44f5-94ba-d77ca82976c5", "comment": "Malware payload (RedLineStealer)", "value": "087f48f1c000404cc7dd4f738620ad0b546ca1f53a306700b61694df9c0e1db9dcb84535bca60d07c96b50430b24d133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606309, "uuid": "f8c65be4-24dc-4b68-aa35-432716746490", "value": "T12AE38C3076E09432D3A7C6704936C2A16A3BB8722F7385CBF65C364B1E316D19AF6352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606309, "uuid": "67619816-6905-41b9-babd-0ee67def12dd", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606309, "uuid": "7c022d6d-f796-4c66-adf0-ca2fadd61a5f", "value": "1536:tCm0tG3hr2RD/Z8fPTJ3QNXQjAGvveHn4KmKT56wv33Nw19LMnahv+RooRy/494Y:1T2ROJ3Q6jAGvv9IT53vtwLtS9H6dYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632606309, "uuid": "9c8bc58b-8698-47f2-91b0-9dd4659a63a9", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632606309, "uuid": "e0727cb8-7dfc-4df1-8dde-e937c46f3a88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632606309, "uuid": "12e8302e-c8da-4ca8-9346-66663ff4b543", "value": "dad310f9c291800939286d91b2b3206ca1f53661eed6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba97669-1e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632580192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580192, "uuid": "a1c03e2b-be35-4b37-9dae-a9805b548d8c", "comment": "Malware payload", "value": "ea00df3b8aa4a4478c89c6a9416cb0e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580192, "uuid": "6152651c-8bb8-4294-90ac-dff53173916a", "comment": "Malware payload", "value": "db2a76da1ad83542b367043776fe2d62942250aee57aae235317e0723d5254a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580192, "uuid": "277b63cc-4bf2-4e05-a6b5-48b03fc67dcd", "comment": "Malware payload", "value": "b6267f81bb9d9f5c16e62cd7fa79223a495fb649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632580192, "uuid": "b5bc3611-b634-4df8-a6a2-58f49ed3c079", "comment": "Malware payload", "value": "91e12f1168374c118c59576e1cd4ecfae4fd3dfee138c9ff7d1c2ba6dab062b47f24a64224f8fb0323ee8f7b055d929c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580192, "uuid": "1c2059f7-1c7b-488c-b26e-d05f6fc697a9", "value": "T14C056CD227D48530F1273934FDAA79505629FEE8191D899F23C5FA133AB1BE426ED023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580192, "uuid": "6210d55e-c7c0-4274-b44d-d09ed9cda887", "value": "4ff77f39ae1ec37d413fa1e15e4c4ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580192, "uuid": "3c0597d5-99b1-40d0-ae13-885e9357103a", "value": "12288:Kz9igLiYnwThUprpw7/+mxgL5xUpWFvGwEcY8jAbffuD:KEAiZUprpw73KSMV//ifm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632580192, "uuid": "e97b34aa-0f6c-4f69-85cf-35836adae162", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632580192, "uuid": "bd95502e-ec85-421d-a372-ea0c5214997c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632580192, "uuid": "6283f568-657e-4b4f-a2d9-f32f178c2e50", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2d765a-1e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632613108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613108, "uuid": "9e384ed5-afa5-4bb0-a1ca-bdcfa8beae15", "comment": "Malware payload (RedLineStealer)", "value": "8146450129b5efe0e6648b2e6298e7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613108, "uuid": "292e296c-2f2b-4642-a3db-ab0246694a15", "comment": "Malware payload (RedLineStealer)", "value": "dc249737489a928295dd8dd13f8c85627f3254bb83a96691b4749a15fd1c9027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613108, "uuid": "857551b2-d91d-45c8-b3d0-0e98ff7ec8af", "comment": "Malware payload (RedLineStealer)", "value": "1d8105d4482dee1fd18054f6718fe0593aceaf65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632613108, "uuid": "d3a0b24b-29a1-41fa-a785-231225e318fc", "comment": "Malware payload (RedLineStealer)", "value": "ccc9527c4b7beee9adb121f6fa8d792a8e8c4e87b1afa4b81f852e269726a2025e4c04bbff779c0305985b7b12805462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613108, "uuid": "a2ceeae2-bb9e-45b8-9246-8a8ec03e62be", "value": "T1A244D0117AB2C072D7A344719878C39566FBBC322DB3816BF75C165E5E623C29BE2342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613108, "uuid": "f6da36d6-81c7-4088-8601-4c4e4c2ac034", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613108, "uuid": "24c4ccc8-08e5-43d4-9835-0587f30e03fd", "value": "3072:z1cqMVrrkkpXZsjCtPpeln8UmHjMTdEhaoWnYC2v/FO5quJ0S9H6l:z1ArrkkpXqjCOpmHjYrnYTvdNuJ0Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632613108, "uuid": "6a5dfa16-f4a8-4bc2-ac8f-21147ca8bb6b", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632613108, "uuid": "1673f539-9727-46ce-b5fb-134574f518be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632613108, "uuid": "2cb4525a-01de-49be-b974-4163a85e7751", "value": "8146450129b5efe0e6648b2e6298e7a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dc51d9-1dbd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632546144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632546144, "uuid": "68a822d2-1768-41f2-a0b0-64388fea6a73", "comment": "Malware payload (CoinMiner)", "value": "745e57d1e9ef58647a60e3d341589d0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632546144, "uuid": "82497b41-7df1-4db6-95d9-1136e7028700", "comment": "Malware payload (CoinMiner)", "value": "dc633709fc89e2c8596d97b71135911f73fb51bd4b9e7adbac5692fc287b0165", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632546144, "uuid": "30b96572-5da4-44ff-9186-2d2510cbc40c", "comment": "Malware payload (CoinMiner)", "value": "6a52f048f821fda5ab3bac10a887fb48462a64d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632546144, "uuid": "20dd4d10-f567-4e46-993f-de766572fc01", "comment": "Malware payload (CoinMiner)", "value": "f119e90f05abd35786160f7870b033d3f41185cc45b76a2080f4fef1df1bcd9e0ec5e58ea645fcd431cb7ed5cde53051", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632546144, "uuid": "66bdbd62-db48-43c3-9a18-35977bfd8906", "value": "T1632612B6CE45A161F00B33F28E0ED1F94EC825DED525A5C6D07EE4BCDC642807BE25A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632546144, "uuid": "b83d0ca8-da2c-4d89-a4b0-bfe34df2ec63", "value": "2a2a662be9dffc461398e7c94d0b55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632546144, "uuid": "5518c0db-fa56-41d0-82b3-33c42d23e40a", "value": "98304:8lTmkKs5QV/57/Alz6eun3QqBAnzrMDMNBY5rr07JTZIIWSOhWu:NhsKVS56/3QCAnvjsrI7JTWIWSOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632546144, "uuid": "9b464119-3bc0-448f-8663-d339bd540cc3", "value": 4503040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632546144, "uuid": "afeece6d-37b4-4528-a534-3611d5717f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632546144, "uuid": "dcfae363-ad8d-4516-a174-d91f98f305a5", "value": "745e57d1e9ef58647a60e3d341589d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9ac948-1de2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561723, "uuid": "1b42bdd1-db74-4d98-9a08-44fedd0f6d82", "comment": "Malware payload (RedLineStealer)", "value": "6b75650091aa2dde3d88a7ecec0412c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561723, "uuid": "8e5d1d74-a47b-4559-b7f3-199c2ab600b1", "comment": "Malware payload (RedLineStealer)", "value": "dd11a4f5d3e725f42278185fef61b35de16b75c5ea06688579d986b5eda56ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561723, "uuid": "f3954e46-bc83-4053-91e1-5e82aa964528", "comment": "Malware payload (RedLineStealer)", "value": "ddea82d755fa9237fc08c034e9147280ebda6c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561723, "uuid": "1757d9e8-fea9-410f-ad6a-692e417f634f", "comment": "Malware payload (RedLineStealer)", "value": "32869baccce7792cd2c06badffdfc64ff7b8ec5d34d9d298184332b9c4d75eca7c2aaefe21058eece2cc0df5bb7bad43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561723, "uuid": "f5f3ee3c-f630-4140-9f22-fbc6144550a8", "value": "T12044D01236F0C932D6F365718870DA956E3FB5236AB8714F2B6426EE5F332C05A25F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561723, "uuid": "b2312459-9cda-4a7c-a3ee-5605583762a1", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561723, "uuid": "8798642d-af57-4809-bce7-73aa8f3f03f2", "value": "6144:gIggZSEEs1apIev17Z7OgHmBZG/mSlK6:rgar1netZlHtmn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561723, "uuid": "53431dc0-9e65-4bf2-baec-2c536cd80b2a", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561723, "uuid": "57589700-ad7e-4c62-959e-444c054dec33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561723, "uuid": "cf580728-4a72-4b6b-a309-48cea221855f", "value": "6b75650091aa2dde3d88a7ecec0412c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce8a9a9-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563309, "uuid": "2f9c19a2-cca6-4965-8b38-f3649c76a700", "comment": "Malware payload (RedLineStealer)", "value": "c1c82187ad97dd01e29ce12f69e5d2b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563309, "uuid": "3c322f8e-5ec6-495b-abee-ab66bd47802b", "comment": "Malware payload (RedLineStealer)", "value": "dd4053f9eda1802add6d470ebe1e904098bbf47c13d19ee342271da2ad6435bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563309, "uuid": "7b1ccd85-6eb8-4719-a828-90fe920beb30", "comment": "Malware payload (RedLineStealer)", "value": "1a716f2c3df15a264cc0546557b3ebf3f0c3d4d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563309, "uuid": "f8f303c5-364e-43a4-a81c-61b9ecbb2519", "comment": "Malware payload (RedLineStealer)", "value": "bc56dbe6b3b881b44bfa07b51037e432eba1e5a492ddc2326b076d8a28ed2e5383d48806183588f392fa0b72df3fb019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563309, "uuid": "adcdd575-6421-4057-93f8-fe5d4837a76d", "value": "T15074AF20B6A0C034E5B312F5D9BA93A8A53D7DF16B2051CF22DD36EA16B46E4DC32753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563309, "uuid": "4f01dd38-7ec3-4832-adb2-6dafa7827a89", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563309, "uuid": "27b170c0-ba31-4753-b16d-eb6cd37f100b", "value": "6144:DgLVees2dZ5kLkeFgCdNKS1wQ3SplM/HW2XQNJIkQM2DJ9fUU9:gns2dZ5kLpvd8RQO8HLXOz21h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563309, "uuid": "41dd727e-86be-4fdd-801f-ce156ba199b4", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563309, "uuid": "75cb2fa0-0d2b-4686-b0da-2706f6dc12c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563309, "uuid": "5f26d65e-6348-4aba-b1ba-53379f2aa0ca", "value": "c1c82187ad97dd01e29ce12f69e5d2b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b811436c-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563301, "uuid": "012f5388-9d7a-4287-bb6c-a72f467a7399", "comment": "Malware payload (RedLineStealer)", "value": "45c3814c6febde056ac71e7024c6489d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563301, "uuid": "d1679aca-f85d-4675-96be-120cda09d437", "comment": "Malware payload (RedLineStealer)", "value": "dd791ee444ada844831a48578cdf6783ac2b59cd19bfd9a6dfa42785f990092d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563301, "uuid": "e4a34a01-2537-47fa-9b5b-ac60d7c83ad3", "comment": "Malware payload (RedLineStealer)", "value": "e69ccc2a05faf9f49926de899ca2f399862937c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563301, "uuid": "97933c15-44a8-46de-a6f3-381ad2d259f5", "comment": "Malware payload (RedLineStealer)", "value": "8636837ac76fbe50f47cb5ca01bc9a930e71a350ded2b3c92000120cddbd597428a67b96c3da1a8245f99801af0b15f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563301, "uuid": "8bb56118-b7c0-4b4a-a77d-a45eeb99de26", "value": "T16374AE20A6A0C035E5B707F449BAD3A8A93E7EB17BA051CB32D1E6EE56346D4DC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563301, "uuid": "d90fcb86-1e7f-453e-abec-95026d85b58b", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563301, "uuid": "cf78a63b-32ac-42a4-9d38-ae2b1a19f28a", "value": "6144:6S99eOkgepULjeFgCV7mSNoP6d3sAMPE9EHRioW/hJSxPwl4KsUtr:9vkgepULwvVveP6d3rsZ4JJSxPwl4Ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563301, "uuid": "f37a387c-0c5f-4e2d-ab5f-0e6dce5b6aba", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563301, "uuid": "8db8aa8b-a29b-4423-97fa-62c46fefa4e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563301, "uuid": "bd794068-00bc-4c31-a1a5-465a4451fa47", "value": "45c3814c6febde056ac71e7024c6489d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a66893e-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632563144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563144, "uuid": "6e71e54e-a720-4c2c-a474-2d3c8263442d", "comment": "Malware payload (RaccoonStealer)", "value": "58bc6d515945a308bfc35358455c96ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563144, "uuid": "c0899775-3542-4c5a-bdb0-0cb3fdc67e01", "comment": "Malware payload (RaccoonStealer)", "value": "ddc293e024821f0870ae59a138e5b9b78047fa2d109e954e18bdfdd6c3ac4c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563144, "uuid": "f6081726-87d7-4a85-aeba-cc1a65d03c92", "comment": "Malware payload (RaccoonStealer)", "value": "b2486bf163f7c3ee1c577106418ec90b0af58c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563144, "uuid": "359a6b8b-60f4-4383-b344-33490ef40cc9", "comment": "Malware payload (RaccoonStealer)", "value": "b6d09ac3b384510b803ac30004259f12bdcddb81151d6bcd318b58a006d7582470c410a0beb1be24bbafaed0dbe63b82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563144, "uuid": "92765e87-04be-4d30-b009-984a615589fb", "value": "T106941202BEF1C472D6F36B308879C6A58A7BBDA26A71C08736D4E79B19223C1CD55353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563144, "uuid": "1fc662f3-736d-4c89-b42a-b0fd82ddb5e8", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563144, "uuid": "32abbc8c-a1c2-4963-9483-768be42af937", "value": "6144:io94A6+AiUP5mkxLzZXdghWJ1m2ujuMs7jxKHLroDBo1ZuFmkVMZHajIILQjTH:io9Hhm5mKtgkrnujMjxkLf1ZupiEIFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563144, "uuid": "7c974974-0227-4a35-9d15-2cbdf289fc23", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563144, "uuid": "8f88dfeb-6a63-4650-bc4c-763a965d6b31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563144, "uuid": "2f3ff8ff-b0fc-451c-af55-578c44a88041", "value": "58bc6d515945a308bfc35358455c96ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da09037-1e2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632594502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594502, "uuid": "94a2d5a0-d380-4fc0-afe5-d3f00a784978", "comment": "Malware payload (RedLineStealer)", "value": "98d36a0d16734429137e490bb4101739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594502, "uuid": "d86ab797-263d-46c5-b556-1e9b5d8008c7", "comment": "Malware payload (RedLineStealer)", "value": "e0115c51389578c0c10c4ebff65fca258a6b453bacda5f3e64ceee7a5f061239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594502, "uuid": "34205d8e-5136-4dcb-b5c3-1aa31935d5d2", "comment": "Malware payload (RedLineStealer)", "value": "a75160d19638553587c8f8d410a9f6afffbcd8f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632594502, "uuid": "8460a7e3-5172-43c5-9aaf-10bedd38767b", "comment": "Malware payload (RedLineStealer)", "value": "5e11fbe5fbd938fc314a85e31e0890f5952ebd07933decd9e3c28d08e60e397c94d656b39d71e215c2300b1ce0ad36a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594502, "uuid": "ea4b1ba3-e1e1-4062-9475-de83300ad105", "value": "T1B644D020FAA2D03DD3A70A3559A682E4273FB8726E33411FF64C175E1D626C18AF6747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594502, "uuid": "6a281ec1-f870-4816-8801-8ad8196a7e6f", "value": "4243f00363439be8c6e25a231537571b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594502, "uuid": "b8fc2ab5-6e79-4b36-9424-efa6e6251fe3", "value": "6144:VqvirAOlWi5+eqf/IuqD8Q3SJnXm1XutjlslEad:yOhQpOD7i9XAAjYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632594502, "uuid": "1986af22-63f9-4090-a4e7-0c058cd95650", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632594502, "uuid": "fc63f699-4e81-45cb-bdae-b24db8b1b357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632594502, "uuid": "4db76efd-3337-4be3-83cd-d1c05e0af5c1", "value": "98d36a0d16734429137e490bb4101739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bf039c-1dcf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632553659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553659, "uuid": "433487cc-9c4d-482a-8de2-09419eaa77f1", "comment": "Malware payload (ArkeiStealer)", "value": "99d3e49783c26ddb5c6ec23207b33b50", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553659, "uuid": "be0afdb6-8689-4d13-b7eb-fe586bf3bbe5", "comment": "Malware payload (ArkeiStealer)", "value": "e088fd3b4328c68fc4efe5348531b294d9e3edd4c07708edc37452b305e0801a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553659, "uuid": "280d42e9-1f56-42df-bfc0-1eb40f54957e", "comment": "Malware payload (ArkeiStealer)", "value": "ba0df43b998e5fa9d0ef918ad42b77a36a0721c2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632553659, "uuid": "00710c42-98cb-419e-b519-b484fa098ca0", "comment": "Malware payload (ArkeiStealer)", "value": "96a4e234337bf9b92c4f3b2af78802d0ea6c97fc42447425fb474de3dfcb7772ed78347da2c67d3161671a74c5037460", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553659, "uuid": "3f6ce10c-cbe8-4578-9dcf-2212dd02bca5", "value": "T1C1F40110B6E0C034F6B716B918B993B8A93EBA726B34D5CF62C017EA52656D4DC70393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553659, "uuid": "519dc0ea-6e79-4001-aa78-84dd45a33ced", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553659, "uuid": "64dbb16b-05d3-4fe0-a8ce-c211a51d7c18", "value": "12288:/uiEVoqF0eb8qiD2yQ1svV3wJsIHYKpz3nIyaaq5qxCfVafvYC7/9Bqbe:Coq1bmm1sd3wJszqzXIhRkxygfvd8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632553659, "uuid": "96345967-3da0-4734-98ee-189e916a1905", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632553659, "uuid": "0f7fc42a-9f52-4bab-8359-9a4aadf8d441", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632553659, "uuid": "8f9e2d2f-0c1b-4efe-9890-39b3728ca36f", "value": "99d3e49783c26ddb5c6ec23207b33b50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ba3076-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563297, "uuid": "5c86f9d6-f711-4b7d-9d28-5c0413877630", "comment": "Malware payload (RedLineStealer)", "value": "c7b7ecc3c01c8b868da718dc555b1885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563297, "uuid": "d7cb965c-ff3c-417a-9445-9c21bbabf577", "comment": "Malware payload (RedLineStealer)", "value": "e099bac474735cf5db5047ba8e817049607ac86e1f82c0f37c0da670a4f862e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563297, "uuid": "ab83ae02-358c-46f8-be2e-8cff7057be7a", "comment": "Malware payload (RedLineStealer)", "value": "73db1085b79e6c367345fb36695ad4a059922ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563297, "uuid": "0f343298-c603-4cdf-9d8e-277fe7cd912c", "comment": "Malware payload (RedLineStealer)", "value": "35f1596838061d8f7785940aa35fde7cab6013a04d8755e9c9f0132c9d21cfa0a28c4163b9dbef460e07d64e62e9a743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563297, "uuid": "00669b16-9b67-4edf-96a5-0be92a638913", "value": "T128949D30BAE3C036F5B752B449BA93A8A4397E715B3840CBE2D526EB16346F49C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563297, "uuid": "4e96eeb2-933e-45a5-9d7a-a04f388cf541", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563297, "uuid": "313e665d-dec3-4db3-b1b7-de9251e4534e", "value": "6144:lSDnXFhnP5WCCT3JO1hRtbwR27pVx9SdUZ2:InXFhP50T5OdtbwA7Xx9YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563297, "uuid": "a76a4da9-84d4-4555-96af-1355ad957cbb", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563297, "uuid": "90115f1c-6717-4864-b0c4-00cc9842f4fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563297, "uuid": "2bf3a031-08e5-44c8-84e0-4a782d334e5d", "value": "c7b7ecc3c01c8b868da718dc555b1885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbe2e61-1da8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632537109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537109, "uuid": "76660f54-d613-4c67-a9d8-861b6c644520", "comment": "Malware payload (Mirai)", "value": "4a91a9810e22c27c04569158a91b2345", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537109, "uuid": "57639503-5d7b-4aee-b98b-5188b3afb629", "comment": "Malware payload (Mirai)", "value": "e0a8e8fe3be0f56fb250c5cbc294c3d487eb736633c70176a525bb0aef0088b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537109, "uuid": "0ee71d70-a3a0-46ad-aad5-39c9ee1c0fe5", "comment": "Malware payload (Mirai)", "value": "eaae665ca47bf0abda4f11562d5b7a7bf6b87256", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537109, "uuid": "ea46d773-ade2-4c87-a0f6-e0eb9bea15ca", "comment": "Malware payload (Mirai)", "value": "97b6f515eeaa2a03be9339d737b5753432dc6222258e6b105d6f835eb34e9331a183c6ff01da247cfd6820adeabfd0bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537109, "uuid": "8d29e5a4-a0eb-4d2e-88b9-c32e2394bab9", "value": "T10AC2E0C2E0639C85FFAAAC313634C7C6A3B11E9DA362CC8671C097F5206B5661347899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537109, "uuid": "aad96426-9531-4af9-b130-293e369bbe4e", "value": "384:yp129Bvnk/Sc20bQUgOS/ETvMozxjaMcUsGoSQwSyjS0mUS6DN4D9ezM4uVcqgwn:4Ovk/aUhzxUFP0mUS6Dgew4uVcqgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632537109, "uuid": "c6f7e1d3-8525-4bb6-a299-b579750866f7", "value": 26348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632537109, "uuid": "c61c9d6b-f809-4eff-9458-0285760049b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537109, "uuid": "47a8fa7b-cb1d-4df8-8eea-1be6412ae6db", "value": "4a91a9810e22c27c04569158a91b2345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30f961b-1e15-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632583908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583908, "uuid": "4a847f7d-4dbc-4687-a03d-2c131070d8d9", "comment": "Malware payload (Gafgyt)", "value": "0ba0a585d03c42f8906b2fcf795a2056", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583908, "uuid": "4aad4413-f5dd-40f9-8955-7ae68bc0b4a0", "comment": "Malware payload (Gafgyt)", "value": "e132bbbfe4832b531a67f95a5245c739ad1bc545d565fa189360f05ebc2ce61d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583908, "uuid": "17c72efc-8fbe-4fc0-8c5c-0e3ba44c610b", "comment": "Malware payload (Gafgyt)", "value": "3d1e8fc7b873148f899032c11627323b0e5925e3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632583908, "uuid": "14feac2d-dc0c-4810-8986-55f62db826b2", "comment": "Malware payload (Gafgyt)", "value": "42a6e436c4eba19c12e90b9f1a903044c7f929c5d5a855f4a64bf6b29c435f05a1abed681b3222198a5bfc5d63f1995a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583908, "uuid": "b28ef0dc-e563-4b71-ac88-fbdd2009fb42", "value": "T1CC836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583908, "uuid": "d8775c8f-40c9-450f-928e-6b70a8bc28b4", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XDuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XDuDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632583908, "uuid": "22ce880c-d767-43b5-8b1f-3d4ec0156f73", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632583908, "uuid": "678fa16b-f1b9-4aba-b6c1-8f2289288eda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632583908, "uuid": "b3916fec-1479-4ff9-bb4b-53eff569a2c5", "value": "0ba0a585d03c42f8906b2fcf795a2056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bfe4ae-1da9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632537453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537453, "uuid": "78a5fb52-925c-4acd-81ab-1822291ba962", "comment": "Malware payload (Mirai)", "value": "e3b8a12ff42ed5d6b35b4b6f0f57aa3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537453, "uuid": "70f9551e-dc94-40c0-960c-b75a9e346e25", "comment": "Malware payload (Mirai)", "value": "e22baefb84fcaf9da8ae7b4e058a433e28300cea7f2972bbf99335aa0504dfb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537453, "uuid": "d5b3a620-f45f-4b00-bc8e-1e39de25a4cf", "comment": "Malware payload (Mirai)", "value": "c9e5fcd96d3cab749ddf4e8db10bf502d8def42a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632537453, "uuid": "9e9f7a28-63bc-4cea-a433-1d6570340602", "comment": "Malware payload (Mirai)", "value": "3c9ddb935fdd55952f3b955c65590f7a9935b963998286912b513cba64e280c3fa45fc9ab526acae5e1e7960dbfbefc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537453, "uuid": "9553ba9f-c527-4c57-8a74-ae6c82efdb8b", "value": "T152831B9EB4414E2CFD8FE9FD55214E19AD20221156830B16A6ABFDD37F732E8CD42D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537453, "uuid": "d024cc84-9459-4141-aeb6-a7679a47aec6", "value": "1536:RV3mIDvLI50hQufb+TAOE0LRYxx7Ideg1pEU7U34sbvgPUUed41yn8P:RY4LI5O+TAOE0LRbdHpEz5jg+4ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632537453, "uuid": "eba30e14-f1c0-4e01-8443-df7e3f12076a", "value": 84392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632537453, "uuid": "4a1f838b-de57-4340-8c47-1e58cff7e37e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632537453, "uuid": "473737d6-7ed0-4f3c-b803-18cf2660ad02", "value": "e3b8a12ff42ed5d6b35b4b6f0f57aa3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d7ad6f-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559652, "uuid": "dcc05423-d737-4b3f-b704-086c2ecd31cb", "comment": "Malware payload (RedLineStealer)", "value": "ba13f9d7508f9e773bb3e94a15a36c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559652, "uuid": "054c56f2-9eb8-445d-90ad-6b149aa29929", "comment": "Malware payload (RedLineStealer)", "value": "e3f41216ea2a0ec97a40013c56259b699008f61c9265296eec32bb36020d95aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559652, "uuid": "78500e14-a401-4942-8ab4-8a45bc0e8583", "comment": "Malware payload (RedLineStealer)", "value": "af0bfadf039d7b986c21e7410360422f2a66cfcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559652, "uuid": "471ebabd-47bb-4ca9-b0ac-abd57f316bc9", "comment": "Malware payload (RedLineStealer)", "value": "444d5c316cbc01aa97cd59c1942c29a26661b20ab763e4d6bb10a47d6b5e89845871923b4e5b923189a29a5ccb95f0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559652, "uuid": "fd89bde2-66bc-4cc6-bb2e-f1a4d269718a", "value": "T1A174BF10B7E0C038FAB312F949B992B8B92D7EB0AB64D5CB62D116EA56747D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559652, "uuid": "8193d8a8-2f57-443f-b1d6-ccc9571ae69e", "value": "9daab65a6dc440e386b70d6bb40ddc6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559652, "uuid": "37ff0a31-f55f-40d2-9fac-de286f327fbe", "value": "6144:6ECpuoR1cb1Z2STO+2ydkaeHsl6AgMVn9wPkeUTqZcvfW:6ECpuoR1cbFOGdaalF9wMePZc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559652, "uuid": "81ad1ada-e1e4-48f9-aa1c-21761a8e744a", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559652, "uuid": "0a98089f-ae10-405d-9150-75d896f5beac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559652, "uuid": "8a535c6f-c713-465c-879e-c8b71e4b0af8", "value": "ba13f9d7508f9e773bb3e94a15a36c40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefc00a1-1e3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632601135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601135, "uuid": "6f6779a5-9d3f-4041-a594-5cc49664cea9", "comment": "Malware payload (RaccoonStealer)", "value": "dab9aebc6468946e8ce38704f33489b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601135, "uuid": "c50ad1bc-412d-4ccd-a7a8-c2146c22d184", "comment": "Malware payload (RaccoonStealer)", "value": "e41b34391dba97a98eaf55d59c565a7ad4f279691bc9c96ae3ebadae0c28b309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601135, "uuid": "767c1186-3d98-4209-a0ca-b8171001ac18", "comment": "Malware payload (RaccoonStealer)", "value": "50a863e3b9eecc3e47bb9c53a733fdf88894a7b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601135, "uuid": "f97b13b9-d8ec-46a0-b60f-fd703fe65ed7", "comment": "Malware payload (RaccoonStealer)", "value": "531be9789547ea3e8707b7e7120b866472104a3d54b33107fb997653028de4eae7b748e6c45b2728a4f5b0b63fb8d076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601135, "uuid": "d1042716-3be9-4545-97b6-8d7d81505d72", "value": "T117C39D21FAE18432E3FB5A7549F1D2905A3FBC322AF1858B7654165E4E212C2B93731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601135, "uuid": "a68e526a-70c8-4e43-bf58-bacf58a16c27", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601135, "uuid": "8a208761-5cce-484f-b2bb-05680bbf77b9", "value": "1536:wtJEIKXpaPECjVTvsYXIMyAMD5ct8gGpnLqi5za5Y4dC8:MJfKIjhvsY4jAMD5ctI75AY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601135, "uuid": "963e2f4d-71bd-4635-85c2-2ca9f6a57811", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601135, "uuid": "44d53550-fd81-4447-95ce-a5419cb71fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601135, "uuid": "a3f361a8-9ddf-4881-88db-64debc070ced", "value": "dab9aebc6468946e8ce38704f33489b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2ffa70-1e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632593646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593646, "uuid": "92c17501-e194-471c-8bee-d1e758c8fe8c", "comment": "Malware payload (CoinMiner)", "value": "68ea7b6eb8bd48a2606c8cf073867a83", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593646, "uuid": "907acde3-ca03-4cb1-bac5-b596e0eda7bf", "comment": "Malware payload (CoinMiner)", "value": "e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593646, "uuid": "b54d41d3-94fd-4cb9-8bf7-6f3748539eb1", "comment": "Malware payload (CoinMiner)", "value": "ec78be2637220d1b6572a9db7b6cd8284fd1b2a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593646, "uuid": "df634f2e-61f4-4c9d-95f6-2a8cb2133e72", "comment": "Malware payload (CoinMiner)", "value": "89d7755d8367f48aaddefa21d56b7874097abda1ac71902125feb1a38eb2e6cb15a8dd232b921d015b266fd1886151f4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593646, "uuid": "c8399bfb-025d-476b-aa69-dd8ab7bfdf3f", "value": "T1F0549E20B7E0C039F4B712FA49BA87B8A93D7DB16B3890CB52D516EA56746E4DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593646, "uuid": "e1819bf1-a8d9-4067-a81d-3fd9691c1c5e", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593646, "uuid": "8ac1d2e0-f6d8-4466-b3dd-3e12a6d2eda4", "value": "3072:2I9LYEcdxT6FjvfOOlKBFUZH8u0ay/M3Zc2oRzMS7AgrWx+ONy/HCv1VIdcoeUm/:20LsP6FjvFlKbyHaoq4ryfC1VIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632593646, "uuid": "29932b11-acaa-4321-b9e7-7c9fa0200418", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632593646, "uuid": "b87cfc04-d59f-49c4-a705-710f2e021684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593646, "uuid": "7c106f19-a1df-48e5-bdc2-02a0d9481f76", "value": "e498ee51d574ae0719fee5da8afb627adc25b946c1798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3825c6-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556844, "uuid": "09f20077-db29-4f6f-8a11-76016f2b6eb2", "comment": "Malware payload (RedLineStealer)", "value": "a6be05bdc87a77421c9ef0834488071d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556844, "uuid": "004b138a-f0b8-490a-ab54-072741a5d9b8", "comment": "Malware payload (RedLineStealer)", "value": "e5ca91a98799cc7a0fdcd0c45f0fce3bfc03ac7d77a7dd20874d6ac5b6476085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556844, "uuid": "e3470c10-ca03-4108-825f-258b4b021a51", "comment": "Malware payload (RedLineStealer)", "value": "474993b69aa3f2cb09853e58c55975e9ec16653a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556844, "uuid": "0ba02e6c-9c28-47bb-9eaa-6d784eec1cf7", "comment": "Malware payload (RedLineStealer)", "value": "24f3682e9b3f52f21e9329e8a763b8d01cdbfe15ec41c592a8a6c38900eaf1e4c25e68434480f7c39afecea665f71a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556844, "uuid": "ceb58d18-c2ce-4e8c-9283-ede6ffb56217", "value": "T1A284AF20B6E0C035F5F712F949BA93A8AA3E7EB15B3490CF62D116EA16346E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556844, "uuid": "8c059b51-dd8b-4dc6-92b6-81d8054fe4c7", "value": "0f0c12643909b692a9be3510bdc965e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556844, "uuid": "10888ee7-b61f-486d-a939-766f24f3225c", "value": "6144:s5R/5dPHRdH+eFDiaBVm9/UWCOR7JsNFLwM48u7nut6P4+QWBsJI:s55dPHRdH3Fo9/eo7ucTg+FII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556844, "uuid": "e7b58a8f-4da5-48ef-bfe4-fb3db71ea543", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556844, "uuid": "e1d4a18f-a72d-4614-9ea3-e52822828f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556844, "uuid": "cc143950-af73-46cc-9988-9322deb724ea", "value": "a6be05bdc87a77421c9ef0834488071d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b8dfd9-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556856, "uuid": "4a7caead-85aa-4220-8e84-834f6c9a66f1", "comment": "Malware payload (RedLineStealer)", "value": "1adb2662c75187ef4aad7be7f16a8f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556856, "uuid": "9082bfa3-a21c-484f-99c2-cbfa8ede3f84", "comment": "Malware payload (RedLineStealer)", "value": "e620189fa4c882f2ec63faed4c07b2a924b7231403513791ce761f7d814ee2c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556856, "uuid": "de8baa6b-95c4-4d04-b13c-7eebfbc13e96", "comment": "Malware payload (RedLineStealer)", "value": "50334d8144ca8278f83ca279d22d142637acd341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556856, "uuid": "373cf73b-35e4-43df-be17-10ef5b3d4b7f", "comment": "Malware payload (RedLineStealer)", "value": "1785c63bac251b01b6bfd4a0ea8b903fb3044b7d6a87583070f95be042dc0da7e9e100977a0523930f17c17101ce908e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556856, "uuid": "b5a6c03e-dafe-414b-9ae2-4b85e9b0e420", "value": "T10974B020B7E0C039F5B713F559BA97B9AA3D79B06B2490CF52D216EA52746E0CD30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556856, "uuid": "2564e1da-b4b8-4c6d-a407-8b190082f8be", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556856, "uuid": "db956fb8-de3f-4275-89d1-48c161e9a534", "value": "6144:nIr2R1bj/slGbEK4714ynsu/Nep/t75JoKJdjWWEb8ri7y5U:nIr2Pj/sl9nxNItTJNwbboU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556856, "uuid": "8105d083-3d63-4110-8e0d-01f1b068fc0b", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556856, "uuid": "8ae16d32-3e0e-4a26-a844-ba0941223577", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556856, "uuid": "3b4ffeee-8379-4a4e-b690-d5b7e998b28f", "value": "1adb2662c75187ef4aad7be7f16a8f4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3572f3ee-1e40-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632602166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602166, "uuid": "4d41b604-9394-4402-a5f3-57700b8a3393", "comment": "Malware payload", "value": "029afdf3dad0e2d196537424fca138e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602166, "uuid": "c268e1d3-419d-4a8e-9cf1-558d61027a40", "comment": "Malware payload", "value": "e6c101e48d9a4201499f802aab62fd5cf05377bee9f0b7eff6add42994bca071", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602166, "uuid": "2b26b7d8-8ab5-4770-9cbe-4fd7edf72255", "comment": "Malware payload", "value": "334ed20c0fd45fc12d6da63601da8e24debfe82e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602166, "uuid": "864359ce-1a36-49ab-8705-f427de8c511f", "comment": "Malware payload", "value": "e0802d1989f52936eae65704c3c0cf1e95859eaa3098a4918c3426ec3d0ac52a56e679f35b8496d416aae9a4a08a54cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602166, "uuid": "514bcbfc-ae58-4632-a76c-0601a0eafb2b", "value": "T17B22A08E43A786B7C47791FF776F5511ACB0F146078DDB92695E8780A1B726302F806C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602166, "uuid": "4df326e2-62ea-4e3f-81c9-9f4a57d930ba", "value": "192:MS8Gym0LZp7e2B/xMXqwXqsTLy+ZTr6ohKEmI2:MvxnLve2B/xOquLy2VKDI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602166, "uuid": "6b664c0a-4a4f-4a71-b619-9e221ae745f4", "value": 10376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602166, "uuid": "97f03960-35e2-41fb-b5f4-5541f7865ecc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602166, "uuid": "e44a533f-5783-4456-b1b8-bbaba2e390e8", "value": "029afdf3dad0e2d196537424fca138e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838cdc77-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559347, "uuid": "f263eff9-c5a3-453b-b4ce-a4f3fc326033", "comment": "Malware payload (RedLineStealer)", "value": "a1dadb74ace70651cf1c8a1d794a9f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559347, "uuid": "7356308a-21de-4787-bf4a-19f27e4a31d7", "comment": "Malware payload (RedLineStealer)", "value": "e78f30b6a760350796129bd3e25b5cb88ba9bd31084878014642a25abb1c5ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559347, "uuid": "f7465b3b-3ad8-4dea-83c1-e959cf5a3956", "comment": "Malware payload (RedLineStealer)", "value": "f571d2035ea95b6086844edeaddd892658125179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559347, "uuid": "d7fc2cc4-98c0-4056-bf34-6c931439a1d6", "comment": "Malware payload (RedLineStealer)", "value": "db0ca9ee3838ae7ef302b1c1d791c89bf5cc219dc91fbeb3bf047b79ff8336242b74e456e7355d41ba9016159de0d20e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559347, "uuid": "6811040f-4ea8-470a-b3b1-bca0208912b9", "value": "T146D5125E1513BB9EDDA1733B9A3ADF06C6F04C6484A5802D39C0BE3BE6B5F46063D642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559347, "uuid": "7b48c5e8-0ba9-4c79-b228-0e4f78dcf4b1", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559347, "uuid": "e96e887f-6b80-4ec8-8781-dd4d5aeafbf8", "value": "49152:ZZNeF0IP12u1y7i7AUBsgegD4fxJ8oPefdKT6xKWWZggkpGBgiWenhCCM8lCjg4U:HMFro3WAUBsgegEKkWKT6DQvBKrg4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559347, "uuid": "17047f7a-3555-4a14-92b7-d5d4151d459d", "value": 2995539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559347, "uuid": "cf8e1a29-1a5d-43a0-b83b-f92e3143b653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559347, "uuid": "5af2be52-50e0-40ab-8f80-2cf015485b59", "value": "a1dadb74ace70651cf1c8a1d794a9f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c436ecf-1e3d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632600943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600943, "uuid": "29a7fc5b-c8ca-4b1c-a42a-493b43ddb132", "comment": "Malware payload (RaccoonStealer)", "value": "d3d718a4348a4d864f4897c8f889eb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600943, "uuid": "609fb81e-6c32-4795-af82-a10311c0ca4b", "comment": "Malware payload (RaccoonStealer)", "value": "e7f73c6601a875dc66411b3a1ae02c746daa4fa8f85afb5771c0e7bf4f68ee12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600943, "uuid": "4518b08b-e27e-4781-ab5c-7f7939248c12", "comment": "Malware payload (RaccoonStealer)", "value": "b8fc804c65458552759485cbf250dbdeba026caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632600943, "uuid": "c42a0119-f6e6-4860-b95e-d68ee74435cf", "comment": "Malware payload (RaccoonStealer)", "value": "15d6c5dd99d4dd3c600aaf4db1fcd9fc1de722551b281f086f9769e64c52f61ca05385035c77e3d61c99d83b58bea126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600943, "uuid": "bf4103ff-083c-4f7f-9220-3ac4b8434881", "value": "T18194021179A08032D3F7AE7079B5FA955E7FF8E32974410A7B881B0E2E216D28E53753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600943, "uuid": "744b50d5-a44d-4c52-b332-d0d721dbc7f9", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600943, "uuid": "b7673758-e931-48ba-8032-f5c46a4d45b0", "value": "12288:Lo9fA2wpIZoBRGId5L4RNbioQhShp82x4+rJ:LKwyqBwUV4HGd2x4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632600943, "uuid": "56afb5c2-0311-4b73-a68e-7ba8d10a7a0b", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632600943, "uuid": "5598e103-f917-415b-bb9f-4098acbb144b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632600943, "uuid": "0e7144f6-d5f9-4959-b60a-88d73ea9148e", "value": "d3d718a4348a4d864f4897c8f889eb4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5278f753-1e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632593625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593625, "uuid": "f0671d84-6b06-48a4-9e64-c63f306fa37b", "comment": "Malware payload (RedLineStealer)", "value": "5da7c6bedceaa3c8262eefb30e80af0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593625, "uuid": "31d506aa-2e83-4626-bb80-5b0331228626", "comment": "Malware payload (RedLineStealer)", "value": "e855a4e71de76c5a61b2702c20c95124e9ae2de2b1465130951bba0f3fc126a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593625, "uuid": "158d9545-a902-4277-89ec-1583e5b7d7dc", "comment": "Malware payload (RedLineStealer)", "value": "e35c890389d974c997028a52b8faad8019544bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632593625, "uuid": "2c84b4d0-792e-4fc2-a204-35e73445c6e9", "comment": "Malware payload (RedLineStealer)", "value": "d771994dc93898e227fbaa4e9922547bc6c4b45f54c31c7df403a3df8f1c3b82dd49684097fe14016f1e0dcb47bb1974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593625, "uuid": "d95ad72d-67b1-40a9-a92f-e8558f19fd68", "value": "T19F44D01036A2C431D3E71976D975C795AA3B7872BE73825BF24C1A4E1FA22C199E3343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593625, "uuid": "87ad985c-084c-43ab-91e5-a0bc18b89f6a", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593625, "uuid": "5aedd186-16b9-4dea-b32d-56cc3e3158c0", "value": "3072:zFn6UX9SGxmK3ltpUC0VvUBZ1bVPBpR/0tZS62iI54vMuiHsS9H6dYe:zgn2mK1l09Uh9BPuEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632593625, "uuid": "796f213b-7946-40f1-90cc-aa586dceb07d", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632593625, "uuid": "9c83dbe8-8715-44be-a033-1ed14ed5ed70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632593625, "uuid": "b623f020-81fb-44a6-81e9-d47334e9fe14", "value": "5da7c6bedceaa3c8262eefb30e80af0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3d9ca3-1df5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632570044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570044, "uuid": "a97e8839-93ee-4306-ae02-f6dbf09c1060", "comment": "Malware payload", "value": "3d8c3dc31b1a5fa8130a76d2f8ef85e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570044, "uuid": "9ddc1620-29b9-4aee-9c05-70c47bad545d", "comment": "Malware payload", "value": "e8f35fa40b8b54c75beb7d65f59655ff697e068f30982f1f0b99a323169cbcf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570044, "uuid": "12fd8b3c-c062-4c0f-9a97-0815a166c71a", "comment": "Malware payload", "value": "7d84b57f202232a9a13c9f720fbc9f1743995825", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632570044, "uuid": "fdb940a5-f639-4353-9856-0dde3374e251", "comment": "Malware payload", "value": "b00524e7197847466bd455738f5217583ef8a76210eae41e4cd365d39d78f5fb0dedf795a5215e87dd7df71f8047c43b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570044, "uuid": "ff318c83-4609-4f13-b318-2c53fc76dd01", "value": "T1E724D06173E2C032D3B766344974A7645B7B7DA22E73D64AF60C275A1E323C1A8E1353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570044, "uuid": "2ada42bd-c6e5-42ad-89d1-7135224ce571", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570044, "uuid": "9665bc7e-8d60-4a30-9514-3b67ebef8612", "value": "6144:3cQaHDpb5iuNvcQOB/EHYKx+Sfm9RGEad:d4biTbXSuMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632570044, "uuid": "f6214fa8-ba0c-4ceb-8c2f-20e169fcdf07", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632570044, "uuid": "300d69f0-64cb-465f-ba0f-88d59e12af2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632570044, "uuid": "1993c1ac-d092-4ccd-8a70-3f910f902e30", "value": "3d8c3dc31b1a5fa8130a76d2f8ef85e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7505563e-1ddc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559323, "uuid": "dbe03b28-2f1a-4b05-8fcf-13fb4f1b2bcb", "comment": "Malware payload (RedLineStealer)", "value": "c7e4802420ad7ba68c721469774a699a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559323, "uuid": "ef8453f8-6b90-4869-9c18-295cb45f2344", "comment": "Malware payload (RedLineStealer)", "value": "e98c050b61c789e9c98cb600f7b8620d77efec27af6cba570df397ea834811db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559323, "uuid": "ea0a04a5-48ae-49cc-abe1-f2b037882122", "comment": "Malware payload (RedLineStealer)", "value": "eec32e5fd47bbbda289c88d66d8f98acd0473ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559323, "uuid": "cb6de49c-8a0e-4819-8f1f-479a43341ce2", "comment": "Malware payload (RedLineStealer)", "value": "301107946b146282b7421f3190a4a6cf3f3d17f2da8d4f24d29708b19e17f50bd83c153056cfc09aa0f2f1d9905add00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559323, "uuid": "344b6091-c3da-4cc2-a0d5-8cd9e085ff4e", "value": "T1EB24DF217EAD9032E2E385B58B74D7921A7FB9633F70474F2644069ADF31790BA26313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559323, "uuid": "0a9ffdad-4824-462b-b72c-f9e8156dbffe", "value": "47bd1659724c857851ce24d0b21faf34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559323, "uuid": "a0ca8f37-6058-4fcf-9803-919f79665a20", "value": "6144:nsZry0Xk5DXWvP5W2lLZCZ6T8xEG4QKNoFK:nsZrdXk5ivP42RZCZ6T8xEGOoFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559323, "uuid": "efcdb71f-c8d6-4abc-abe6-9dff024b3b40", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559323, "uuid": "9dee38f0-8aff-4fb0-b565-8e60ef588b11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559323, "uuid": "4753f0bd-6fa9-4e0e-9733-a27420e71b17", "value": "c7e4802420ad7ba68c721469774a699a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde3aea4-1dd6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632556868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556868, "uuid": "d9858969-1fc3-4d76-8c22-ba1ca3a8d79d", "comment": "Malware payload (RedLineStealer)", "value": "153d58ca96e5e84d2fdd836812c56e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556868, "uuid": "91979431-0d50-44dd-af8c-0662bac67ec4", "comment": "Malware payload (RedLineStealer)", "value": "e9a88bd278708f782b812280963af6ada76bb4f23d1e4fa3b8282f6dc7d5bebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556868, "uuid": "5a9311c4-6fc0-4287-a3bb-c4eb951c67d0", "comment": "Malware payload (RedLineStealer)", "value": "59f3516cde892257e18c85c43edd551712813658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632556868, "uuid": "3b0522ff-740e-4484-b42e-b21d7ebe368e", "comment": "Malware payload (RedLineStealer)", "value": "644e348373c17ec886b38ea5ee485904b6ca2dfddfff4a19d17c9e42decb57d4cf3b5acf93554241ec3985f1d3c10d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556868, "uuid": "391f4fd4-21a9-45e0-92e6-945f3d0fee83", "value": "T19774C02067E0C039F0B712FA49BA97B9B9297EB05B6891CF53C616EA47746E0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556868, "uuid": "1714d305-ea59-422b-a6c3-d217320db62b", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556868, "uuid": "bc98cdb0-27e1-491a-9bc9-7568ef2c8e75", "value": "6144:7VvOxSma1jgnlGb7n5tYdmrP5l04YcOnTEj2LDl0rDTwr1u:7VvOwjgnlonomr5l04Y5XyDTgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632556868, "uuid": "af8ddae7-e42f-4100-9a15-d9db27edd2dc", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632556868, "uuid": "a1d9a248-b82a-4b80-b7f8-2e7d1445a1f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632556868, "uuid": "e643443e-295d-4222-a51f-e9bf11173f65", "value": "153d58ca96e5e84d2fdd836812c56e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b495a29-1ddd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632559656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559656, "uuid": "3055682d-4946-406e-b9a9-431cba5321c9", "comment": "Malware payload (RedLineStealer)", "value": "4286e43b61537e57cc1cb77346a15852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559656, "uuid": "e5298ea5-fe50-459b-b6c2-b20a072b3a87", "comment": "Malware payload (RedLineStealer)", "value": "eb0ed0f454c867f51b23ad4ad763971915d187fc9e45a719c7dd866d4cc51384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559656, "uuid": "a6d5d661-eaad-4b6a-8a9d-82923e030b95", "comment": "Malware payload (RedLineStealer)", "value": "6d81f273eb2d4b1beec86369294adf255ce35a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559656, "uuid": "9f1d66de-587d-4a17-83d5-6e51957a739f", "comment": "Malware payload (RedLineStealer)", "value": "1125d14362c01c9f645d4ad447d187601719578952cb1ae7282319f4cec084ceff95f68026a433bb4590e9ca8e996e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559656, "uuid": "92f3a239-b47e-46a6-b75d-9190c64036ff", "value": "T1FA74C011B7E0C034F6B712FA59BA93B8B82D7DB0972885CB66D51AEA52746D0DC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559656, "uuid": "5f5ec4c5-bc08-4e9b-934b-9321702229c8", "value": "9daab65a6dc440e386b70d6bb40ddc6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559656, "uuid": "1651d1c3-06f8-4c26-902a-125309f6a29d", "value": "6144:+L0yBooFpbdZYdAHyvH8zUOzwCtl+zRVE3mhMEeEY:+L0yBooFpb/HiHOJ+9VE2hFXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559656, "uuid": "32217fcb-7a8e-4986-8a78-c102085adfb1", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559656, "uuid": "6dd5cf59-d0b5-4dd5-b76a-2f6edfce69b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559656, "uuid": "eb8de8ed-3ef3-466f-973c-218e47913e4b", "value": "4286e43b61537e57cc1cb77346a15852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abb9791-1de0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632561077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561077, "uuid": "58d68082-0bea-40cb-a2b7-52eaa3329aa2", "comment": "Malware payload (RedLineStealer)", "value": "af025a91ae32e80af818e5e49fc4bf54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561077, "uuid": "76798c37-d3f5-48f0-bc31-1fc13e4968f7", "comment": "Malware payload (RedLineStealer)", "value": "eb16fe53e16a0d808f617f7a9437e58fa60ffb8c190171277fcd3c4620d95fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561077, "uuid": "24608709-c592-4d5e-af09-bdf77858a180", "comment": "Malware payload (RedLineStealer)", "value": "bc03965cbd70774e8a5b6a70a7d70f24948ada05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632561077, "uuid": "0f122945-ab58-413e-a522-045cd0514e22", "comment": "Malware payload (RedLineStealer)", "value": "9ab0e3a15050864d1181ca11b0ecfd5b00715b647824b64c11b48b6a3adabb71764c251f29dd8acfc4dc512e132578ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561077, "uuid": "da3421fc-d96e-41f5-a3e7-cb0e784ef05e", "value": "T1B524E1A1FEE1C432E7A78AB16575D3A4D87FB5631B30809A76541E9E1E323C09932333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561077, "uuid": "cab9af0b-dfe6-4224-9252-5c6353b0c8a1", "value": "f7987bf55fcab080da60dcb9686a7f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561077, "uuid": "f67658cb-a910-4772-8d65-348b39b724ea", "value": "3072:74662biKFUVjL+JLzK6VFMLIClC6HjcFxwefkwOxn2HtfwjX4RMt755zQGe4:74PVjLoKjLZQ6HIFxjfnOxn2hwjOwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632561077, "uuid": "6347555f-0b1a-4c33-ba82-c5c6a044e4ee", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632561077, "uuid": "4f2677e9-976f-45a6-ba49-049e8e7f1319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632561077, "uuid": "2f8b5f53-eddc-4309-9b99-be0df532de25", "value": "af025a91ae32e80af818e5e49fc4bf54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157689a8-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601253, "uuid": "0a227160-d4ef-45c5-86e7-4bcb473eda93", "comment": "Malware payload", "value": "5fb0ebe420b4793890b6f1751ca09a13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601253, "uuid": "60ee34bc-5384-45bf-afc6-214486f8784e", "comment": "Malware payload", "value": "eb6962fd3359cfb46e5723f437bbfc4e00c397f1228a29bdfa22e6806048c713", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601253, "uuid": "ce5b5eed-c858-4a54-86be-89fcee1b25de", "comment": "Malware payload", "value": "27f8d55573e700cf8c02671fb6566c733ec8a95f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601253, "uuid": "ec06c5b4-5a4b-4bca-9f9b-f456652d454d", "comment": "Malware payload", "value": "9ab8e229c0e87d4be67dce96af7e3c32703a2f26794ee283c0a2dc56bf078ae110f612aac9b5c6415b50942db11a3929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601253, "uuid": "d3370a5b-7409-44a1-a93d-ae164701dd4d", "value": "T11003E1C9F353F99BD92AE4BB13FC93414AB06FEEBA93CC04745078428B095C59862DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601253, "uuid": "a1b08637-8173-4464-8db2-a940a68bdb65", "value": "768:D4MuudSy5ofXiua60i4W90KWnHMtcLxGk5THXJgGlzDpxYsVc8CEYrQe:D4MuudSR3WfL8k5T1VrYt82Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601253, "uuid": "defc976d-b65f-49b9-85f6-128596c18844", "value": 38880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601253, "uuid": "cc9c1cad-edeb-46e8-84d3-c40507bec651", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601253, "uuid": "9836b135-6b1b-4706-b92c-33a5e8acb0f7", "value": "5fb0ebe420b4793890b6f1751ca09a13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4581d307-1e05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632576853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576853, "uuid": "3e3f805b-6873-4bcc-89b1-826a347d721a", "comment": "Malware payload (RedLineStealer)", "value": "28789a7d7b4c811574077eac74ce1f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576853, "uuid": "e2e21cc2-ccb3-4556-92b4-89c6b33aa049", "comment": "Malware payload (RedLineStealer)", "value": "ebe3253fcbdfeb54cb8a45a567dd3c7b1dea06061d0ed540d050ceabe054360d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576853, "uuid": "018391db-f2a8-4f67-a70e-e963f39e8a1b", "comment": "Malware payload (RedLineStealer)", "value": "fd6af363712e0a06ae80870159d7c3a5671c12ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632576853, "uuid": "f4fa8f21-5278-47dc-8367-14010d0b02cc", "comment": "Malware payload (RedLineStealer)", "value": "2d2eab2d668de961fb92dbab7f153bb6ac26205dfe644debec79f1b0c9690fda53020acb3fb3878cb77e2f6dc8e9ecb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576853, "uuid": "a4e771c8-8d39-451b-a554-4c716a663974", "value": "T14444D01176A2D432D7E70970DA2486956A7BBCA13E73817AF64F131EDEA31C189E3307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576853, "uuid": "06b71c58-18d5-41df-8fed-da7c8f0dbc4d", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576853, "uuid": "7d0cf72e-5d6e-4e7b-93de-2cd71b2bd26a", "value": "3072:bFbopYDiu8AWUbCGwFhvD+lPXUENDiPjfsYtggTHC0dzlFBhqUXDRew85FuurASe:brOAKh/EDwsYugjzhFbXguurAEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632576853, "uuid": "6915aca1-ea95-4c35-b839-64827625e3db", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632576853, "uuid": "703d6b88-a06c-4b62-b0b8-1d86b0f1607a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632576853, "uuid": "d85735a1-3b95-4928-a39f-666ace231566", "value": "28789a7d7b4c811574077eac74ce1f59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144d6090-1e03-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632575911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575911, "uuid": "4057c734-3676-4ee5-bc00-98b0d5acbb26", "comment": "Malware payload (RedLineStealer)", "value": "52482664211542940c3e6dc8b9b8a847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575911, "uuid": "a6cada8d-29b2-48b6-8b0f-6eccde26a99d", "comment": "Malware payload (RedLineStealer)", "value": "ebfa18875163da933b48b59672f9beeb94042994788b410ad82ed1870204a92d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575911, "uuid": "38fa4bd2-d4f4-4786-bdcd-a051768d9dbf", "comment": "Malware payload (RedLineStealer)", "value": "a93fe1e80069dedbbdb15a92d0bffdbadb157816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632575911, "uuid": "429699ce-7d1d-442e-a4d0-c21916fa7ba1", "comment": "Malware payload (RedLineStealer)", "value": "f580a0d82251ded8fc21c2113cbce8a98672bbe9429fce7212f25f72981058662d0dc1000a34708b08999febcc288ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575911, "uuid": "a8964e8d-fc6f-4d5e-856c-9628e1ab4b74", "value": "T1C744E12076A2E033D7E3097559358390263BBD226D73865BFA4C17DD2EE26C14AE63D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575911, "uuid": "be48822f-8a3f-4107-b9e8-1c45717e2009", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575911, "uuid": "e0d69f04-9e75-475e-bb3b-f288c711a1ab", "value": "3072:3FRWQwO1+P1t7CnO9EZ2BQFrzBCwFt83iSPCb/uJBWx/DBI9LBEFrN/5arIPbKSe:3X181tKO9Ez6y8iiJ1Kr2rVEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632575911, "uuid": "ebb6f73f-18b8-403d-8401-6e724c97e982", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632575911, "uuid": "6e190768-4189-4ad2-bc29-47b4487c274d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632575911, "uuid": "14a00634-440a-4d4c-85c2-32341072bc91", "value": "52482664211542940c3e6dc8b9b8a847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c007d2bc-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632573622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573622, "uuid": "7ee2c0ef-7231-4f21-90bf-455f6a8c23a2", "comment": "Malware payload (Mirai)", "value": "72efa1f6dda2c32c7b52190a2531b730", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573622, "uuid": "1a9c63b1-1dc3-40fd-9b37-837779e1caad", "comment": "Malware payload (Mirai)", "value": "ecddc77cd10fd5a45248de234717444166386ec087413fdf37669c011a85eb6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573622, "uuid": "d8c59d0b-d40a-4292-96ee-0236358ce040", "comment": "Malware payload (Mirai)", "value": "0f67b9da3d479aa31ab8266d14e8702dd87de487", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573622, "uuid": "19f92b40-3093-46d8-96e0-b5bc7abe7a6e", "comment": "Malware payload (Mirai)", "value": "7b1ed76222a262dbc577246fc96bd7b3375f500ace67664226ed744b90588d1a88f22723712383e8402f15681d43fb3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573622, "uuid": "d132d8ad-7b74-4d7f-870b-6e5ca675d16e", "value": "T1B0432945BC92DA02CAD823B7F62E11CE372263A8E1DF3207DD126F51778A92F0D67546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573622, "uuid": "5a8cdbb1-e075-4bd9-b06d-9e9046795e2e", "value": "768:TcoL7VI6A2OouYiIkS0HHNpEyyIksSucssoCBNFgsBNOX9mFfWMLHHHeEm:FLJI6vOo5iIkS0HtrjSdsKrq9/In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573622, "uuid": "a33e1e92-0e7b-4781-ad22-4196fe4ff02f", "value": 56912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573622, "uuid": "7832836d-3747-408e-9264-8d4cdee5f820", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573622, "uuid": "faa64368-61cd-4bb0-826b-c1d21d52cfd1", "value": "arm-20210925-1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efc76b9-1e57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632611980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611980, "uuid": "3b3dbe9f-0e9c-4a7f-b6a1-1efc13a410e4", "comment": "Malware payload (RedLineStealer)", "value": "508c293d08879afc11ad4864586375ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611980, "uuid": "8baf550c-dc40-4202-9cce-6a6b447bc2aa", "comment": "Malware payload (RedLineStealer)", "value": "ed28348183904d91b1f9a1757b8cd6e2964b5bcc680f1c5ab5e92662a92c3953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611980, "uuid": "77bb365e-3483-4854-b7f0-09070e08c023", "comment": "Malware payload (RedLineStealer)", "value": "c3fb6772502f35e0cd36e7497b65662423af9c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632611980, "uuid": "b158a9db-bc21-4594-a952-75d87500a50b", "comment": "Malware payload (RedLineStealer)", "value": "bba1a9e09def5569ee8f78274f711e427cd3ef3f894104dc14d5a05b5629fb30a0b670a3774fd2816a38eba654effbd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611980, "uuid": "b4236623-c69f-405b-be92-e9b1cd215465", "value": "T16244E020BAA3C432EBA359B10965C7E0163FBD622E73854BF64C175E5C326D297F2316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611980, "uuid": "4abd4498-d8dd-4021-91a1-5977d40f68ba", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611980, "uuid": "90315011-b4a9-430b-bffb-dd7a6e6060ad", "value": "6144:csNpiXWA/6KqXYKXm08BAt0gRYSEMrz8SpOuEad:/IbCKqXYdBaI7Mf2Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632611980, "uuid": "83c269eb-42d7-4dfa-9603-606ae9a77319", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632611980, "uuid": "20b3e6e2-fdc9-45d2-a483-4658f4d36477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632611980, "uuid": "067ac54d-f2fb-452f-a75d-aee7dd30f266", "value": "508c293d08879afc11ad4864586375ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5afc323-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632563404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "2a64f092-fc84-47af-8eef-c16837905c30", "comment": "Malware payload (Gafgyt)", "value": "e7216a5ee147d2192f47d274dddabf35", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "86b6c074-e9f2-4a95-8872-33f04c913315", "comment": "Malware payload (Gafgyt)", "value": "ed30641f661a4051e42e3e47d340417a5637c48342ced2e255c483897c5a99e8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "7e229fbe-eb50-477a-bff0-77bd917d392e", "comment": "Malware payload (Gafgyt)", "value": "fa8afe0e47a53d3b644a7988464fa514539f4228", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563404, "uuid": "deb3470c-1e55-4b82-836f-6fc63f3ac4df", "comment": "Malware payload (Gafgyt)", "value": "eb41b22dcfd66cd01c24c945d86d7424519496e4f8b0f1d792d63da44f77efc77006d5dc61f268124306fc308653e20e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "34978c8e-7689-449b-9d06-24f1017cb94c", "value": "T1DEB32905E5508757C2D2177AB79F825D33322B7893DB33215A24BFB82BC2B9D1E3A521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "fbf46479-feaf-4c51-a95b-736b63bbe923", "value": "3072:3dXldsaoe88Xtl2SAJ5sx8DqjK547rXbmTQOWsXPOn:NXldsaoe88XGsx8DqjDbmTQOWCPOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563404, "uuid": "eb272690-bf75-41e2-8203-f9b46760d5ca", "value": 116504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563404, "uuid": "dc51bd93-7c24-4553-a75a-f0211776e6af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563404, "uuid": "f28a51d7-c5fc-4819-911c-153b4b2ed594", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb1f6bb-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562854, "uuid": "30b3707b-bc98-40e5-a587-6a5e3c0dc2e8", "comment": "Malware payload (RedLineStealer)", "value": "1d33cc27065915e794b8883b43a8df4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562854, "uuid": "6593a7b1-dbfb-42b1-931c-40a62a33fcc0", "comment": "Malware payload (RedLineStealer)", "value": "ee1465683fd8c09fe3908879b9250b1d5898aa0a25986278aef04fab6fd898be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562854, "uuid": "083eefd2-a3fb-4102-bebc-6e7f3eb8eecd", "comment": "Malware payload (RedLineStealer)", "value": "7101f6e0b40eff32f6d4b488791af9d86f22b90d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562854, "uuid": "988621e6-89d4-4dd1-8308-c16d9a26c1cf", "comment": "Malware payload (RedLineStealer)", "value": "b50987e89b217cbd95046410f44e46f3a277a2152f1c73dacbadcb0ee0b97c332121702cb30f0e8181a5a80778c21c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562854, "uuid": "40be3d5f-b0d6-40c1-9603-bc354db53068", "value": "T1F584BF20BBE0C035F2F712F949B693B9A53E7AB16B3491CB52D526EA12346E4DC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562854, "uuid": "cd10471f-fbb2-4322-8c29-f749ce01ae7a", "value": "0f0c12643909b692a9be3510bdc965e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562854, "uuid": "09f7e0a7-d6ef-4fef-be0b-238b869a2dad", "value": "6144:CRl5PPJ/lpShFHqaDbq9LUWY9ZYJvDa6aHW9mihg1ndE3tbQKObgzH4TmB:65PPJ/lpwFc9Lc3Y9a0h0iUKO+46B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562854, "uuid": "35f63904-5069-4d6a-8cae-c91f90a5b0b5", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562854, "uuid": "5f42ca37-f725-4727-99d9-1eddde7b5e95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562854, "uuid": "60589157-00a3-44bc-9203-736098f6cac7", "value": "1d33cc27065915e794b8883b43a8df4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e23072-1e4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632608631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608631, "uuid": "7f173f45-b3d2-4bbc-87a2-1f96108485ac", "comment": "Malware payload (RedLineStealer)", "value": "b0fc8f3b950a475b438837bf5e98f996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608631, "uuid": "fb9a1eb4-d9ea-4876-85ce-2309e5d38500", "comment": "Malware payload (RedLineStealer)", "value": "ef802bdc93dc58499db371f595959d532aeaddc4777df6ead932f2cecec97a61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608631, "uuid": "3d214119-a481-4ff7-bf8f-f9f21c6e9144", "comment": "Malware payload (RedLineStealer)", "value": "0ce3e1baef325bb99756702590248c3643dd797e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632608631, "uuid": "86234b8e-f896-466c-9e5a-3e1dbe6d187f", "comment": "Malware payload (RedLineStealer)", "value": "606961c585e2139d97841d74e8dc785f12af5a2ac8519c21cab9596f6970c63d29cfb7cabf247f7343648425acf4e8ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608631, "uuid": "53f8944c-bca6-4284-8217-23eb795fc895", "value": "T1C044D03172A2C432E7E7C9344A75C761663BB8722E23950BF71D170B6E7169287E2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608631, "uuid": "43898cc8-dc97-4c05-8f37-644de1218da1", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608631, "uuid": "834d38a1-b93c-49b8-a0fc-2a304baf4709", "value": "3072:uF6168c6BxJqEBRj4F1W+Yctj2dYhhN5RZqHvZNXe5VKh8ACS9H6dYs:uU1URPjW+YMj2dYhhPRZqHLoKhFCEad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632608631, "uuid": "b0ac9a12-cf9a-4c36-9139-03db290ed202", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632608631, "uuid": "72a8c71b-2698-4577-aabb-a54911b89f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632608631, "uuid": "a8676bdd-8565-45dd-9480-0c69a5324556", "value": "b0fc8f3b950a475b438837bf5e98f996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac773a5-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563359, "uuid": "6fda62dc-fda5-4e20-a143-fbaf9a4c72c4", "comment": "Malware payload (RedLineStealer)", "value": "16366a76d3794eb82399340fe756cbe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563359, "uuid": "a4983749-4ac4-4dfe-86e8-9d810e9e95c7", "comment": "Malware payload (RedLineStealer)", "value": "f18ddf6b5463037a5ea928e0aba4b0783621211b0afa17f4a0a8ed6c1e8014e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563359, "uuid": "da60dd48-46a0-487d-b8a0-3ec487b80452", "comment": "Malware payload (RedLineStealer)", "value": "3fc9deec2f504c216504d2092de8bdd8724723af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563359, "uuid": "5e5bec62-2420-4335-974e-c89332bb10de", "comment": "Malware payload (RedLineStealer)", "value": "a80357dbe205b98b7bbd393cdbf432e7c55103e6e4b2c3ade259c01d8c47f19849e3698d15eaf70f0488b6b5a4d9d3f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563359, "uuid": "39e9db3e-1f4a-4f1e-8176-3cf41dcfbbfc", "value": "T18964F1003A60CB31C69311719B25D7E15EBA78A25DB1938727E776AEEF303D0376631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563359, "uuid": "2f40e967-1cfa-4013-b4d6-6201da2e5fdb", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563359, "uuid": "f094df89-ba87-40f4-b095-c00a02f3bd44", "value": "6144:qygAnf5q6xr9rXG0mVbMTATlZgkljBwjtw:vgoRdr9ze2Af7jBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563359, "uuid": "8d4d9217-0ddb-44b7-a88c-59af63085ad6", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563359, "uuid": "4e4e5651-88e3-429e-8e8c-28e311a44670", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563359, "uuid": "7a1c446d-9506-4554-98e7-bae2c0844c44", "value": "f18ddf6b5463037a5ea928e0aba4b0783621211b0afa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d44d018-1de9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632564867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564867, "uuid": "eb937128-9e5e-4510-adec-9fe897753fc9", "comment": "Malware payload (RedLineStealer)", "value": "151c3f87773fc882f4713a314bce04d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564867, "uuid": "73cbbd94-15d7-41dc-a675-8eeb78e2cbd4", "comment": "Malware payload (RedLineStealer)", "value": "f1a9eccc2cb1b0572b669b47cb1b29667221529555e554f34d2d13e6e334ceb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564867, "uuid": "73628e02-efec-4678-8fb7-21bc5c9d5829", "comment": "Malware payload (RedLineStealer)", "value": "be2aa3fce6752277a92354f19cb134b0ca2400c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632564867, "uuid": "2b4e539a-beb4-4742-9c5e-fbcb3f731bdc", "comment": "Malware payload (RedLineStealer)", "value": "2ea60ff7251140d99ea5183f20da5b2f2b63604b339e39b5c2ead4553750927ace27a6e147f9b9f9ec35ad08a4296e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564867, "uuid": "5b578b0d-e97c-4235-a77d-b400f49061c7", "value": "T18264E1217560CC72C7A31D307867C368AABAF9E6693CC68777686B7E6F203C15635306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564867, "uuid": "efbd237d-016e-4984-a3de-94b7e83e3b63", "value": "87c83270f93d842aca2a44bace33c055", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564867, "uuid": "e2d2b6f5-05e6-4827-8742-c2f0b7720875", "value": "3072:sAfrfTuXQ9y5+mrYU5bqt3RCihVSOIXSi0DoDd3t4RbGdD3N5AWw15F2VLSQEOJV:szAirY8D4V8/6oltw430N2z5JHa2su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632564867, "uuid": "7e2c1fe5-2d86-4fd2-9abd-1a32eaa22d67", "value": 315560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632564867, "uuid": "9dc5ed00-c80c-497f-a245-259b95356c73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632564867, "uuid": "4be6f4bd-f5ef-412d-bc38-638b33270fb3", "value": "151c3f87773fc882f4713a314bce04d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fec282e-1dd8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557462, "uuid": "9ac1235a-4126-4adc-80fa-8c09f7bb224f", "comment": "Malware payload (RedLineStealer)", "value": "fa4033de2f76c09b47d1bcb6115bea01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557462, "uuid": "09708f35-0e83-4d72-9f42-9b8a361716ce", "comment": "Malware payload (RedLineStealer)", "value": "f28cc6aa3c712a3e9d8876e15d385c8854d1a1a65897f84edd794ed1f47af2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557462, "uuid": "4bfe44a4-ec0e-4dd3-9a91-88c798bff8b7", "comment": "Malware payload (RedLineStealer)", "value": "3654d087b8d4d4e3d159234f5633c96592539943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557462, "uuid": "8b9061b2-fbec-43f1-8ace-7e5392c01dee", "comment": "Malware payload (RedLineStealer)", "value": "2eda0136fbbdbc05fabd097ea924a5ab8b984f8589cc4b784319be1303c4abd31fb6631143bd24d31ade22d63078a4a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557462, "uuid": "b6390466-f2e5-4b65-93d2-9c650cbc494b", "value": "T15E74D02077E0C039F5B713F659B987B9A92D3EB06B7880CB52D616EA52786E4DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557462, "uuid": "47a86d91-db20-4e53-970b-5753271a2a79", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557462, "uuid": "8df2e8ee-08dc-4a98-8612-f9d1446a2995", "value": "6144:S2bMzpbjXulCbyDvvtMf4w+FlbU2zHFnBgK4feO+z4hQzp8U//F:S2bMtjXultDmfubUIdB+fe1znp8U//F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557462, "uuid": "74204bf1-c1b8-4068-a9fd-86290ecada30", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557462, "uuid": "ce46127f-719d-482a-84c4-12ff17872794", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557462, "uuid": "55791d15-e14f-473d-8efb-3b82defa2a8f", "value": "fa4033de2f76c09b47d1bcb6115bea01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7c4cb3-1e23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632589833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589833, "uuid": "9a7c7264-1bfb-4f77-9eb1-92d570f583bf", "comment": "Malware payload (RaccoonStealer)", "value": "5a9c5eb4f65710d4747c49497b06da64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589833, "uuid": "e917692a-6b36-4c76-a698-4ea3cdb5928c", "comment": "Malware payload (RaccoonStealer)", "value": "f32f90d244411e731ac4ae9ba99620a74ad4770554832334f4cb2662dde77ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589833, "uuid": "a15c8b08-b5eb-4b68-92a5-1df541b5a861", "comment": "Malware payload (RaccoonStealer)", "value": "b631b4e415b060037ff1e7051bb6556c44554ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632589833, "uuid": "51b328dc-dd4c-4efb-9746-5f9e89f61830", "comment": "Malware payload (RaccoonStealer)", "value": "25c48d85daca5791efedd68f0619b42ff3254b1af69049703da0dec506813859a1ff91627637bd3d2b5a15a8118d4910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589833, "uuid": "0e1a7b41-bd11-4070-b187-117be98bc8d0", "value": "T13A940190B2D28031E3E79631893AD370663B7D723E77924AFA9C275E1E302C447E5396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589833, "uuid": "2fda58c4-6b84-4878-a226-2bd0f469bfd8", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589833, "uuid": "1bced8fc-a380-4ba6-90df-5b64fd9faedd", "value": "12288:bfikJ17nCpfFuucROvg6jGb+sayFjYZeHd:X17GNuL0uP5FjYsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632589833, "uuid": "d1ff06ca-da55-4143-b814-5c2c932671cd", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632589833, "uuid": "582c6194-62e1-4890-87fe-6828b00e24e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632589833, "uuid": "91c408fd-b32c-45ea-8222-5664b0299a0d", "value": "5a9c5eb4f65710d4747c49497b06da64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad12a2d-1e40-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632602175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602175, "uuid": "f4ec832e-ddc4-4f08-b9d9-9c644df6cc3c", "comment": "Malware payload", "value": "2359d931fa2c3aaa66cb825d578d206a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602175, "uuid": "7aab3a04-0188-46b4-b604-205533e69c90", "comment": "Malware payload", "value": "f378956351d240cd1c7b4d8b98b0583d2f497435d423e433efa58ab8dfb6ecae", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602175, "uuid": "e6486fa9-7ff1-453a-81fc-f669deac05e1", "comment": "Malware payload", "value": "c6fdb38e2dbfb680541a7185ebd61965c1b84340", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632602175, "uuid": "801d59f9-12a0-438c-806a-c265c616eb61", "comment": "Malware payload", "value": "f82fba50f55e5dcf95d361fc2e672d439b1029787ab998dedbd5e642a57b91d7b39aaa32a24516cefbd418fc84348e5f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602175, "uuid": "621868bc-1086-4879-b3e6-373090df77cd", "value": "T199032A15254181EDCA4AC276996FD573F538BDAD2234692F3BE47FB51E23E20331E288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602175, "uuid": "e50721d6-9629-4253-8464-48e34c6b9ed7", "value": "768:Ortqi8vIq1IgRksZUNvNfaf+JLQuHkax17YdNHVJC8R:Ort5Vq1IgGsZURNfsbuHlxYdNHi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632602175, "uuid": "dc0cda20-5c63-40fc-8722-7829d531c409", "value": 39904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632602175, "uuid": "dd072661-ac33-4302-a8cc-07e0f8f5f4ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632602175, "uuid": "a7cf29e8-3fbe-42b6-b47a-71846e0505c5", "value": "2359d931fa2c3aaa66cb825d578d206a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53baefe9-1df3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632569146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569146, "uuid": "2514a9d9-0f9a-4dff-8362-7b2ec5da54b1", "comment": "Malware payload (RaccoonStealer)", "value": "4365eade996ce5dc3b6e016ed06c26b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569146, "uuid": "2c9d5cec-9fa3-42fc-8ae9-b19bebd17ec2", "comment": "Malware payload (RaccoonStealer)", "value": "f386f1d1b1efa56c34270692f1beb0a1a0c4156c2d37c267ea235adef1c6aa48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569146, "uuid": "1c9c71e6-8304-46e6-a641-0ff37a3a57f8", "comment": "Malware payload (RaccoonStealer)", "value": "e71d72d888c9ca02851809691a8adee7701a4162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632569146, "uuid": "9b1a6361-e698-46e0-9f8b-169985b08f04", "comment": "Malware payload (RaccoonStealer)", "value": "261c28203113b9d5f975ada523eb8680317cc4fc27e8465e7a470a672235a4390e6ac029da952aba392a43030b95d09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569146, "uuid": "52a793bd-2dd9-403a-945d-d23dba0e12aa", "value": "T131941221BDA0C433D2A3667449B0D7815DBBBD627A75927A3E0306DECEE06C18D467E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569146, "uuid": "b96425cc-66b3-42af-8669-50fc77a15d2e", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569146, "uuid": "3ed9d920-811d-44e1-be51-44e947849a7f", "value": "12288:6o91M5GbTojwV6kkLVdXR7hzGXO61QTNd:6WM5klVy7XRJwQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632569146, "uuid": "a4a7906c-f15b-4105-bba0-939e5e83fe5d", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632569146, "uuid": "a19fcc2e-dc35-4ac4-b0cd-ff555c99ed30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632569146, "uuid": "62f133f1-a6fa-4d7f-a10c-4ca55d348f90", "value": "4365eade996ce5dc3b6e016ed06c26b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e29a59-1e39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632599081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599081, "uuid": "64b24333-f0cc-4d25-b0b7-f7080282a8d2", "comment": "Malware payload (RedLineStealer)", "value": "056b39b4eec57b4a075ddfcdc79fd170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599081, "uuid": "f5c3717f-ba7d-4d35-9499-c92e9ec3205d", "comment": "Malware payload (RedLineStealer)", "value": "f3fe7fbc96c0cddde89839a421a20ebf157b08f3e1deed28e404d97a7b23cea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599081, "uuid": "105ae2a9-fac8-430e-8430-a25600ab1cd4", "comment": "Malware payload (RedLineStealer)", "value": "62fd105b47631ff11cc5665bf407a49949f0a0e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599081, "uuid": "6a319179-c518-4b83-9ef4-d2fa1a316ee9", "comment": "Malware payload (RedLineStealer)", "value": "1939a130de1ed3c86888a99d31cba70df9a41443b4bad6feddb8199f34fd084bfbd655b42cada0602f536abc25606139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599081, "uuid": "50f0eb5f-641a-44b5-93a4-3ea76d1390af", "value": "T11544DF00F2B1C436D7E6467559F6CFA01A3FB8221D77954BFA1C178A1F622818AE271F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599081, "uuid": "b5dafcec-1dbb-46a5-998b-53d0cdbac2df", "value": "062d438af0a5427d47d2119e831026d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599081, "uuid": "1fb08504-8e15-4696-90d5-6ec0c5c678e1", "value": "6144:yBIBRDU9rXqughu/UEHE9AIpVWVdyDPINYEEad:PSF+u8EHE9V4ToPInd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632599081, "uuid": "d50c77d5-00d4-41d6-9b07-89e12969a188", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632599081, "uuid": "5a1e9c99-ce26-4010-a30a-798f8bce5b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599081, "uuid": "7958e129-93da-4590-b09a-8bc5fd75ec62", "value": "056b39b4eec57b4a075ddfcdc79fd170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5820fe75-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632552403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552403, "uuid": "91302a96-2009-4dbb-84b4-308e46f76541", "comment": "Malware payload (Quakbot)", "value": "f3cad4f5a5e424fb23a4bfc2c771af5c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552403, "uuid": "cfb25c50-a406-4f7a-9abc-ddec534cc497", "comment": "Malware payload (Quakbot)", "value": "f4a28b038eda2056b50f8e16e4bebd7de5f15655a0b1d88bf104a38ae4530e28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552403, "uuid": "fd9d4d5e-9585-41ad-a1d6-bc6ea4e20fa1", "comment": "Malware payload (Quakbot)", "value": "b41f2f7372d64b8a0f3c902070a190b57f8ab407", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552403, "uuid": "9bbe17cc-5707-4839-87f0-168495faa2e7", "comment": "Malware payload (Quakbot)", "value": "57f96ab9a4a7e692d675cf743d075343f51495f72ab409e05ee066d8def0f52ca5582bace3d789b1cc1a9a46ffda42a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama102", "colour": "#6CE6BD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552403, "uuid": "1866395c-777e-488b-864b-3a01e9e4c87c", "value": "T12B05D02A7ED6E191C83C5D7988E1C8E67238BC686D28961739E53F3F29F30D1584909F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552403, "uuid": "23ed4a27-e14e-4366-b838-aa8d7b25b05b", "value": "fcecb109cd51f9ec6659a40269cd21c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552403, "uuid": "c72346cd-6290-4c44-a387-8e4937a97b2b", "value": "12288:V0yAZOB93YJh6kwi4eYHc+12GPUhW1brsZCesX/OkSAIV5TQi/c+FI2PXykp5:V0y4QFViB7IOcesPIVVZQi/csIXk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552403, "uuid": "0949bea1-7699-4809-8c5f-75ba29c510eb", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552403, "uuid": "90f5c3b9-d55d-42e9-a935-0426eecc33ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552403, "uuid": "3d5553b3-cc74-4f40-827f-38a370c56195", "value": "f3cad4f5a5e424fb23a4bfc2c771af5c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4656bf-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632552326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552326, "uuid": "b405dc7b-2ba6-434a-bf3e-93984785484d", "comment": "Malware payload (TrickBot)", "value": "01711d67f997b7d97e256a2b257801ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552326, "uuid": "4771da9e-a43d-4b10-a42f-2044a2403849", "comment": "Malware payload (TrickBot)", "value": "f50b51b633835edd334b8627e2cac0571b856212ec2580a7aeb149bd27066255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552326, "uuid": "751fc7be-df3c-4220-a3bb-7477fe1b6167", "comment": "Malware payload (TrickBot)", "value": "769693477473f26fc8917c9c091147b9220746a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552326, "uuid": "adcfc457-196c-4fb1-a765-daa4069350c0", "comment": "Malware payload (TrickBot)", "value": "d8d7baa609734d13b7afa1373be2f9dea8641f263d75f141935fc290fd971adbf4da93abc9dd8d9b0860618bef5fbf4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552326, "uuid": "44bb528f-5810-4b6b-862b-5a3fcd46d0fe", "value": "T1FCB4D03535E08973D16319308EFD07E963B9BCA147B2958F8F902F0D3C7E556A43A2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552326, "uuid": "4308dd55-6ca7-49d1-8fad-07542674b5b4", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552326, "uuid": "dc6d75ae-ffbe-4d30-bd69-cef497d94e00", "value": "12288:cbVMh0tRyr3W3SsniM+uwkMx8nXoTT0WJZmo:WMh0tRya3lY8X2xJZmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552326, "uuid": "639ea876-eb85-49b6-9ec7-6ec8b4ff7bf3", "value": 528443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552326, "uuid": "0e390919-158c-4c0a-b831-e1b72c25fa1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552326, "uuid": "965c80a9-c0ec-486a-bcf0-d14d4cd553cc", "value": "01711d67f997b7d97e256a2b257801ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb884da-1dcc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1632552415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552415, "uuid": "c5ffee6f-1abe-45b2-94cf-f823f0bac18f", "comment": "Malware payload (TrickBot)", "value": "0ddc8fa338c60794513052a5ad015631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552415, "uuid": "d7f8fc21-d11a-49d6-b976-b1aea110d23e", "comment": "Malware payload (TrickBot)", "value": "f61db22354e7f73c3bdcd0465608a2c27e182426bc1b1cafd3e2e134965fe7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552415, "uuid": "eeed33f2-6ecb-4da9-92d6-e5b990bef71a", "comment": "Malware payload (TrickBot)", "value": "ca2bf760360a34d33f697a9cae16ed77f12da05c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552415, "uuid": "9889f435-ee4e-46fd-b668-01bda1727ec4", "comment": "Malware payload (TrickBot)", "value": "73095d232c750f72b340fecb366184a512dc3eee8f611ef0e08e0246bc1c167cad4f5eec83288631f0ace66d8a4a1f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552415, "uuid": "dbd0a1aa-6030-4cfc-9a8f-359d28db947d", "value": "T1D0C4BF3574E08DB3D1A315319AFC1BE963E4ACD187E6628F4F803F1D393D299B52A216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552415, "uuid": "37c98620-a481-41f9-a535-59e6b99d10bc", "value": "675872e23dfc0f62ffbc2f69c316f4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552415, "uuid": "9fa3a950-7b60-4ea2-a57e-65b8011f0d00", "value": "12288:671bBfnoWMPARHQGwdGnmrAz9zC0mtwYHDkrchSJkZu06R:obBfnoWyFrAzEwrMuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552415, "uuid": "b5b1d4a5-e54b-4a9f-9368-e576786d66bc", "value": 593979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552415, "uuid": "3e941d48-2faf-4bf9-9e65-83bbf9a542da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552415, "uuid": "d4d8bce7-0c38-49bc-a83f-fa72d30425f9", "value": "0ddc8fa338c60794513052a5ad015631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c798693-1e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632601265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601265, "uuid": "4b25ad03-36b4-4193-904d-9a34f4d0959a", "comment": "Malware payload", "value": "4c330905050ec800c8c2502ef1a314e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601265, "uuid": "0cde3256-cdc2-4fe2-a093-6da0724e364e", "comment": "Malware payload", "value": "f62bda012fad640e02def537a60285cd4703d8c47657e9491b7dbb923acf67b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601265, "uuid": "07cd98d7-6645-4703-af1f-582eabd2ad1a", "comment": "Malware payload", "value": "1c386f8cc940d7cc6e89453e54dca366bf2c97a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632601265, "uuid": "86ae0eac-10a6-4b59-afcc-801f55c59d57", "comment": "Malware payload", "value": "65c61689aff2f88e7785b7cced349969fcf1343a6e37b7eaa5414c2cbd8fedeaf0648d17e2d99f11f3935c85bae9dca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601265, "uuid": "2a0bd40d-11d8-445b-bc2a-ba75a349806d", "value": "T1C6933E8ABF903FBFD81ECC3241A4DA0A119C990963A57FBB5F78E404B64711A59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601265, "uuid": "41d1a1a8-456b-48a2-a9d6-65560fff4b82", "value": "768:3xqVAApJI7TdkwDytvYZNHyHyRLAZh7lkn+gacI3v1bDrsSn/EQcElvb:/AmDylYDSSRLAZh7+jI3NbDrz/7cElj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632601265, "uuid": "d86adbe6-c794-4e85-a160-72ba4bd59cce", "value": 91592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632601265, "uuid": "093c1108-6732-41c1-b142-be98af609901", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632601265, "uuid": "4fdff692-ffc1-464d-8f9c-8e97e374c485", "value": "4c330905050ec800c8c2502ef1a314e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9041e8fc-1dfd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632573542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573542, "uuid": "a9ddf145-e764-48c9-a7ec-9c47391ddc72", "comment": "Malware payload (SnakeKeylogger)", "value": "14b1ff6b6a7cf9e48f67b90839032f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573542, "uuid": "e0928ca8-bd49-43cc-937a-047aecfb9c40", "comment": "Malware payload (SnakeKeylogger)", "value": "f6382a7def8e93189e1ab1bbc9698bf9527995954b76d1f58a7e59d946ac7021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573542, "uuid": "75875fc6-b1cf-428d-8aed-c20004bc0151", "comment": "Malware payload (SnakeKeylogger)", "value": "550ad80b6a9463ee1ee53d6d60c77fb75f9e0992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632573542, "uuid": "68025ce8-4b39-43ac-80b1-58b646c98a7f", "comment": "Malware payload (SnakeKeylogger)", "value": "740e7defa63bbe7adc1d719c2633f3b22fd1ff21668077691c441e3ec25c36f7d97e7b2146d32f5d975e1dc90b40c93d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573542, "uuid": "95bc7c36-9ed0-4437-a9d7-cba0c1f767ef", "value": "T1DEC42356F2D218BAE1467A72187BB13B93BAD35D90F9090317BC7BF634B09C2C506D85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573542, "uuid": "bb92e46e-ff39-4cdd-b426-f412ec4606df", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573542, "uuid": "46c77596-908d-4535-a7c0-c1c2df1637d0", "value": "12288:nCJXVyAa4YLt1YmQ8ZwFEEnZwfK5A6cFTcgpJ3nuULEeB/:nCVVyAzYxCmCwRFFcgfuxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632573542, "uuid": "34f39bdd-977d-42fa-8f29-1cafa6c85e02", "value": 587944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632573542, "uuid": "49e4103d-3a03-4ee0-bde5-145d655b5d88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632573542, "uuid": "58d3a52c-963c-44fd-a0ed-f9c00c059549", "value": "09876567824567890987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf8ccd6-1de4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632562611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562611, "uuid": "da5fea81-395d-4bf6-97df-7b04325c912e", "comment": "Malware payload (RedLineStealer)", "value": "032782c1fb2435deb2cfa5a4d9eff0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562611, "uuid": "23f3b3ff-68a3-43c7-a95f-997505ad41a5", "comment": "Malware payload (RedLineStealer)", "value": "f6b45d99bd1d10e3debab0fd1fb953125903a1e0644cc9876de1cf9671620f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562611, "uuid": "a035eee2-0896-4e2b-b857-553311c1e606", "comment": "Malware payload (RedLineStealer)", "value": "8bab3b663cf667013f3da80a1fede9efc95ec7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632562611, "uuid": "9369a8e0-10cf-47a9-b630-0e8963968e04", "comment": "Malware payload (RedLineStealer)", "value": "438e0fcc2d0ca712723040e69fbb9d88eaddc913d0077da300035bffcf2344aacd15e97a392e508ff664a5430a15da46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562611, "uuid": "bfdfeaf2-67cb-4583-8fde-012b18402f15", "value": "T16A84AF20BAE0C034F5F752F95AB993A8A53E7AB15B3481CB62C116EE67346E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562611, "uuid": "c1d70938-69cf-4dfd-8124-87ae4fed61bc", "value": "a2bc3921f9c8d145b9a6f1e3eaf1f8a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562611, "uuid": "be97f6a9-e792-4b9a-8684-913237cae054", "value": "6144:87slwr8SqlyYy3ys4jpVOTm98+Z4vmDq16koJiZbuwzISbpP/SxwpQ:nlwr8Sql6yfjpATn+mXtAclpP/Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632562611, "uuid": "3ba1cf14-211a-4ea8-a0a0-5e475f77ce7f", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632562611, "uuid": "98084168-3c03-4b39-8850-caff871bc101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632562611, "uuid": "4ba2e499-0360-4411-86ee-a1a6ec34d061", "value": "032782c1fb2435deb2cfa5a4d9eff0cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acb8e87-1dd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632555333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632555333, "uuid": "33f670bd-160f-4055-a517-4039d12109b9", "comment": "Malware payload (CoinMiner)", "value": "7041130b7052851e0753ec72d7e95f52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632555333, "uuid": "013b65b5-4072-45a1-96f4-70268800c0d6", "comment": "Malware payload (CoinMiner)", "value": "f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632555333, "uuid": "dee1606d-182a-4f5e-b122-7734a21c1c8b", "comment": "Malware payload (CoinMiner)", "value": "be6beef6c4608d8675b983183f5556ced9be0692", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632555333, "uuid": "6db294f0-3d8d-418d-b201-511b83246417", "comment": "Malware payload (CoinMiner)", "value": "f62734b7b635b562bb133dc7d40aeb329703ca8527d136d41577e5578f143c966d8460825718d0503e97d7c0dc204353", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632555333, "uuid": "081d25e3-e0e1-4635-8596-7293f2203f98", "value": "T136C39D2035F18432EEF756750B39D3E55E3BBC336A70418B76A4265ACE216E0BE26353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632555333, "uuid": "b460665a-5c9f-45fe-a203-fc499e73a0f8", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632555333, "uuid": "0dccf0e8-e3fc-44e2-b4b7-88835a3a462c", "value": "3072:pEabqYnqDEySanNPjCZQ+1D55M4KCrx+KKY5:iambg4cqCNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632555333, "uuid": "794a26c5-534f-4746-9f43-bf8619217dfb", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632555333, "uuid": "d0f8d20f-4525-49e7-9242-d75da151a7b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632555333, "uuid": "ee8b4f32-cef2-4829-99be-6e6472089c86", "value": "7041130b7052851e0753ec72d7e95f52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7c4373-1e39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632599441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599441, "uuid": "5ea31500-0c97-41d4-b54f-fa5e7c05ff98", "comment": "Malware payload (RaccoonStealer)", "value": "1772f2f7dd150e0a244e335f16bd6a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599441, "uuid": "88bb89da-4815-4f36-97f0-b5e2f9ec3dc5", "comment": "Malware payload (RaccoonStealer)", "value": "f7e22e20cd90f57ce6025dfb5bd05d49963e1915c18abcf16af7503a7215be8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599441, "uuid": "f6c629d3-a3ec-4055-ab8b-a80bb7910c31", "comment": "Malware payload (RaccoonStealer)", "value": "810015c53414a98e54ccc4db5853ed97f0d0afa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632599441, "uuid": "de6056e7-bcaa-4ebd-9a3c-6b9552d27e37", "comment": "Malware payload (RaccoonStealer)", "value": "80a6ee9f349419c2911e192c1a6e37c49225593708e92257034e5182690bb221c840aab1ba8e0e111d2b2b4cf2f7f572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599441, "uuid": "8549ec77-4c49-4dca-aef2-f2b2e871113a", "value": "T19BC39C2075E0C032E3FB56715B74D7E19AFFB8732B70858B3664265E8E213A09A27357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599441, "uuid": "267ccddb-61aa-4556-a089-7e3c1bb6269a", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599441, "uuid": "546f1381-e756-420f-971e-965b8d6c67ee", "value": "3072:xZHSD40MIDHAyZgnYo2qlRd0D5rWb77nMKLYQ:DH2Z3gsqfF/Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632599441, "uuid": "618849ef-8f24-4267-9747-b0fde8a7217f", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632599441, "uuid": "6e3ac5a7-4ec8-49f1-837d-bb8346d3e624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632599441, "uuid": "b2072b23-d357-4da7-935c-797aba2fcaf1", "value": "1772f2f7dd150e0a244e335f16bd6a47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f82d5f2-1e37-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632598425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598425, "uuid": "ed284b8f-f5fd-4aa8-950f-b9a051e07939", "comment": "Malware payload (RedLineStealer)", "value": "f273879ad8d9860c9b75bb682e50333b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598425, "uuid": "5bef3817-689c-4ac0-b372-cee31a554a03", "comment": "Malware payload (RedLineStealer)", "value": "f8a24f64412f44222e72d8a2c396bf1472eafbd41c5abbbaf9c4fc2a655175ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598425, "uuid": "ab8bd136-995a-464e-b6d0-7d362944900b", "comment": "Malware payload (RedLineStealer)", "value": "6e682ffbcf13a53b7d5104c01489ee68bae6c116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632598425, "uuid": "bcb4326e-20cc-4aaa-8398-2897291c6d8d", "comment": "Malware payload (RedLineStealer)", "value": "6ba7b42a5b9f5acb0f96211f1f8925e122924c7fc2f49ef51688f774aa6407c5f4443d345d4c6fb97b1e95c949a095de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598425, "uuid": "20e1220f-0fb7-4e7d-8579-41df4edc1d6e", "value": "T15D34D01176B2CD31F3E3797558748395AB3BFC222AB1910F7665072E5EE22908E36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598425, "uuid": "cb3441b5-fef2-4b00-ac5f-49e6db2ae328", "value": "1d8fbfe9f1ddd15c4632d3ab4f1ae1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598425, "uuid": "fda80581-2b03-4533-9922-3328851c3b1d", "value": "6144:0OnAbD9SnEe5YTkValp3xpMtalVWM4gYy:0qEDYnL5PVavxpMtmVWBgYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632598425, "uuid": "7d75c2e1-df95-4355-926c-db028ae6bba8", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632598425, "uuid": "ac89e0f7-21a5-4e8e-b862-5252d495fb50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632598425, "uuid": "aa66de07-b867-4fc8-82b3-4ce6b92a796d", "value": "f273879ad8d9860c9b75bb682e50333b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d9a804-1dcd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632552780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552780, "uuid": "01bb8925-e8b6-43a3-8737-04d8e0e9ab6a", "comment": "Malware payload (Smoke Loader)", "value": "68dbe18a88fc1375deb8100e367826f7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552780, "uuid": "616ffffd-b72d-4bf7-bf56-c3e42f51e915", "comment": "Malware payload (Smoke Loader)", "value": "f8eee2152f76d73d0eaa7be03d1232fdf15cf798167f43f06f4a58751780cd8a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552780, "uuid": "11dbac16-1783-48b7-a20f-9423520c5e35", "comment": "Malware payload (Smoke Loader)", "value": "d24df032cbfc2a19fe03873609d47f92195811c1", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632552780, "uuid": "940f0c7c-6bb6-4da3-98c4-0cff79b7f39a", "comment": "Malware payload (Smoke Loader)", "value": "7ff578562647341da2772527895fccdd944fd4b2c1094c3c3f1958dda39c37f9b2d14af62a34e593cecf46ecd1d946d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552780, "uuid": "0ba64f35-9016-4eea-b9f1-a76e84209441", "value": "T14E54AE10B6E0C034F1B713FA59BA93B8A92D7DB05B7895CB93D11AEA46746E0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552780, "uuid": "2b7aa4da-9b4e-48ed-9d9e-4da48d55086a", "value": "efb815d76c298dec768e3e4b14d60fd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552780, "uuid": "5185e0d9-bced-4d15-a1c2-1f4e538fc5e0", "value": "3072:Io5eiWVHGylf7j5r1/s3R94t7uEO9S20ke9e7yZKnRs4E23tNCOVMXlEv1vm5:j5RGdf791/sB9A7MGZKnyZ6BVoly1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632552780, "uuid": "a0e49706-831f-413c-b52f-a10a1f03fc26", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632552780, "uuid": "c7491251-2c19-480f-a620-0d5f3f291d7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632552780, "uuid": "4c7d9fd9-bff1-4ee6-8856-3d3f9a8a8aa7", "value": "68dbe18a88fc1375deb8100e367826f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6175f321-1d96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1632529225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529225, "uuid": "cc0c73e8-47ef-461e-9079-c9d6dd6b011f", "comment": "Malware payload (Tofsee)", "value": "261f94efe9509b20f72bb4a64c154ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529225, "uuid": "8d4bdb93-6c11-420b-a115-f2c9ffa2ee04", "comment": "Malware payload (Tofsee)", "value": "f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d79176d68bf09a842167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529225, "uuid": "13c5f843-f848-4602-9454-d9e703f1641d", "comment": "Malware payload (Tofsee)", "value": "1e9ecc9e3ef63741689d7133c42a67da087fb397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632529225, "uuid": "3542f631-1682-4be7-8045-bea7285e61de", "comment": "Malware payload (Tofsee)", "value": "526c1366f43f157b466fff8f70e0427e6998d28a77423308f7081df2ed549b6340652ab454d378b9f06c275e3e4d6cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529225, "uuid": "aad8f94d-0634-47fe-a8e2-e99cb79c6fdb", "value": "T119549E1077E0C039F4B712FA49BA97B8692D7EB06B3851CF62D616EA52782E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529225, "uuid": "84a87d44-8953-404c-a96a-825d736e775d", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529225, "uuid": "33f8e410-f8e7-49fc-ba29-df7b34514fb3", "value": "3072:y19PhEcKxTEMjVHxoAlWBFZqPWu0ay/MvZLKvaXIBgd3KUQ8n1mJq4VziqCm5ejH:y/PrcEMjVHXlWb0Pkbv5C3ZQy1mFs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632529225, "uuid": "48effba0-9af9-405d-b02f-3b7c5cb3a9aa", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632529225, "uuid": "e37d1b23-ebd2-47bd-bfac-e1f844e6d398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632529225, "uuid": "66ae5180-3d44-4c5b-9141-7b8b1ca3cb7d", "value": "f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3f9209-1ddb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1632559067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559067, "uuid": "59c35ddb-a19c-4e52-a9c0-6b933e7fc253", "comment": "Malware payload (Gafgyt)", "value": "3e566272b83e18a62c7599409ea6e58d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559067, "uuid": "cbc99900-a5bf-4ea0-b713-13528087997d", "comment": "Malware payload (Gafgyt)", "value": "fb3c80d192850087270be3a2f0b1685afb18b8c550dadcf49727700426b378ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559067, "uuid": "af0e45fc-c12d-41da-8108-0dba61eec745", "comment": "Malware payload (Gafgyt)", "value": "2918f330a681694ae0134302ea763e6e07019c9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632559067, "uuid": "732368ef-8f24-491c-ac1f-14546e39548d", "comment": "Malware payload (Gafgyt)", "value": "a0d7f649095e614a53f85c130e15d5e8f3063422fa4d0e82dcabd493f1f2fe4653e63601846fc2b3f98f44f57b2816b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559067, "uuid": "e60496cd-2417-47bb-9409-c13d71347626", "value": "T14E83294758A25FB7D04A6AB92D7745B0075BAE510F0F1A9B726CB6B4033F8CDB40E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559067, "uuid": "d13ed054-a5f8-4b76-883d-1451bd5cae0c", "value": "1536:+quP9DLm2M35V47hNzDjmgVKJpMrrvCOr7oCUE+IHUJa:HutI47WJgvCsofEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632559067, "uuid": "47dd9687-071c-4190-bee7-0c37f60f245e", "value": 82844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632559067, "uuid": "a04728f6-70c8-4790-92f9-32d9211f32d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632559067, "uuid": "81b77ac5-8a3e-4e2b-af5c-238beb4bc6d9", "value": "3e566272b83e18a62c7599409ea6e58d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b431c77-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632605665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605665, "uuid": "8d449d73-acf8-4661-837a-437a87ae990e", "comment": "Malware payload (RedLineStealer)", "value": "1c5d633c6ee45b3e1648d8bede18ab89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605665, "uuid": "d876e8e9-3c37-4f5c-94d4-605cbc026373", "comment": "Malware payload (RedLineStealer)", "value": "fbe14274d58bb5526c9d75bfa7b94c309d63c175ddf6fc5c3331e8008b056e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605665, "uuid": "1dce7ad6-1efe-4235-912b-75b003485b1e", "comment": "Malware payload (RedLineStealer)", "value": "415ca5caab56d3794477e79fb99d86b0da0a50a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605665, "uuid": "83b7746b-8ad2-42b3-8497-d410dc4a6a6f", "comment": "Malware payload (RedLineStealer)", "value": "f943abeb2c9112008bee1ae295e9a0880c180799e1800c35f62b11a4fb5190fed4ec595142d549bc4f7c89f39ace3054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605665, "uuid": "e80985cf-6dfa-43ea-aca9-64d699176baf", "value": "T14344DF2077A1C433D3A749759878C7E41A3B7826EE73854BF79C175E2E72381A6E2342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605665, "uuid": "97fd7c45-821e-42b7-8789-f14f3087aa70", "value": "13d097bc679769118a9ca1658020024c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605665, "uuid": "47604ffd-6fcd-4763-a61c-261aee3fde93", "value": "6144:Q1TZsSP4uWMR3fZYRAH2HguOuYSyeqPPldphoFuGEa:E1wvMRPZR/0yeCdpmFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605665, "uuid": "66d558bc-92f9-439b-8b0c-ebae92e4d089", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605665, "uuid": "115d3418-2de9-4f0c-a953-defe2b0cebce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605665, "uuid": "de5a0dfa-9bdc-4ee0-95c0-81d2c8af4b02", "value": "1c5d633c6ee45b3e1648d8bede18ab89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8858a0b0-1e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632605741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605741, "uuid": "a550779e-244d-4244-94ae-df7359914963", "comment": "Malware payload", "value": "9ea8b47f6e4d9ee3c169de1d2286547b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605741, "uuid": "9378a858-b336-459d-925c-e3e78923ff9c", "comment": "Malware payload", "value": "fd6189c2d9d73c2e91680a6f510bf56b70df5b546e0ccde2d2db49927b5af5d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605741, "uuid": "1954757c-cec0-4818-bbb6-6aad0419f43d", "comment": "Malware payload", "value": "1410416c5d60954d3d5a1a5dfccc6f8acf1c01ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632605741, "uuid": "09e0b559-8f2c-478d-994a-830cf4a3aceb", "comment": "Malware payload", "value": "6014198f0c5074f8faadb230d463f1fcf1133afbaf280955e63ca75f7a48a0d5b23b3d70fab9e99f47f7b7b3d0bf9d82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605741, "uuid": "50071c08-eef3-4c74-b7fd-e27c81f57953", "value": "T1DC8308A2F901DAB3F40ED77604D74B217630FBA14A932622736739B5AE362C53836F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605741, "uuid": "15687d3e-b803-45c3-935d-d93722d81b1c", "value": "1536:kQjgdDLPJG82ArGlQyGrx1CNMjzXaF6oJFsBMBcmz8EVhrjdlEfdn:djoPLGlQyGrxsN6uJOBwcmQEVhrhlEfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632605741, "uuid": "c638b7db-33f4-4ac2-9598-41f296cd99de", "value": 81317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632605741, "uuid": "f7c9a179-0ec1-41f8-9507-f9269429c592", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632605741, "uuid": "e980b095-0a31-4dee-a219-51c5b8bfe3b0", "value": "9ea8b47f6e4d9ee3c169de1d2286547b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829b2fe0-1e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632585545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632585545, "uuid": "cc123bbe-e934-4f7e-89aa-44a8195e270c", "comment": "Malware payload (RedLineStealer)", "value": "b991c983f852ba17b2c0d561301b8a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632585545, "uuid": "01c5f323-28d9-429c-8ab4-cdb13ed041a8", "comment": "Malware payload (RedLineStealer)", "value": "fd72e5fa17b537f3c38a4218bef6634b45a6c3284499ab785fc1b4ac88fa04cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632585545, "uuid": "adf87f58-831f-49d3-8575-988f539a967b", "comment": "Malware payload (RedLineStealer)", "value": "2b9c52ed359803a9903c5c4bb013d303edf73f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632585545, "uuid": "d05b559e-70d1-488b-9d3e-eb86fc8778b9", "comment": "Malware payload (RedLineStealer)", "value": "043c06a324e6ee21c7b6adf7da75efbaa1d360fbae7cfc0e718e9d3e35cc427c4d2ddaff5edc85d887ae59459f88e207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632585545, "uuid": "ace654e8-c433-47f2-8c4c-775c1f1031dc", "value": "T1D424E03136A4C472D3A75A78AA70C3D4693BB9237F7445CB36440BAE4E723C09A7A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632585545, "uuid": "4686f3f3-a536-4e72-8dde-fecf406d5e32", "value": "cff62fa5d60c26268b201fcb5b9dc813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632585545, "uuid": "3c2d49b1-a741-4f32-914e-6ba3e06994fd", "value": "3072:F0vPnOT4UR/zgKRnwF8tTeU5GThgeYRq782DfzSpPJz7jXMAfD5LS7SaYQ:F0v/OTjrvRnwFpICjYRsvDbSpVfTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632585545, "uuid": "73b96c38-cf45-464b-9897-146fbd7f95cc", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632585545, "uuid": "549a773d-30a4-4e1e-89d3-1ba24caf3310", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632585545, "uuid": "dc7921de-d934-46f3-84df-c006f955c8fe", "value": "b991c983f852ba17b2c0d561301b8a57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca4b293-1de5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632563282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563282, "uuid": "3fd9913f-af8d-48cb-a71d-3567be8697be", "comment": "Malware payload (RedLineStealer)", "value": "591c010d6ee1deb2d84b87498f994821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563282, "uuid": "7175d937-0376-43f9-9d4b-0b4deae68506", "comment": "Malware payload (RedLineStealer)", "value": "fda5fb395d4b9611ea0f5bb65bee0f5d9a07220bcbdf1c49e44aa8cd923bce9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563282, "uuid": "4683fd50-300a-42fe-b225-29c879c70fec", "comment": "Malware payload (RedLineStealer)", "value": "559d892bbf91cf3ee96c269a605c053459476c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632563282, "uuid": "a7e352fd-e6d9-482a-94ae-eb085729af05", "comment": "Malware payload (RedLineStealer)", "value": "5c240599ebf3523cfa28d87858fe0aea10d9be081d8f961f2cc1507bbb9f4d255398932e2add299171edfbfb265c9c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563282, "uuid": "12b3fa62-f127-4f1b-939d-ddf3328bba2c", "value": "T1D084BE20BAE0C034E5F316F88AB993A8A93E7DB15B7491CF62D117EA16346E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563282, "uuid": "55111359-0dcb-4a59-a967-4016c943bbec", "value": "64db17fb74f0fc4cbe32aa2e57d24a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563282, "uuid": "5ef86c30-9c3f-49bd-b0c2-e546fee8e038", "value": "6144:BjXeJaMA1IRNl55aSbPF/V1/tFh8W+nLNWMR/gVwCYWvxE4bFUPboFb8A08:JqaMA1IRf5dbPd/t8oMR/gpYQwbAbRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632563282, "uuid": "359881bc-e4ff-4fd3-88c3-6b4f7d1836bf", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632563282, "uuid": "f2c8833d-c7e1-4f71-b7ca-888ca0fc955f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632563282, "uuid": "e4bd25d8-bb36-46c3-8015-79bd89df2352", "value": "591c010d6ee1deb2d84b87498f994821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e96f201-1dd8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632557460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557460, "uuid": "ffcd90ca-6f5f-4808-b8e1-c526b0a7d8b5", "comment": "Malware payload (RedLineStealer)", "value": "beed8a30f01b18ccc0b3b95714af4944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557460, "uuid": "53fbbdd0-50db-4cb0-a211-11a3fcb51f3b", "comment": "Malware payload (RedLineStealer)", "value": "ff061e51cc408d07d54ac73f7bb7725cf8266aadf6b7ddc336a84f2eff2d1e7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557460, "uuid": "ded40889-aa8c-42f1-b39b-2ad6304d70e2", "comment": "Malware payload (RedLineStealer)", "value": "10d72c5845a51512b8f0543cf1ee8adf394a6255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632557460, "uuid": "e5f88730-d336-469f-ae3f-e4d53cbe73df", "comment": "Malware payload (RedLineStealer)", "value": "c1eb32be873064ac129fe2d7884eca6be54e69d405819c737f9e46f79250646dce21e635af67242f966e9c25b69df06d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557460, "uuid": "31b383dd-90fe-41d1-a0e8-3001115c594c", "value": "T17A74CF20A7E0C039F4B712F54ABA87BDA92D79B06B3890CB52D616EA57742F4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557460, "uuid": "d90f0409-20b8-4c9a-a5bc-06f4ec8f76fc", "value": "968069613992074265463fec272c56c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557460, "uuid": "ba6e1749-ab8a-4f35-9913-e4870faf13bc", "value": "6144:Z2DsTSujX+adglCbYDZhAtmweNL+q9F9QcHV9ejgR:Z2DsHjXslHDimXd+y9Q29x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632557460, "uuid": "5ab4796c-c639-47e5-8afa-e1af7b055e22", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632557460, "uuid": "92e58646-0729-4b94-a860-4cd4daec3b51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632557460, "uuid": "2bc0153d-57a9-4de0-8433-9d68172b5bf3", "value": "beed8a30f01b18ccc0b3b95714af4944.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }