{ "Event": { "published": true, "date": "2021-10-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-31", "timestamp": 1635724981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "97d2e0e6-7321-428f-9a96-6b6448b762af", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6743855d-3a97-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635718248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718248, "uuid": "08a003ae-6b54-4096-a4db-cb876cf6efc8", "comment": "Malware payload", "value": "2c22834a72b44fdf0b5a468ef386bf62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718248, "uuid": "20fc5d9a-14d2-4f95-9e44-081d7c0ef53a", "comment": "Malware payload", "value": "0388db40f61ae2d1f97cf3178d3356f3022d61329dab38e8ebe54964f84ce058", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718248, "uuid": "01aa9dcd-aa65-4399-9fcf-3b0fd1229503", "comment": "Malware payload", "value": "8038ed21451e2f7c3ad75f0f13bb602dfbf29290", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718248, "uuid": "576ff099-766c-499b-a8b8-301516ac62d2", "comment": "Malware payload", "value": "d7930be5fdc63d07a36be0c9070eb27df9799d9d649368042b44e5331311fffce9319d784b59b21dd2cc8ab190a42722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718248, "uuid": "a9ad02a7-aea2-4f39-abe9-4b42298379ee", "value": "T146A3A5267E11EFFFE06986310BF39B3082E5629627A19385F25CDB181F6128D1C5F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718248, "uuid": "85ecec07-e559-4b27-b050-94f86402fb01", "value": "1536:xTr+tr7YiujNynm5PFgnQDyX86FJ1ePpHKXqWJxmkihF9MCWRjge:slrX863MqXvxmkihF9MjRjge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635718248, "uuid": "4d3c09a5-8c79-4543-92a2-3af270e56c43", "value": 100026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635718248, "uuid": "27d4517c-da5a-48d2-9fa0-b4f5162e943b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718248, "uuid": "9d253cbb-2e82-468a-813f-a8e86c54b324", "value": "2c22834a72b44fdf0b5a468ef386bf62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf585246-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635692653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692653, "uuid": "4fb5ba20-66cb-430c-8d6c-9202d3b9b4ed", "comment": "Malware payload (ArkeiStealer)", "value": "5438fc4e7c66a72b2b75b248d970b5ef", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692653, "uuid": "2bd08892-6420-4943-b60e-77d8179a2889", "comment": "Malware payload (ArkeiStealer)", "value": "03953078a89e2efb12217ac6df2584d0c8d5ce0190daca67d85910e24f273383", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692653, "uuid": "634c1ab1-7318-4e2a-b00c-0d52b6a24a94", "comment": "Malware payload (ArkeiStealer)", "value": "9f489ac261c84fca71a5c9ca42459ff029ca895d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692653, "uuid": "58eb4029-6954-4ebe-a253-3c4c73281de2", "comment": "Malware payload (ArkeiStealer)", "value": "00f5540c1a2540997b6bc1fbc3c1805a2f6b559a63421c7d5e0ada82b0d37a6393450971de20bdfd019d3c16e16f5843", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692653, "uuid": "78de64d9-5c1e-4ad7-91dc-7372a2ed87bc", "value": "T12555230C739DB1EEE127D5329D5C1D28A900287BE757D64B90A71ABADE0F14BCEC41E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692653, "uuid": "acb5fee1-325e-49a5-9b0e-6a3d16f44325", "value": "24576:EVjhKwBthw7DT3f8zVsJRbqfcIn3uHa6Q+KAVzcebeU/Z/iq+3oqKn:EVLt+D8+J9qfXnuKAVcU03od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692653, "uuid": "006d31c1-9275-4e76-8c11-eb4dc19ae244", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692653, "uuid": "c36a8212-29e2-456f-b776-c7672ce3335d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692653, "uuid": "15c8045c-0f25-4069-9dac-091d409577e6", "value": "5438fc4e7c66a72b2b75b248d970b5ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b80fe36-3a3c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635679091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635679091, "uuid": "c28f9c5c-b45b-4c67-aebe-b09b09111449", "comment": "Malware payload (Formbook)", "value": "2bdaf95f3493de9b27a51048fdd6dc99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635679091, "uuid": "db2f5307-cb09-4aaa-aa77-5050fb9e5747", "comment": "Malware payload (Formbook)", "value": "07108380475747569f5e1eb477ab651bb2d1310368495f147a408b6bdc9a6fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635679091, "uuid": "8a9d2159-0f14-45b4-b092-a65cf0a1ad31", "comment": "Malware payload (Formbook)", "value": "b7151a59f3e030f9d292c4c7eaf4e14b2e99a9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635679091, "uuid": "d9ab91c5-0146-41dc-95b0-52761bca88c3", "comment": "Malware payload (Formbook)", "value": "ffe7a0f26ac665d750ecb5072093c65ecb8e0aab176c17e8dec8a2809cd0f9e7fac53ab354476fe8d1ed3877947953ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635679091, "uuid": "d5366cb3-d1da-45ea-8ca5-b972484612e3", "value": "T1C06422241F94D377DAFE3B7B46C2361467BEEA3E0998D7095D70918B82B13078513A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635679091, "uuid": "9ddde2fa-659b-435d-9060-4a2c17730d07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635679091, "uuid": "88a85c1e-8184-468c-bc60-4ab521f3657a", "value": "6144:F62cKLxS7Kba1t5rUuncXDuHFp8bzYnh2MJu2zZbqsXgeW37DQBQ:4qxS7aa1ttHn4ulqbzYnbJu2zZbqLerK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635679091, "uuid": "457277c3-91a3-4724-acaa-52326ca5ca77", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635679091, "uuid": "a2b0c350-816a-4beb-9a15-45c3da14c0b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635679091, "uuid": "24374bc6-aad4-4fa4-ac6e-c13bcd02466f", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4c3e21-3a59-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635691464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691464, "uuid": "71b0bfbe-6823-40b2-a5bf-524f6d486234", "comment": "Malware payload (AgentTesla)", "value": "359ca6f3ff54fa7aa127a4f05a5c76f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691464, "uuid": "5baa9241-2763-4a2a-8442-138075c70a12", "comment": "Malware payload (AgentTesla)", "value": "081c51e58495d188d195e3cb242677b68190061e7e54dc2fea98e51bbab22aa8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691464, "uuid": "9ac28f29-77a8-4e50-a93e-a9cd8b822af2", "comment": "Malware payload (AgentTesla)", "value": "1f0f40109767f92b2654d40214d67a2b0a1bf75c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691464, "uuid": "6fffdd03-96d7-4823-97c8-9e0079867edb", "comment": "Malware payload (AgentTesla)", "value": "209399477c14832dab77a4a8a1cb7a93794d6e13993527a18af32587f5bae69f107c54996f9f1aa89274550d7b3cb336", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691464, "uuid": "456d1669-fea1-4999-a3e7-cfe3e624ebc7", "value": "T16A942374891C0D55D19849B2CA070097B778C86EDAE04C8F29FB496DC6DD336ECAF2E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691464, "uuid": "771f37e2-dd2f-40ae-89b0-0f0c7edb2462", "value": "6144:qCtiMioP3OFpMLx99z5yXJWcJQG7ltdhJ4+ChgL1ctOX3PnQr1MT7scy8LgfS92g:nt153cV1DPd/40XnQSAcykD92RrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691464, "uuid": "15395552-f186-4b93-8917-e4cea111ef29", "value": 445669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691464, "uuid": "31274117-1f15-434e-817d-ac09b733e7e5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691464, "uuid": "9e42b20f-13cf-400f-ab66-471b468fff6f", "value": "(KOREA SHIPPING - KLCSM)_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61938e0-39dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Phorpiex)", "timestamp": 1635638467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635638467, "uuid": "78447e4f-44b3-4712-a457-9223b221c17a", "comment": "Malware payload (Phorpiex)", "value": "dba6311e5bdecea5182235ba432bd586", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635638467, "uuid": "dd831ea9-cb0b-41ff-9c65-36f99e450d09", "comment": "Malware payload (Phorpiex)", "value": "08fa38854d73c5532fa3023ca09b620c3f0553aae5cfa98950e723d834c60653", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635638467, "uuid": "8d0a69c9-3bd3-4533-aedd-06dd5ee72bcd", "comment": "Malware payload (Phorpiex)", "value": "07147f72fa9cd98da96bfa2f6f2b006bfcc7ab80", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635638467, "uuid": "289b041b-3a6f-472a-8baf-6a0e61f35dac", "comment": "Malware payload (Phorpiex)", "value": "4f9a74f00ab20059940b52c8dda3938af0edd009f2c78409f7ffbddda6f8d403cd783c69b209b3f5e8dd9311c2c96342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635638467, "uuid": "c7192e70-5807-44bb-a29b-5cdc0f2bf98f", "value": "T155C5AF5099C94CCCE062C6F2AF36A0177B1DBE5352D684C6206FFB478133E8BA9D7616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635638467, "uuid": "926fd07f-e79d-4cb9-bf4f-a6cf326d3deb", "value": "49152:AjqLUpmF/5QI6FEsFPBHe82KyLX4c/SDAw1:Nem7QIo+3D/Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635638467, "uuid": "aff0589a-33ba-40ef-9096-c07e34b9ae3f", "value": 2627584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635638467, "uuid": "485d68ae-f18d-4909-80e2-a345107ab942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635638467, "uuid": "c40d5c6c-9307-48fb-bb47-057227568a11", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7a74f2-3a58-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635691412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691412, "uuid": "bd4febf3-5372-4e26-9375-1e5423b9d109", "comment": "Malware payload (BitRAT)", "value": "ddbe0a97070fd07670f16996dd8c6305", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691412, "uuid": "f30f016e-5a7e-4ada-af3e-1cdaed7b9d73", "comment": "Malware payload (BitRAT)", "value": "095d13644bb4d1c77a555fefd7fda3c9c3560cd8c21a26d3838fba2c28419c56", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691412, "uuid": "f3f36398-18ac-4a0d-b09d-4cf2179f76af", "comment": "Malware payload (BitRAT)", "value": "a33c7a647c57a4e34b04310fb92a9494af282250", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691412, "uuid": "6700dc94-79e9-422b-9a6d-69ac72268319", "comment": "Malware payload (BitRAT)", "value": "051aa3503c4ad82a1c915b7fb219f61fc1969486dd3206861b6791ea1caa47d67321e93c8405d9da5c5db2cfc31d9def", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691412, "uuid": "bf72cc0f-cb00-4836-a6ef-9451a38ba5c8", "value": "T153759E23B2909537C13366784E17B2996416FF103DE8ECC677F86E4CAF792807869963", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691412, "uuid": "2fe8025c-98dc-4998-88c6-c4d0897e60ae", "value": "12288:lXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4JV6NuLpjqayC94M0LdEegD:l4uBfTG2pM9o6NN+swhY4eMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691412, "uuid": "cae93bad-a3db-4c04-80b9-734f9d1af2cb", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691412, "uuid": "b0d6345a-c6e2-4e7c-84fa-939f9de0ebac", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691412, "uuid": "708f7c04-1a9f-413a-b28c-459797b8f980", "value": "dhlfile299.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809c0c4b-3a87-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635711419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711419, "uuid": "28533adf-32ea-4f75-baa2-64cea0046304", "comment": "Malware payload (RaccoonStealer)", "value": "e1d2526b1c250ebd2144f9dff2e6390f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711419, "uuid": "49887a62-5a30-4b1d-9dc4-7763fac1d48f", "comment": "Malware payload (RaccoonStealer)", "value": "0a8405ad8d7fb8f334acd2fa1e0729a9b267d85af6bf7cbed9450c1640fae973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711419, "uuid": "968fe002-ce1e-45a1-80dc-7206a0a4e739", "comment": "Malware payload (RaccoonStealer)", "value": "e75405a3a100e7be8697105435c36c5b30733c93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711419, "uuid": "59c29020-ee93-4abb-9ad8-3a7b64bade59", "comment": "Malware payload (RaccoonStealer)", "value": "4ae9793021fbf5abe065cf412a782e36fac52ff4322f4a6bca374a317d5eb90641e6f0c7c68c46f115aa41218534815d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711419, "uuid": "bf008ca5-000b-4e46-9ef3-b131d8249508", "value": "T146F42200AB5A93A7E4AD47FC556702F80371EABB6212E68C7F80F4DD5E727144E60B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711419, "uuid": "edcc6b7f-9678-4ade-88bc-829731733cf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711419, "uuid": "01a64fb0-45fb-4442-9900-81613f40a3a9", "value": "12288:g7Q7WJ6owDb2cB1SCJ6VMWr0VwsQ+JDnJ9KTgXlE6zs/LEWXQVK2dGN69AJBG:u6Zb24QC2MW17+8g2Rj5iKg19AJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635711419, "uuid": "ed431659-ed71-4f31-9da7-1e1e0ab0b903", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635711419, "uuid": "42da04f7-3d2a-4d4f-bb14-77123f78e4b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711419, "uuid": "4c4a3da4-de62-42dd-ad2f-7d56476530b7", "value": "DRAFT BL - KTX3-JVA261S.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f4a4c0-3a15-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635662569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662569, "uuid": "64cf9647-fa99-4bae-bd46-b3e66ec94a2e", "comment": "Malware payload", "value": "e32a8ebbfc2bef53571a92eaa335a61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662569, "uuid": "0181c43b-a366-4ab7-a832-d2323e372174", "comment": "Malware payload", "value": "0ab795074e75a90975dd30d5e2b2331e87b65c17f2bdf2b796b83dccaf524019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662569, "uuid": "1501be83-6659-4733-b7de-01b3aa3a0d0d", "comment": "Malware payload", "value": "5cbaa1a754960c239c2d72ae1ad029d51476ef7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662569, "uuid": "f47197aa-e646-4673-968b-4555fa464074", "comment": "Malware payload", "value": "0b6d7c9001a6bbc98c90a619055b67e3318a1102b9f9cecd84adf7bf8b7a4ee22ae93ca537c87c5268cfb93c31d3d6fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662569, "uuid": "610e68ca-1573-464a-b577-edb25c73f52b", "value": "T1FB94A7D4A2D65E03E83D36796161AD0993F310E62E2BD72DBF4D5EE94802AC74F0D24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662569, "uuid": "52b69a0f-e79e-4efa-b519-882bb7de8f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662569, "uuid": "efef5e86-d6bd-46fe-8ee0-ce1044467c88", "value": "6144:CufVFFF78KhBGZiZiZiZQe+m7wdkp24kjQy5K+:CufVFFF78aGgggGe+GwdQ2KX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635662569, "uuid": "e007cdb9-d50e-4f8f-acd7-a86c25545a1b", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635662569, "uuid": "507667e3-e373-414b-982d-cafb6d7054a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662569, "uuid": "2a102c0b-a825-4587-b651-fa2c785d38eb", "value": "e32a8ebbfc2bef53571a92eaa335a61f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7369f0d-3a95-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1635717523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717523, "uuid": "b5575c1c-47a2-461a-a6e0-e96a5b2b6c2a", "comment": "Malware payload (Gafgyt)", "value": "cbead44342e2d438afcff1f116b544d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717523, "uuid": "53acb3b2-c61c-44ee-b6de-3033257e8fc4", "comment": "Malware payload (Gafgyt)", "value": "0bea7b4d84a2f2a7d02faa5c0bcf45add3e2b02c1c61cf264449a15056c59453", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717523, "uuid": "1b5620f0-d3af-47fc-ac51-4c11805d7f50", "comment": "Malware payload (Gafgyt)", "value": "bb080a904221a3b11500af2f6c1d58ee5dd562dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717523, "uuid": "d4329b30-3c26-4491-bcfe-0e050199dec9", "comment": "Malware payload (Gafgyt)", "value": "50f7905ca2fb2f4634b02405255f72dba386e5318db419523bc0117e60965cb8ca36bbbf789d89430e023e4e15f3f631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717523, "uuid": "51af0859-feb8-4296-b789-236e1f79bd46", "value": "T1C4831A41FD418B57C2C327B6FBDF4359772A6A549BA73301A7287EB42BC27D81E29210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717523, "uuid": "83784d82-3c84-4770-a9cb-921a9d9ea6e6", "value": "1536:zTVA98TTfSXgwiQF70gibRFOwc6KEnrDdDU0jZmR7qQEi/4JXWde:G8quQ+9b86KEnrjmR7qQEiAJXWde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717523, "uuid": "44c840f5-d82e-4a10-aa55-322399fe4a98", "value": 80807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717523, "uuid": "c18b91b6-3c86-4629-82e8-c24514a36d34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717523, "uuid": "3f5271b8-de1f-4e9d-be0a-78273a7097c2", "value": "cbead44342e2d438afcff1f116b544d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e958e717-3a8f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635715031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715031, "uuid": "2d6ad1fe-9426-4ce1-b85d-f064845bc42c", "comment": "Malware payload", "value": "d5c74994d728ca8e7136bfde9bff7cf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715031, "uuid": "3b0c8940-4310-45df-9e3f-cb6db75a0e99", "comment": "Malware payload", "value": "0c7a9a3f5dd80065350241514d96f61fde84a504cba2cd61df8a9767d601aec9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715031, "uuid": "885d12dc-5cdc-4238-8f8b-64b50cdc7fbb", "comment": "Malware payload", "value": "d3cfe3dbe5cafe4a189f6866783d4b5b18ac2ed6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715031, "uuid": "a89744c2-2579-4f44-a568-e2988af72977", "comment": "Malware payload", "value": "c435a3b6cd1e0a2b2265e3c6c7a330051a7f33e62870f85decaca6d2d09fdaf7fb8dafdeb4081c426942ae229b31bd06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715031, "uuid": "8e98b380-f9ad-423d-b2d1-758e22af3c1d", "value": "T1AE355B76325079CEC857CE7288685C20AE607C6B432BC20F6013366D9AFE657DF256F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715031, "uuid": "f658a492-6499-4ea4-a410-6b39f816aa93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715031, "uuid": "88a8d8c1-781a-42ae-9496-703790c16444", "value": "24576:841yWqk+a8fck15Wte9Gtfuif3RwZRRN9wV:jMcGpAtmowZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635715031, "uuid": "ac3a3f90-e1fd-4513-8a68-172d654fcb26", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635715031, "uuid": "c939fac9-8fda-4628-96ef-297063a3ba60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715031, "uuid": "dd318edb-3bdc-459e-9e9d-599eab527406", "value": "SOA JUN 2021 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ca9584-3a1d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635666064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666064, "uuid": "aabd8392-b834-4789-a6dc-78a9b0638496", "comment": "Malware payload", "value": "6e8fa8af7755874f7928fe0aad63ca7e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666064, "uuid": "e90f0332-b160-4f24-896f-38fef38e350d", "comment": "Malware payload", "value": "0cb0fc6fdc41aa614b62fe601d61dd940f99a7c18ffbd7b3706d90b3f8fb8fc8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666064, "uuid": "5174d317-0d65-44b7-b1ef-62c92f02668b", "comment": "Malware payload", "value": "84ea786cd63fe847b8f3da99b42754f3e8ba7339", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666064, "uuid": "e4ed6bf7-c8e6-48de-907f-986ea25ccd99", "comment": "Malware payload", "value": "2650bd991f196d9b006d6833bebb339eae4c1a1010bd53ead051236bcc0d3388c3ab2d7e01b74a5da11a1210b184e901", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666064, "uuid": "b84d7b8b-3f40-4b34-81a5-3684a50954fb", "value": "T151F0611ED41B6ED7C7117D5BF1F3D560481581038AA4C51C8162634D477446EFD2C3BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666064, "uuid": "a2929fc8-32bc-44f8-b9fe-e30039af9532", "value": "12:TaVlPL6yNnys2M9wCioDYysamqljehfMWUBAzdqsH3wn7CCH0TC:mVpL6ycs26XioDlsawfMWPnwHHcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666064, "uuid": "fc5a2a95-0657-4adf-99e6-88d73e8809ce", "value": 480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666064, "uuid": "7c6cc9b8-118f-40c8-bede-88aa788d9b07", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666064, "uuid": "35e73f1f-6734-4c69-88cc-28e8f3d3a0ad", "value": "PA23145678923PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e8d339-3a1a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635664609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664609, "uuid": "3a8f72f2-bf11-4ab0-b5a2-ee1f7f91e91e", "comment": "Malware payload (AgentTesla)", "value": "ae775a47b6de02fef7b837bec3569968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664609, "uuid": "f672a9a4-29f1-4ade-a009-740858a53059", "comment": "Malware payload (AgentTesla)", "value": "0e9e5968f046dc6fa5202e801d927662ba0048d92cdbb28da25c3275b5264123", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664609, "uuid": "0fc90fd8-0b43-45ca-8377-eb74f9b1752e", "comment": "Malware payload (AgentTesla)", "value": "f4aed8675f768c35820467a0f69df6aa5ea87f0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664609, "uuid": "b4362259-624e-4541-b86d-468160e5ad99", "comment": "Malware payload (AgentTesla)", "value": "2fdfdf775efa2fafb4c16954e1849894d2f63980a0e2112cf04ef73fb225ebaf0a0ae7b8eeba55bd8467b1df81040494", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664609, "uuid": "1dfa7cb0-7c76-400c-8ea8-e282f1493cf9", "value": "T14B84238F52849320C695137AF9D194F143FFB24B217AE8A99D553BC51FC03CEC9826AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664609, "uuid": "2c3b351a-e9b2-4478-ab52-ec2fdc4cfc4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664609, "uuid": "7d54bb48-f864-484a-bbee-987c946be5df", "value": "6144:3qK+ZxkyM6lQGWE1CjiSN2ECLMdaVxSafgenDJVDQI66wmSxxcAvNUkIOzcWIq6u:j+zkFoQTIC3N03UafgeVVkIdbwxc+mk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664609, "uuid": "5dd5d2dc-68f2-45a4-88c6-a21fe57f2dbf", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664609, "uuid": "692634ec-92b5-4e62-83a0-0ff2ccfa0b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664609, "uuid": "1151b6e7-6056-4b44-8625-ff381379b329", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453980d9-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635692851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692851, "uuid": "e3c190a1-842c-4611-be41-e5f6543f29ac", "comment": "Malware payload (RedLineStealer)", "value": "c85c3285955918a27b8f3c17c0f70673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692851, "uuid": "a47547a4-899e-4be4-8d01-b198db22a2a0", "comment": "Malware payload (RedLineStealer)", "value": "0f583723e61b99cc4f3307c332a98040c2d95f4553738c447d7302ccea1c08dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692851, "uuid": "54b1f6ce-0609-45ce-8247-0d7f052686f1", "comment": "Malware payload (RedLineStealer)", "value": "123eb6bc33cfb21e7729b2d626ba30e5921384ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692851, "uuid": "07855c8b-2154-431f-82eb-dea3fbd7f145", "comment": "Malware payload (RedLineStealer)", "value": "1410e7809d0795dbbefa0857fd230b5aba1e2f848c8c826b01d4cd54860eccfa241a759ec79fd8a8f93c909fd051ba1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692851, "uuid": "4f92f62c-c4e8-45ea-a363-1b969a0ff84a", "value": "T1501518C6E1B3608ED7A2B0B90F0156924A470C766B129AF56F35E96B11F37E1CAD7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692851, "uuid": "419fe01c-d31d-41d6-8db6-e1c8913898e0", "value": "4702f357dfd397a016277573e927cfb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692851, "uuid": "76b66fbb-e116-44b1-9152-ed05797b44eb", "value": "12288:ab2yXYorwxLPabFf9+sXMnE68WDZkUZPnZmU+CTrjkO868OL+y9zF36x6cBwJ:ab2YrwxraBf9+KMnb8WD1ZbJTnm/BwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692851, "uuid": "263db301-5332-4e44-a2fb-8205fa49e0e5", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692851, "uuid": "a10bdaaf-c646-452f-ad62-a0e79d75a498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692851, "uuid": "175d4393-4e38-4ec7-8044-b8eb10ba59c7", "value": "Fortnite Aimbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1cd9b8-3a84-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635709940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709940, "uuid": "654f22f3-fecc-4c22-b224-c6763cd5674a", "comment": "Malware payload (AgentTesla)", "value": "434c8c2a6df74c34f7621d92b6417794", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709940, "uuid": "c8c84f71-363d-4e1e-abea-707ea9664980", "comment": "Malware payload (AgentTesla)", "value": "132e8248c6d5e4ee96d5f3908d6a2f6613da62d028fb0364b28597a89fb4f700", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709940, "uuid": "234eb3c1-d7b2-4a21-a39c-449e836f27e9", "comment": "Malware payload (AgentTesla)", "value": "de1d346bf8300946d68f72cb1b5a5b5e1dbdd22a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709940, "uuid": "3da158db-dace-40bd-ac83-e5de2392eaff", "comment": "Malware payload (AgentTesla)", "value": "0c83841d6c46897c5df5e84f9457b5b3667d6400ae677a0ff0a693ef151de0c36d10fc69dfa59d1a7715407b56f79fc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709940, "uuid": "db974fce-f491-4df9-ba27-a63dd59edd3a", "value": "T12DB4D04163E6A92AD7790FB2047301501BB179973E22D35F1DC830EE69BEF990A41F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709940, "uuid": "f4e8f395-ba96-45c7-8831-7b2fe67e12e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709940, "uuid": "42d7f505-d06b-48af-b5de-fdc2ca8ccea8", "value": "12288:MFABptMOqV2MQy9LiFToPrwoEKhFlLfP4Np/qtrN8iMfx:fXMSwZPUIzGmN8iMfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635709940, "uuid": "102bd933-e6b0-4730-8daf-247e16552c68", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635709940, "uuid": "fe573985-b4c7-481a-9de1-f91f597a102c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709940, "uuid": "8053bdef-81f3-41e8-a388-69b7fbe65baa", "value": "AWB09_00000000000022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f556ad-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635692666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692666, "uuid": "f67a1f6e-8daa-44db-a3ed-511de34057f8", "comment": "Malware payload", "value": "84970fc9edf72dfbd1b6b20e9904e3dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692666, "uuid": "1d64b009-a216-45cf-be02-d9fc081b2c75", "comment": "Malware payload", "value": "141177f5710c9cd97690f1a7391e129d15b3718b18bb8aa8b52c4eb493bf04c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692666, "uuid": "766ccc76-b994-4d4a-8872-42df11bb2445", "comment": "Malware payload", "value": "595e73c7804b39b23baaa070ac1f787b140881c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692666, "uuid": "6e3170a0-9324-4176-87bd-590cd7da1f64", "comment": "Malware payload", "value": "d3eb8f81448a7e1e81ad883d1b4de2af48a7f8194378477f6731071b6d66afca52b9bc5cb30c295def29e8eb7ff799f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692666, "uuid": "3b5d8f10-3632-4335-9eff-193d4b83d92e", "value": "T10C63021261EAC1F6D17A44FBBC3045D42320BBD09A45862FA3A87FF6CE1248579B518F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692666, "uuid": "61ed3c76-eb91-4195-871f-a03f63921997", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692666, "uuid": "baca9cd5-92e7-4ee5-b315-82e937de2250", "value": "1536:mqtsXIW70EQoiPQ1vO3BK1xGdjDzQ7nGtTdS:mqsI3EQoiPYGUx+jXSnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692666, "uuid": "7ae835a4-0b31-42eb-b844-e188a15f24e1", "value": 68649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692666, "uuid": "ac758e3c-339a-4bae-8607-579ed7f45cd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692666, "uuid": "65019403-5ece-448c-8158-a7d7edd6cbec", "value": "84970fc9edf72dfbd1b6b20e9904e3dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d22a0d5-3a28-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1635670638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670638, "uuid": "1f3761ba-8787-41b4-b382-803ca0104a6e", "comment": "Malware payload (CryptBot)", "value": "192a3af3b72e560a61e3775513ea9c22", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670638, "uuid": "61982bc6-13da-48b1-b3b8-9e343ffdc5f3", "comment": "Malware payload (CryptBot)", "value": "1470c130974e406406b0e9f3eecd0770576158ccfb401a7eff5f09f10b3ab08f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670638, "uuid": "a10bed56-ecab-4faf-ba19-c1c126270771", "comment": "Malware payload (CryptBot)", "value": "c5eb71b68ece2dcb3d8ab4b9571efd049436dd37", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670638, "uuid": "ffa34542-002e-4319-8794-b8c013f9e110", "comment": "Malware payload (CryptBot)", "value": "3871ebdeac7bbc252265dff6c19559589aac55c9d12add018c702c5f1556079c5b89acf2172ee384394177a45eb177f5", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670638, "uuid": "6d0f6d09-9341-4494-98a0-30f4f29dc1b6", "value": "T107D49DB519A64036E3DE21BBEC547CF976484937BF1733EED60942A0C2793C94B2168B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670638, "uuid": "8dfb8900-66f6-48c9-b5e3-698260c80c17", "value": "8a9ed89ec8df27eb3e2cc7fd06678d71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670638, "uuid": "ca61f5d8-3abe-4dbe-aab8-9f142fd73a33", "value": "12288:FgxVgSkNB7mBRAog/4zgrMvULGxlDdtsoxSU7E4gq3qiuv:FgxVgSGxELgxAvfSPZiuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635670638, "uuid": "f568f189-d62d-4f01-9884-d2809d2b7b4b", "value": 624048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635670638, "uuid": "b0856b1a-ed0b-412e-a130-2e6e4c83d96d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670638, "uuid": "3f7cb5f9-9a19-4d15-9e6f-3c947c527cc1", "value": "File-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28beed37-3a4f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635687220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687220, "uuid": "81fca471-b88a-4e28-90b7-f0d83843625c", "comment": "Malware payload (RemcosRAT)", "value": "40944d3b7acadd381ad4bfdf62b28945", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687220, "uuid": "d37873c3-d0c1-42c0-9009-096f1fddad87", "comment": "Malware payload (RemcosRAT)", "value": "16ed3359cc5de49c5ceb1770bbde0652438ab15a910ba51814803fff7f68393a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687220, "uuid": "c04f2c16-48d3-46e1-a4ac-903bb448c9c9", "comment": "Malware payload (RemcosRAT)", "value": "6f43adeb6b0cf968f835f96f94dc493d3de2a511", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687220, "uuid": "6c9760cd-3c7c-431f-ac63-0364acff9ec9", "comment": "Malware payload (RemcosRAT)", "value": "187123bb5e3716411a76d481927ab998265232eba97d5ea96680d29e099c5ee37e9e81d8b0fa6fd0f573d378b0f88d2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687220, "uuid": "68920dc8-9972-406a-a816-f4be625dfc01", "value": "T195258D91A54006B2C1232E380CEF97381566BEB66D6CBC566AF87C455FFB1C23036D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687220, "uuid": "616156de-6de1-4750-9986-930912260651", "value": "3573f467b247eeb40b07b99c0363824a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687220, "uuid": "cec41206-20c6-4b05-95a7-d7f0504dfe55", "value": "12288:rhHWm3RcYRn9vyZuZkxx46hPXBfwLHvzScQrtbPNOCFPwQtoGkjc75ZfTZ:E2Zn9viuZkx1hhqP+jn/F4VGkjSjfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635687220, "uuid": "28bdb457-df8c-48ce-bf4c-bf604cbb9834", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635687220, "uuid": "4dec6f6d-2010-4bd7-a5b8-17d0fcc71f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687220, "uuid": "62eab470-b87d-4923-8efe-7a6d2a36afde", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a4f5c9-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1635692954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692954, "uuid": "4d8daad4-52d3-4c69-8196-41665224ba76", "comment": "Malware payload (Neshta)", "value": "931568b982ac42dd2edc68ff203ec101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692954, "uuid": "85396af0-7dbf-4660-a6b2-1a984a448536", "comment": "Malware payload (Neshta)", "value": "16f75019c7de5d79c259d4b1f1003938bd6449ce3c49b28d6320bb43dd6bd82a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692954, "uuid": "74f44e28-7755-4f78-8512-48016cf9817d", "comment": "Malware payload (Neshta)", "value": "9955f4d4fd6e0000a908e99116d5d22c6371b255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692954, "uuid": "6ec572dd-ba62-4ae9-9d13-fc7ced820941", "comment": "Malware payload (Neshta)", "value": "4bae34d59d0baadd231d35334b6a9a8c8c520020d23990abfd4ffc9b7b436569191f02b819ee8310c0144df7403a5771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692954, "uuid": "23366861-1bab-41cd-992c-0c90ddeb1ace", "value": "T114540255F9E1C8B3D0221A38DD3AD7B0917A792279306597A7B41FEFECB53C2680C14A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692954, "uuid": "b44fa53c-38b0-4a90-8382-d0c603a84034", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692954, "uuid": "94dae553-4d82-4fbd-99a8-ad565d14ea01", "value": "6144:Pu/vLdNnaLNu0ELLFUH50QsVMxi6KjwBsG14ugTqi77cBlL/cw2:6RNv0iZ80Qhxis14Jqi7KeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692954, "uuid": "f0988e75-08ad-4f75-8237-dccc7df62b5c", "value": 281781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692954, "uuid": "72fcb940-2949-405a-8ce9-5bc0919b7a1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692954, "uuid": "30d69fd1-5367-4404-ba2b-65713401935f", "value": "931568b982ac42dd2edc68ff203ec101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbe7ab9-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635693103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693103, "uuid": "d3f185fb-5cc5-4a61-9f63-6082efe9f76a", "comment": "Malware payload", "value": "443c306b2728e96474dfb7392d94cc5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693103, "uuid": "7c3fb110-1b20-44e2-8386-139cf7fee277", "comment": "Malware payload", "value": "1764a3523eb73d0b632820c013bb2a723fbb3779c7eb59c7e0b67cd488deda6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693103, "uuid": "7c06958f-6010-454c-a6a4-3d24e3835c50", "comment": "Malware payload", "value": "d2aad42cc1e0cded7cf6adac9841151851cf575a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693103, "uuid": "f169f09f-aab4-4f05-9f4a-be918152fc8a", "comment": "Malware payload", "value": "7e20aacc53b56662106aaf5956e9512ba98f80f52c76ecb0f757abc66879ec8531b87cda3e649861916815116d4b7ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693103, "uuid": "0bc6de45-b90b-4647-a256-3073b3fef1eb", "value": "T15B64121603A0A336F6FE133E4A415191A3EBB851545ADF1E4D897BD73E707092883FBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693103, "uuid": "2440bdcf-fc31-4151-a177-1dedadc79a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693103, "uuid": "d0c19dff-6f2b-426c-87fa-0a2e7548e538", "value": "6144:5vpjkGPKxR+toDwuXoX/uklQzj1zSozes1oaOcB3VyY9W1J8AsXPVQcJ:xNk7A8aBlQHusyaOcBIY9aJ8tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635693103, "uuid": "edbf2fee-e2d8-44b7-a24f-9aa56506b97d", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635693103, "uuid": "07300d3d-e7a4-4968-ae4b-cd194fba7eb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693103, "uuid": "f4ac5308-7429-4a39-91c9-e1cf62f3ee1e", "value": "443c306b2728e96474dfb7392d94cc5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b4194d-3a35-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635676075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676075, "uuid": "ec6b7f06-8a3f-4191-a92e-d8f1548b136f", "comment": "Malware payload (Formbook)", "value": "c143e48329117200f2fed704dd8a3427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676075, "uuid": "0ca0a36e-f40d-493e-8b74-18fac5779779", "comment": "Malware payload (Formbook)", "value": "1910bc92f591b3feb607aac1518fe2cc6c834b627b76637cb27464006e072a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676075, "uuid": "77e2f8a1-f2cc-4ee8-a92d-9154177b6e87", "comment": "Malware payload (Formbook)", "value": "14bf703e576ff1b76b9ad540fda7bbdd748e78c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676075, "uuid": "c8497b86-b5c5-4c15-84d2-b6a784174984", "comment": "Malware payload (Formbook)", "value": "836a02dbcb11edb48aa1edef2b38346b5c6e6fe510a9197da4cdd9d7e512b87f83c8660a2fbb110d6e5acb16c7fe7501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676075, "uuid": "7daeac51-e320-445d-b30d-f48bebf48acc", "value": "T139D4AE90A69194E6CEF81E7B6E1AEE300B217DFCE125846531DC3D9F75F6AF30244292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676075, "uuid": "c3ff23d9-042b-4053-b35c-612191a6d8a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676075, "uuid": "5cccc9ee-6060-4598-8a4e-138abaec7e7d", "value": "12288:SSMGMjxDLOgrWm6bZlrlxeFe5UkyQF52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMB:p1MjxD6kWJ5YWB52MMMMMMMMMMMuMMMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635676075, "uuid": "34f23656-2f4b-44ff-a4b3-c924bbcb5c17", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635676075, "uuid": "4f4d1e29-489c-412e-91c6-ce4ef221d1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676075, "uuid": "067f0e74-828e-4330-b7cb-8778026616f0", "value": "Reversed Invoice for new products.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da416e9-3a19-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635664116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664116, "uuid": "b6c7f614-d249-47cc-83b1-09ff42ed6637", "comment": "Malware payload (Smoke Loader)", "value": "38bac4d4f6a7f2f0168ce3de540597c4", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664116, "uuid": "c2b83db9-6a57-405f-9f31-30a7e1598514", "comment": "Malware payload (Smoke Loader)", "value": "1a4e910b9002668467538442a8d37376fa3101a8174ee3fa771d5b36dc0afaea", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664116, "uuid": "e39f4ace-65ad-4156-b47a-bf2b5a289dcb", "comment": "Malware payload (Smoke Loader)", "value": "827820612c01da9d610cfc0c4043e6c7348eab4a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664116, "uuid": "26f552ca-82c6-4b65-a814-bd78530b6a4b", "comment": "Malware payload (Smoke Loader)", "value": "6edc773fad26c6ff0a489a3671f14ca7d5947d63a39ca24e391c3d54be1f51bb30e2471ae1411b87e5c55f7df639bbdc", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664116, "uuid": "7a1d5450-2083-4d64-945d-1ef48fb4243d", "value": "T1DC049D3036EDCC72C4A706308864DAA5DB3ABC21577091BB2794372E5E70E9C5EE635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664116, "uuid": "0c486bc3-8a08-462d-bc9f-83ae1d3daec8", "value": "c0df013463ae9c6441312a1218343a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664116, "uuid": "2eb0d4cd-25b5-4a63-bc24-12cc22710658", "value": "3072:PQuPIsPKxMhLHjC40hxEgC1YM6BBNwaiZTtdlM1s2TWrxpzbgqru:9PI/xM5jJQxEn2JnkRtd6sKuzbgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664116, "uuid": "5f39cf04-171f-4739-ae1c-3df1a9771176", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664116, "uuid": "04f92dc1-f19b-4734-9ada-1f7998c181c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664116, "uuid": "185719ee-144f-443c-8a8d-0a22fda3caae", "value": "38bac4d4f6a7f2f0168ce3de540597c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e405c49-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635665083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665083, "uuid": "bf0e37ae-b817-4b36-af9c-deddabf964ef", "comment": "Malware payload (AsyncRAT)", "value": "b499879ecff174810433dd79baa219cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665083, "uuid": "625d5c57-3c7e-4702-a216-527990d9690d", "comment": "Malware payload (AsyncRAT)", "value": "1c785e22bdb2aa3ef8f6064df5f14d81ec5bffa599500326308fdbe1ee21bb30", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665083, "uuid": "86e34992-ea19-4f31-918b-8e1fd2fe90f6", "comment": "Malware payload (AsyncRAT)", "value": "1120e6705d8611d54e459e451abb25670c9bddf0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665083, "uuid": "d44dd7d3-4326-4338-97a4-8a1e5f9462ee", "comment": "Malware payload (AsyncRAT)", "value": "70fcdb1cdef131aea3a13c1f8247e0b006ca2a1e9213f4d104743bb0414e8ea636da5c868ee5482865c2a1a3bbb9d33d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665083, "uuid": "093c1983-d5f8-4057-aeee-ea39574a4c5a", "value": "T1FF64233121E35CF3C98786305FFA53B0D5AEDA062230634FAB64AF7635B09DB8A1B505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665083, "uuid": "d57a4d3d-7859-493e-9834-51e7a60b930d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665083, "uuid": "54600682-ce05-472e-98ed-216214a1c163", "value": "6144:wBlL/cYSKaiJVj8L1h/b1VBOxzTR8D8I8j6o6MS2C2XGONWeLU:CeYSiTI1V1VgxB8D8qJMSZ2XGONWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665083, "uuid": "5b06cc9c-f49a-43ce-9aa8-aff03f403aeb", "value": 322704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665083, "uuid": "d09fd1e3-66d5-4081-a8d5-4daac4d46fca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665083, "uuid": "4cc0f38c-6520-4f24-ad3f-7ce96898491a", "value": "b499879ecff174810433dd79baa219cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef4b043-3aa4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635723737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635723737, "uuid": "330575dd-bea2-4616-935c-cc5726d68bce", "comment": "Malware payload", "value": "d34fd02784523412a00ac63fdbb21e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635723737, "uuid": "d5076baf-84b8-4a25-a0e7-332a7def527a", "comment": "Malware payload", "value": "1ee9bb4e8bcabe197399b654dbf940438b120af1c376719ff9bdccf2bb1dc606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635723737, "uuid": "361e7b2c-a3e1-40e2-89e9-4caebf85dad4", "comment": "Malware payload", "value": "88715f6200ee11ba44726568796e1a0ccd368999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635723737, "uuid": "d03228d6-29e9-401f-8345-db0f11ef28af", "comment": "Malware payload", "value": "a4def5992a5a3fc9609ba820fc8d6fa4c20e4a8a01700594353f6eb58540d317249e1506a2402848a8ea539c48484592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635723737, "uuid": "915814b4-bc92-46fd-bc53-66a1d104dabf", "value": "T113846B5AE6F048B8D96BC278C9B74716E7B2B8481360DAEF23A456651F33FE1463D700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635723737, "uuid": "8bacca87-dae5-4e85-a66c-2d7a4e661474", "value": "6144:5DP0nV6wncqWvM1ENuvd3FNy7E/XxFL6uqmLrxMOHWDf:5j0nV6wncqW01ENuRFM7iXX6ZOHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635723737, "uuid": "f2d78ad6-20e2-414f-827f-dc48ee73c353", "value": 395327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635723737, "uuid": "0d9d7226-c315-4acf-ab78-7ace0a45279a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635723737, "uuid": "a39fe04b-6317-47f9-8159-b3fc5b12f522", "value": "1ee9bb4e8bcabe197399b654dbf940438b120af1c376719ff9bdccf2bb1dc606.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba2c773-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635692727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692727, "uuid": "15496c9b-ed6a-4070-8645-2437a22b8227", "comment": "Malware payload (SnakeKeylogger)", "value": "6df2e325b036328968b45911d6bdde91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692727, "uuid": "d766a251-a2c5-4cb3-ad89-d3896011651c", "comment": "Malware payload (SnakeKeylogger)", "value": "1f53b933ba4b54f34bf8d9888d86f71c95a8e201611da32369b464d959efaa27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692727, "uuid": "1a67afef-b213-4466-93bb-c2b91d51a8d8", "comment": "Malware payload (SnakeKeylogger)", "value": "ec636b87c0f1a58495395b660bca585794c02ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692727, "uuid": "35205f03-cb9d-4857-8527-d1d30fc51e47", "comment": "Malware payload (SnakeKeylogger)", "value": "ef4c1c84c369e29a85a663654709560b4b62edf95f38b4cc5b7f0136fce0c989d417ec8b1f51930fb003a59b8a71dd0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692727, "uuid": "3c5eff2a-3f53-4b51-8791-c411689e3138", "value": "T1F254120813F99722D9BB0FFEA1A1900C477972993701E75D1A80705BBFBB305991A6EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692727, "uuid": "8114d278-792c-4b32-964d-b467b3feb976", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692727, "uuid": "bef8ab0b-f75b-4f54-ab34-e224b015aa8b", "value": "6144:a3Aad4a8z72kzLR0sdRjVk08neykpvJ3SMuorfV+Nc6EfMqiCC:N3/LyCjanehZVZuw9JfMqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692727, "uuid": "e42c907a-f302-4ed3-857e-595ca1c6ccb3", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692727, "uuid": "ef692da1-5aa1-4257-95cb-88aeba7b574f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692727, "uuid": "1d4e66cc-81b0-4d3c-a6d8-e2ba6e0639ef", "value": "6df2e325b036328968b45911d6bdde91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9db5a4d-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635717931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717931, "uuid": "a647e67e-ae6b-4dba-ba0b-16dea1d11d57", "comment": "Malware payload (Mirai)", "value": "ddf1909101b3d8a73f6da2c28e8c0bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717931, "uuid": "6ed5ac0d-a331-4f17-9ce8-b16df431605f", "comment": "Malware payload (Mirai)", "value": "1fb6db937930f208f181522db027772daa49b396dfe072e01a9e0952f782f061", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717931, "uuid": "6db8f0f1-71d9-4148-aec6-f24afc7100d2", "comment": "Malware payload (Mirai)", "value": "573374cac29ce6f3fe0b7034e2fe7dc5e7ad1120", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717931, "uuid": "7478cd98-1225-4f48-ab16-140fa683636b", "comment": "Malware payload (Mirai)", "value": "2e344aab47eafc5fa32e334a1353c8d2e892f9f70a5052f3e98d58176e14fe2a0184bb4b7de8c7684fd504e19e6b2f79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717931, "uuid": "5c3cc1de-25c4-493f-92cc-d0f10bcfa03f", "value": "T179D33A05D8909767C6D227BAF79E428D73236B68A7D733115A28AFB42FC1B9D1D3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717931, "uuid": "53190b03-51f0-4fc3-94bb-02de37e3d0bb", "value": "3072:gVfyQ+d+pceQGfUbvTapLFhWOiwTteqHY45hLtk3H94G1ZZTMmydQCYMhEFg:/bvTapLFhoUHz5hLtk3Dv4mydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717931, "uuid": "dae3b33b-3b05-4695-a02f-52553857c79c", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717931, "uuid": "241ed8f0-c4e4-4bc7-ada7-c2e77964ced6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717931, "uuid": "55bfd9ae-0d9d-43bc-870c-16340a594712", "value": "ddf1909101b3d8a73f6da2c28e8c0bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2e14b5-3a19-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635664164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664164, "uuid": "1c55ccd7-9cc5-4045-8e06-7305687fa31f", "comment": "Malware payload (RedLineStealer)", "value": "5b721c41b601f8b913f9dfdcd6eda73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664164, "uuid": "7f5ea770-c716-464c-a11b-e788221618c8", "comment": "Malware payload (RedLineStealer)", "value": "2169180da6a8db79b150491ce14b4b7c8718c1121d0a197bfafe0c14b1e82cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664164, "uuid": "8f2e40fe-e8fd-40b6-86f9-ad90124ff110", "comment": "Malware payload (RedLineStealer)", "value": "b10056899f861b7c3144310edb1cf57988bf97c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664164, "uuid": "63817c60-2efc-4652-838b-15f88abd6bfc", "comment": "Malware payload (RedLineStealer)", "value": "f59964196ac93f149bd8fb92bfc0352130468ba89c5515221c607e0420cc7906ac387d413358dbcacfff7175e705c881", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664164, "uuid": "c8d73a6d-5dae-46e0-a8c0-f6a5fe94a01c", "value": "T10DC412313159C039C6A74533D5A58AA506FBB812C5A5418B3BC5277E1E30EEC9FEB32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664164, "uuid": "d538928d-54a2-46a2-b2c5-e29b724ecefe", "value": "c0df013463ae9c6441312a1218343a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664164, "uuid": "07c525fb-6e24-4c61-a670-f0d2db40b1dd", "value": "12288:1AP24YDZe4ULdjX6TnW/Eo9Y3k6K0sFnDViPjZ2ztVXF/MQ2+jsHunnN:qIstLd+5oS3xsFnBNbLj7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664164, "uuid": "bfab6349-facf-4a7f-96b4-90b20757895a", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664164, "uuid": "7530b8a3-5ea3-4d05-b0ba-4be7713a1401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664164, "uuid": "b36e6de6-981a-4914-b716-d4ce2538f6cc", "value": "5b721c41b601f8b913f9dfdcd6eda73c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd238d31-3a37-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635677268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677268, "uuid": "09e818d5-067f-4ac0-9d82-76038268d3b2", "comment": "Malware payload (CobaltStrike)", "value": "0e213ac3a9359c792209af3f36340827", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677268, "uuid": "5641cf99-8a4c-43c8-9e2f-a668bcc7f442", "comment": "Malware payload (CobaltStrike)", "value": "279ce2cb987153384169af66cb691a952254f97e4665f3ed126afe61664ff128", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677268, "uuid": "f52ea58d-b0e9-4088-8092-f925ca16dd8c", "comment": "Malware payload (CobaltStrike)", "value": "2f10d29c523a99934e9e4d974e47edc5391699ef", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677268, "uuid": "f1cda361-d562-4dbc-9213-f3a777d2c501", "comment": "Malware payload (CobaltStrike)", "value": "d3a15b0444600dbee38bad6ad9fd8ea603e8873fc179f4ca9484fb55fcf5b9c32ea484ce0d18c1fa9ab52d49353ce174", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677268, "uuid": "fd8e60de-de8f-4cf2-b3c1-fd7ca6d1c512", "value": "T1FB24E037DBCB68B8EC755B74608142FF1E6B103359B730E2D6F2D96D0D0EA26780A526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677268, "uuid": "641d6b50-884e-44f0-90c0-285617a3a17e", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677268, "uuid": "c2c93a35-ae9d-4bd9-bc7e-d6c8b5ea3d61", "value": "6144:zEjWuY72nWHeJHRCZHnEgKaKKKKKQKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKH:4CV+WCx+HnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635677268, "uuid": "48e518eb-7756-483f-aadd-e016aafbe42d", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635677268, "uuid": "b98fd2a7-803d-4ba6-b7e6-34982c6b577f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677268, "uuid": "7d6d961a-d729-4722-ae27-29c17043443f", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda1c801-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1635693080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693080, "uuid": "aac86683-566b-46a3-abf8-279822759ac8", "comment": "Malware payload (QuasarRAT)", "value": "163658a6f37d558724e43f6f30ad4a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693080, "uuid": "284bbfd6-11c2-4aa3-a6db-906b49c82d20", "comment": "Malware payload (QuasarRAT)", "value": "28d0ac2b1be7545097b6594c9fa467345214473dc91ea83b245735894e47cb61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693080, "uuid": "c15dcf84-114b-41ed-a6c9-815e36147b49", "comment": "Malware payload (QuasarRAT)", "value": "4e2c4c4ea060b5044598d5f404b0102f65a2e4cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693080, "uuid": "f10dc8fd-4879-4195-9777-00407d2f50d3", "comment": "Malware payload (QuasarRAT)", "value": "98b24f064c7ae022e3af18a96141823988ffa381185cc4ff5b079bf8befcd0bc6c80e155fdd9cdc8be115d17bc096a0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693080, "uuid": "468531ee-1122-4e47-bf2d-1225312dcbcd", "value": "T150D55A1573F80E2BE06ED7B2E5B1002A57F0F81AF3A3EB5B218166791C63B515D412BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693080, "uuid": "48b9c9e5-bb56-4073-8665-63e047822c5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693080, "uuid": "e38b4506-7c02-45f5-9bf1-9bd41df53da7", "value": "49152:ZAA1/64VAI5jOkaEiJXApzkGDKzHjfskza32ehyfTmBDm:ZAq/64VAI5ixEiJQPKgBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635693080, "uuid": "0339c5bc-07c1-4262-9676-f06775e36f5c", "value": 2898944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635693080, "uuid": "6766a392-00aa-43e4-bfea-08887c070a1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693080, "uuid": "e852d9e8-9a3b-4716-8d42-ed638b9401f9", "value": "163658a6f37d558724e43f6f30ad4a0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad80d171-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635717937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717937, "uuid": "a4946e05-138c-462f-aa56-ac862a6e9713", "comment": "Malware payload (Mirai)", "value": "244e2404db3861daba9bf6ed46e7c133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717937, "uuid": "3ce26c1d-3bd1-402a-a9db-01dacfe2b2e4", "comment": "Malware payload (Mirai)", "value": "2acbdbb6b4a1c2b9be6c6eb3d24246bcdc3ada0533642d433660a8735f5ff866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717937, "uuid": "8564c3da-a74f-4a11-9751-2d5a095e7c58", "comment": "Malware payload (Mirai)", "value": "28e04e6f649c87c7740c25fe0f7924bc8c6c0ac3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717937, "uuid": "b269586d-42f5-4ac1-a4c0-a25d79573812", "comment": "Malware payload (Mirai)", "value": "acaf192d1a89d8bff8d1d442246aa8ab2d4d90236d7fa84430e57e0b503d663cc0c95906a079f77add913e5f5c10cb6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717937, "uuid": "5d75d9bd-a62c-48da-93e3-9624a229efb5", "value": "T1A3C30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717937, "uuid": "8d5ce69e-db6a-4ba8-a6aa-fda7d7973e71", "value": "3072:EJDZ+6lJQTnoo3YKdLrLmkx7WC5hL9cuXE674eoC9DQlD6ObAF5R:LXmQKC5hL9cuNVoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717937, "uuid": "767cc383-cf9f-46c9-bded-286c3a503e65", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717937, "uuid": "697fcd14-5be8-4861-b557-8f6aae1e2997", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717937, "uuid": "9a0fdb46-6e42-48c3-854c-057adcf81ba4", "value": "244e2404db3861daba9bf6ed46e7c133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a326bf-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665344, "uuid": "fab7e928-e64f-44ae-98bb-84ad33154008", "comment": "Malware payload", "value": "d4103940fc73ad2c938eaa14e02535f5", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665344, "uuid": "b27e1aae-13fb-45d5-9ac1-836226ed10e9", "comment": "Malware payload", "value": "2c171866307fd99be1794a073a3b4a13a840319892de8f758057eabc650e7951", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665344, "uuid": "6d1ca536-3ad1-4f2d-a402-181d2adb7989", "comment": "Malware payload", "value": "e13a9ced3c2616bf93ca261fcb94c74f23ebc53b", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665344, "uuid": "436e90e8-f16d-4acc-a43f-e705ab8e36f3", "comment": "Malware payload", "value": "52322074b4e5aa3561443a94d27d772684548078ad51ed51424f079ce29763e34bd2d4e315e9177ebe4be8e4b054d754", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665344, "uuid": "1246c610-9e92-4210-8246-e124680a01dc", "value": "T116A24B01F3EC532AD8BD8F796CF242010771FA878826EF4E58CDA2991E373945B05B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665344, "uuid": "d581eb8f-f0d4-4223-b02d-d8dca2a5101d", "value": "384:DI0eFr3gT29sZHYXCRNyNAM8wHZ8QPU9Il3RCCwiWwpraAhK0Paq7w:8jFr19sZHYXCRNyNjbaS90il9amt7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665344, "uuid": "74186ed1-c164-4315-b505-341d362bcca0", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665344, "uuid": "517e9f43-8466-48fe-8c9e-2ffdb26a46bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665344, "uuid": "8c8eec5f-2938-4023-8a89-fe4fb393635c", "value": "2c171866307fd99be1794a073a3b4a13a840319892de8f758057eabc650e7951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b05a509-3a98-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635718550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718550, "uuid": "2ee9fb76-fa1e-4d8f-896c-bc03917846f2", "comment": "Malware payload", "value": "258798b252e692430052f5e5be7adda0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718550, "uuid": "ee1b4f8d-06ee-4ec4-ac30-e0a1d4a696de", "comment": "Malware payload", "value": "2d1e2d6b40087947ca8ef5c550b6eafee045fda4bc746a413cdbaf65f9b2f365", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718550, "uuid": "a01472bc-8cd4-4cd6-b925-2554566a9049", "comment": "Malware payload", "value": "64cc18e1eaab5d92ff4731a9443b69e1e9ac44cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718550, "uuid": "35fe2446-3a18-44eb-9f85-511721aa88ae", "comment": "Malware payload", "value": "63df8190c1ec69ae9741b77d4d7545af78dc5345378efecb1d027713312e7d9d906853492586e93b1bd9c198c22a3930", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718550, "uuid": "5fb2fcd9-0e5b-4daa-a668-d2740dbef6f2", "value": "T1B273C7B7416194A6C1892730F4B51F0B3A7CC6381980B698F04FF2AEDC1D69D9EF87A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718550, "uuid": "513b0acc-addd-444d-b4e7-a3e8bb650987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718550, "uuid": "df530513-c52f-4bad-a20f-05b1f85abe48", "value": "1536:MOPAY2EZEro0NoY2JTeXePKL3N9ggf3JOLd:MOPA7BNb2iD/ggf3JOLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635718550, "uuid": "9c522a22-d9c0-4461-b21d-3004ace3abe0", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635718550, "uuid": "133c0098-5322-40ee-bfc1-4a56a9cb156c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718550, "uuid": "4bddcad1-5cda-41ca-945e-02ade8e3b728", "value": "258798b252e692430052f5e5be7adda0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75366f5-3a58-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635691405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691405, "uuid": "177beded-1934-4e1c-a0b4-267ee76f31ed", "comment": "Malware payload (BitRAT)", "value": "b443a69966fbb1c0a32a468ca84df138", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691405, "uuid": "84ee89bf-5a04-4a5a-a1e8-d28e17ee1a85", "comment": "Malware payload (BitRAT)", "value": "2dbbd9bfef3e5cf4a47f48182e8cb7a8e94dc6d4eacc709402049ff14d7c9055", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691405, "uuid": "0e3435f4-7e13-4ade-b8a0-280bee8bc2f3", "comment": "Malware payload (BitRAT)", "value": "78f736ada2bc1fecaad128a21fb1a7fb353cd7a2", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691405, "uuid": "363eff70-79fd-43e6-b0e4-c98e2bf58fb3", "comment": "Malware payload (BitRAT)", "value": "6e48875669b4d6c5521a73890239617c47cedd248c7606dd972c786383c42797f3c8ae2b59fc427688f89418e6dec21f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691405, "uuid": "f89861ac-8474-4fa8-a23a-eb6966c552f0", "value": "T192757DA1C54045B2D5221A34246FB678556A7F3639ECEC0AAAF97C4A0FFB1C23039DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691405, "uuid": "ae37a13e-5d60-4917-b349-174e573e76c3", "value": "12288:KhHWm3RcYRn9vyZuZkxx46hPXBfwLHvzScQrlbPNOCFPwQtoGkjc75ZfTZ:52Zn9viuZkx1hhqP+j//F4VGkjSjfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691405, "uuid": "aefaac8c-61c7-49d5-9760-43e751e227e9", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691405, "uuid": "8d419061-857e-45df-a1b1-377dd0040b6f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691405, "uuid": "5c4f9296-06f0-49a1-b3a0-a57fc18aab65", "value": "dhlfffiles.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b02f0a2-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665400, "uuid": "c72b7e08-904b-4443-834b-0b09d00690b4", "comment": "Malware payload", "value": "443afa319c77befa84749a668a89a8b8", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665400, "uuid": "7315f704-9855-47d4-8862-9c42dab9f44f", "comment": "Malware payload", "value": "2f9e50d0785c1066c71cf0e97a4dc9eb8e8ff57df68f7101259735b262a15421", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665400, "uuid": "1030455a-0d6e-4acc-85b4-2f9dde27713f", "comment": "Malware payload", "value": "2157eb69f1af1612abb0be7e283f49aa1e3e10ef", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665400, "uuid": "b7b17631-2d83-4c6e-bbd5-67617ea8d950", "comment": "Malware payload", "value": "d54ee751fdff259b0ae7d2cb0b00388ef1ea855b5b314c4c7571b706b6629294c4ca6fcbd99021a8b623e6b51e008318", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665400, "uuid": "a5d19942-0ef8-49bb-966c-41197986ebe5", "value": "T1E4A21805B3EC4326D8BE4F7AACB146010271F5878D23EF4F588DA2991E3B3A45F05BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665400, "uuid": "bc8f2718-0371-4815-9b6f-0a75ca6a915a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665400, "uuid": "dac26d8d-d728-463c-aa67-115aec33a204", "value": "384:DNJQ8TBYwrYajjJ30GqQrNese1GjZ8QPU9Il3RCCwiZTpraACu57Ynww:c8SwrYa/J30GqQrNh7aS90iN9aIcnww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665400, "uuid": "690c9eed-3b37-4be7-94cb-b2594b89e56e", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665400, "uuid": "19c3dc89-b19c-49e0-a2d9-81c7f4df7192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665400, "uuid": "0653bb2c-2a7c-4f44-9e31-5b95e73a5d9b", "value": "2f9e50d0785c1066c71cf0e97a4dc9eb8e8ff57df68f7101259735b262a15421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0897d0-3a95-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635717530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717530, "uuid": "b523df9a-e6c0-402a-9e31-0fbb5bbc60e8", "comment": "Malware payload (Mirai)", "value": "89b67a45d974950c179502082ea40674", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717530, "uuid": "517701ee-49d1-418a-a5bf-1cc6a82f8786", "comment": "Malware payload (Mirai)", "value": "2feb90c0489bdb7c966f09c3d0c03e7326c467a4bc850a5dde4ffd04eb2e978b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717530, "uuid": "a79bf355-866b-49bb-ad62-ffba72f023ed", "comment": "Malware payload (Mirai)", "value": "e8dd78e779942488e3bbbad59e0c5184f1dd6dc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717530, "uuid": "9eac4a7c-6297-4b3f-be3b-b84e38473431", "comment": "Malware payload (Mirai)", "value": "f76d815d066f9095fa68d27692af57dde897e8175b52dadfce1a046863e4684937ce1f659df3ec4dec2b5cb1c11ad3d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717530, "uuid": "9e6fcc9c-08fe-4927-90ee-1679fa555d94", "value": "T167B32A0798615F77C045ADB129A75530072BBA120F8F1F9AB57DAAB4074F8CEB40FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717530, "uuid": "c1cdf1a2-331f-4b34-905a-5c8fdec88953", "value": "3072:bMTwsiL+Y94kYgSsU5hLw0rXiILkY0Px9gQNfR:bMMLK8PSsU5hLw0XzLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717530, "uuid": "4118c34c-a660-4b0c-9eb2-0aa3dc422a83", "value": 108423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717530, "uuid": "4d7a03bd-87b1-4134-a7b5-7daef4607bb5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717530, "uuid": "9bf85e16-99f7-4407-874d-5346e3050f3d", "value": "89b67a45d974950c179502082ea40674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1bb08d-3a1d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635665967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665967, "uuid": "0b81ff99-74ab-4fcc-a55d-35feec7342d4", "comment": "Malware payload (RedLineStealer)", "value": "5a6395afba5cc57f21c75c78fbfdfbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665967, "uuid": "1864c617-8ac9-4ecc-8c67-8b28fe2bd8d4", "comment": "Malware payload (RedLineStealer)", "value": "33465a3c5546d6863c136167f666d58513bab040dcabf3c9af8b8e807a25f1d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665967, "uuid": "3fe3d6ee-a9f4-49f3-a3a4-306665b782a3", "comment": "Malware payload (RedLineStealer)", "value": "c948a3e5220228de9d35181d8577c61984f653cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665967, "uuid": "0706d54d-1e10-47d2-a62a-d28d00ec010b", "comment": "Malware payload (RedLineStealer)", "value": "bea99c1cf31d2f15bff665a7712f07a270a0a5f0896d0203c9e6a47170cc02819f08af666d1175f753ceb6e30c8d17ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665967, "uuid": "6d8f9adf-0932-4369-a068-ff327c50dff6", "value": "T147A40B6CB1C28E23D9816E7BC7A3DD50BB7348C7471347C8974A8BF24A1E1612E19ED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665967, "uuid": "1d6a7d01-206e-4e9c-9532-a67e2f9c3962", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665967, "uuid": "16dc06d9-b3b9-4e99-b892-5feaff9c7e90", "value": "6144:wxcdclPwHLi2OJ8mc2XzA+6ZtP73lPlaig:bdKPw2jJ8n2Xz2Pblng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665967, "uuid": "7d7d130b-1a60-4741-8476-a000f48d1a0c", "value": 464288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665967, "uuid": "42b01e17-a98d-4ab4-be08-815e8440abd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665967, "uuid": "bfa929b5-57b1-4653-ad0a-53dcc0f2732b", "value": "Genshin Impact ModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc87198-3a15-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635662504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662504, "uuid": "8e8c6b05-37a9-463e-986d-62620b94b701", "comment": "Malware payload (RedLineStealer)", "value": "278354cec44960f94d8bda95c6a44a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662504, "uuid": "218589f8-9a67-4487-aaee-12a04105502c", "comment": "Malware payload (RedLineStealer)", "value": "366fd1b85db7bccfb5884996d3ed5542a733fade1d927d48ba88972f50d3baec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662504, "uuid": "905ff5cf-e1b8-425f-96a3-647579334860", "comment": "Malware payload (RedLineStealer)", "value": "18283423b9861cb7605ae29ca017f73d9d70a91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662504, "uuid": "c5e0ff1b-a9ea-4553-b7aa-bb7382e39307", "comment": "Malware payload (RedLineStealer)", "value": "16df04a85122bf158c1d5b14c534800e71b3a99504a1d01a1e8d6dacc556ffcd49f3d2bb3e05fe66dad727d30bd50df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662504, "uuid": "54228a3c-abe5-4115-97d9-db1b922c1e29", "value": "T1AA753328C1DF0846D99F893290CEFA52C63D3B89590664F9301F15FC5AE258FA7BA1F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662504, "uuid": "72046373-ce99-4c52-b50a-a7c2199f5c97", "value": "94e2b0572ac9e87d08b3c525a2cff4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662504, "uuid": "2f510638-e85a-4abb-b4e5-61b910777833", "value": "24576:VBmAMdROKok6IsDKrM/za0Xn5JQ2mTkjhcfygiVejFR3ReYwxaBf3/I:QdRLwIKr55eJfDrxHdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635662504, "uuid": "a63bdf1a-56b3-45d7-afda-c64f02464ed0", "value": 1622984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635662504, "uuid": "2b1eb0c8-27e9-4881-a011-021a1b4fc55b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662504, "uuid": "2c7f6959-622d-41f7-84d7-e4f27f3ebb1d", "value": "278354cec44960f94d8bda95c6a44a30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b129828d-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635717943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717943, "uuid": "d7419851-1ec7-42b9-9103-38f2f8792ffc", "comment": "Malware payload (Mirai)", "value": "8f680540877b3775c1f9d82fbe8521a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717943, "uuid": "28041263-208f-4ef0-a17c-467d4ec2e915", "comment": "Malware payload (Mirai)", "value": "36ba6a7e678a10299db9c33c31667030b8960746c79adb9e29b2dec378cd8920", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717943, "uuid": "e64376ac-d57a-4079-ad44-006f12663ddb", "comment": "Malware payload (Mirai)", "value": "3c3a886c0976ab1782a9ed918f3d99ae9a899cce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717943, "uuid": "a8a54a2c-114c-459b-9c16-34efa511b45e", "comment": "Malware payload (Mirai)", "value": "b6e8c75c0a395d671adf7c60ed7e6a841c5ebae3f5bf0ec06748d09d0ea0788bb99af775260bd74e3db04246d7962871", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717943, "uuid": "40185148-e85e-462d-8655-28e8416d37e2", "value": "T19BC32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717943, "uuid": "e1ce0c05-dcef-4bbf-8c9d-dcccce2063e6", "value": "3072:/YNa/GLBNPoQJphakpiQ9/nYEP/UnSQf/R:6a/yloOphakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717943, "uuid": "04262ef4-1fca-4e09-831f-b6eb16723a29", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717943, "uuid": "9dbbd20e-e422-4122-9f36-4c0848cfae90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717943, "uuid": "d017a0d4-02a1-4348-a95d-e6b795990cc1", "value": "8f680540877b3775c1f9d82fbe8521a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bc78f9-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665335, "uuid": "c8a0d675-5769-4a72-9398-d59af854e728", "comment": "Malware payload", "value": "9fa8fbbfce777aa16eb5e89267f6976a", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665335, "uuid": "d5ee88bb-127f-497b-a42a-5982ffc8f9ac", "comment": "Malware payload", "value": "374357e26796f4861f52b8be0e215aea70154d3e72ecde8b82adcdd57ce084da", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665335, "uuid": "703f40d8-53cf-4631-bc12-1061e3121266", "comment": "Malware payload", "value": "576c30aadbbb8ff9713dda8e7309e1086909d324", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665335, "uuid": "8d1df3bc-98fe-4743-ad50-8ad7fecdb907", "comment": "Malware payload", "value": "e9062028f977f48bb5d5538bf07bdf39a96a7487cfcbaff440f5ab3052eab236febe48ea5c2b8eeb1a52fa5c2857db94", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665335, "uuid": "0d82e68e-85be-4f68-9569-3af7706e64d1", "value": "T1E9A22A05F3DC432AD9FD8F799CB1460503B1B5874D67EF8E088DA2981E3B3A45B05BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665335, "uuid": "29fe2387-ac34-4b45-b970-4b6a1b4f45c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665335, "uuid": "e678b3e0-9834-4acb-b9ed-f2762635390f", "value": "384:sNJQ8qxwfY4ovGVHztWKjHRmNApxwZ8QPU9Il3RCCwiWwpraA+Kg+D6w:/8ewfY45VHztWKjHRmNYSaS90il9aqDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665335, "uuid": "f3ff20a1-b189-4bb2-9324-8ef20ac6f832", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665335, "uuid": "6b05f751-77ff-4b86-ad07-ec3943cb3228", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665335, "uuid": "a59662b7-06a2-4439-bed0-a7e4c7218a84", "value": "374357e26796f4861f52b8be0e215aea70154d3e72ecde8b82adcdd57ce084da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5706ee01-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635664964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664964, "uuid": "8ab2835d-8983-4722-b293-d9c14e6fa797", "comment": "Malware payload", "value": "e30b52c5805f693ba614f702db3c5782", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664964, "uuid": "e58af6e6-200f-4a1b-9d94-e04dae17a7fd", "comment": "Malware payload", "value": "3c867e245d6b7aa55ce5953233351480fc20ad89715487638fad2022c697ec21", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664964, "uuid": "f43b7b43-a22d-4580-b069-f36c2dd1e81a", "comment": "Malware payload", "value": "36fe713d009adbf4d1fe662ff5a9dcd7897c7aa6", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664964, "uuid": "d106ef11-bb32-45e2-9590-28e87b226267", "comment": "Malware payload", "value": "049971360d5ea024829e12b065860dbbaf080d49fb025168deff7ac3edc2c5f7413b19c3f9681f676cf7717e9566ec4e", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664964, "uuid": "9ca6a8ff-d7e6-4b8d-8aa8-255347b78bc6", "value": "T189C22B0477C98F22DDED0BBB5863670153B8D291542BFB491ACDE09F6E737944610BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664964, "uuid": "b343d9e9-2e28-4f42-989f-f567576535c3", "value": "768:TD8KfhM18gofcrIdfAKZdzflPlZNMBRjw:kKK139FIVf1FMzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664964, "uuid": "372b0a50-e802-4ab1-a363-c6be6e54afcd", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664964, "uuid": "c0af6fe7-cb0d-44f2-bdff-248762b26b03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664964, "uuid": "4dc28fcc-8daa-4fc8-8ffb-cecccc36294d", "value": "RuntimeBrokerBin_64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6523e4fd-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635692904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692904, "uuid": "a25b672d-25a5-4e13-996b-f29edf29ab6e", "comment": "Malware payload", "value": "28ddb8b9a4b9fd87038b9661ca2ef0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692904, "uuid": "480c1135-543c-4db5-85f1-d7f9e590ab3f", "comment": "Malware payload", "value": "3ca1f69a7723a39f214cf3e8a02123d33d929a47d7d47f02bd834632faa23f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692904, "uuid": "3781ea97-29e9-4484-b366-4a0d5200b894", "comment": "Malware payload", "value": "9ad7c1172a8e12b464ebe150a21c75e093bc45ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692904, "uuid": "767dc0c5-5b75-47f1-9537-8f784d62e79d", "comment": "Malware payload", "value": "1feb9e160add3e6299b292e0699d9e01b2941ec23e82d57a54ec3f5da0ea8bd432499bd088c54bad17c1b25e330975ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692904, "uuid": "34f8ad3a-446a-45cb-898f-ce9957dbe124", "value": "T11084D73D55282A48F7A085BCFD715CFF17953C1F88A7B9B3A04CF98B0AB97C25416229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692904, "uuid": "dad0920d-477f-4a04-ba34-8a11b0501c97", "value": "fd665c8501eb1a152d6b80cff0d63b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692904, "uuid": "3af9f29d-b628-4f06-a416-7c57e07ca07f", "value": "3072:ySgW8stAeW4guBOvffu6Em5sK4gMs4oFT89lwYX7aVKiEu:ZgW8CGu6/yKLLFTKEVKiEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692904, "uuid": "33a77538-fbce-4ca6-bcd6-4a975637fd2d", "value": 382356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692904, "uuid": "0255340a-f7a9-42af-ac13-f9ce7868e560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692904, "uuid": "3f15eb1c-6c7e-4af2-8e4a-20a69f076562", "value": "28ddb8b9a4b9fd87038b9661ca2ef0c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b23761-3a58-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635691260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691260, "uuid": "349f32d0-b26e-47f9-b7f1-b3ad95f69086", "comment": "Malware payload (RemcosRAT)", "value": "20d345fe0735636fa2d509438b26e85b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691260, "uuid": "e2d84e34-de2b-4619-b94d-681475fd2752", "comment": "Malware payload (RemcosRAT)", "value": "3db3afd078ec35245b20f492c175dfc1f21e359fdccb20baf55821d49101064c", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691260, "uuid": "d967014f-6d31-4c9e-b7f4-73c1065471d1", "comment": "Malware payload (RemcosRAT)", "value": "e9e8c19d970e53180cb04c3e840e2a90838fe4ea", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691260, "uuid": "4e33f506-5f20-4136-b859-0527fd239197", "comment": "Malware payload (RemcosRAT)", "value": "667e05818972835a1be780c6b95c7e36dfbfc916a41d681d0e868f533051cadd7509af6453b902ace20fd1c8b80688d8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691260, "uuid": "20d868c4-9c1b-49ea-a926-ef7425119976", "value": "T1AA758E92C45046B1E8A52F7455EFEB34152A6FB3285CED0AB6A87C091FFB5833026CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691260, "uuid": "9887cf99-574e-42fc-91b9-3de5b0146ca5", "value": "12288:7hHWm3RcYRn9vyZuZkxx46hPXBfwLHvzScQrCbPNOCFPwQtoGkjc75ZfTZ:02Zn9viuZkx1hhqP+jM/F4VGkjSjfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691260, "uuid": "af430877-f836-485f-8188-2f8f85156963", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691260, "uuid": "14fbd892-f3c8-494b-8628-a587010e8348", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691260, "uuid": "fe8f7c61-600c-4efb-8068-02a2ef370874", "value": "WayBill.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78839e3-3a8b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635713336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713336, "uuid": "0249b743-f8ee-4846-82e6-b382af6fe730", "comment": "Malware payload", "value": "3c271948c1c5e0fcdcae34feff119d46", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713336, "uuid": "51c03544-727e-46b3-8111-e78f4961c331", "comment": "Malware payload", "value": "3ecf3de486fb5a195cb36009439064d95ceaed44330dd5c9f33fd47237fd8d04", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713336, "uuid": "ff1b96dc-fb84-4be4-9d71-c6b96095eb0b", "comment": "Malware payload", "value": "731cd6211443706df54345334912e04ccf0bdead", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713336, "uuid": "d8805ae5-114a-4216-9cbf-1a6d07e69ab7", "comment": "Malware payload", "value": "d7ab692f5337d9abfee650994b0e922177562ae67ccec571c3b8d07767071be3ad661d538c9221ab05cb3f10cf28acaa", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713336, "uuid": "1322254c-19eb-4951-95dd-c10a7e245d55", "value": "T114519609F847D14C9BB9236BEC978922FF1B411B9DA2104C71DCC2495F30809A67CB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713336, "uuid": "919294bb-349b-4a84-998a-7678ce1919f6", "value": "48:A9ub48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozf:MIGhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635713336, "uuid": "b8b92dcf-8f6d-46f8-80bf-cce572e8fbcc", "value": 3140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635713336, "uuid": "acc929c8-4827-42d6-a60d-be74474a23c1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713336, "uuid": "6f3596c9-c45f-47d8-a4d5-5720f0c7f973", "value": "xGngNsX0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920203d3-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635665062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665062, "uuid": "22805a15-2838-4175-a599-c0b4486e9d68", "comment": "Malware payload (RemcosRAT)", "value": "88095398cd6237c5b39b59982d8f9e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665062, "uuid": "484108ce-e3e5-4a8d-b4a7-2a45d84ebd2d", "comment": "Malware payload (RemcosRAT)", "value": "453ac1c258a1e7c99dfab679640eba21f5b011bd1693d810498387807271d974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665062, "uuid": "105e096d-3c67-4d6d-98f9-69f0a869bd5f", "comment": "Malware payload (RemcosRAT)", "value": "91ed3fabd442ba3a4f2e72d96a1e9ec18e513ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665062, "uuid": "91e856e5-6b03-4d71-b38d-56e8924dcaea", "comment": "Malware payload (RemcosRAT)", "value": "a2bcf11fd2999add73e3962f1ec97bcf393c01c1b0186675703272693382280c1b425fd25dc60c00b85ab6ef067cd833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665062, "uuid": "d0887c15-c8aa-4fc9-9ce4-eb00fcd2d0d2", "value": "T181A422B622C19A37C29906B28AF3177DF2B2430416785BDB1F7E4D3B34B94A7A8074C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665062, "uuid": "96b45c7e-9ea5-4f73-b51c-d5c505baac98", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665062, "uuid": "620314b1-e080-4ce4-b189-d567e0d11639", "value": "12288:CeLl+WQMjk+LUvWr6zrF8LlSDEmMK+9OhR7J4u0q7u7pA:JLl+TMfoOZlAEmMT9OWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665062, "uuid": "7577622f-7402-4116-af20-f17b9507b48e", "value": 452682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665062, "uuid": "5e1a9908-dbf8-406d-b088-27f193d1cdb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665062, "uuid": "ff95acbd-e682-44fa-bcb9-04c454cc3a0e", "value": "88095398cd6237c5b39b59982d8f9e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd12e4e7-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1635692676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692676, "uuid": "3b77f3ca-a148-4889-b6ff-af35db3770d5", "comment": "Malware payload (Lu0Bot)", "value": "ffba4ffbcae311a5a4e68b66569e48a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692676, "uuid": "8d59d2e0-0007-49ad-9bb6-2b864ad43c6a", "comment": "Malware payload (Lu0Bot)", "value": "4547dab867404fa6e5cebc5794ae58c4d365355372d26e6bcd01c1aea0f91e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692676, "uuid": "a4fb07fb-c038-44b8-94c2-79094a8202e6", "comment": "Malware payload (Lu0Bot)", "value": "9943b216569f6254e8856ef9ace0a3b900a3fe0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692676, "uuid": "2c69e65f-9073-47f3-b9f8-4b95347843b2", "comment": "Malware payload (Lu0Bot)", "value": "81fc85fe5f75ae5752a19cae54ffda8fafaf6552dd0852e01ea19eb67af8a136d7ee0a4380f4ddde1b6cb2c325f3a4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692676, "uuid": "6e6b6531-0dfe-403d-8bb1-6d52139921dc", "value": "T10E41EACBC2488A32D84703B15EBBCA057BB57AA603F5CC57426880FB137B5B06C8C406", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692676, "uuid": "63df1eb2-d02a-46bd-97c6-1a624b6cd469", "value": "50532df3b419244f50e7013475da4ce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692676, "uuid": "4703caa9-85f0-4a88-895b-299ca217fb29", "value": "48:6RfnNH2cFAKclVbotAWxnCmuI704KNDwRBS:+t2eiU+WUAqwRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692676, "uuid": "886805c3-d9b9-4435-87b0-490698eabdec", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692676, "uuid": "f0c084c4-23ff-4b66-8a0c-df67bf6eb079", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692676, "uuid": "93f4330b-d6d4-4770-a6e1-fd3f87d6eee0", "value": "ffba4ffbcae311a5a4e68b66569e48a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e25a7da-3a19-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635664090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664090, "uuid": "a16f2d14-9612-4f25-ba4e-dfbe5ac049b3", "comment": "Malware payload (TrickBot)", "value": "60e9dca76408015d98cea97a38c4c81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664090, "uuid": "8abfe173-7d78-4a85-a9a7-812593052548", "comment": "Malware payload (TrickBot)", "value": "4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664090, "uuid": "6286ad6d-5822-4da1-8ba6-3d52ef977ffc", "comment": "Malware payload (TrickBot)", "value": "fe72dc0d7548bdd6b3d5703d4cfc7e5da57265f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664090, "uuid": "f921332f-ab30-4c61-9008-7f88fc51d19a", "comment": "Malware payload (TrickBot)", "value": "cb54086b10394b3fc053037f62cd204ab2bb1f3650bca7422fdb3a1afdae56e4c202a9e85bbfd948ce6dedb040349a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664090, "uuid": "fda55ab9-bcc0-4e12-afd9-981e79025a49", "value": "T18105CF123AB0C077E2B291754EF67B69A2FDA9205F674DC723810B5D7E31CC1573A22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664090, "uuid": "fafbdad8-b5a3-4cfb-8516-644c8c6d4f6c", "value": "d70d92f424e874b7f2d958376b177fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664090, "uuid": "0facc42a-70a1-412c-b0a9-74d59d618d70", "value": "12288:m1d+w0o2/pnRsHnF2XqBNiKtxRDB02HTUj/AUYQ+wsE6tn6tLB:Mesl2XqBNicTtZQO1wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664090, "uuid": "a6ea01cf-0667-4093-8f9a-66f62df0a1c0", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664090, "uuid": "a387bec4-58f5-48c8-9ae7-cd547f56f588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664090, "uuid": "bc81f963-d739-48ca-bab8-c1e83c882fbb", "value": "60e9dca76408015d98cea97a38c4c81c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3be0a64-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635665200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665200, "uuid": "242b11d5-3305-407f-8bb6-490f1def60d5", "comment": "Malware payload (RaccoonStealer)", "value": "0e0a1e5804e9543ebc1fd9086d2c6f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665200, "uuid": "78f000a5-6bca-418a-b67e-a7ceb1d0a6f9", "comment": "Malware payload (RaccoonStealer)", "value": "472652363b7b94b0d1da752c5b3c738ae6798f2234cd04311def0c509e5e04e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665200, "uuid": "a8090c21-276a-4608-8130-e958292a55af", "comment": "Malware payload (RaccoonStealer)", "value": "3909cf05d079760138fb1e26c741f3ee1e9cd4a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665200, "uuid": "c3d084d1-aad5-4f42-8729-04c3f2b0f0ff", "comment": "Malware payload (RaccoonStealer)", "value": "e3d28f8506020b096f2bf89f1b9cd31a48639b1aa0c7f7ee216f77d2c1231c14fd5a4f9a60060bc7b89f98f179a35d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665200, "uuid": "825175f5-537e-40e1-9962-32e6432ce0c1", "value": "T127D4E010B6A1C030F5B252F449B59268B53F7EA1A77884CF62D517EE4B78AE0EC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665200, "uuid": "bb382957-a5bc-428f-96b1-732a89aed2c4", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665200, "uuid": "ea44a966-ba28-4811-ae4f-e175de533c41", "value": "12288:lmQ1X2Gti0O8gtY1hBk7tz74niPRw5dcmvZoI:0QHi0OG1jk760GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665200, "uuid": "862c019a-59ab-4107-a7af-192c4ff4b39e", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665200, "uuid": "29b83913-ab89-4684-879f-62b3ca2c4c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665200, "uuid": "9b6b7489-fcbf-4ef5-ba8b-23cd381606eb", "value": "0e0a1e5804e9543ebc1fd9086d2c6f1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af52a780-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635666400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666400, "uuid": "c70bc1de-4548-4916-b5f1-4456d05c6434", "comment": "Malware payload (RedLineStealer)", "value": "11f9a933afd8a6c4b859f525d3d68009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666400, "uuid": "828145a0-afeb-49e6-b957-174589b43ec9", "comment": "Malware payload (RedLineStealer)", "value": "49d498db863506458f4be15e28061e128480c214b39b9060a9a63ee5477bbdc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666400, "uuid": "b18bdc19-6d31-42b6-ad42-c510ded75fdf", "comment": "Malware payload (RedLineStealer)", "value": "012dfe9c4c01a88fffb3fbe95e566953ee80f882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666400, "uuid": "23d05958-82c6-4739-8816-f86a918f05cf", "comment": "Malware payload (RedLineStealer)", "value": "4d51a7b4c96f8af8eae8131fc4039cb1533f0eb548d1008cf6e0958b8654ee10c14bc9ff6fe2d7b7a2f2460e3c4e0e0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666400, "uuid": "0b843715-e1b5-42a3-be8f-df3f07db3d05", "value": "T114F42AC6F173608ED3A3B0790F0515864A471C7A6F129AF4AF35A96B25F27A1CAD7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666400, "uuid": "6c3c6fa2-b4bd-4b1d-9763-1437750decf1", "value": "c18eb5133e3f30215246505f555d85be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666400, "uuid": "e782a169-216c-4598-a6cd-d8cc6b50948b", "value": "12288:jt0rGuaEQYHLvb6bs67srnogkVDy3voLwFO69I3GzYksTzTh7I7z:jkGHYHJUqsgKh7Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666400, "uuid": "3e1ca7cf-7b38-456d-bb77-a877bd4631cd", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666400, "uuid": "3f6e109c-d4d2-4047-91a1-569d7dbbf23e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666400, "uuid": "319119f5-0b92-4351-96ee-0512ec1ff113", "value": "Cranch Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42479ed-3a8b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635713304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713304, "uuid": "30409b6b-cca2-4adb-acf0-2310caed5604", "comment": "Malware payload", "value": "7658f58ad5facc3184eb9f2ab82ecc12", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713304, "uuid": "4c8afed8-5bee-44b0-891a-704528c686c8", "comment": "Malware payload", "value": "51eacf1aa47d3d0c2f77ed02ddeca745f603aae3d123cf4bf3d9f0e6cbb6e27f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713304, "uuid": "ef8e8268-bbe8-4f9a-b9af-e4131f90ad54", "comment": "Malware payload", "value": "656382a2b8a762fe360750592c65a3494a0e865e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713304, "uuid": "3fc6466b-c8ac-4659-814c-03b3c9a51526", "comment": "Malware payload", "value": "ca3dd7dc24090a3ee66862bb18777efb675faf761834e8f412c2af8c48325724b72bec418b5511d4e83577d619511d3c", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713304, "uuid": "e9865e5a-a0de-41dd-9df5-b4e7ce642c7d", "value": "T12251960AFC47D14C9B79236BED978522FF1B411B9DA2105C71ECC2491F30809A67CB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713304, "uuid": "1d0ef7de-a850-4288-b1dd-70e25bfcc823", "value": "48:Axmze548iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBr:XybGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635713304, "uuid": "a96f6169-fb6b-4e0c-a082-f4be0911f254", "value": 3145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635713304, "uuid": "27e98fdc-9a8a-4609-816e-393b1d4ec004", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713304, "uuid": "3845fc51-00c7-446f-b58b-5955265ecd49", "value": "p95vEYaM.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e917dbd-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635665030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665030, "uuid": "ecbe3223-d46f-4776-b7a9-caa283f487c9", "comment": "Malware payload (TrickBot)", "value": "818ddb3d73670d6ed670bd689d481cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665030, "uuid": "44b5cb01-ad35-451a-b9a5-9e80454d7d01", "comment": "Malware payload (TrickBot)", "value": "549babb526332bc84aeab495b8b99982c30497716142c317e13fe3e96cf7188e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665030, "uuid": "128c60b5-f321-4e6f-ad3c-ac8cdb808ba3", "comment": "Malware payload (TrickBot)", "value": "51f05219c127a40e6054bdad597a4c8adf306f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665030, "uuid": "a4ef650d-0ce4-4c63-a576-6512d343d069", "comment": "Malware payload (TrickBot)", "value": "33074b59d4adb27d5e9bdde19a5568a4d8e946c58978e555040871897cad5bc6fd16ce338d523fb47fa8fd5e2aa290bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665030, "uuid": "c3375139-2acc-47b9-ad3c-4d0e662a6bc1", "value": "T1F405CF123AB0C077E2B291754EF67B69A2FDA9205F674DC723810B5D7D31CC1573A22A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665030, "uuid": "24f1ab3d-ade9-4736-a8b8-5b698a49930f", "value": "d70d92f424e874b7f2d958376b177fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665030, "uuid": "573553bf-9a9f-4a63-ad66-3398438fd242", "value": "12288:m1d+w0o2/pnRsHnF2XqBNiKtxRDB02HTUj/AUYQ+wsE6tn6tsB:Mesl2XqBNicTtZQO1XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665030, "uuid": "d3b995d3-56c8-430f-b1e0-e271c76847ca", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665030, "uuid": "206a2373-8c3b-40ed-908b-623c340a67dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665030, "uuid": "eb0619b3-f8e2-4a30-ae3b-ebedb6333774", "value": "818ddb3d73670d6ed670bd689d481cca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4aaa31a-3a91-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635715909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715909, "uuid": "d4e08e5e-a5cd-4a1c-a4ea-bca358946876", "comment": "Malware payload", "value": "33cd2011370fa026b8fcc75069b16931", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715909, "uuid": "4f024806-b0d8-4ed7-82d0-58e692b7af4d", "comment": "Malware payload", "value": "557917b31673e90ecf1d4688d8e457c478ba307f37bda61e060ce7f1075aa275", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715909, "uuid": "43ed1afa-dae8-410f-8b1d-d9fd242c9c76", "comment": "Malware payload", "value": "b96d5d0d74913a478ca42476202d3efc5da001d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635715909, "uuid": "ae71d33e-1123-4f35-b9b1-0e7c9aa15072", "comment": "Malware payload", "value": "5fa8a96acf855e6501009999b310aa27b7e1b7f9bb016285873b31837af37146b44c0ac3828e608c98ae3211c3b2b751", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715909, "uuid": "9988e6d6-16c0-4751-b495-0bb2a7691162", "value": "T1DCB501E6B5C5A6CEF80248F680108F608156BCBB676130F6E1DD705B1A7B858DB53E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715909, "uuid": "72848493-6df5-483a-aa6c-d5a1567b0bf8", "value": "da6277683746544a6a8ca9dacdaecd4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715909, "uuid": "bbbf462a-7d79-4b87-a57c-91869d5d6bd6", "value": "49152:AmdPAjXI62Ks3/1If0DGn9IhuIWHSrsXNNVVyPcqzsvwvqpsUC6eq19Z:AmdIjXI5Km1IfgGn9ySyrSNNDyUqgvww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635715909, "uuid": "15571eb1-f8fb-4953-8b23-eb4674b17fd9", "value": 2404864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635715909, "uuid": "e7bdec0f-4e62-420e-ad26-20a23cfdc69f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635715909, "uuid": "23825d21-34d0-4b10-a054-2d8d2dc576d8", "value": "33cd2011370fa026b8fcc75069b16931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4540265-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635693011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693011, "uuid": "94e08441-5153-48b4-991a-de8312d1a1e1", "comment": "Malware payload (Formbook)", "value": "b897bfd728264f102e07e613a01657da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693011, "uuid": "5b7c4173-55dd-4de8-ad59-7ee474af731e", "comment": "Malware payload (Formbook)", "value": "5dc5fd5aeb9e4902ab1efa0d1e058b2dfabfd0888be4df553a19c66a0c008de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693011, "uuid": "0796752f-e706-459f-9910-acd1ae8f8006", "comment": "Malware payload (Formbook)", "value": "ca2227f6b1302b1958449e8a27d9ae2f70eca7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693011, "uuid": "006ee708-cb22-40cd-a17c-2953063ab7ca", "comment": "Malware payload (Formbook)", "value": "adbb0a438dda3004e8df90f1a1859a70f13e656126791ec9b5dc48f18c6f2ac68650862d5000d9ca42f90ed11bcb450e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693011, "uuid": "fc5adf8f-bd89-451a-8cd5-30f1a7e0abf0", "value": "T14374231B73FACA56DBAB52F434A54610567EB08E45B1E21D9E1932C6DB03B8C1703EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693011, "uuid": "bef2f3fb-d53c-4435-b684-436e4f3ea1ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693011, "uuid": "256f6fa3-f52d-4195-8688-79c4061d914d", "value": "6144:YVPMX/1X9Fh9qiknURh2FPPN62zZnuMu5v8juprSpOANFJTTBq1JEQ:gEvd3h9qiknU+ZPN62zZnu15vSuFSgAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635693011, "uuid": "47647835-a765-45d2-a678-2ab1cc944cb0", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635693011, "uuid": "63926f8f-b318-4f20-b665-8aa11efb46b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693011, "uuid": "3c3ecc2c-5215-4c61-92cb-efc9f11bc392", "value": "b897bfd728264f102e07e613a01657da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b634a679-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635666412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666412, "uuid": "f6120138-df2e-426c-9b53-ae0c5b2b5555", "comment": "Malware payload (RedLineStealer)", "value": "25a2beef2f2e7eca936297350d01b299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666412, "uuid": "e755f022-2833-4030-b0db-476d1ea64a57", "comment": "Malware payload (RedLineStealer)", "value": "5dd943c56508689ccf31338d5b04b91176f29005cf98258f3a161fa01c7cf3a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666412, "uuid": "1dff96dd-8dae-4e86-a642-2924d6d41573", "comment": "Malware payload (RedLineStealer)", "value": "372b23a8cd577e394775313d16e2a1f18a4a328d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666412, "uuid": "8ab47ff6-5d05-4925-b9c2-0c3baa2d1771", "comment": "Malware payload (RedLineStealer)", "value": "29a9209901d58ea4cf0a97cfee897c0177f7f46f749a6efbd7c69b38c10d55f594939f8256a272302549cdbee5191984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666412, "uuid": "6080c62f-3340-44d0-bd4e-04a6bfbd6343", "value": "T1467533AAFD190DD2C9EDC83E94FB0B4BEDF01C82461467BAA41E45F3334554E8993786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666412, "uuid": "196f7eb5-b8ba-48de-bc2e-e6f11f2d459f", "value": "94e2b0572ac9e87d08b3c525a2cff4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666412, "uuid": "23132b0f-7b5a-467e-bc4e-cae131b08d65", "value": "24576:GId2ZvuYcBFIvZQ2412UxOvcutO0jEhqJhMexXmjsCvhji0UrEhAyCLMjk+xvI:tyuevZ0Oln4hYjQwN0UI2ojk4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666412, "uuid": "aab4e2fe-5766-4809-83e5-b090d2a1998d", "value": 1571784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666412, "uuid": "84c52b48-2a84-43ed-a8cd-20ba72766e6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666412, "uuid": "41e1ab38-a8bc-4e8b-838a-6de5bc6b75a0", "value": "IcePick.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc57d83a-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635692729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692729, "uuid": "19a4b3d7-8302-476a-8e04-6f4d10f0fc38", "comment": "Malware payload (SnakeKeylogger)", "value": "520a01ecc23cebf88a2436a7670d33a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692729, "uuid": "4658759d-f43c-4d0b-b0aa-a631b9ccac77", "comment": "Malware payload (SnakeKeylogger)", "value": "5f4ab51db894aad5649092cd87687eba272168f2540573844bf8c27b1c8cb234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692729, "uuid": "3b5ccd19-d82a-44c6-845a-4336a61a56a7", "comment": "Malware payload (SnakeKeylogger)", "value": "1f8bb4cd9f96431d5d73e510a381b831cd181690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692729, "uuid": "924b5983-f13c-45ea-9077-eaf104a78bf6", "comment": "Malware payload (SnakeKeylogger)", "value": "070a0b0eacc30846adc3e37dedd52be8e831f488d967c3e12a46e39357a986c6fa1eecc11e60786b1aa6d2bf7fe12254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692729, "uuid": "c9696562-02bc-4142-b1eb-a19b94ce613d", "value": "T1C35412785F35E770D2FE9B7A6050550C977AA10E2901FB2A1CC160E73EBFB0AC189A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692729, "uuid": "851c96ac-08f6-49fe-bcc8-677641b6cddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692729, "uuid": "f71a05ce-b88d-43e5-8fe4-52f0a2cad0ef", "value": "6144:UDpnDp21mfOCdTE8pEUug+X1G1jBfQpt/SB23NZtge0LQO+Qae:up4CRBBu31q17B23v0s7Qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692729, "uuid": "77cd9adb-3d7d-40e6-8771-d8efda1d908b", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692729, "uuid": "ba6fbcb1-94bf-4c69-8df8-746a801200c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692729, "uuid": "b47686b1-ac03-4584-91f6-b8bf91d28a55", "value": "520a01ecc23cebf88a2436a7670d33a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a926c0-3a14-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635661873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635661873, "uuid": "9774ca5d-4dda-4dc1-a144-d3d4a257c771", "comment": "Malware payload (Formbook)", "value": "3da25ccfa9c258e3ae26854391531c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635661873, "uuid": "c15f7d40-730b-404d-978a-c2b5e208ce4d", "comment": "Malware payload (Formbook)", "value": "62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635661873, "uuid": "0e664fa3-2457-4252-ba97-9e02dca09e97", "comment": "Malware payload (Formbook)", "value": "1ed5613b0ad8ab4c47f07e52199a4edd27be40e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635661873, "uuid": "fd841cd8-34db-4cdb-a35f-ca595639c684", "comment": "Malware payload (Formbook)", "value": "b33dea9341c42bdbc4de1b8aa716c04bf0bf57a8b28a2642f1ba8e315d464a071db03037bfb475ff39198ae3d268609c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635661873, "uuid": "76742c4f-e16d-45a0-947a-e71ef9bddc73", "value": "T1CE2633DC3DE0D9B4C28B69F0EE754A480F69387639C4279AF620135CF799E08639936D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635661873, "uuid": "0d3d9b48-c50e-400e-ab85-e2a135dc181d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635661873, "uuid": "d708d22a-7443-430b-b43c-7c10b508a7fc", "value": "98304:JlrgAU/jcyw9AW5Vry+Awi0vhXYwF0kd/JKPSSXkw:JlrtP55Vry+71rFrIPXkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635661873, "uuid": "163a55de-48ae-453e-ab67-2799a3dad1d9", "value": 4748769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635661873, "uuid": "e944aec1-5c67-476e-a01e-b5c0f38b7b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635661873, "uuid": "a67f4435-9723-4e31-bfc8-9794ebd3e44e", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fade5e79-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635692726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692726, "uuid": "dfdc16a7-211f-4353-995e-949c9a6aa951", "comment": "Malware payload (SnakeKeylogger)", "value": "7915539112d1334acbecc5d1d8b16e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692726, "uuid": "a4ff0347-d395-444a-95ce-dfbf9f50d896", "comment": "Malware payload (SnakeKeylogger)", "value": "65490c9b6b485e9bbf8dd35ab1f0d411ffdaaf09d5bed62c912c0f651b513011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692726, "uuid": "adec3c06-b5a9-4627-b6c7-c7f0cc5bf5cf", "comment": "Malware payload (SnakeKeylogger)", "value": "ba923fa51859660c6666639403861754dcb9a2f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692726, "uuid": "124b0a91-2bd9-49d3-9233-a1d33ae8d204", "comment": "Malware payload (SnakeKeylogger)", "value": "30e8b22dad9281b2aba8749ff182a67db4bd04b251344cca7d96a40f27a68c4e3c6a18ba29339af49dff28490fff38cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692726, "uuid": "8e0e3c34-338f-4852-a965-811a61f9451b", "value": "T10B053FC2F5C3EA1FC5D825B09681CE5074646FD8406FB9A5F96A7E9FE33E690A80C314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692726, "uuid": "6e6893b4-26f5-4d92-958a-9977ccf5b997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692726, "uuid": "99a6ca9d-8a18-46fe-a817-d65c1fe05154", "value": "12288:Uui1576Z0tjR5gl6iEC/MHmg789IW1dXg:UuiXGaR53C/MHmg789IW1dXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692726, "uuid": "cae100f2-a59d-48b1-a238-c992d7709995", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692726, "uuid": "5c5be316-da7b-4a1e-a4c8-12fcfea4ccb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692726, "uuid": "e29ab17f-eb6d-4f83-b1b5-9f63a03e99b9", "value": "7915539112d1334acbecc5d1d8b16e28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cd0b0e-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635692689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692689, "uuid": "471972e4-dbb3-49d1-ae3f-311d4eabdbe5", "comment": "Malware payload (SnakeKeylogger)", "value": "0e4bc8e6a8be7254a700221d72c02a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692689, "uuid": "7b08e2b1-3100-4af4-8877-bda5010da281", "comment": "Malware payload (SnakeKeylogger)", "value": "674ecf9a50c708b802f18f704c95ed06e2b96ae8291777a9011f0d3eb8ac33e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692689, "uuid": "cf513711-3c63-4636-b722-e7cbf29d30f2", "comment": "Malware payload (SnakeKeylogger)", "value": "34458236d7027cac36a0d1dfc9d50d1026f2b616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692689, "uuid": "58eeccb9-54fb-4801-abd8-2cde9cad2962", "comment": "Malware payload (SnakeKeylogger)", "value": "ccf10e15cc6f0994b9415e938035a38aa6f399997184df1e71b09d71a09822f601f2d5f7a0f9fb7a32f25c7bc7f11923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692689, "uuid": "a02d1f09-23e0-40e9-9cd8-e580c9be181a", "value": "T138442315339957BFFB7F1F350800C1E4A2F1F51BC409DA485EA2A24A6E91B0B9B21BF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692689, "uuid": "71ab1cc9-db3c-4d44-9609-4f2ca7d308aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692689, "uuid": "11d45831-0cce-4182-977c-0a571fcc4bf0", "value": "6144:8wTf3O6RnLGRhtmlgyCC0JI0O6XGyK1i2SGpcZVa/A2wlkQ:xj+ALGRjm2yFoIYXHK1i2p02kkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692689, "uuid": "688ce194-4924-4f8b-a2e5-117647066454", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692689, "uuid": "2230b922-ce18-4940-8f6b-ec094b686b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692689, "uuid": "7721c4b3-d6d6-4764-9b99-14fe6f727b75", "value": "Scan 20211031__01004002001003000100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b21a192-3a25-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635669131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635669131, "uuid": "6cbc9058-c0eb-4761-b63d-960e0f09feb2", "comment": "Malware payload", "value": "f94a877432adc435d82c040256114abc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635669131, "uuid": "239eb5d3-799e-46d9-99ac-6ddcde21b35a", "comment": "Malware payload", "value": "67cedd984e7a99da6b880b58a8cd62930f447139893fa1b58ec992d19428f5bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635669131, "uuid": "c39c9175-dd74-4317-bfc4-4437288f9633", "comment": "Malware payload", "value": "896982749e952f890f04a7211ac6549adbb80df4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635669131, "uuid": "79cbf649-7245-4c23-ae06-3ed3326ed7a2", "comment": "Malware payload", "value": "03e9ee5f76908bd8380b74812a11989a3175952b39e122e45a9db7101c458da918e39a9eaa58a6d34953a6fa68e6a36c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635669131, "uuid": "b53b3d58-b2c5-4779-8ded-5113edeb23e2", "value": "T13FA21801F3EC632AD5FE4F79ACF252400371F5978921EB8F188DA19C6D363985E14BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635669131, "uuid": "0329f1c2-a375-4b2f-ba66-2c7a05486379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635669131, "uuid": "31b1e2e7-a8d7-413e-bf66-b2a5c508ce95", "value": "384:HdP26eTOCqkn3tKrJ8KNqnlKZskZ8QmU9Dl3RCCwiZTpraaWu2S1kzP8vI5w:IPh3tKry6q4ZLaVy0iN9a4I5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635669131, "uuid": "768af71e-fd31-4246-889b-2fe50f0b377f", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635669131, "uuid": "a6b97e01-a225-493b-be12-ec67726a1627", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635669131, "uuid": "1b13f2a9-c2fa-4292-b73e-671a2edf22de", "value": "f94a877432adc435d82c040256114abc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd92b15b-3a6a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635699119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635699119, "uuid": "7206b3b6-bd69-4973-b79e-0a0b5879b9de", "comment": "Malware payload (AgentTesla)", "value": "2a6909786a011b9f168fff28ace753eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635699119, "uuid": "b9ba716a-54bc-42cb-ab9e-21ddfc474031", "comment": "Malware payload (AgentTesla)", "value": "6c4e1a2401e20d6f2e850e5a81abc528e9c57550df4e4c5fe49e013cf58ccdf8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635699119, "uuid": "6e317600-853d-4626-b601-89c26c5c3e00", "comment": "Malware payload (AgentTesla)", "value": "f6440e962705b27d0315e07da949d9e74454880c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635699119, "uuid": "61a850aa-70ce-4de8-97dc-ec20a72f27d2", "comment": "Malware payload (AgentTesla)", "value": "f193f7ca3dd84af2bfd83963fc44977d00c856d155f4e36d9fd712f64e07b7abc6c234872077c6e787dc35c902d6943d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635699119, "uuid": "3ca571e7-180b-422e-b522-fe06de8d23c2", "value": "T1EE355AB9325176DEC86BCD728F681C60EEA17C7B835BC20B9017319D9ABE552DE140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635699119, "uuid": "572a0ad6-885e-4b26-8846-ef554c9dfc6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635699119, "uuid": "52dd3357-553f-4dd9-87da-614a431f32c4", "value": "24576:WMjgiw5td97lmqIfGkoOGgi1+ncmB2VYJUEKlCW:DUiOlmBlPGg4+ncmOYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635699119, "uuid": "108af016-743a-4ed7-8f00-3dd9481ee350", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635699119, "uuid": "9f7b4276-ab40-46e4-a073-bdc890df396e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635699119, "uuid": "d1de8f0a-9d35-4e01-9602-91c58c6562ee", "value": "new order 20211029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27086608-3a98-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635718570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718570, "uuid": "6395b655-2ce2-4b58-b5f9-47841eae7db1", "comment": "Malware payload", "value": "d42dcd47745b0d76f99636d6d6c499ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718570, "uuid": "431eec6a-895d-4114-afef-da94b4b71b64", "comment": "Malware payload", "value": "6c4e722c3789b1bcaf9b7dc84850c7d7a814f862504d47b7dce38e30e70589e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718570, "uuid": "9a0bf7c9-af69-40cc-8fb2-172ce48740ef", "comment": "Malware payload", "value": "f2adbeaa0bfe142c7fd027153d73898b1cf50b43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718570, "uuid": "5755e498-46fc-4044-a64d-7edff7d29fd3", "comment": "Malware payload", "value": "cf5bf3f8fb1ea04e24a2630f42eb59544ba443fe96fff2decd0435edda93758eb9c5e941eed3ab7afb657ad2ecceba58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718570, "uuid": "4311bf2b-69d0-4801-9307-847b290837c2", "value": "T1BC456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718570, "uuid": "0e994dfd-8cb5-47e3-8619-4a426e8b1c33", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4F2y1q2rJp0:745vRVJKGtSA0VWeosu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635718570, "uuid": "82bd7663-28ec-4b16-aee4-9d59801e9a27", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635718570, "uuid": "8355ca80-4f27-468f-8b1c-d6b23c93b48f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718570, "uuid": "870c8c6f-03ba-47fa-bf56-5a2f4250aec1", "value": "d42dcd47745b0d76f99636d6d6c499ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8b08e4-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635666152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666152, "uuid": "24b75729-f2c7-4a49-ae2a-47f71f9f91ea", "comment": "Malware payload (RaccoonStealer)", "value": "b286c94b9048622a26e3ec8f00011989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666152, "uuid": "463acdf3-d44f-45ae-952d-0e955776f067", "comment": "Malware payload (RaccoonStealer)", "value": "6cf46399cad159c9ee2bc033acf896bb794d0cd8d1a1e6f131ce5b6a822f424a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666152, "uuid": "7efd1a56-402d-400c-98e7-488cecde00ad", "comment": "Malware payload (RaccoonStealer)", "value": "2da66a3cbdb97de8c5aac1fde839d0dfb816a495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666152, "uuid": "5d99d844-a509-4dca-90d5-675dfcc866a7", "comment": "Malware payload (RaccoonStealer)", "value": "9ccffc9030f0c3df2430b15d67bc57fbe0379c7eb03419dc5763cea888dd1c862b48fd18f2aeb1c8b6f93ea2f9673e08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666152, "uuid": "064cfeaa-0440-4f80-b051-2369a3662a1c", "value": "T1A4A4013037BFC032D06315719834D6A51A7AB9265535858B2B984BBE2F70EDC4BEB31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666152, "uuid": "5501e7d3-bc65-44a6-9418-8c8701b1e17d", "value": "d3a97c61fc26bbf128da129c9758c519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666152, "uuid": "288fba7d-9c60-49f8-bb5d-d9acb1b4213e", "value": "12288:nLFcdyrs8Sa/1lhlOPjLRbWDiHWSG3eunn:OYeklheLUDb3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666152, "uuid": "83d349e8-927e-4bce-8310-fb246716cdbd", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666152, "uuid": "566a8a32-aca9-42be-8689-1d7deba5c6b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666152, "uuid": "48bd5124-71b3-43db-a7f3-98b510411b10", "value": "b286c94b9048622a26e3ec8f00011989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b05fd40-3a87-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635711410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711410, "uuid": "48541162-dd7b-41e7-ad83-9260b92cb196", "comment": "Malware payload (Formbook)", "value": "413ab519f50e6709faa369ea11176dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711410, "uuid": "29b72241-d6a2-42fe-9327-b161229f4d4c", "comment": "Malware payload (Formbook)", "value": "6d1db64be8034306d9b947c25edf28730771762e1df73dc15f4bb2347266f4a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711410, "uuid": "39ccdc15-a9b9-4d3a-9bf6-8bb273eb319a", "comment": "Malware payload (Formbook)", "value": "949fa30b4421a761affb20b40dd78b60205997c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635711410, "uuid": "cc4fd652-feb1-4303-a258-c15764fce95c", "comment": "Malware payload (Formbook)", "value": "18707edd0ae8f1167fe5fdcbbb22a8b7a75f084febaaa6a0a6049e04f788f7e9dcddc5315a68b42430fae2012f2207f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711410, "uuid": "179caac7-7b84-4f3f-9043-2de3ccfa1a33", "value": "T14F840209AB5D8673C5AE87FD08A74A2453B56A77A923DF0E1EC8B4DD2DB33400D40B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711410, "uuid": "c8970ee3-bfef-4159-a704-133171f3594d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711410, "uuid": "13f8b891-e6aa-4ee9-86f3-aed01fe51866", "value": "6144:DWrGQPRN9JGGwXjdZC+zqirzPCewGRto+1tZBnrik3b0cG9hTobzHE0HRdbg:yyQrCXjRqiKeqqBrik3DG/KHZRZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635711410, "uuid": "9467dc73-86ab-4a59-a9a6-7a389c1409b3", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635711410, "uuid": "776cbd72-f37d-410f-b384-a3afaec0ba5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635711410, "uuid": "96c541f2-0c41-4257-90ea-bb45d863d4e1", "value": "Change Vessel Schedule Notice - KTX3-JVA261S.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2038c459-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635664872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664872, "uuid": "1b7817f9-43bf-4be6-9a62-899cbcb3a6b4", "comment": "Malware payload", "value": "f7744662b78e045946678b3aab34f5b5", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664872, "uuid": "bd01ea55-a233-468b-9bda-ae84bbef7c05", "comment": "Malware payload", "value": "6fcf190d85dee62ab18a9bd36d8db98cadc10e75ec8aacd1093013a46e188db4", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664872, "uuid": "174c59a4-4b57-4e51-b532-df70b6e07c11", "comment": "Malware payload", "value": "1d07ea7ca3dcf5b16f92da25ad283e8d8112343d", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664872, "uuid": "72a9e692-1ef2-497b-99aa-1198801e4321", "comment": "Malware payload", "value": "8296cbcb142e3c0207b8783d8ce9ccfb8cd32c2952847bb9f2de0705d593b5761abe53c17e8c3dfd9735b80c244e31ec", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664872, "uuid": "60c78dcd-3bde-485f-a241-b7c4057edc20", "value": "T1FE821B66FBD8422AC6BF0E37ACB2534082B2B546CA32CF6E1AC9611D5D73350C661FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664872, "uuid": "a1e84034-b9ae-4fb5-9670-247d2fd307d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664872, "uuid": "fd18e695-ff67-4007-a65f-484f2c07f7d0", "value": "384:ewEr8k1TyImwVz6tGu6jFN40Zy+Tt+ynFHuu6KYfe:ewErn1TyImwVz60ucEAbnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664872, "uuid": "05dd1d2c-bb6b-45a1-9946-b9370bec939c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664872, "uuid": "9f96d41e-0183-411b-8e68-cfecd64c428c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664872, "uuid": "c8a73f62-8199-446a-bc87-41b46cffb54f", "value": "6fcf190d85dee62ab18a9bd36d8db98cadc10e75ec8aacd1093013a46e188db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4313671d-3a06-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635655911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635655911, "uuid": "7fb6e1f7-7857-4c5c-9a20-4296b77eaeba", "comment": "Malware payload (AsyncRAT)", "value": "42c19b54abff4813d3c7aa7ba914cb57", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635655911, "uuid": "00dc4a3b-0db0-49ed-a6c3-a5b14b9b4454", "comment": "Malware payload (AsyncRAT)", "value": "7080be3c64500586a249c98f43b71be914dafeebf5e77ba5f7629b06fbc62ebd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635655911, "uuid": "21df0915-e9a1-44ce-994f-a91006e6a7da", "comment": "Malware payload (AsyncRAT)", "value": "5f4422ae0b8350450701b5ff38008eef73f77f97", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635655911, "uuid": "59e309ad-c359-4352-9b18-7647507bfa96", "comment": "Malware payload (AsyncRAT)", "value": "54d66baf1aaccd1e6270a479e760af036bdba9ebeb2d1695333372e242ccde1bf37b2e67d5d8ed5048e96c1673ee0df5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635655911, "uuid": "7daf24a9-3d52-447e-9315-21feb5d18691", "value": "T1EF44BF3636A0CE01C2AA577FC8DA540443FAB942B413DF1E6ED633DE48467E61925ACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635655911, "uuid": "accd0472-64e4-47ec-ae94-75c4056b3920", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635655911, "uuid": "e1990a72-66de-4225-abbb-cd26c781b582", "value": "6144:u5JoSdwfmykze190YNv87xzKxt2R5iT5e:u5eV+7zI9/Niurk5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635655911, "uuid": "85b75d9b-c993-4682-bc3c-ac6b03e81b81", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635655911, "uuid": "bf029848-f0c0-4ed5-9a91-fe6b3cf62990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635655911, "uuid": "914be0d7-ad7a-4ad2-ad1c-5086312e29da", "value": "Purchase Order# 210145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe79d08-3a17-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635663260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663260, "uuid": "550cfb3e-8561-4b5a-813e-644160d36481", "comment": "Malware payload", "value": "213006bf3ff0e8eb4345d391377eb8c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663260, "uuid": "fc5f7cb6-9d73-44d4-a0a0-23398de9235f", "comment": "Malware payload", "value": "74531b8fdd99b02a6712748a4c24e0226b309c2dabd62971bf5745a04f7db942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663260, "uuid": "8c67bebb-3097-465d-bb99-280127803aa9", "comment": "Malware payload", "value": "a92bfdfb7a3c3c6140cfdd6315eecdcf60a5b38c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663260, "uuid": "f672553f-8ab4-4cf7-b706-f1b88cea843e", "comment": "Malware payload", "value": "01216c77379c0ed459467d4b1334ef295d8735654e5f31428ea5bdf832a588bc39c4156aca994bfb671e13632143f16b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663260, "uuid": "9c973eef-0550-46e8-977c-a52b854e922a", "value": "T1607533C60177CFDAD4D84EFB14EEA3CE58A43AD09994B83DD68F1282538371D6B90972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663260, "uuid": "fc87eaf1-c49c-44a1-b5f1-da28b1cf3e4e", "value": "94e2b0572ac9e87d08b3c525a2cff4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663260, "uuid": "89e0f916-f612-44b8-8103-10521efd1a03", "value": "24576:tLfbInc0Z2CVOZpRUJJO6xBlJBw1e6bO0n0wtKU0FtAF6TJ6ggy+P6+7J:tLt0UCVUvs5HlJNONnL3pF6F0y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635663260, "uuid": "fdc6e3c7-193b-46f6-a29e-29fc0ba82881", "value": 1678280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635663260, "uuid": "ad7fe744-cf13-44d9-9d9b-08e6e4da62c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663260, "uuid": "86dbac8c-5c0f-4cdc-8781-8b35d2f9fe54", "value": "ONLY 64-bit IMPORTANT optimizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262b441f-3a10-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1635660157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660157, "uuid": "56e1147a-679f-488e-9787-805f6d08034e", "comment": "Malware payload (Socelars)", "value": "767fcffc60f9222e3465080b53291aba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660157, "uuid": "0399ab2c-4152-48ed-941c-319c0d2b81cc", "comment": "Malware payload (Socelars)", "value": "76a35b1e906112cc35d5b2ae166312a28d32a2ef8d1ac5cdf0cd2ee380062abc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660157, "uuid": "5fd1fddf-3350-4909-9e22-cbb59f4fd3f9", "comment": "Malware payload (Socelars)", "value": "06ea7bb5f8dd1a1b729975ce9b7f443ae911ae30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660157, "uuid": "4e3e8f65-036c-4e20-a405-7a6e9b14446d", "comment": "Malware payload (Socelars)", "value": "72db46baa31adb4fd704f8bfac13a647748a44c9f5f3911fa4fa49a372e9b2e7dfd0576e310156f37bc56d9ca3106ea0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660157, "uuid": "015c7e1c-45ed-4575-abfb-d524e304a2aa", "value": "T10065AE21F782A036ECE300B385FF4AFF9D287621070854D7E3C45D6A5A619E27A3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660157, "uuid": "feb319f1-f543-458e-8bd6-d3915bf23019", "value": "bb685719d9ce856f7efb2faee0f8ae19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660157, "uuid": "1109d855-f898-431e-bf08-a9398e687886", "value": "24576:M40mpQwZSQhRfEnj7dbE1EHVluS8+XrWG0d6AM+Td2SZF9F1/cPRs:smpRfypigMQ+TESZTF1/cPRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635660157, "uuid": "b617d94f-6bad-48dd-8e63-e39823bcaeea", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635660157, "uuid": "8b84647f-8214-4361-b517-14a6bed07496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660157, "uuid": "b2a44936-b15a-42b1-bb0a-fe51fa415ee8", "value": "767fcffc60f9222e3465080b53291aba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6560f32-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635717925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717925, "uuid": "22e1d609-aa00-4a94-bae2-68afc248e0fd", "comment": "Malware payload (Mirai)", "value": "94a0e94268f56c74aad36c8ccf58f5a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717925, "uuid": "42bb1a51-834a-4236-bbcb-0ff2934fae24", "comment": "Malware payload (Mirai)", "value": "773631ee31ab0dc49fe6ac220d1a686b84c76c9ad4c828875b756595be720aca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717925, "uuid": "0376b6a5-79b6-4847-925a-9223734213f9", "comment": "Malware payload (Mirai)", "value": "99d1f3422a3c5f0c334c26c17b0a752389084c18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717925, "uuid": "6de70525-a1a0-4239-aead-9931dd8bef29", "comment": "Malware payload (Mirai)", "value": "627457202114608ca58ba4c9b1f42e9b38ce29fc4c5d2efe3ce71b58627e4e0d11cee3aa3138702214cfc8afd6275c3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717925, "uuid": "63698cdc-8cf6-4b5c-a8b6-b0f0ccbcf461", "value": "T1E6B33A57671C0B43C59B9AF52D7737F187ADEA7102E221C1A40EFF801B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717925, "uuid": "5049e5ae-2952-4ee0-8b60-d77d19003b8f", "value": "3072:hHXj8UjfsEsbN7ONRwQV5hnrLfNK62QnI0PDG4gQNcR:h3rjsbN7OYQV5hnrL12QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717925, "uuid": "7c627ba4-9b55-496b-a779-f3d8b466f1c0", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717925, "uuid": "3bc8a721-03cb-415a-ab22-edce0b9fccab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717925, "uuid": "7d7db2d2-4a57-48a0-ab33-e4ea7319b286", "value": "94a0e94268f56c74aad36c8ccf58f5a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cd76e4-3a17-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635663156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663156, "uuid": "7ef3728b-da14-45f3-bd6c-110f68439c07", "comment": "Malware payload (RaccoonStealer)", "value": "5d91e73234aade4ca3b286706367a476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663156, "uuid": "6704f1f4-328b-4884-b640-b8367e7ff391", "comment": "Malware payload (RaccoonStealer)", "value": "7906b83d40f3290496a98e071fd8585a8b93bb562a2957b4ab7e498a5e2d2da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663156, "uuid": "5a63d9e4-a53c-410c-8d9e-b2c6a0b5eaaa", "comment": "Malware payload (RaccoonStealer)", "value": "583ced2c5bb198b8bb3114f353967c2a2e879401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663156, "uuid": "2a7c2902-45be-4f58-81e8-e09e64e67708", "comment": "Malware payload (RaccoonStealer)", "value": "177f61aeabbc5add90163ebdc7f5b665c1b96f35efac3da732794f7a4b0a7255bdeec6d82ce24a96300dc9450a4dff04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663156, "uuid": "320addd4-3a5c-436c-976c-36ff9c387ff2", "value": "T19CA4F13136B9C473C093167059B4C6A54B7AF8115565B1CB3784AB3E2F70E8CBAEA34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663156, "uuid": "e3d67010-4077-4667-8927-14fae5c5afd9", "value": "399419c867e1b29b8b53fcd0cc79fbe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663156, "uuid": "594a751a-5c93-470e-b056-1fe2504317a2", "value": "12288:bqFrxeDXX3Wt3jQS+mJGuepm7pdyD6Mnpnunn:m4TWtMSFJGdp+dQ6Spw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635663156, "uuid": "c6ca9310-8660-41a5-8b5a-f01bfa5d65b0", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635663156, "uuid": "eaa0965e-b549-42df-b482-3d730423d63b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663156, "uuid": "8da1676e-7081-4434-b6c5-0481ca0cdff6", "value": "AutoInstallYoutube.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c048e021-3a8b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635713244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713244, "uuid": "b7b9b2d3-3880-4e1b-a460-bc64a71f4cb3", "comment": "Malware payload (RemcosRAT)", "value": "d2619ae1b8477bc948d6dc41124a2511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713244, "uuid": "2e1d93b4-2a9c-4ce5-9860-7bb8768b6333", "comment": "Malware payload (RemcosRAT)", "value": "7c4e0e8533b1e1b0299766f2a6db4d6dc5ba277cf776ae84517d64199e0a9652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713244, "uuid": "cec95316-de5b-48dc-9219-61ffff649857", "comment": "Malware payload (RemcosRAT)", "value": "4360da4ef16aa89278478d139eb1c37a18d0d536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635713244, "uuid": "a61a82a8-34b6-450e-aadb-5e05c9e65650", "comment": "Malware payload (RemcosRAT)", "value": "38f5f56267a210983ca524bdb4b6c2f4ecdc935d03f67bb6fc120aa7c914ea0e9f0be5b325271b8f268e05d50a23d15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713244, "uuid": "c46e59a9-83dc-480a-9c36-33218fef698c", "value": "T15D93D813FA4AD0B2E42591F145426F32CEBCBC3636496173D38FCA41AD79892D416EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713244, "uuid": "f8e76c7f-8118-4c3b-9e18-3f1b1236e57e", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713244, "uuid": "29cba12d-020a-49b0-bf2e-05b7e5a7a1a9", "value": "1536:YhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6prC:+hzYTGWVvJ8f2v1TbPzuMsIFSHNThy+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635713244, "uuid": "8dc90002-2343-4097-8081-90ebfc5e6744", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635713244, "uuid": "35cd793f-2bdd-465a-92ae-30f411e643c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635713244, "uuid": "5e39b4b0-aab4-4a7a-adf1-6f2bf35fa793", "value": "0v6vzS3Z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665eb2c5-3a2d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635672720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635672720, "uuid": "e76f8096-5408-46be-bc7f-49e3e9555f9c", "comment": "Malware payload (RedLineStealer)", "value": "e5faad92951c7ebf9d8dfc468f99ac42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635672720, "uuid": "6a4a003e-1d3a-4956-8f38-4f2d28e2351c", "comment": "Malware payload (RedLineStealer)", "value": "7d61f984aeed2f5bc08d55a88a18f7002049bafc046e3154831f728f961c4921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635672720, "uuid": "6187d4ef-0b21-417c-9976-e24d587287d9", "comment": "Malware payload (RedLineStealer)", "value": "a8b0aac6bc3edbf0bf3eeffd148203960e33fa88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635672720, "uuid": "3990fa82-a53b-4349-86c4-dd90533fdd25", "comment": "Malware payload (RedLineStealer)", "value": "64a9000009e8666df3b6770c03d885e39b59cce6b9aa9180c3c8fe26871b14d014e7abf882eb7d41cf9c7648d28d9141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635672720, "uuid": "7add6614-4f8b-417c-ae0e-d6fb7a8b6cfe", "value": "T1067533619D632B77D086DAF172CD9D109E2113904AAC06887DDCDAAF2EC724EF74642D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635672720, "uuid": "66f2f7cd-38be-4021-a506-7f68bab90983", "value": "94e2b0572ac9e87d08b3c525a2cff4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635672720, "uuid": "d9176584-cd46-4bbb-bc0f-af5a0c92677e", "value": "49152:OslkrRujNsBTTSWFcyfh0lCzCJcNiDUFVS29:OslkrGNsBvL6lHJS+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635672720, "uuid": "c7596ad3-eef5-424e-bc61-b0831a5c0b10", "value": 1588168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635672720, "uuid": "233daece-99b4-4887-9a69-f7b0abbc9d23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635672720, "uuid": "fe4ec85a-d71a-496f-9e91-051ad50bb0e7", "value": "NewUnicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4d637a-3a9f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635721778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721778, "uuid": "7604923e-27ff-4867-a084-03251cf57913", "comment": "Malware payload", "value": "e00291eaf259766b04c5c9eaf3f0b2a0", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721778, "uuid": "5ef778e1-f605-44e7-82f2-17e1f9798a4c", "comment": "Malware payload", "value": "7dc3c9d9a9192794a913c9b37e8acafa088b5cd4ea4f6313036832b6aba13b85", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721778, "uuid": "cbb0321b-9b69-4498-a9a0-770c3c98e9a6", "comment": "Malware payload", "value": "25a2604d5f685d1bfa67bdfac3d5e7e815a3d13d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721778, "uuid": "c818955c-be02-462a-9cba-0eb78ab6932b", "comment": "Malware payload", "value": "4636559498118055f5317f16063f20630dcb296edc2c92a2f0deb5f4d73b627055f50d7fb5b801892c5f5915b43751ab", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT32", "colour": "#69891F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721778, "uuid": "2118891c-a65f-4bd7-bd8b-b80876788347", "value": "T106E4F013F4AC8472D8AD003605FCAB36973FEA718B51A6EB3384A26D5F702C2AD75517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721778, "uuid": "6138f6f8-0e8e-42be-8365-95b234416361", "value": "7753088718707690ed1fd7302f4c89ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721778, "uuid": "968f4f05-bded-4a51-98cb-a100b6a33932", "value": "12288:b8h4EK5qu1TEun4loyWcF7OKfR7AjnJWDX1SFnUDxR3/5Dc0kZC6bc6Pt:YNKg0TEG4dF7OK9aUDQFnkxdivIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635721778, "uuid": "c612a5b8-3962-43d8-85bd-8e016c534ec4", "value": 693612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635721778, "uuid": "913df1bc-5c6a-4586-9ad6-695b6ebbf8aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721778, "uuid": "fe60915f-fd16-4a98-856b-b950628da366", "value": "7dc3c9d9a9192794a913c9b37e8acafa088b5cd4ea4f6313036832b6aba13b85.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e51311-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635717916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717916, "uuid": "0ada5a58-c339-40c1-98e1-2594e2e7eb75", "comment": "Malware payload", "value": "db4c33ad123226eddd6e3d06a7c4f7ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717916, "uuid": "e38d90f8-f141-4c75-b44b-15e712ab50f8", "comment": "Malware payload", "value": "7dcf64c6c104208986e9771f3beebe909fe62d3f9f069d923e76f7a89bdbf2d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717916, "uuid": "8e92512e-fa09-4506-9799-65f7de3959f7", "comment": "Malware payload", "value": "bdd71a418edcce096360a67abb9f49982cc03307", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717916, "uuid": "161259a9-26bf-48a7-a024-b8e90a3b0942", "comment": "Malware payload", "value": "f6463c5bca97a620693fd064251d9b5605ef38180ca0030288299471b47c66469da6989f7dd5abd2ad2f88ddf28f56e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717916, "uuid": "b3f5729e-599b-40c8-ac78-5364334240fa", "value": "T166835B337B134F67C0CA54B212E30331B7B6D61928BA5747B9A06EEC2F16BC439167A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717916, "uuid": "70f9c134-19a1-40f1-b713-64c0f1d679c2", "value": "1536:N4Wr+NM5WatctPlNs6vmQEF6kjNufVuZe:Tr+N8ejNs6vmQEF6k5ufoZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717916, "uuid": "f3c2d8e1-db79-4453-8283-28e465b828a2", "value": 85151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717916, "uuid": "16fb0af2-a7c6-4734-80de-8d2be796278c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717916, "uuid": "899c96a0-09d0-436d-9936-4a11d9100b77", "value": "db4c33ad123226eddd6e3d06a7c4f7ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0911fdd-3a3f-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635680576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635680576, "uuid": "105a4d2a-ed17-4660-938e-872083591ff1", "comment": "Malware payload (ArkeiStealer)", "value": "eea1c3d1ab9dd50b3dae826b35c8b138", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635680576, "uuid": "61466072-6708-4850-81d8-7a30521c3a97", "comment": "Malware payload (ArkeiStealer)", "value": "7e148999439b83e74d823e98f7a82e4bd75d5e259e4c6351aabbb446eb9dfcc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635680576, "uuid": "f43c7eb4-7bb5-4b49-917d-abb8eec8d489", "comment": "Malware payload (ArkeiStealer)", "value": "69d61ee80fa5b203f367c5fed7e7da8ae79697a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635680576, "uuid": "8784b27a-ae5b-4817-bfe5-5c9eabcd8e70", "comment": "Malware payload (ArkeiStealer)", "value": "a5da522d798320c4b4ae6d2ad23aaa85d29f79e518b3f821d39a1d7297dec60d87699d1afdfb49a598924bf10d5ca5d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635680576, "uuid": "8e805ced-e6c1-4836-8d0b-00b238b9abda", "value": "T10324502AE610C146ECE73FB722AD6B02C407C6F10524A476A2D87C6C58B12FD7799B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635680576, "uuid": "a43acc1a-2cf0-45cf-82bc-00b72de78239", "value": "ca4c54abb883e5c1afbe2edfacafd15e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635680576, "uuid": "88be3cda-9784-4573-8d30-6d05aa412c49", "value": "6144:lRqUj7H4qyEcBDcUGi9ghYW2bGj9Gz+NpYg5iYI5Lw6/30iEtE/6uz6HgNQHJxWU:lRq47H/tcBDcUG6ghSW9GiNpYJYI5U6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635680576, "uuid": "3c410a8e-76e6-40c9-91d8-1566b2d9e417", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635680576, "uuid": "3e32b502-5104-4f7a-94a9-439293172eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635680576, "uuid": "afe36d02-1d43-489f-ab64-16ebf15d9bef", "value": "eea1c3d1ab9dd50b3dae826b35c8b138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c69950-3a59-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635691528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691528, "uuid": "f68619dd-af9c-48a9-a2a7-ad3bc6cbc6ab", "comment": "Malware payload (RedLineStealer)", "value": "ada67f5362b131f2f8f9d9c13dd88100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691528, "uuid": "24ce6407-395e-469b-a641-e1d36af6e66c", "comment": "Malware payload (RedLineStealer)", "value": "7f0020cf9f13b030eb6b8c8cf3609e028b18849b922126a93e32272e08d5bf97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691528, "uuid": "08f0eac2-b74c-4dbd-bd69-0b6019fa2087", "comment": "Malware payload (RedLineStealer)", "value": "91c3438ae4a9791fa38c10b94e78368eaf144810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691528, "uuid": "8687f585-d230-4d47-8e17-37c57f8f1e2c", "comment": "Malware payload (RedLineStealer)", "value": "1d6134db9d7d895321547050d8ad341ae70adfb5c035e5766ff913b4f1d7644342925bf416a0f22dfbe615e221e67aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691528, "uuid": "13f13412-97a4-4aee-a494-547b87e80ab6", "value": "T12B451202F98189B3C6712D7146396B54557DBA200F24CFDFB3D4096AEA354E0BB31BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691528, "uuid": "cd1058f0-c445-4667-b6ae-4193bc3e001d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691528, "uuid": "946e74a9-4277-4127-a134-9888bd56b745", "value": "24576:lhvJVJdMh9LHXZjb49rPZOmHoaYbY29m74E/dNPxS3X1Ts6pCBJ5Eo:V3dop/4VPAuOY04PxooJqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691528, "uuid": "f3636133-760a-44be-9625-ab65ad18a6cb", "value": 1206741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691528, "uuid": "b930f8b2-fd92-4638-a33c-1ac0bc432129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691528, "uuid": "8cf248f5-e6b9-4e53-b6d4-ad621f021875", "value": "procexp64a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc1a53c-3a24-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635668864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635668864, "uuid": "f2c0d374-dcd7-45ae-95ac-ed8e6a6239f7", "comment": "Malware payload (RedLineStealer)", "value": "d4156f1c58ecd4b9eea61f0a75e7aaeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635668864, "uuid": "0bdf48cd-5c67-489d-a752-ed17b9a59dfe", "comment": "Malware payload (RedLineStealer)", "value": "7ffe215c075ff493cf6c474d54aae0fa6f1e0cac704637e68476a02be21983cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635668864, "uuid": "b4a8f583-bd1d-490c-85c6-b3da3b089cb3", "comment": "Malware payload (RedLineStealer)", "value": "0a8e146805c2c38421881ff93cc833d7fe64c640", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635668864, "uuid": "7aecd9df-1c00-4a70-a8a2-24de187d84b1", "comment": "Malware payload (RedLineStealer)", "value": "7d4648858379d43ba377e72b65d1296879e351e6b999a04d1c3dd18c56fab6597f979f19114f13e8346b0ab98b10d42b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635668864, "uuid": "68a231c7-663c-4bb7-890b-3b011c3590d9", "value": "T10C54F0703ABDD432C8A706708870DA940A3BBC2359B1958B3794176E5F71ECC9AF639D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635668864, "uuid": "54d09d7b-69d0-47ba-a126-581828334e37", "value": "d3a97c61fc26bbf128da129c9758c519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635668864, "uuid": "ad9f1ea7-be0d-4c0c-b2b8-57beed592033", "value": "6144:pd66YiGVX4reUT3sgBVynfWe7Ahy8LpuBZM+suzbgwu:66YiGVXsL7EneBWZSunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635668864, "uuid": "26804d9c-f5d1-4175-a085-65b53f7196db", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635668864, "uuid": "a6ba1d4c-4fc7-4143-bc82-48a61895a7a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635668864, "uuid": "8079e2f0-057b-40a5-b534-dddf42f42f25", "value": "d4156f1c58ecd4b9eea61f0a75e7aaeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308f01d0-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635665328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665328, "uuid": "45f87b95-e116-441e-9aed-ba117c011f5b", "comment": "Malware payload (RedLineStealer)", "value": "a4007fe007caafb644f98a26ad8f726f", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665328, "uuid": "43d0d4c0-bdca-400b-af70-a89f851d47df", "comment": "Malware payload (RedLineStealer)", "value": "82dc0e2c9c9026e57ffbad9d660283eaaca40a0c58b215c5699420bd069b36a6", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665328, "uuid": "1f3146d1-d204-44f2-bb31-d5bbf48520cd", "comment": "Malware payload (RedLineStealer)", "value": "88f5b191e17b5dd7fb4a5ac331039f4d05d8c6fd", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665328, "uuid": "01a15940-f65a-4c16-b37b-5c6be2223c9e", "comment": "Malware payload (RedLineStealer)", "value": "53a917ee241f2c05a977ce8d8cf743ea49aee23e128353747c4ff00e07c56d3ce35d8cf7ca3ae39ba81e8b9390381d6f", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665328, "uuid": "f22d4b63-d6d3-458d-8a65-9951c3b0cba3", "value": "T170821915FBD8833EC6BF0A366CB323508272BA46CA66DE6D0989A06D1C37354C761FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665328, "uuid": "13e8ccc2-0f6f-4f12-bc11-a38214570ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665328, "uuid": "51538b8a-059d-4788-93a3-802a9929d54d", "value": "192:mgdQowJJinkk/6F9pQCw7/iQ+nBbTQyEOFyt+yLmeFHJouIJ1xq+5lFkZLR:m9Akk/4v20nB//Byt+ynFHuuI7vlsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665328, "uuid": "580d061f-13a5-4a43-8992-3916b422df10", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665328, "uuid": "65ffe308-43fb-4844-91b2-43f83e329cc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665328, "uuid": "52528d25-1d05-420b-a54a-f811c6cc6476", "value": "82dc0e2c9c9026e57ffbad9d660283eaaca40a0c58b215c5699420bd069b36a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e819f2c-3a97-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635718261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718261, "uuid": "96a82cfc-5701-4a33-8311-e60fc1d65f60", "comment": "Malware payload", "value": "b787bb031060833daae06dfed12abec8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718261, "uuid": "f06844aa-e731-4e42-9c17-9e6a28c33ebe", "comment": "Malware payload", "value": "87cf50a8868d25354b485e197776a72b98869a76f4f5510073f85a0a568b2072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718261, "uuid": "260236a7-1eb5-4116-9042-378ffae4fe91", "comment": "Malware payload", "value": "d8bc46c2bdfedb0c6c33a18c3c6be9995af41322", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718261, "uuid": "7a9cb9f6-e50a-415e-8f9a-880e7ccdab37", "comment": "Malware payload", "value": "6d0c685db84c365b63441a5348e58e41452ed276ac0c03f54235565523f6fb72db0b328327c3ab8ed628f86e0c257984", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718261, "uuid": "fc5e6afa-fab9-470a-ad2d-c532287fa207", "value": "T143831B41F9418B27C2C327B7F7DF435D37266A5497A733016A297EB42BC27C91E29620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718261, "uuid": "c11c47e5-ff53-4c31-a237-c36afaa96d68", "value": "1536:bjhMoza/CU30z1XGpkdO9YOHrvRRKAuYcl0afc7ugzbmCArQ0CWC4Xmpe:CoPlTdOhRRK3cPmCArQ0CN4Xmpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635718261, "uuid": "11fb63d6-8cda-4eb8-82c9-f860abe40d1c", "value": 87385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635718261, "uuid": "16a01a17-fc2d-4f67-b289-c4fdb5a563f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718261, "uuid": "c139b8b1-f419-480e-8b5a-936fda71b1c6", "value": "b787bb031060833daae06dfed12abec8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b848744-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635665025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665025, "uuid": "54ce5725-455d-4638-bcee-548d792c0462", "comment": "Malware payload (RedLineStealer)", "value": "d492af0d6f8a0cd37c6b4efd4c3c72a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665025, "uuid": "53037653-1e0c-4534-bacb-cb20663b158f", "comment": "Malware payload (RedLineStealer)", "value": "8b808185dc8cc0b23c275ce6b8d384814d37ccec8a842e1e8702f63e76de843c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665025, "uuid": "e4313fa8-1e44-4846-bc29-72b18bd30ced", "comment": "Malware payload (RedLineStealer)", "value": "f07d420133b6923aed6ab95b6d487274f5559605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665025, "uuid": "f2e87d55-7374-445f-bd81-0c366831027a", "comment": "Malware payload (RedLineStealer)", "value": "1d19f7063eb5996269ab4d1831dbfa46b227fda6f6a9432578803cccb6ec0bb63c62de5224c7e98a21c8816e4eb206fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665025, "uuid": "30ea5ed1-e8e3-44de-90e3-d6b73a302357", "value": "T1DD050B29F0DA8540CD441171C5A3DD30AB3A1F9083BE87F95AF67DDBB6392D22938D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665025, "uuid": "585edff3-7116-4962-a0c9-4c792868f36f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665025, "uuid": "8d137d64-c541-4394-a33d-0138f8c95929", "value": "6144:Q8ml5VY/nUFuZRJvhQccv1kDvq4La8gu9VngrukOIsa/pP3crweoz0BO:QN5VY/rJvhEv1gmUVgKkrxGwe7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665025, "uuid": "2ecf77ab-a7a4-4ec5-9e61-64f08d6a9fd8", "value": 802720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665025, "uuid": "2e7d62de-6ca6-4723-89fa-fd39dd46fceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665025, "uuid": "c8af9128-0bf9-4f72-96b9-b77a19038a84", "value": "HershyMM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9515fd-3a15-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635662500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662500, "uuid": "230763c8-9e51-43b2-a82a-8ecbc2d19c32", "comment": "Malware payload", "value": "90af861008fc7cc2f1e8c7725e3a6fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662500, "uuid": "12875174-453e-4486-8213-e65b3f544123", "comment": "Malware payload", "value": "8c1dbb6983c9905b536bcb3c9c7b0e6f23b3b55d280557a08357f6c3cfacb51f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662500, "uuid": "2521f06c-67e7-44a3-9bbc-eb194302957d", "comment": "Malware payload", "value": "7cb1a69f2d448a9b49afc769795895b985f483a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662500, "uuid": "7f4dfdc1-ec72-4465-80a0-45387e16d215", "comment": "Malware payload", "value": "e65638d3da6c6a265f5180db6ca823fb47d6f208af280f103a3004bd952fb30224d4d68e726c18f559ae39eb976c332a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662500, "uuid": "43b547c0-d47f-4945-9113-f2e9c9982f11", "value": "T14BC401383599C431C4A756304871BA625679FC312B33D29B3758222DAD70FAD0BF67AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662500, "uuid": "ad4aa33c-d3f2-4547-b2dd-7e1119f14405", "value": "c0df013463ae9c6441312a1218343a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662500, "uuid": "180b6b86-793b-4085-b002-ddbc1746c57f", "value": "12288:5hdRm77DXoSo3iqkKL3eez3XVfbPQrz/U9+94hZalG907QZVWr3a7u9unn:5gboSo3iZ03lVfbPQ7U9+Iag907QKrBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635662500, "uuid": "c8d96685-608e-4396-901a-91729eb23ff0", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635662500, "uuid": "28ae3368-acca-4005-8a2a-fcecf16418a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662500, "uuid": "a2640f74-1eca-478b-9563-02ecdcbd4708", "value": "90af861008fc7cc2f1e8c7725e3a6fd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36083f4-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635717920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717920, "uuid": "24f7ad96-fb77-42ea-bfa9-6cf3301421e5", "comment": "Malware payload (Mirai)", "value": "d0dfd11f669a96745162b7631058a18d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717920, "uuid": "a1829c37-2e47-4e7a-9a53-e80fbe10aed4", "comment": "Malware payload (Mirai)", "value": "8cb1f7aac43b5b83bc9f93297f1662baac40f89e312e71bf80d846302208a91b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717920, "uuid": "61833b46-1674-440b-a5f9-afc74120bca2", "comment": "Malware payload (Mirai)", "value": "78282503d6b005edf82a2b23245d614b78a43e53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717920, "uuid": "c223b713-2958-4604-bde4-34de226e4088", "comment": "Malware payload (Mirai)", "value": "ca1de6e38e5006365cacadf2cea24bff057c44f1c8b12e15ee52e9e1a52409bef530da984b8e55acae2e6ec1ece1cb7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717920, "uuid": "60134923-b393-4d63-8ef3-1cc074f9a64e", "value": "T105A35B82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717920, "uuid": "7d4bab10-a63e-4dc4-bf1d-8b1d2fbd83a4", "value": "3072:P3yqjPQP39VjGWX98732V7kGyNVK5huTP7FXnf0OzTyoQQub:PxQP39VjGWXW9NVK5hujFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717920, "uuid": "043ca181-b7e3-4c6d-bd46-c93cae8e3480", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717920, "uuid": "55fc9d46-3510-47ad-b16e-91827738ca9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717920, "uuid": "8f5aeba0-47a9-4cab-87eb-2a9bd810d130", "value": "d0dfd11f669a96745162b7631058a18d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b9ec75-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635692697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692697, "uuid": "e651fef0-37be-4b43-bb14-a8b827ba384c", "comment": "Malware payload (CoinMiner)", "value": "01161fe886f9ce76733397d429e784fa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692697, "uuid": "0e49976c-331b-4544-84ac-eb12bda840f0", "comment": "Malware payload (CoinMiner)", "value": "91b9cfb1f7af4a031f50d9b02ec34f910301a29b864df4e7952a41887a2b1b2a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692697, "uuid": "c1d494a0-d5a3-46bd-bb87-8605344852ac", "comment": "Malware payload (CoinMiner)", "value": "e906759e68a2a415165b6bbd82426c99938c8f5c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692697, "uuid": "094e56dc-5317-4672-8e38-0dc9c62fcd53", "comment": "Malware payload (CoinMiner)", "value": "a5af9be7162377bb548f45645e8fa13bd2b9734f05862d4348b72c3e167827dabca0f9cf704cf1d457603d1beac87444", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692697, "uuid": "f34fd07b-29d6-4aa2-bc96-b3465d9048d3", "value": "T1D8467D48BE0E3C52F3CAF23CDF8EDBB0762779A9E316C0B279164159D5C26A4C6B2511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692697, "uuid": "1dba1932-6142-484d-9dcf-b2d8af39d888", "value": "98304:dw7E/+GU7YoSrn05RHCDxZxTRKqATS4Iy/G1ukWftLi3G:dw1GUern0HHkxZxTRKqiLIy/9vlLiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692697, "uuid": "59b1dcb2-d92e-4755-8492-eb9d2a073c75", "value": 5803944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692697, "uuid": "3a5b4ca6-aa56-414c-b9d7-5742e5c55e74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692697, "uuid": "5ffd71dc-356e-4dc3-abc9-afb3c5352a6c", "value": "aarch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ed681f-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635666406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666406, "uuid": "74445ee6-6c36-430d-9a75-71cfe292811e", "comment": "Malware payload (RedLineStealer)", "value": "1ecab17d7617ae63958bb045255fb1e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666406, "uuid": "a748007b-1b49-4329-af43-741e9c186b91", "comment": "Malware payload (RedLineStealer)", "value": "920df869a28663cf24be9e115521174b240a2ea249a637d0e432f57b202bceeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666406, "uuid": "b6c750a1-c852-444f-b0cb-bc31306f4191", "comment": "Malware payload (RedLineStealer)", "value": "0eb17360f4871cb87fe2599abea2c87912fbdd8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666406, "uuid": "c01e1c6d-0508-41b1-9dca-64ca236a0b0e", "comment": "Malware payload (RedLineStealer)", "value": "f6e70262ce6f8201e53c5e81c65d425a10a4cca80df99af4b14e0d5cf1aee33bbe7c3de131a87368de93c528a040e5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666406, "uuid": "85b672ff-a361-464a-9536-22232dd54764", "value": "T11F940CB871C3879BCD89257686F3BD00AB931CD347674BEA5F0B97B04E0E7252E49294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666406, "uuid": "cc6ea8ce-253c-4ad9-96b7-62d9faa3cecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666406, "uuid": "5dfda56a-c687-429a-9c7a-e0343bcfc8e6", "value": "6144:3CFOM8qr4OXFJyju2vHVktP2DMbU9oTffhlEav7yyG:3+Kqr4KFJ/uXAbUiBlxv74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666406, "uuid": "7708ea8c-4763-4e9c-96e1-10575e076310", "value": 418720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666406, "uuid": "fc964031-28f0-4a77-84c2-092b9fe3d6ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666406, "uuid": "237632b4-8b9e-4325-b4cb-d9e44ddcd178", "value": "FreeForYou.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad1b7b9-3a15-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635662527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662527, "uuid": "5815177b-a354-440d-b2f9-4a3807276e5f", "comment": "Malware payload", "value": "512afcf7032d5601cb04852b00d26999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662527, "uuid": "a38856e5-8606-406d-9ec5-d4915814e5c5", "comment": "Malware payload", "value": "939d7f86c86ecf9d15114b335bee3c8e760f743b62cba3cb2b8afacb5fbab1a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662527, "uuid": "def4e189-ee2c-49ed-8525-8297a4425154", "comment": "Malware payload", "value": "f1f3300d3b53cdd1a84f7e8ca98a1fc2ac8b73e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662527, "uuid": "6786dd36-ba94-4e34-a01b-535096fe4de6", "comment": "Malware payload", "value": "5f48b0292b22b6a35dc9ebc5d1bf94dec85adad4b2e63ce7b7940e9808ddfbea5208fc840e5504f4d80737b5fdbb83b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662527, "uuid": "34a375c2-588f-4fcf-a8a7-125d573f2106", "value": "T1C2F5336C11B5963AE0E9E4B8712F8D11329513629BD9CBF6B466CE634BCF1CF63116C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662527, "uuid": "30679832-f6a4-40d2-80ff-1fdf6ce31a21", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662527, "uuid": "0f8e92c6-3f85-4543-a00c-9349f47ecc41", "value": "49152:MZKDhM2g7Nom/Kqmr14m7N21J0QIYrIcS+kU/p4vzB+wH+WcyDHSGDDUr8si0yqN:GKDh7CN/irrqIBceU/KvF+IewRMA/FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635662527, "uuid": "202fdc6c-92ac-4b2b-88cd-b5ab3edd8d21", "value": 3454976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635662527, "uuid": "85a4b78e-8674-4039-890c-51b9bb9eee5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662527, "uuid": "fee7602a-74ae-49b8-a092-2e7f7a92ebc7", "value": "512afcf7032d5601cb04852b00d26999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a3f7c2-3a18-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635663777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663777, "uuid": "76c740c5-1465-43b2-a525-52f2bf0e0e61", "comment": "Malware payload (NanoCore)", "value": "aa7a0447437a65fe55dad70eb23ee51c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663777, "uuid": "a281c7b4-f42e-4bb6-93ef-5cc789e7733c", "comment": "Malware payload (NanoCore)", "value": "959484bfe98d39321a877e976a7cde13c9e2d0667a155dda17aeade58b68391c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663777, "uuid": "2bb93f64-3ca5-4f7e-84b0-0ce069a8084d", "comment": "Malware payload (NanoCore)", "value": "13a4ff9fbba5bf86c2943651bb253f28c09c0734", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663777, "uuid": "230e8948-9824-4e4d-8b5a-74dec1422480", "comment": "Malware payload (NanoCore)", "value": "d0b2172ffeff2bc722b923528310022ad9ba5ac7e44b1c477e98a36086400f0b706ecd96b2f93e4593f99134c010beaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663777, "uuid": "cde2e616-98f5-4ebc-8a1c-6d3e9931f33a", "value": "T191F1AE829FB8FA6F1B0A4328A83E484484DFDD85DF4CDB14499866C149DDB0A8877FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663777, "uuid": "c411a951-d4e4-442c-9318-f5024fd31a24", "value": "192:il3hrVMAMDXHULo/TZq+WXfpHBM3tHMqeW2uGpqj:ilx/oXS7fMuWLGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635663777, "uuid": "f2def3f5-df23-4e43-a05d-de37cdcc6def", "value": 7822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635663777, "uuid": "ac67d3c8-3a00-4bc0-8f65-a7633bac182f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663777, "uuid": "792da041-009f-4245-aaba-8eafdb162d87", "value": "#ZOOW2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314401e3-3a19-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635664041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664041, "uuid": "ef38e096-b148-47bf-ac34-14594426bd16", "comment": "Malware payload", "value": "7ff213c23f8ddb1125693634c942c230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664041, "uuid": "ed8eb3de-9ea6-4180-8ab5-e94ab92b988c", "comment": "Malware payload", "value": "9708f5e77b00a04b75adfe963e94a3cc08eb75ee8889c2aaefb72e39dc37997a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664041, "uuid": "8d42487c-ec58-4bce-819c-89492749b2ba", "comment": "Malware payload", "value": "205621baa23e47635bfae9165d2c3659249cd3d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664041, "uuid": "a02f44d8-4232-4df3-9210-458049afdf5f", "comment": "Malware payload", "value": "1af38295bad3ce62c7302b5dc821bc9478e7e6738b3f0eddf3ba0a2dd22a8230e59ee85cce5b347867263a7946781f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664041, "uuid": "e39a7f94-b0f2-4e96-aa0a-619665660507", "value": "T1F2C412903691D037C7A212713929DBB19E6D78E28A6141C73B98277F5E303B06FB63B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664041, "uuid": "02be9b29-2fe5-492e-aef8-1a67a791cc0a", "value": "399419c867e1b29b8b53fcd0cc79fbe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664041, "uuid": "3f744faa-0ce9-4a39-b0fa-32423d5fc3d1", "value": "12288:eoPOjkoO9zYFZ6r0rPVOfW+sfAw4We+qis9Kvu:woo8Yr6QZcwiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664041, "uuid": "fb94f1c6-01b5-493e-b421-4a8f2b85c871", "value": 554172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664041, "uuid": "bbbde598-e6ed-4c01-bbf7-b67cb06244c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664041, "uuid": "5367afc8-6ab2-44b2-8bec-a06082210e3b", "value": "7ff213c23f8ddb1125693634c942c230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a03039-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635664968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664968, "uuid": "09d93829-d900-40df-967d-908f75b216dc", "comment": "Malware payload", "value": "e2d319ba821ce4f428552fa521594660", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664968, "uuid": "07930758-19ea-48e3-a35f-b502e145f871", "comment": "Malware payload", "value": "99b4f556165b9a40bbb31cd4e57411bb4b2757c7ee8c6a9129334e4356186124", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664968, "uuid": "41991f94-43a8-42aa-9431-db070f2712be", "comment": "Malware payload", "value": "cab6c8cf6dfdb0b4f545391b5dce7caa61b57193", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664968, "uuid": "24a78a6c-bae9-4fc8-a9ec-a325839a0821", "comment": "Malware payload", "value": "d08adb6f5709e28640336aece7448f40bcbae086ab451fef1f520f7e94981c25fe4ccbf7a4a0cae8f4c485eeabb7c757", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664968, "uuid": "00b7df03-d6ec-4bb5-95e6-47d414ce1d72", "value": "T131A22801F3EC632AD5FE4F39ACB252400271F6978D21EB8F088DA59D5D373985E10BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664968, "uuid": "0c188402-7162-4573-9d11-96c42c4bcf33", "value": "384:tlQtzSCygfap6HtYeoNAZ8QmU9Dl3RCCwiZTpraa5u2El01kzP8vS7w:oUgfHNYfyaVy0iN9a9US7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664968, "uuid": "d3c7e09a-fd64-4a8f-85ba-eb2c80d33f3b", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664968, "uuid": "b868c3fd-81b5-4396-9492-26177ca9149b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664968, "uuid": "43ce5ca8-05df-4588-b6df-aef487499f92", "value": "RuntimeBroker_64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c6e56c-3a15-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635662487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662487, "uuid": "650bfa2a-b846-4040-84f6-affa3752870f", "comment": "Malware payload", "value": "1ae33973dd300368302f436eea2cfdd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662487, "uuid": "1c3e5781-0951-4ccc-98bc-aaa4eab78808", "comment": "Malware payload", "value": "9ab85c68338687154f9ac21de8f1a25828cc75aef1b69b09add600727ffabcc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662487, "uuid": "3f8c89e9-69b1-41ce-b64b-0adcced40680", "comment": "Malware payload", "value": "4904f54b9f55c5fbff2dcd356f7e3f88e0580086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662487, "uuid": "dafddde0-a046-4729-9cda-2c428cdcd658", "comment": "Malware payload", "value": "896af820068617b1f6a635dd95138a3eeb35e0f2bad89ef372b49fc735fa2cfee3553f17c326586ca4ef9891ba8729e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662487, "uuid": "24a72981-4b92-4a1a-aec9-886137126e89", "value": "T18AB4013835AAC132C5A715340973F2655A3A6C62553ED14B37142A2D2F70EAC8EF63FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662487, "uuid": "71c05e82-62c6-4175-bf34-4ee7fe1e14c0", "value": "c0df013463ae9c6441312a1218343a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662487, "uuid": "ae7bd842-4c7e-4846-a6c7-b167b6816977", "value": "12288:zf6Rm772Zc+wcu39teHNRoAIowvCrvmPP3Hunn:zR2c+wlKR9IowvkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635662487, "uuid": "da7b5488-d135-413a-be28-bda9c43cac59", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635662487, "uuid": "16c21961-fb36-4a95-83ff-02391d100144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662487, "uuid": "30867b69-4d47-4a88-befa-8e8c349fe321", "value": "1ae33973dd300368302f436eea2cfdd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c652f37-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635666154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666154, "uuid": "be11b202-1a1d-4eee-a71a-510d97a954e3", "comment": "Malware payload (Smoke Loader)", "value": "cde594559b7e4711d93c40a5cd2c6b27", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666154, "uuid": "e1625d6a-7604-4fac-9024-902fde4e4101", "comment": "Malware payload (Smoke Loader)", "value": "9ad470b81620ed278575914cbd017490234d37e500d43f8ca18469bc0118f54c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666154, "uuid": "e29646a5-443b-4a92-ae2c-d9e1a615bb5d", "comment": "Malware payload (Smoke Loader)", "value": "d50c05aeb81881e1f1ae3d2634497f82d8aef2d5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666154, "uuid": "d56acc0d-aaf6-4692-851e-829d186882f9", "comment": "Malware payload (Smoke Loader)", "value": "acaeb62e421cb5d88249e52a070154101851a6963f05a7e2d48bd6518656378bd79d866b24b9b14f80129283ca9f7903", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666154, "uuid": "ec7c866f-22a7-40c3-b993-92983d2eab5d", "value": "T1AE04AE3176ECC072C5A316304861CAE51B3ABC229975518B3794272E5E73E8C6EFA35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666154, "uuid": "39f3088e-d0ba-4f5e-8e64-d43c8c56d714", "value": "5848abf496f2c7261aa7c8e0792fff14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666154, "uuid": "e702e16b-248f-49e8-a3aa-9b671dbb43ef", "value": "3072:jLHfdyuxMwbwODjSCOs7SuFN+zqN0fJBNQwZTP6+C5uFhFWrxpzbgqru:XHfdxMlOD8s7Sq+zvHF7htuzbgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666154, "uuid": "65e8776c-11bc-4729-a842-a8df3b2193d0", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666154, "uuid": "49486bb1-a1d2-4e6d-a67d-e8a9b9dab230", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666154, "uuid": "e1797680-1aab-4e77-9422-6a8a8ceacd18", "value": "cde594559b7e4711d93c40a5cd2c6b27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1d550a-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665323, "uuid": "ac93cc00-159e-416a-a814-76772b8c0766", "comment": "Malware payload", "value": "f84ee138443e0d628acf8299776f0dfc", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665323, "uuid": "c5d82177-e1d6-40cf-a892-ce940b3fc71a", "comment": "Malware payload", "value": "9cffc024d481a5d5ecd6789d495a3f6187e0e3523b4490fec15549fca406a5dc", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665323, "uuid": "ab004042-7516-4312-b2eb-1b6584082c97", "comment": "Malware payload", "value": "5cd4b3c90c8692278f279cf0d6408985141700f5", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665323, "uuid": "6b56a4b4-320b-49d1-95ce-490ea6f37eff", "comment": "Malware payload", "value": "ebc4a8c58fb2d62b1ecd571f5f93cbf228e80d21905a42e239e15fc7bebb4a936e709b73974b0419da9e0844a0a37930", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665323, "uuid": "460ce837-4463-4f40-8891-3a9ff30c6f14", "value": "T128821815F7D8823AC6BF4A366CB313508272BA46CA66DE6D0A89A06D1C33350CB61FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665323, "uuid": "62586a1f-55e1-4636-9df1-ea236a923a6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665323, "uuid": "4f9ac57d-bfd3-46bc-839c-8498f04f23f7", "value": "384:wtlVuk/0yiBr0nB//Byt+ynFHuuIvclsa:wtlF8y2S/IpSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665323, "uuid": "142908cf-fe33-4921-8943-043b02b7b751", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665323, "uuid": "726edf41-fbac-448a-b23d-3eb1b4dcf68d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665323, "uuid": "5f1f3a6d-d4bc-4a86-b609-56d34f886187", "value": "v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2f7536-3a19-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635664378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664378, "uuid": "87baf7c9-54a9-4430-8c61-a2ad28a1c40d", "comment": "Malware payload (RedLineStealer)", "value": "fac92ae45706373bbeecd6e954fd2b44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664378, "uuid": "1ca767fa-06a8-4c68-9386-14ab6cd7d74b", "comment": "Malware payload (RedLineStealer)", "value": "9f897441820de0f050f41fa9d1cbdb70aad43e1bacc202ae11e8a38d1d043fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664378, "uuid": "001a2a0f-750d-434c-9ad6-58c9c68cfa49", "comment": "Malware payload (RedLineStealer)", "value": "8420d7d0402f97c76c831e4548371984cd6d3bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664378, "uuid": "1dac5e1f-12a4-4520-ad59-0252c6aaa0bc", "comment": "Malware payload (RedLineStealer)", "value": "414de711c1b0dee07ff9173412a2bb94fed0de0d832f0389f61bb5a84c3969abd937d766e6c777d7b3ec8a001d5105cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664378, "uuid": "1cdf0344-e863-44e2-9bcf-df13e62bc2ed", "value": "T1254633895AD8305DCA4A7DB09534E27F4572C18BBF9DCF80BE91743EAC15B688702AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664378, "uuid": "704fc87c-742b-4524-a20c-a6354fb9d686", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664378, "uuid": "6c372008-1d43-4f24-9723-2fdcaeab3117", "value": "98304:wqvUgMjWke2B1QIaNQrisrSAB/I/8jCBk5vcEvQsyvAI+Yfvg75:vUgYReooNy508jgAbvQsIp+qoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664378, "uuid": "e6de58bf-39d8-474b-9580-36cc46ec1084", "value": 5452542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664378, "uuid": "ff72fed0-cd36-4c72-903d-7c4e78aff8c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664378, "uuid": "1873eda0-c5b4-498e-b876-979f4e1f3394", "value": "AutoInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3835414-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1635717947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717947, "uuid": "f701e5bc-e72e-4637-b078-0a92081cda04", "comment": "Malware payload (Gafgyt)", "value": "a39b6ae0a14d2e019fe573d498b428bd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717947, "uuid": "6cbaa9dc-cb73-4ad2-a533-20ca0b70e96b", "comment": "Malware payload (Gafgyt)", "value": "a122cea6a3346cc9cd1313de43a875c638f2f50e6cb654dd2e8869468cff3420", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717947, "uuid": "9c8f57d0-e721-4999-99e0-179b6917c4bc", "comment": "Malware payload (Gafgyt)", "value": "0e6839ccf81f839f5ced071c2da346c3499a5062", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717947, "uuid": "ef9f8abb-9370-46b0-af61-121b7a8de2c4", "comment": "Malware payload (Gafgyt)", "value": "b783420a8de92105231be14b8dcbc0ef55c8dff48ad0f88d11da7748730d1ef640eeb76a36909dc6f51b12b71a29d335", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717947, "uuid": "e8805b3e-c4d3-43c0-aaba-e2bc0a8912ad", "value": "T1D5734A176A51C6BFC0CB86F95BDB96244023B8391F236305B3D8BDEA2F169D86D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717947, "uuid": "cbf168e5-53a3-40f2-b7d7-e136bfd97d38", "value": "1536:h7+dMRiYIzKuvAuFTbsRXkEtUTPN3CBHhmoI3um+jcYZx8e:x0RKuvTdoUkGFCBHhmr3um+oYZx8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717947, "uuid": "65bf1e01-3818-4027-a0db-f82dae5452c9", "value": 76997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717947, "uuid": "296ecb36-2b0c-48aa-adde-f5b4d619733a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717947, "uuid": "54f209b2-46f5-4bd1-91a8-57a5ce3e30cf", "value": "a39b6ae0a14d2e019fe573d498b428bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17abfcde-3a5a-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635691916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691916, "uuid": "50afe831-01a7-4fb8-a5c6-00b3e637ffbe", "comment": "Malware payload (CoinMiner)", "value": "0cacc48fcdf11e4be10a8de6c18588cc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691916, "uuid": "70e9be65-8c40-44a3-ad56-ef5a9f13b040", "comment": "Malware payload (CoinMiner)", "value": "a1f259bf158f3a1c75a30da3ed70e8607041b93ef2ff56f25980c3c6be447a9c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691916, "uuid": "ef89ee77-4512-4e3a-b792-4637847f6e4a", "comment": "Malware payload (CoinMiner)", "value": "3ce37f9c0ab5daa01e8409c6933703927c744fa2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691916, "uuid": "420c33d4-322c-43aa-961a-4ec159aed501", "comment": "Malware payload (CoinMiner)", "value": "2bbe01f79004633c9a7f50d2d2e92afffce8dab07e90bf977619e37f28c1146fef95298104892d60f6104cc59fdcab3d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691916, "uuid": "9b0bf31e-b3e1-4ead-8365-c70025a3d48d", "value": "T148055C2AE1E370BDC1A7C03107DF9B726939F47A02216EB721C4A6353C56ED12B19B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691916, "uuid": "ec6890b9-e596-498e-a191-ea69b2ac09ed", "value": "6144:YnZCnz1dYfj6xDA36jwvI7IRecsXVsJIOxHE4OTHYJVkE4SHIrEenqK05ElggXfy:Yn8nweSdgs2MMTHYJV4PqMlggvbuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691916, "uuid": "011ab400-1002-417d-8c9f-cad5574bb97a", "value": 799816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691916, "uuid": "e0512643-4311-49e8-ba06-4d17973def96", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691916, "uuid": "16557684-44d8-47bf-9f59-4b763474ad60", "value": "doslas", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3265810-3a1d-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635666058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666058, "uuid": "e35f4389-b39d-4692-9eae-c2e45cf39e5b", "comment": "Malware payload (AsyncRAT)", "value": "51e07d7ad67224da3c78ba6ca3485bd7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666058, "uuid": "7efa656c-d90a-4097-a1ab-ba8a5486071c", "comment": "Malware payload (AsyncRAT)", "value": "a3a219ae2223e214eb55adc8466942abb6e112f173875419f043d6e3583967e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666058, "uuid": "45157c55-a7a2-47d9-9bce-667851a6740c", "comment": "Malware payload (AsyncRAT)", "value": "2d244d726b49dbbf5f32589d5a436af748ef4774", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666058, "uuid": "658ce7aa-25c6-4970-99a2-1ba177d8b276", "comment": "Malware payload (AsyncRAT)", "value": "2871350168dc8ac160f57b74fa9061c95c5deb9d9d8e043163b4466120034d1241fe6ccda7f832f0c95528aefaff3d41", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666058, "uuid": "0ebee9e9-a355-4b38-8ab9-0634d4e34882", "value": "T1FBF0277BD0572AE7C7196D5FF2F39461441840035A94C41C8212638D8B344AEFA2C6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666058, "uuid": "b7c582ab-0256-4917-8422-2920c217cf32", "value": "12:TaVlPL6yNnys2M9wCioDYysamqljehfMWUBAzdqsH3dW1fMpCH0TC:mVpL6ycs26XioDlsawfMWPndS0MHcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666058, "uuid": "b3b94cbc-04a1-4c7a-9cfe-50bddf33ce70", "value": 532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666058, "uuid": "cd662547-bb7f-4f9a-8aae-2f596a3b85fe", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666058, "uuid": "b7938718-7bbd-4a45-9a2d-4c29f6eaff6d", "value": "GHFSIKMNCUUYTRA.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f286aca-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665353, "uuid": "64d6ca10-bf01-4bc7-af12-e15c30d4b4b3", "comment": "Malware payload", "value": "40e099dcc295083052a40c1b22eb0350", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665353, "uuid": "d4b07f05-bdcc-46a9-b5f2-52d65c7b4c4c", "comment": "Malware payload", "value": "a3ce1a4ab05731c57792a6fb9e3e8a7daeff11273ce888011c200c70758a9a8b", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665353, "uuid": "4a750ad9-fe34-4b65-b896-d160bd12f193", "comment": "Malware payload", "value": "2f84f577afa63b1f6efcd92a85b0ea565452ee3d", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665353, "uuid": "abc034d3-fd69-4474-af74-3fff7d7c9850", "comment": "Malware payload", "value": "ab6a39a6d8124c2c669e7fc7dc0b2dc4785649c76dc51888f32608cb841c0919df86a9af9965ebeacf915927b5e36eeb", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665353, "uuid": "8b23ec49-da71-4754-8569-24bcf28d5f23", "value": "T112A22901F3EC632AD5FE8F39ACB252010235F6978D21EB8F188DA19C5D373545E15BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665353, "uuid": "f92e3369-fee6-45f3-a9dd-a7aebd0b189e", "value": "384:UBkzeCDoX8pvHtYeoNAZ8QmU9Dl3RCCwiZTprai1uvEl01kzP8vmbw:t9oXwNYfyaVy0iN9aqUmbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665353, "uuid": "95b07072-93e0-4c85-a38d-cd0803faca02", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665353, "uuid": "ef6f2ed6-8b8e-4dfa-958b-ef212620d72d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665353, "uuid": "f915e707-8414-4f24-86a1-cc0f9ecad788", "value": "a3ce1a4ab05731c57792a6fb9e3e8a7daeff11273ce888011c200c70758a9a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be146bd-3a19-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635664113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664113, "uuid": "abd20ced-c316-4882-81f3-af5ba1de02f7", "comment": "Malware payload (DanaBot)", "value": "1e918c74068951bf6c4a02c729039e06", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664113, "uuid": "e533d9c3-3359-419f-a58b-ae1b0ff51ee0", "comment": "Malware payload (DanaBot)", "value": "a55f459fcb194a85abd9a6557204a938c1de2c089a15dded6e6748b0d4ce6512", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664113, "uuid": "1df9e04f-3d8b-4cea-8d5e-2d6b1629de70", "comment": "Malware payload (DanaBot)", "value": "2924b63a062df7aabc8674d5c3ad5ba4dcfda130", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664113, "uuid": "a56d9a35-0a43-4dd9-85c2-280ec3f75225", "comment": "Malware payload (DanaBot)", "value": "1cc9d72a25bf2bbb0c7cd9bddb5845f8354c2e1488be9dca71b5c6a37a3036381aba345de47b899a55148185dc508c55", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664113, "uuid": "50222a59-6e47-4774-bece-ddd936953482", "value": "T1D7958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664113, "uuid": "04fcade2-3213-45b4-a17a-a3c182cd8169", "value": "fbaa4feec3fe32007a4a6422ebe11e15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664113, "uuid": "3b115d35-e23e-4e92-9f7d-c804e485e98b", "value": "49152:wQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BIe8qfn8+nFFQCxEsJwKQ5:wfaNQh+NUABO/c0Y9Adt8qf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664113, "uuid": "5f5d6c3c-1b68-40ff-aea3-faba2018733f", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664113, "uuid": "effd538d-6fcf-4e74-ad17-04ca3b772ed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664113, "uuid": "3a63a648-92f8-428d-a841-58d6a6a704d0", "value": "1e918c74068951bf6c4a02c729039e06.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5678ed-3a21-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635667445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635667445, "uuid": "cdb1c87e-9a8a-4b00-8034-9a78dd1a9a6f", "comment": "Malware payload (RedLineStealer)", "value": "7410d2718e463f452c48f8cfa3673cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635667445, "uuid": "c21a2762-b530-4912-ae43-8968398a008e", "comment": "Malware payload (RedLineStealer)", "value": "aaa0f060df90b346b6ee2befdebaaa9df8ee085f4f4879adcf38c54a0cdee0b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635667445, "uuid": "d6c12734-c067-4fc8-b457-bb835403cba9", "comment": "Malware payload (RedLineStealer)", "value": "6ec2de2bb57e275b9373095bea4b349adaec8294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635667445, "uuid": "a83c0814-bbaa-4281-a6ce-9458eece0ee1", "comment": "Malware payload (RedLineStealer)", "value": "74f3e7177a62f6c589c73eec4313dbab5a71806ee32f5b0cccdf5ede71f34fc7a8bc09c813f44ee025d33ba378aedc5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635667445, "uuid": "2f0ec7d1-de6e-4b11-aea0-97ae0b69ff30", "value": "T1DBE4DED821CF9E90CD4816B68AE3DE218F6E18D34367B7CB9B4C95D0CA05261EE1D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635667445, "uuid": "3a381fa3-b61a-4518-85e4-86bd09811f83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635667445, "uuid": "da539570-ee25-4458-acd9-3a20ec82331c", "value": "6144:/pigQVRqUPQJO5Jn19xvSuTHgyE1JQptWxy3Q/oZrZmICvVQ5ntXrSd1Hszzq8Lp:xSYzObLxv5vnExo1Zkv6p21HMqm1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635667445, "uuid": "2c57731b-b7cc-4940-aa17-9aff6e4390d6", "value": 666528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635667445, "uuid": "7a4e8ae5-4dd3-43b4-b977-2418f593be2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635667445, "uuid": "db3ff7ba-2c8e-4739-a5fb-92f7d97c81c5", "value": "GenHuck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9bf267-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635692971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692971, "uuid": "25ef4f1f-9f58-4984-b159-9ad4fe30801d", "comment": "Malware payload (Smoke Loader)", "value": "9289a1505dbfc636e9c89aab5b7172a6", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692971, "uuid": "f05b32d2-29b9-47de-80d3-35e0fe78fa76", "comment": "Malware payload (Smoke Loader)", "value": "ab3519a53d3aeecddbab52b811a78bb073fe83d91f9e861c53a501f1d3bfeb89", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692971, "uuid": "5b12a5dc-e3f6-4385-84a0-787a7cf93e08", "comment": "Malware payload (Smoke Loader)", "value": "6d03dced14d1f5536f1b68253f3acd6e64e372c6", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692971, "uuid": "e0e3ced5-a37a-47a3-bf28-0099ebb20a43", "comment": "Malware payload (Smoke Loader)", "value": "0a66c7882039fd3a9720f0074beb2c8478e075c72d8b884aba541abc1d38352069f021c638756e850fb84788478b0289", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692971, "uuid": "4f28114a-10bd-4f94-8559-d2be046ad0a2", "value": "T13CF39D24FEE2D471D4A715304874CAA11EBBBC72577481CB37A82A3E9FA06C06E75376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692971, "uuid": "34a5949e-0571-47d7-a3ca-23129ec72b11", "value": "779056984bef08a13651915e9728c17f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692971, "uuid": "d703f9fe-3d96-4a65-9c2b-ca6704e2c9f9", "value": "1536:9Xc3S1B63D0JwwTs+Nem1peZZeUIqSnEA3kWnJLQNjMrcf0eQukxeOk+va7U85Vs:9Xc0PZZjbFlkorY0eXhOkYa7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692971, "uuid": "addee14b-1a0f-4340-8350-ba20efd25284", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692971, "uuid": "09d598fe-ac6e-498b-9c7a-d5dd50bf2b8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692971, "uuid": "4f3f5027-dd67-4d3c-9521-17fd8641abb2", "value": "9289a1505dbfc636e9c89aab5b7172a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d7062f-3a1d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635666059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666059, "uuid": "52cfda47-801b-40ea-a8d9-581403010a2b", "comment": "Malware payload", "value": "0faa3de5f4ffabaefdd39610b66cf243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666059, "uuid": "fbe8e791-4f50-4e43-bff2-49caadca5ed4", "comment": "Malware payload", "value": "ab938fc34d733fdb483e4236255d08c176063e0e4d87eb45cca92ae0615f467a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666059, "uuid": "befaf919-d23f-475a-830f-21c48290578d", "comment": "Malware payload", "value": "ee0628c2410cce47ccd9c4f0ab273449a5bf8fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666059, "uuid": "7fb43507-2371-47e4-aada-f90f4a2447ee", "comment": "Malware payload", "value": "96bd9a06c627d6f5d917cd62ed9ac3370c26dbf78213ae7bf95899c78d91454203fd3fcd1ba297128a4ab2e1591e53f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666059, "uuid": "c7404fdd-2752-45a9-a04a-74e00ce1380e", "value": "T1AF83AE342783D032C45364B0B9B9E7765EBD562211384AC76BA56E3DAF303C19BBB24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666059, "uuid": "ada990e2-4153-4192-88e7-7ed5967a7a1d", "value": "1536:272bG8ryWjeDOJYF1DxFMr+wJvPxnvouk1bf/WYo6z:272bs7FmSwdybLOYVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666059, "uuid": "a139e1de-0b18-43bd-908c-3b1fba74e491", "value": 81672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666059, "uuid": "90328c38-04b7-42ea-a395-54be8e4156d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666059, "uuid": "e1d7c14e-ff94-40b8-9d8d-87ba31c68b82", "value": "0faa3de5f4ffabaefdd39610b66cf243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8042eac2-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635665033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665033, "uuid": "a85542fc-9832-43a4-8f18-7ac215fba7a8", "comment": "Malware payload (DanaBot)", "value": "9845c33992fa1328fc3cb542f2871f04", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665033, "uuid": "a2ca6ba9-105b-4a77-b36e-78cb0e4cc92c", "comment": "Malware payload (DanaBot)", "value": "abcfb420a209258fbd9f96ed7f5e7aa4021845c2417cff19b0e6a95a07b59782", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665033, "uuid": "78bddb66-5bdd-40fe-9ea3-227d2d0749e6", "comment": "Malware payload (DanaBot)", "value": "bcfc6b5b430adf021fc6674d5fa11cfcbb81d4ae", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665033, "uuid": "ccb50515-470b-4d22-85fa-105f38797975", "comment": "Malware payload (DanaBot)", "value": "812844426549a30306c7fba1df28e9962902c64a1f9132b3b1c7c805163d00175879c799ee04b43704b0c8805a5e82a8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665033, "uuid": "8f4b4b60-01c9-4ba3-892b-f933e5df7d65", "value": "T1AF958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665033, "uuid": "51f54ce7-797d-42cc-9b14-535f36733e23", "value": "0f50489443e6604e62f8eacde68181fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665033, "uuid": "d1fc6c0d-7aaf-44a9-8105-7e01f8d4a6d3", "value": "49152:/QU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BQeZqfn8+nFFQCxEsJwKQa:/faNQh+NUABO/c0Y9Ad5Zqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665033, "uuid": "20890bca-2ec7-4947-9a6f-6f9a3bc6706b", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665033, "uuid": "44039349-1a91-4b2b-98e0-6ae3d9dcb7a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665033, "uuid": "8c6a6dd9-359a-40c9-9e9b-8e55b3c543ea", "value": "9845c33992fa1328fc3cb542f2871f04.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe4fe29-3a18-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635663932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663932, "uuid": "17a9706d-4f5a-4471-8677-7ca387be4367", "comment": "Malware payload (RedLineStealer)", "value": "432e0aa89b16204307d034dbb0bf5934", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663932, "uuid": "731da74b-7c46-4b68-a261-c7258aa3df8d", "comment": "Malware payload (RedLineStealer)", "value": "ad7c5a0fb3bcfafed608b33c38ce110e50aa4158906abfc8092a660b6b2ea133", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663932, "uuid": "1a22922a-8caa-4a5d-9501-f506ff525b86", "comment": "Malware payload (RedLineStealer)", "value": "beb13518af26b5e0b94f14e2c26f638f1e1a682d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663932, "uuid": "0e0a2205-850f-475b-a6eb-5d378c8c9f85", "comment": "Malware payload (RedLineStealer)", "value": "976c6a60776a716397950ac76c695544408838e47fa0e62d275985e5acdcdbdeb7010468d1ac04286cb8fcd397b00deb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663932, "uuid": "efec4da4-c7ee-4241-9e3d-bdaba0d550bf", "value": "T1B605999F20DA81C0CD67BD31D5A35D20AB2E1C91C3AA47B9EF36F5C896391111D3BE86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663932, "uuid": "89e853a0-2e15-48b4-b904-a1e323aa899d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663932, "uuid": "0b8df98e-b645-4dc4-af7f-7617755a957f", "value": "6144:q8ml5VY/nUFuZRJvhQccv1kDvq4La8gu9VngrukOInm+GH9/JyqjxK:qN5VY/rJvhEv1gmUVgKkrnbGH9/J7xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635663932, "uuid": "35e2061e-34cc-4928-994a-2cc06adc09d6", "value": 813984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635663932, "uuid": "6d710c80-2566-4409-8140-e70f6c430c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663932, "uuid": "db7bd565-39e8-4a1a-bcf4-2cc3affcbf2a", "value": "LauncherHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0235e4-3a8e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635714253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635714253, "uuid": "67ddd03e-e252-4313-88ea-5e8670215ff2", "comment": "Malware payload", "value": "af923e132c07ab77eae004e642dfa15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635714253, "uuid": "4375a100-ce15-4418-a12e-f1e65bc6195c", "comment": "Malware payload", "value": "ae98f2063823340917b2d28987b221b83e7b16d2e9c86c35bdff71e84eca5e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635714253, "uuid": "03d2f049-f497-4099-a054-e19a69712b78", "comment": "Malware payload", "value": "c275a82bcee305a3eb462a2f98412e18b6fcd605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635714253, "uuid": "14ae3ac6-ed9f-4ae1-9483-39839f878b2b", "comment": "Malware payload", "value": "cb3d47651352dd0b4bbe5a3ab474a2665e6836db9c655341e7c88dde5253beee669a60f58ef846a080538fcbc1d322d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635714253, "uuid": "57bad108-6d8c-49ef-be0c-d96c8644e75c", "value": "T1A555236626CA8873E2E19F730AFA069B033078E4BD25635F634138DD69214EA5F75733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635714253, "uuid": "73d0514a-9ca8-4ad6-9236-4d33b8bc9d67", "value": "d287b46f6436ae965f0f1af9da8d89c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635714253, "uuid": "304b622e-9d65-48a5-80da-6a17c667c8bf", "value": "24576:SfArddt0oTZx2OMm9PEzWOUDFkOaKfL5n43mlf7XT0qFALTofk0BKHuvyrxaY3H0:SfArddt0uZ9MKO4YsXIqFA3ofpHyrxaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635714253, "uuid": "0d9a07d8-24e6-425b-842f-ef0d6d316676", "value": 1334544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635714253, "uuid": "95b6f7fa-11a8-4d55-848e-ec29bf4a7ac3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635714253, "uuid": "110fb985-f200-4f79-8664-9e1d1847edf8", "value": "SecuriteInfo.com.FileRepMalware.2600.19222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e94a30-3a5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1635692644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692644, "uuid": "abe86bcc-a538-4a6e-bb0e-dc0a69313bd1", "comment": "Malware payload (Socelars)", "value": "8f27212b7de6d1757e52c79d0bad4f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692644, "uuid": "bf2c847a-304d-4cd1-a3e5-03c83350c783", "comment": "Malware payload (Socelars)", "value": "aee4ade7b3a4ba286b7de4c10d16b804fe94c3ddb07c4399d8ee4c07be1dad2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692644, "uuid": "663d06bf-f632-4718-bd62-f26820372780", "comment": "Malware payload (Socelars)", "value": "3ba9fabf7105dda944f76ef549d8dbcddc757347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692644, "uuid": "fd54b595-5219-49c3-9c7d-776f7b235e97", "comment": "Malware payload (Socelars)", "value": "ad3f9afdeff85917004916586976e002c537bf96b8feb4be3c9b8ebf618d64873723cb829ba28f45cbbe272a2ae53cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692644, "uuid": "efd5ce62-0e5a-4a8c-b17d-7ce971cf086f", "value": "T13265AE21F782A036ECE300B385FF4AFF9D287621070854D7E3C45D6A5A619E27A3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692644, "uuid": "42cea583-84f6-4e89-981d-b6f0f72a8623", "value": "bb685719d9ce856f7efb2faee0f8ae19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692644, "uuid": "4d9b755f-52db-4ccd-bb09-6cb94b202a8d", "value": "24576:M40mpQwZSQhRfEnj7dbE1EHVluS8+XrWG0d6AM+Td2SZFtF1/cPRs:smpRfypigMQ+TESZTF1/cPRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692644, "uuid": "50ad3a4c-3f3b-4172-a02e-9e300e2bf5dd", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692644, "uuid": "b6427d21-4fea-4cb7-ab1b-2854d9acec00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692644, "uuid": "774bcc1e-de50-42dc-a45b-61c052c25a2e", "value": "8f27212b7de6d1757e52c79d0bad4f8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a59d104-3a61-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635695088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635695088, "uuid": "feaf2178-a662-44f5-9e27-7db50b37ce62", "comment": "Malware payload (RedLineStealer)", "value": "887fcd9c9405d9942f65c58e11601ead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635695088, "uuid": "40016960-9a2c-4ddf-9648-21ab1f6f6d69", "comment": "Malware payload (RedLineStealer)", "value": "b26de00581fad51925754ed2837f74019544f170660eb37df414e73f65b910ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635695088, "uuid": "014a4c06-604c-48ab-889b-bd59cf7855ea", "comment": "Malware payload (RedLineStealer)", "value": "e2ece616016c128e332390a151a82ec60fe6f60f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635695088, "uuid": "e0637561-06ba-42c0-a353-d06bc481fa35", "comment": "Malware payload (RedLineStealer)", "value": "6427b76ca58bcf1c1799c803fa5a8e208bf3edc6f91f61fb20ccf3001e55f5651336dd553ee959616452d89b72316d16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635695088, "uuid": "4ad2d6f0-b585-4df8-82bf-0bb6b884988d", "value": "T11B54E07C36BDC432C4A31630B835DAA64A3A7D216974868B27541B2D7F30E9C8BF671D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635695088, "uuid": "9a5b9f5a-97ef-48e9-ac05-92e5b0ecffec", "value": "d3a97c61fc26bbf128da129c9758c519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635695088, "uuid": "aa011135-4815-4fcd-a625-5c60672b4b7b", "value": "6144:NNqqYiB1nU6bmjD6jZghFvV41FuEkjkdBoRWPXNuzbgwu:OqYiB1nUNceZV4eEgU/Vunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635695088, "uuid": "4e4fe839-621c-42af-97d9-c0c7efedd89f", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635695088, "uuid": "732917ae-9bff-4c08-8b5f-653200b8cdc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635695088, "uuid": "7fa8e3f6-5d72-486f-bf52-3fd0bed9ecf8", "value": "887fcd9c9405d9942f65c58e11601ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdff74f-3a9e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635721102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721102, "uuid": "c4bf8909-2a27-467f-895f-26c3ef877c55", "comment": "Malware payload", "value": "109077a96c1ead8960970373eb739501", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721102, "uuid": "e4c0c46f-2857-4575-b3f7-3243152d4432", "comment": "Malware payload", "value": "b396f55b0cb17ada2fd582e0dfd39feca81ba7466c7d01cbfb19d2229a3b2993", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721102, "uuid": "f574a05b-35bd-4289-9921-3eb3ec022863", "comment": "Malware payload", "value": "b13e9e41e4f0a7e0a36434038b681da1be513519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635721102, "uuid": "62f6f1be-75fa-4c36-97ac-85ad12078de6", "comment": "Malware payload", "value": "61659b3a3f795b875c0368659fee9248e4c62e929bc90957e031ecf75c6c8c73917ca7fa1fe0acbb641dd864ba5cd4af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721102, "uuid": "a5568cd2-9be6-40bf-9e8d-1829fb33d9e0", "value": "T1CF06332324EAECB2F42301705578A5B06AFCFC27D978154AF3D4AA69B6326D2F415F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721102, "uuid": "6179e3c9-a5c2-4b74-9c5e-74e92ca2d0da", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721102, "uuid": "189cb4e4-fbf0-49ad-bf99-5bc1c624a5b7", "value": "98304:EFUwOUe+fSFtfZNVLKc5CjJwKdhLFKTAGrrcGxxzjto/K+bsYNSh46:xwOd+aFtfxGcEjJwKzBKTtrrXxbCNSi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635721102, "uuid": "26824a81-33e0-4b32-a7a8-88f54672bb2f", "value": 3972138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635721102, "uuid": "e2e38e65-b39f-4f24-b3c3-5158c562b3c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635721102, "uuid": "df0dd9e5-e914-4bb1-862e-3c658db9dcf4", "value": "109077a96c1ead8960970373eb739501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aad4953-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635666151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666151, "uuid": "821c413e-c1c4-4020-bfca-ed5e11e82bcc", "comment": "Malware payload", "value": "9b27bb9d633040a01a964d12b40b144f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666151, "uuid": "3ae3dcbc-b38b-40be-9ba1-270b2c45c6eb", "comment": "Malware payload", "value": "b464b774eb8a0f033ded0b5d0765f526cfbb4c38452c13e096f03dc7c8025094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666151, "uuid": "f1aee733-5775-4ce2-a0eb-f1657ac10dd5", "comment": "Malware payload", "value": "6e63ecef9c7e872dae19a5d7903a94a6ccaf8ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666151, "uuid": "6a9d989d-cd96-4041-8f35-8c209a041352", "comment": "Malware payload", "value": "f50d97c97257ae935e6b02bbc072f2b7bf884479fd186ec5ca56b7f2e3e656e436a02bb4cad85f02cc154b5e76b5880d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666151, "uuid": "ddb15973-0040-4d51-9182-d3d495300b9b", "value": "T17DF5335FF2B3D203DE966AF215A719EBE01991DCBAD050D8E47700BB2C0453B899CBD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666151, "uuid": "ce5680c4-7ddf-43d1-99d0-52222279b003", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666151, "uuid": "52f2e51d-cbad-43e4-ac21-152e16685972", "value": "49152:R9z8+aDmD+909PsxiNh1cOvthtWSOgylB2PaQDvZZ0EIp769z6jttfp8g:4ms6sKylAzDvz6Z5p8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666151, "uuid": "08f5e3a9-569b-472c-bf46-33254387d44f", "value": 3431424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666151, "uuid": "e354f98d-9862-44ac-8a37-9d108359c967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666151, "uuid": "44948445-56ff-4692-a286-7b348b6ed9ec", "value": "9b27bb9d633040a01a964d12b40b144f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f425f76-39f7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635649596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635649596, "uuid": "df943757-f38f-4dcf-b3ba-c4d12dd81fca", "comment": "Malware payload", "value": "46954ca98b8f9f70d0dec43624d301df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635649596, "uuid": "6fffcbf1-023e-441b-b03b-431f67f5c7c3", "comment": "Malware payload", "value": "b896351c5f5d6bee633563734a8e2fa11a01f879faa818165a12607312fc36a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635649596, "uuid": "472b2195-2873-4490-b272-c41db6312551", "comment": "Malware payload", "value": "2408349433b6d3a16133630cf8fe75dac67bddb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635649596, "uuid": "0024a3f6-b56d-48fa-9c61-270e1cce51b2", "comment": "Malware payload", "value": "8e450e82bf61fa25967886063278338261758de9f3c0d23d21d5330eded5eaf54a1a5c5eb2066dafcb8f986da5f54ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635649596, "uuid": "be39a2a4-e69b-4ca1-9eca-1d554ba9af79", "value": "T19996331A620929E9F573213ACC01C43AC871F4735782C59F0AD8ACA79F5B6A5BC37F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635649596, "uuid": "befbba5c-b2f0-4b84-be4d-e8758b486082", "value": "2cdcfb3a828433ba76b5b41f45519bd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635649596, "uuid": "876e551d-0d21-47dc-8350-6183060d11a9", "value": "196608:oMTlAG6ZnP4Vh6CsXDjDyf6L2WliXYrHW1Da8jh/yIA:TlCRP4VICEDVL2ciIrHWHjh/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635649596, "uuid": "747373ab-1857-4ad7-abc2-e9396089a39c", "value": 8906767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635649596, "uuid": "030d2f41-b09f-40a3-97d4-874130e28704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635649596, "uuid": "b87f0354-4ab3-4761-9675-20a1df6ec684", "value": "\u5ba2\u6237\u7aef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8836a43c-3a16-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635662899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662899, "uuid": "cff5faf9-8ff1-4a7a-a814-c0519ba0afc0", "comment": "Malware payload (SnakeKeylogger)", "value": "deb6464fd50c36910e837c43c8cbb09c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662899, "uuid": "a51ff74d-4be8-4cbc-a2ea-e810a26d4dc5", "comment": "Malware payload (SnakeKeylogger)", "value": "b9132e6cf9b02ce27d2e6202531c20baa2b21dfa74583280abb03dcd14cd2983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662899, "uuid": "4e9e2f86-b97d-446b-9056-199e3db37fb6", "comment": "Malware payload (SnakeKeylogger)", "value": "61660b8de4b68914795ed318d6368f8f22eadf9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662899, "uuid": "a83c5e5c-3bbc-4106-b6fa-bcacf7117c77", "comment": "Malware payload (SnakeKeylogger)", "value": "414317b09f8b7287b334980a6355a808d43065938724a5e59feffdb339a0a745cbc261791be6e0b643315ffb20631bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662899, "uuid": "b4668e07-a258-41a8-a776-f6a5056ea41d", "value": "T144C3295C6BF89C00E6FF8A3705B25120C775F8410AABCE5D4AD1F868193DAA09D56FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662899, "uuid": "e86b0ef1-7c57-4331-ab48-4e91f366a7bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662899, "uuid": "01f62145-4f3c-45b6-9929-9c8e96ee3372", "value": "3072:hqKsT1oyor2Z1iDJv9ISTpQUbSUG8wBkSf:1c1i9v9XTp1bfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635662899, "uuid": "4db09526-2a7a-4deb-9e81-cc3e415c4747", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635662899, "uuid": "6b52ea8f-2336-4952-97ec-9d75df736439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662899, "uuid": "3b76e20f-1cff-4f9b-8ec9-291c2a3c158f", "value": "deb6464fd50c36910e837c43c8cbb09c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ece23a9-3a10-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1635660172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660172, "uuid": "9cc6ba19-a49f-4124-a90a-060574c02b72", "comment": "Malware payload (Socelars)", "value": "867f1890d45a83e6c39f629212f52949", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660172, "uuid": "a4d45f0d-967b-45df-934c-a1e2f6fcbda0", "comment": "Malware payload (Socelars)", "value": "b9787e60c1a66b64b1dcd99218da86295866360c57162e59ea109a482d900c89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660172, "uuid": "bf02021d-cd78-4bf4-8223-655715f5e8d1", "comment": "Malware payload (Socelars)", "value": "6e1bb7c63ea8f77ed23977e7b998e7fc8f7a20ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660172, "uuid": "2098c02e-6d47-496c-be10-a5c216e420a1", "comment": "Malware payload (Socelars)", "value": "ed31739c97f4de51d0e84b4d6b859470d7a3bfa3df1a4e43bbc0be9f881716e22301dcf4e24bc0ca81a8c72f1e0b537b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660172, "uuid": "317ee6fe-7f70-47b7-a9d6-e000e030f696", "value": "T1C565AE21F782A036ECE300B385FF4AFF9D287621070854D7E3C45D6A5A619E27A3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660172, "uuid": "4b799ee0-4cd1-431f-a1ad-eecfe4ec099f", "value": "bb685719d9ce856f7efb2faee0f8ae19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660172, "uuid": "a3c222a2-bcdb-4314-8fb4-f717200596cd", "value": "24576:r40mpQwZSQhRfEnj7dbE1EHVluS8+XrWG0d6AM+Td2XZFJF1/cPRs:RmpRfypigMQ+TEXZnF1/cPRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635660172, "uuid": "d3d7a02f-bd41-4148-8885-883c8c02025b", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635660172, "uuid": "d443a705-de8b-4831-95a1-03a66a865021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660172, "uuid": "ff2bd076-2c07-4b39-89ac-e6eb57e6f78a", "value": "867f1890d45a83e6c39f629212f52949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c4b413-3a7c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635706547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635706547, "uuid": "77552150-dcd1-4d9d-bacb-9ee74bc49862", "comment": "Malware payload", "value": "c625ef6a2d10861133ef8aab2111785c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635706547, "uuid": "6f50019e-986c-4f80-b0c8-904d93b53ad7", "comment": "Malware payload", "value": "b991b8f0e98632888f9d20106598cdcb658c2bb17dd77ca9c5277c42269096b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635706547, "uuid": "669e2397-aff5-4e9a-9f59-b2af1468153f", "comment": "Malware payload", "value": "8381b5c33ea74d290996aa52afbcab7f6dbb6b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635706547, "uuid": "d357bec2-77dc-475d-aba6-aba82b339a22", "comment": "Malware payload", "value": "2b22f4f1ca055a3844e3c33cd1700e7a3dae15b0a1723b950e24d83c953efc2574bfbfe5a0da650d83309e78f71eb025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635706547, "uuid": "019c925a-a0dd-458d-b5f3-8526d6fb172a", "value": "T183C33907F2B911E8E1A7E278C9A24A46E7763C664775D3CF0360466A0F637E0DD7A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635706547, "uuid": "01ff591a-ad00-47d1-a150-ba11c77682ca", "value": "e136c78efac5157bdb78b75c07967d98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635706547, "uuid": "105a01cc-4f25-4411-ac8b-15e90a01f7c4", "value": "3072:L6DhOHYMjlkvuk/1AdNR6LWaoQutlPnq:LBKqf6LVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635706547, "uuid": "30f7593e-9798-4c69-a48e-99dca1319711", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635706547, "uuid": "3ddec514-2e8b-4e7c-9633-6bf8c4c02b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635706547, "uuid": "72414ef8-e9f3-407e-b1c2-613ff774cf59", "value": "SampleEmit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26568c3d-3a56-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635690222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635690222, "uuid": "65d0cfd2-daf3-436b-a1c9-d33fb9e9c4a5", "comment": "Malware payload", "value": "6ea13b37daeb4eeb9d42285d4a3bb646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635690222, "uuid": "57032c04-cc1d-4a57-b60e-7fde7111acd7", "comment": "Malware payload", "value": "ba68b5e886701bf55a19b4a6ca073c9cb8e1b8f381a11650ea5a1a1283b51e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635690222, "uuid": "780fe88d-d3c6-435d-a9bc-22e7f88b13f7", "comment": "Malware payload", "value": "039f506ef63a82feb124c889d309671587eef3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635690222, "uuid": "6220fbc2-6fb7-4b4c-919b-37d934e7f8a5", "comment": "Malware payload", "value": "c485113722818afd5d7a0e6602d625ed9226b2235d43337c502c979702e28d0eeed9b630db524e585f569890b2c60940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635690222, "uuid": "73debe0f-bdcf-469c-89e8-5e2b80911b7d", "value": "T130953393D5B28398CD17FD38A6B9F574AC12F404D56AC7E83A8E122ADFC5325C168713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635690222, "uuid": "1983863b-3f2d-4f33-a005-1a67727e0db5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635690222, "uuid": "461c200e-16c3-432d-9d9a-f66b217bc8d9", "value": "49152:Pf6zUp6aGGLKY5gX1uJTtQVVaPho7urpidW2Kusn:XUUpfJtUQPa7urpidW2Kusn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635690222, "uuid": "f464b52a-884d-4720-9f49-ddbf4a6d0f9e", "value": 2027448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635690222, "uuid": "b1856466-c2f4-4e4b-9b96-9198f2f4c299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635690222, "uuid": "5faf6f6c-5398-446e-a4bd-14bb126e3b4e", "value": "Genshin Impact cheat be Spyro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b17391-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635666163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666163, "uuid": "c7bbd7ba-4782-4d34-a06e-00e01ddd9bf0", "comment": "Malware payload (DanaBot)", "value": "84a4124b8b3cf0c7a3a98b94dd79e49c", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666163, "uuid": "3e1cf010-503f-4cc4-abcc-d7df322a5002", "comment": "Malware payload (DanaBot)", "value": "bc3892c64701f79525a84b21fb1287431445266f18bcf2f7523437f003fbfbe9", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666163, "uuid": "0ae28bcb-43cf-4ae3-a7c1-8528ca07854f", "comment": "Malware payload (DanaBot)", "value": "c8be36c55d3815d1165d961f9316fa5579c89dec", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666163, "uuid": "c5454a40-7797-4aa3-89b9-8bcb50d4a81f", "comment": "Malware payload (DanaBot)", "value": "0fca72c55774fb5d86527c4cd880642d962ff5f49bf0e1a87fe65798a76bf13c17176bac26c2e2ea290ead8bc7aa0762", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666163, "uuid": "7ebafafd-b503-48d8-9bba-dac944ba5cbb", "value": "T16A958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666163, "uuid": "79c6f87e-3d1a-4a5b-acfa-ddfd643144af", "value": "d45437b200477f6972288897fe23fd78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666163, "uuid": "bf010dbc-3dfe-4e28-9a96-8caa8a6ceb2c", "value": "49152:mQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BkeAqfn8+nFFQCxEsJwKQp:mfaNQh+NUABO/c0Y9AdZAqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666163, "uuid": "c8018813-2e9d-4912-8b03-6f85fc46a6f3", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666163, "uuid": "def4b6dd-a31d-4fc4-9ee9-e0aae3bb2a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666163, "uuid": "09dcedda-41e9-4e07-9127-8263fa5dd822", "value": "84a4124b8b3cf0c7a3a98b94dd79e49c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274429ef-3a7e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635707404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635707404, "uuid": "f4b4c021-247b-4c0b-8a1e-39f38d0fd18a", "comment": "Malware payload", "value": "a10148ae088edac876840fed13bb6a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635707404, "uuid": "c8dbce54-6953-40f4-8818-1efe9f5b9868", "comment": "Malware payload", "value": "bd283396c9b4fb560a876788aebde19ba82c0efb8b25188bdf1347dfdef1ee7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635707404, "uuid": "28d8b81e-f6bb-46a7-8c3d-b68e56c482b7", "comment": "Malware payload", "value": "958732de2f9f0660e09e347acf77037a84f230da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635707404, "uuid": "def8be2b-fcd9-4dff-8e31-214ca5a1169f", "comment": "Malware payload", "value": "007a58758de5ee84707f49612ec22ab462fdfbbd86b2ad97eb5c3f240fcc13fe07494cb941b33bf7fa520e0edd8e9206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635707404, "uuid": "b60d45b8-3cf7-4ce9-811f-e9fe565a67b8", "value": "T141C1D642E3E88137D9E64B72AE7327001779EB562C92C35C2BC9116B6C1371519633B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635707404, "uuid": "57c2d507-39bd-41c6-914e-47c53c418258", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635707404, "uuid": "82c0cb9f-1fc1-4e49-8d88-fffb80edadf3", "value": "96:k6Vh2iYvqi+L+wrpKYeako2Z7lWmgDAu6o2ucl+6SAzNt:th2vCiw5rpK1aknZhbo2uibSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635707404, "uuid": "93997d09-039b-4914-92de-957c60079e4a", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635707404, "uuid": "f736e2f2-9d07-4bf8-bd64-ad5d341bd6e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635707404, "uuid": "49be8e3e-45f9-4f3a-8aa6-499ae04a784b", "value": "SampleEmit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67875c8-3a28-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635670814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670814, "uuid": "41a3344c-2eef-484b-8301-1c9848d1d53f", "comment": "Malware payload (Loki)", "value": "3e29938876e4b0a3683e2313b6847854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670814, "uuid": "e759acfc-0ffe-4aa9-b041-e3ff5f627fc9", "comment": "Malware payload (Loki)", "value": "be660ddae693708f0110416705ef6d350531851251a6fbf49e19d2b276527231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670814, "uuid": "d73e8f1a-dc90-49d7-b4ba-c9a9c5b1bcf3", "comment": "Malware payload (Loki)", "value": "884057b97917dbc82ba6988af44acf238bef218f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635670814, "uuid": "008d4d6a-a3cc-4aae-affd-1c45c0e50b69", "comment": "Malware payload (Loki)", "value": "e866fd10c4af930b60f48c1e8178245443cad7e6450930e23d209cd447e17883372ae6180ce7fc4eac2acb393bc14391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670814, "uuid": "92e9f1e8-41aa-4e4b-b543-861e3554ddb7", "value": "T1B644121033A4C3B4C2EB47FB32650420D27BFA5D506ADF1C5E68B14FAD9079B8AA1F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670814, "uuid": "50f1a509-8b34-4cea-a230-ab9f065640d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670814, "uuid": "267a7b9a-4577-4ca4-8141-fa531766f192", "value": "6144:nhtT6/f8s0/bEbQkojjxjFJmY1d4YC8ArfIoQvaQy:ve/oC/wlLbC8AvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635670814, "uuid": "72996060-fcdd-4d0f-9af5-db06200c8e12", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635670814, "uuid": "3b1b8471-8c71-4baf-8d0c-b1e0d97bf60f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635670814, "uuid": "b4ad46a4-48c3-49a1-9ca9-319912f01330", "value": "3e29938876e4b0a3683e2313b6847854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13423c8-3a15-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1635662592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662592, "uuid": "e2208dad-b0cd-4828-aaa3-8aa6ef0b5063", "comment": "Malware payload (Socelars)", "value": "1c7373c7f8a6fb5c8c267ff7204ca012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662592, "uuid": "e2f290bb-1805-48d8-af7b-8206d045037c", "comment": "Malware payload (Socelars)", "value": "bfca59746aa632114419b5e930bc0b2c010991ff992503c390e3504b78ed2064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662592, "uuid": "736d6679-5c31-4da4-8868-2f20d5c8a1f3", "comment": "Malware payload (Socelars)", "value": "c2be697471af8114c8fcf7d3d06314e742f06b12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635662592, "uuid": "0e119597-2f8b-404d-b122-252e50b20cf2", "comment": "Malware payload (Socelars)", "value": "57571c41a7fa73fe866379f333d958ba068f3298235b5aa8be88bf02d114b4831399a2185af1bdcb9c9ba012e4fd3da3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662592, "uuid": "06cf16ac-86be-45de-ad11-3979eb349a6a", "value": "T196659E11F742A036ECE310B285FF4AFF8D28B621034854D7E3C45D6A6A619E37A3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662592, "uuid": "15c941ae-2041-425f-871a-7d0ac4a628c1", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662592, "uuid": "94c8459e-42cd-473a-98d4-871e90282e4d", "value": "24576:bop4e+P7hGI5Yn3H4pIkOIkWsRhehSrob1gBckkcf6XKYycjj:kpQcZ62sa9kk6XKYycP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635662592, "uuid": "8532ec50-e5de-4f05-935e-017fc3c10ae4", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635662592, "uuid": "7255ce6f-97dd-4f7f-b7eb-e76c16bf7a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635662592, "uuid": "379b0609-be19-4d16-9032-03fa96df356e", "value": "1c7373c7f8a6fb5c8c267ff7204ca012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295d9f48-3a10-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1635660162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660162, "uuid": "ba703dd7-2e41-4fab-9f9a-81e15503ebd5", "comment": "Malware payload (Socelars)", "value": "3d3d006726a944136a63820c48a81ee5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660162, "uuid": "a1e7180b-6f39-4e33-8dc3-722ba759e728", "comment": "Malware payload (Socelars)", "value": "c11b40b180d20ac5f5f49071df7b3b5f9809fba193e4af70b92cd985eca54283", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660162, "uuid": "cd67103d-25e7-433a-b191-97829cb769da", "comment": "Malware payload (Socelars)", "value": "69dba4a4e818ad456c8a23ff9e7725c98981d2a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635660162, "uuid": "b34af020-959e-4b9f-aa66-76b1f1eff258", "comment": "Malware payload (Socelars)", "value": "238a3a510288e6ef98b7b647b12c7150a7ea422c04073d8011c8a2711d5b9230140e7e6a67f9ea7868ecd7c7f004ca48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660162, "uuid": "f6984ced-3b0f-4f4e-9268-225851291289", "value": "T16665AE21F782A036ECE300B385FF4AFF9D287621070854D7E3C45D6A5A619E27A3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660162, "uuid": "aa1b6369-40c2-44ef-8b31-048712ca6dd7", "value": "bb685719d9ce856f7efb2faee0f8ae19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660162, "uuid": "92042f41-2fd5-46d2-b203-213cc7f8806d", "value": "24576:y40mpQwZSQhRfEnj7dbE1EHVluS8+XrWG0d6AM+Td2aZF5F1/cPRs:ampRfypigMQ+TEaZvF1/cPRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635660162, "uuid": "2c806066-49aa-42dc-abc9-d86ab45c34a8", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635660162, "uuid": "a11bf671-7896-4113-82a8-893a3436cde5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635660162, "uuid": "c0c7cee1-946a-42d6-8b43-3c08dff1e23d", "value": "3d3d006726a944136a63820c48a81ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffbac21-3a59-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635691473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691473, "uuid": "448760dc-c4f5-4723-a05b-6028f60f364d", "comment": "Malware payload (RedLineStealer)", "value": "433bf96f4ecb8e38a1a80b78eb0abf4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691473, "uuid": "6245b480-2302-4255-b9b7-d23c5f4bde21", "comment": "Malware payload (RedLineStealer)", "value": "c1266acce2c7a4c69f64c2226a8f780b2688ecf0f1812d0083a85648d350a666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691473, "uuid": "a41fe483-bc97-4df0-8017-b00d5a9b9528", "comment": "Malware payload (RedLineStealer)", "value": "b46050627a8a3f3fa5444822bf1c24c3c8a17452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691473, "uuid": "f78f2ede-8466-473c-a6cd-b3a9652eaa5e", "comment": "Malware payload (RedLineStealer)", "value": "8c6934451bbb3b6eee7cc78c49fed4d3b37bc497f008fffd7643c911c4cc3cfa6b64e6eec86c66bf586345c2230a196c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691473, "uuid": "f64d3edc-b064-4d5e-bb79-e67abdd2fc6d", "value": "T1BD752301FC8095B2D732193549297761B97975201F18DFEFE3C80B6AEA711E0BB35AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691473, "uuid": "ee043038-7595-4e66-9060-b3363b381da7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691473, "uuid": "01155352-2496-4ca4-bf60-75bacade09ea", "value": "49152:V3d0r1OR5ybLNpJyWW06C4ICZ4ayzrSHkJSWSa:V81A5ybLWhgzrSHkJSWSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691473, "uuid": "80a2096e-4dbe-43f8-8a05-b4ca347de689", "value": 1653327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691473, "uuid": "210b8455-f849-47ad-9959-9924414a53ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691473, "uuid": "3df0c06f-58c2-4a8e-85c9-2109215f7c5e", "value": "procexp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d9bd3b-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635666114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666114, "uuid": "234217fb-6b82-44d2-86b5-bad0ea40f8ba", "comment": "Malware payload (Formbook)", "value": "bb395896ba43c73d81fa70140ce69ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666114, "uuid": "12eee2ff-eee4-4f27-9036-1e7338d18e4f", "comment": "Malware payload (Formbook)", "value": "c3327a302a265c4327ebe46e508cf30c5be39966bdd95cd286f56d93d22e80c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666114, "uuid": "1a9234c3-171a-47ea-8c68-8dab67cc6565", "comment": "Malware payload (Formbook)", "value": "4fd5f9d1cb716f7259fa8ff61fb8dc6ba0b34f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666114, "uuid": "b6d56457-0bbe-4fb6-8766-321f97b35d78", "comment": "Malware payload (Formbook)", "value": "bcf6a0d772a2a81f3c7300e2fa1528fce624846cc627ab88ca238ae86a2357e8347d5c2ba557ea6a9f84bb0b7e00d054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666114, "uuid": "399281cc-87da-405e-a8d2-f32199712f8e", "value": "T10E441267B3E14ABBDD874BF400B7E394EBE7C54804A2A2A7D730CF1E7D20A81D556252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666114, "uuid": "2f4baf87-841e-4334-9486-245d80b72600", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666114, "uuid": "504ee27e-71b7-41a3-a009-ef1fb7d8e17d", "value": "6144:wBlL/cWGPJTfPM2Vvkbku9Z5cKGCtdZ5RrwjkFg:CelJTntPQRGSZ5RrwA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666114, "uuid": "407c0d47-ce4d-49c6-8989-ba6feec42bf6", "value": 256446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666114, "uuid": "0bbf1185-1ef9-409b-968f-69f0d1e8c7dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666114, "uuid": "5bf4e74a-e7d2-40e6-b0db-8c507f632423", "value": "bb395896ba43c73d81fa70140ce69ee6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bcb15b-3a59-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635691503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691503, "uuid": "f00cd115-5d43-47d1-b133-6812802f85ff", "comment": "Malware payload (RedLineStealer)", "value": "0a06fdaef53c365e10abf33951568cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691503, "uuid": "0bc61c76-488c-44e5-ae1a-8eda69184f37", "comment": "Malware payload (RedLineStealer)", "value": "c3d08c9293f87258ab312e53d5b830c60aa4717a9dc87a76d34f421ba19ad6a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691503, "uuid": "89b2258b-dbd6-423c-b08b-ccc8ea0a4597", "comment": "Malware payload (RedLineStealer)", "value": "ed7235dce4b1443c52a9e27eb240adfc7cdf652c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691503, "uuid": "604b20da-e022-412b-9bdb-c896a92ecc67", "comment": "Malware payload (RedLineStealer)", "value": "1b1409b134838570b4c8ee9eb28c6101ec08f8c946749aa36d1cb00ec9211506d17848a75a6e0a3ffb3721bd0e715219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691503, "uuid": "5fc5f335-8845-43cb-9f6a-81cf6121f2b2", "value": "T1B8452202FDD155B3C3711932192AEB52BA7DB4201F08CEDFD3D40A5EAA351D1BB35AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691503, "uuid": "b39f7f10-8cdc-4822-8baa-5c7f5f119562", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691503, "uuid": "d88141e6-6979-4c91-bf19-d7197979863a", "value": "24576:lhvJVJdMhrxwK+okHGAPIrGsy4smuTRC0AlBYy/rvSYtUNHxhn:V3d0DkHGAPI847O+B7/rvPKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691503, "uuid": "ffbadcb4-a451-4913-926d-248ef1c38cd2", "value": 1260877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691503, "uuid": "f91e2bb8-94d6-4c91-8040-b32ae3151140", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691503, "uuid": "58755605-462d-4ad8-8e32-0cef5320809c", "value": "procexp64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be853cdd-3a33-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635675445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635675445, "uuid": "88e2ada1-8119-4164-93ca-824556a2dd9a", "comment": "Malware payload (Formbook)", "value": "3ee4311afe3321e9c9b4c6b07ee874d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635675445, "uuid": "6a91f135-abc3-4b26-bd42-4b79fa557f57", "comment": "Malware payload (Formbook)", "value": "c781169f80930851f2174df529d1aaba061c45fd7ef90c5059a7c513bfda3414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635675445, "uuid": "84e7d1d7-15a6-48ac-9353-64d6f03f1612", "comment": "Malware payload (Formbook)", "value": "abf184b39c7b4d3acb7a921a34abd031791f048a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635675445, "uuid": "3c2bfec6-e7d1-4b7e-a41f-da00dc05e985", "comment": "Malware payload (Formbook)", "value": "85f78824716d489679e75932b307d7c50e59d51d4249972cdeafdc730134b753544a71a6077f581cb65cd91fa5244e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635675445, "uuid": "7ea0e027-cac1-4971-9ee8-0766e34b52e5", "value": "T182742321BBDC82A2CD1F13B5405404D035BF7F4FD042EF99D86F61A67922BA78663EA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635675445, "uuid": "d9556568-b34f-4acf-b9ff-621807a96492", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635675445, "uuid": "44d16ef8-e5f6-4eea-b016-195e258b8db7", "value": "6144:J3leo3r2zAIBaZDpb6t6II98yb6ff0awPYczzxqlAO26x7dAYQgTGv8qQ:lBrIBaKt6F9/GfqPYL1nT/qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635675445, "uuid": "f7200360-1ca8-49c2-85df-5cfc155e9d40", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635675445, "uuid": "85c8dc99-4b92-46b8-873d-bab289b6d7cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635675445, "uuid": "cd4c82e8-9c24-49d0-9135-55aaea364474", "value": "Scan-Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d99f72-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635665035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665035, "uuid": "d80520d9-fb26-4a3d-bc14-8396ffbcced9", "comment": "Malware payload (RedLineStealer)", "value": "89326660014452a89862042c73e9ef72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665035, "uuid": "57e66382-383d-4b87-85e8-3d315fbf9032", "comment": "Malware payload (RedLineStealer)", "value": "c82fa4f2b1069a3008f1f25b67c68e6f8b49b556c95441f625d660d05f565d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665035, "uuid": "02416f16-4da5-451e-9904-0b763d1fc85f", "comment": "Malware payload (RedLineStealer)", "value": "d2275dc95e1a24264ef6ffe7bd864557742cc4cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665035, "uuid": "cee18a48-c045-412e-92fe-323c82cfef5c", "comment": "Malware payload (RedLineStealer)", "value": "90ede16a733b07a58d3b5ccedcb0cdc3766df054a84573cf33a405ca882331f03ad33dddcf91155e0279b2efa5018aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665035, "uuid": "1b50ea80-9455-4241-8d72-d061e3d803b9", "value": "T13DC41231319C8036E6A7027159A692B44B7A3C22567142C737483B6F9F30EAD4FF676E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665035, "uuid": "e3bfc46b-25a9-4fb5-ab2f-dbf64b543f60", "value": "a7f0007c8ce9f2d8fa1deb194b6a334d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665035, "uuid": "3598f54a-5c55-44f1-9008-51e5dd630efe", "value": "12288:2zfemCpMqBu9o+5Aoxw2uwTQ9a/hmaAWHZ4QW6sUunnc:UhqBu9o2y2f/hmaA4uQW6sHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665035, "uuid": "05a9ea77-659e-4331-9945-d38b6fc36bd7", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665035, "uuid": "443a990b-0b3c-4976-9145-818fa6f7b0ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665035, "uuid": "3c51464a-c4e3-461c-914f-c476701e1d9b", "value": "89326660014452a89862042c73e9ef72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad2b895-3a54-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635689612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635689612, "uuid": "2a95a50a-404f-4d38-a6f6-22cc87535917", "comment": "Malware payload (RedLineStealer)", "value": "2cebd4bccacbee5777ea0ef8d717a5ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635689612, "uuid": "c9f1ed43-e4d1-44de-9078-b0c2163af1df", "comment": "Malware payload (RedLineStealer)", "value": "c8482562def318764a835e4c148e3f8e86d8292b866cede7d0280eedc503d7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635689612, "uuid": "9be8989c-f135-42da-95b1-1973400cc5e1", "comment": "Malware payload (RedLineStealer)", "value": "cb78198febe22213467f7605301f0c44fdbb3146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635689612, "uuid": "f698e9e9-a526-4f1c-9423-6a51f6b4ccbd", "comment": "Malware payload (RedLineStealer)", "value": "5a8fa9bedf6eec995883cd5ef9341eaaca6ed1596cc9a4fa80a096cae04181e4001fe4780dacfb6195e9caf200ca7f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635689612, "uuid": "ac21c927-a7f7-4684-a038-ddb39e26ff46", "value": "T1B9052AC6F1B3608ED3A3B0B80F0515924A471D7A6B119AF5AF359A6B11F37A1CAD7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635689612, "uuid": "8b03788e-7c9b-4fd7-896c-6c6730791ee2", "value": "c18eb5133e3f30215246505f555d85be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635689612, "uuid": "6c51f247-1926-441d-b84d-6b6869fecab2", "value": "12288:sgOKX7/m7w/8iaORSGe9bqLWUngEx7mT2WFyxXnX3GEioAzYj0Fvaq8KFcX:PO4Cwk2BsG1gtXmGs8Yj0Fvaq8KmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635689612, "uuid": "d0068c85-fb4d-4629-a0b0-1dc96ee75b40", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635689612, "uuid": "5478ba0f-736d-4b40-89fc-d2c635e1f651", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635689612, "uuid": "1b5d669f-676a-4ec4-93b9-4b5e4063ada0", "value": "Unicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cec836-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665359, "uuid": "2fab4365-a71f-4da4-b587-5683796d9953", "comment": "Malware payload", "value": "ca9d37b6cadea80f14f48f6c003f7a91", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665359, "uuid": "295a30e7-ef11-403d-9bb8-565157d571bb", "comment": "Malware payload", "value": "c91266f2c46c716c5f977035a94caac0230913a2916725dbe8864ec1699be62e", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665359, "uuid": "7b4ed450-e35a-401c-950a-e26bd24b29e5", "comment": "Malware payload", "value": "6b7282c87365e1de25bd342864fd31ad314d6472", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665359, "uuid": "359bca9a-579f-4f8d-bd7e-6ceeb0921f85", "comment": "Malware payload", "value": "4daf600dcdfd9fecda5d58fe4a6466853cc4b7659e014132ba291c29255435eade18a83f46f4a00892694b1601223cf4", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665359, "uuid": "30200fb9-539a-4d48-89f8-e628dc4705eb", "value": "T11EC22B047BC98B22DDED0BBB58A3670153B8D291542BFB090ACDE09F6E737944610BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665359, "uuid": "494313d8-fff2-4dc7-9d86-301aa2b84737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665359, "uuid": "5d5fb093-b0f9-436c-ab1a-d0f2a91c1e4b", "value": "384:toDmPKNNB7Qp18goWR56FjdHfIRKBdYUbzfttNz92O7tPWZ0Zbt+zOv3RwM+MBDT:CD8KfhM18gofRdfAKB5zflPlZeMB47w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665359, "uuid": "6c6b1a40-d188-43d8-bbdc-130d5cf46419", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665359, "uuid": "6b8a5dba-1647-40d2-b409-f47bfa73749e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665359, "uuid": "6669c537-da83-4842-92be-1421e90205ae", "value": "c91266f2c46c716c5f977035a94caac0230913a2916725dbe8864ec1699be62e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f27a3f4-3a80-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635708410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708410, "uuid": "c1eeeb41-7fef-4dc9-b92c-79234feb3242", "comment": "Malware payload (Formbook)", "value": "992fb2560834dcb308a6dbb37ced524b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708410, "uuid": "226df525-5236-401a-9a8c-06d7485dedc3", "comment": "Malware payload (Formbook)", "value": "ca205b38e2ee729d40141563bbb4200970224f4e00b380d5108a3ae51fb7eada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708410, "uuid": "53c3ffd0-7798-4c0a-9714-3693669ac040", "comment": "Malware payload (Formbook)", "value": "b05514375371a1989935160b72830122182e90ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708410, "uuid": "98f379d0-366a-44fe-8264-1d35060f6cdb", "comment": "Malware payload (Formbook)", "value": "c6e8d9a052841c28cd2f65f4a17aa82322d10187b496317ad6e42db3549338ab3d95b660fa223b377b056ef7c7158282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708410, "uuid": "85f058d6-0262-4d70-ab3c-cc52f78cf9d2", "value": "T11494DF00A3E5576BE67D87F824B311502BF6786AB272DB4D0D8274DE3A72F804A50F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708410, "uuid": "ede47570-c438-41d7-83c9-c618665b7f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708410, "uuid": "91d434b2-9f97-44e9-9b04-377153bd77ae", "value": "6144:fF1pu/Q26E5Ljxz+JG1Xtp2af491J7YjAkU9MIDQad4KZ/n:fOQ25jxi+2t1lY97KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635708410, "uuid": "e5f6e8c1-ed89-4f3b-a3eb-365b569b4b2f", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635708410, "uuid": "e8886028-d8cd-477a-86c7-2029d671f614", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708410, "uuid": "341f1765-104b-49f5-8d27-c99b08081f60", "value": "Invoice #00442811-20211029i.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5f4227-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665407, "uuid": "77ff598c-1979-4a2e-8df8-68f8aa111e8e", "comment": "Malware payload", "value": "98e25e7ecd5671e8811830fae688e52a", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665407, "uuid": "20fb7802-61dd-4330-9ff6-b1fe9ecf84d9", "comment": "Malware payload", "value": "cbd753e1be7725924982ee8eca9cb5424730a5d257c5ac82faafe5434aeb4446", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665407, "uuid": "818ca886-688c-4039-a97b-bf65a2f2dfd0", "comment": "Malware payload", "value": "a2b2679ecef28d4482cd66e56ffbdfffa4d1bff9", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665407, "uuid": "1fd276d0-b7b8-4aba-9a7f-81f39ea900bd", "comment": "Malware payload", "value": "4da71507673a5a90906ca645552bd1ff8522537ed333cbb3e43126a45a8dbd26e53875c59ede0c3b1c232802fa88008f", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665407, "uuid": "5824dbc5-db24-4ffc-a3c3-62364d343e84", "value": "T153C26C057BD48B22D9ED0BFA54635F0053B5D791884BFB490ACDE0AF5D737A40A24BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665407, "uuid": "ea1043cd-ae34-424e-98e9-cab999f7c5c5", "value": "768:p6BX6ahUpkbMaeIZHeeQUxYzfEqlZtbBrDw:12AkYaneeQ/fJtlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665407, "uuid": "4004a256-f720-4489-9b49-e2ca992bde49", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665407, "uuid": "b9d7acbd-052b-42c3-bb1e-bc6f413c93ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665407, "uuid": "31d2e93a-eea6-46d8-ae14-760a5b7e5bfd", "value": "cbd753e1be7725924982ee8eca9cb5424730a5d257c5ac82faafe5434aeb4446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed4f391-3a1f-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635666641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666641, "uuid": "5bbf2676-4f58-41a5-a29c-25a4b04e8acd", "comment": "Malware payload (BitRAT)", "value": "d69f556eb6cc53d985a2f9cb85c33bc9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666641, "uuid": "96268324-612a-4210-a4f0-6b8ae6617394", "comment": "Malware payload (BitRAT)", "value": "cc3456df5b06b6f2cae266ee1be8efdfa9396fa97a4b54a68b64ed839989de56", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666641, "uuid": "8e0a1ad6-65ff-4655-97ad-f2ef0e9429b9", "comment": "Malware payload (BitRAT)", "value": "dbc0a435c770363f4f00bdfeeaef9719d8aa5788", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666641, "uuid": "42d9c6c2-8614-44df-b4a4-be7eb86b764a", "comment": "Malware payload (BitRAT)", "value": "8f30d6b619872eab4739f415b54c15140c67d42353385ddff229fe60794d86476ab8b6448ce5e1f6bb88ff331735e696", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666641, "uuid": "269c54ac-2543-43df-b81e-0d03d2a0856b", "value": "T15C6533E06B1A9B3EF99AC83C79B62D03CC3DC561617B05063E6CC5ED60FF9521884C66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666641, "uuid": "886a4ffa-3568-4fd7-868e-3037d92e8773", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666641, "uuid": "79f2b456-be83-4bdc-a020-b96c5c1ab5c8", "value": "24576:VndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzbHvE3M:NXDFBU2iIBb0xY/6sUYYQs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666641, "uuid": "45993dc9-d74e-4c6f-aff6-f749844e2b65", "value": 1528320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666641, "uuid": "ed4f0265-abf6-43cd-9fd4-5534ed93b3ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666641, "uuid": "0599f9df-7163-4ace-af05-cbb416f3f047", "value": "d69f556eb6cc53d985a2f9cb85c33bc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860ad531-3a36-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635676639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676639, "uuid": "c6eb6817-e2a3-4164-91be-bc7efcc1fa1c", "comment": "Malware payload (AgentTesla)", "value": "01f38e0b4a1302ee1e4ce01976ff6cda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676639, "uuid": "85471c5c-3e1d-4ac3-8223-3e218b587240", "comment": "Malware payload (AgentTesla)", "value": "ccc0ebe08973d264ed6865f3f9ecac10c770ee84a348c80f282c650d2c66a070", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676639, "uuid": "ba0b9d2d-a7c5-4b6d-bd69-091e084e9c5e", "comment": "Malware payload (AgentTesla)", "value": "22c14b98efb0be86408c32c25ea4050c5b755a7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635676639, "uuid": "432163bc-1c8f-4f56-8a17-af9c949c3395", "comment": "Malware payload (AgentTesla)", "value": "19dcb975831479296bd873b4e9b4788cff20af3869d18ce7aa9e4c5b858d4a709d7cd4a55ca102634689e655847f8446", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676639, "uuid": "33af3c8c-a23d-4231-a40e-abc8c3d768d2", "value": "T1478413212FEE57FFDBE91BB66550581D63FAF30A5461D2088D6864C60EC3393B912F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676639, "uuid": "433c2565-096f-44a9-9277-36f6ccdd1b92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676639, "uuid": "32783d57-4885-47a7-b4f2-165495655be8", "value": "6144:4wFHG+olzVzxQoMyCiIoJ480vQNmRBqqseYhkhGgXprQ:RnWeoy80o8iqRY+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635676639, "uuid": "7772d3eb-28aa-45c4-b450-a28aef74d51d", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635676639, "uuid": "561f7e6c-1a83-49c6-9835-8eaf3bf07339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635676639, "uuid": "04b9c403-8050-4388-b209-4983f70fe4f4", "value": "DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f018d7-3a96-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635717953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717953, "uuid": "ca86d3e0-327c-4d0f-bce8-0706a819920a", "comment": "Malware payload", "value": "8c8f6c159a2f4f7dc379892c77b4f80e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717953, "uuid": "854bea04-c5da-4b69-9e9b-db9367cb58a0", "comment": "Malware payload", "value": "ccfed916f7ca51396d4ee2be762900f74ee54d652145a5567c91b232d99c125f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717953, "uuid": "6aaca48f-cab4-4a0d-b996-8add5200b65c", "comment": "Malware payload", "value": "5798b261f45fabd58e9ec0d81b52ac9f807b5a9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635717953, "uuid": "245d6736-f2a7-4e35-9b9c-985efed12c40", "comment": "Malware payload", "value": "425ba889c244a7e72c45caab37361e4e64b9ee0cfe07fdd85443c8aa6cce1582b616c4cf90302c138d18a922a111bce8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717953, "uuid": "0c8e9bef-b82e-490d-a57a-58cf14a1935a", "value": "T15B157D8AF6C751F3C8934EB0025BE73F4231AA268017CD96F78DDE15F823E96570A259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717953, "uuid": "030db32e-2799-48f6-93a4-b66904704539", "value": "12288:/UZssk3AvXrCOHdhA/vsBg4svy+8zC3ltGf2uWZ+n2fFf+j9DIhs/:/ussgAvXzHdhW0Bg4Ru3DGfRsucf+R+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635717953, "uuid": "129aa828-416e-40a8-818b-94c9234237f6", "value": 949066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635717953, "uuid": "d7194620-84b0-4ab3-bd96-55aa1f58d34e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635717953, "uuid": "ba0a836b-bb26-4102-951b-1809fcfd105b", "value": "8c8f6c159a2f4f7dc379892c77b4f80e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f989414-3a98-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635718558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718558, "uuid": "ac5eb7a6-02a2-454b-b9f1-8d18a3fc90d7", "comment": "Malware payload", "value": "c6777da6b8ac297800085ca519d3c2f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718558, "uuid": "9f3f6a13-3196-4a0b-9397-21833ce24285", "comment": "Malware payload", "value": "d363ecd0b087fe6fb9b9ee5e599bd4f69e75f1a67a8a6a1266d54c405cf9164e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718558, "uuid": "be09f525-5545-4a43-b746-fe8d4fd8626a", "comment": "Malware payload", "value": "a8e9c57f6a811cec79db0e34fadee827852db244", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718558, "uuid": "ba160a02-d2c0-4a17-8ff9-9c89464bad0f", "comment": "Malware payload", "value": "108018afdf76a03bfd5d03312ad3680351116345935b94302068bee37dfe17e420c573b6dc7dc30aef144603b7e50276", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718558, "uuid": "59974c69-ee79-40d1-b30a-523f26ddc7ed", "value": "T14CA33906D5508B57C1C2277AB79F825D33236B68979B33129628BFF42FC2B9D0E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718558, "uuid": "0e197ff3-3c33-4115-a0c1-95ae49cb6558", "value": "3072:KSaLYLNxe6RKand3oKmQqG1tV53bmUQU5hXsxn:KSaLYLhnd3oKJtxbmUQU51sxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635718558, "uuid": "a45feac9-d920-4ba1-abb9-9e7231ab8c6c", "value": 102071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635718558, "uuid": "9fd90230-f875-4fbc-aea1-ff9018145a7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718558, "uuid": "e9456e52-8c5c-4818-bde0-d2a528691ccc", "value": "c6777da6b8ac297800085ca519d3c2f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4131d365-3a39-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635677812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677812, "uuid": "041408ae-69a3-4261-8925-fffa5dc548a2", "comment": "Malware payload (AgentTesla)", "value": "2c34d8bc9fed7d9072510f1dfbfd3b9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677812, "uuid": "c5674d21-683a-4c2e-9893-e367920fa2a2", "comment": "Malware payload (AgentTesla)", "value": "d37dc05dce3e6a9ce15108042553aedcf3438f60b53e86522525ed8b8d58de64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677812, "uuid": "834dafab-e30b-49e9-ac7f-c249a0a5d19f", "comment": "Malware payload (AgentTesla)", "value": "46a85873c4af64df1ccd4bcf120109600e81f257", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677812, "uuid": "40f8958d-af14-413c-bfc1-6026f1cd9369", "comment": "Malware payload (AgentTesla)", "value": "1853f9799c3630717548e044d105a5331c41b93d166671b7c5e46f56d6404cf78cfd65363a7fa52cb63c0bd032329ccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677812, "uuid": "9f50cdec-833f-44cb-bed4-91b36ac79781", "value": "T1CB84221B063CB2BFCE6D0F7D9B5555A5077FE2813651EBA69D22208EDE723188215F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677812, "uuid": "5a26db1c-bfc9-4a5e-a57e-fd7c8e969ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677812, "uuid": "3b87b1b1-c97b-48bd-8a57-01535d64fc67", "value": "6144:u3k/WruKV28H1sI3g3D0qPEcsgXlO1VMuL2WHxj5c1gTEdLYxdayC0+sQ:EOWruKUI1K30cVc7MZaxjK1K1zOsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635677812, "uuid": "dd0b6e4e-4ca6-4505-a47f-b7b92346746a", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635677812, "uuid": "7f3bef38-4edd-4aa8-922b-a72e5bfbd9f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677812, "uuid": "ce2d6850-729a-4fe9-a33a-fd84643afd41", "value": "Fiyat Talebi 20213110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7711587d-3a80-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635708396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708396, "uuid": "3a712abf-4915-458e-93c5-735b4b911526", "comment": "Malware payload (Formbook)", "value": "0af6cb3874a08a177df8e051bd77ca7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708396, "uuid": "d093f6f0-c698-474f-87f3-11a35b06667d", "comment": "Malware payload (Formbook)", "value": "d80436359f7dd16d812a1007524a34b9f62a9364062b19e198f505051bbe98a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708396, "uuid": "c640aed6-d0ba-4f8b-b515-de38783661f2", "comment": "Malware payload (Formbook)", "value": "e70b0745f95a6bd26a1f08494fa78fa674dfa1e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708396, "uuid": "6ee85c6d-31b5-4495-bc9e-6b1bffa064c0", "comment": "Malware payload (Formbook)", "value": "41e9707126e5f4fbf123d0e3102ac13d1e289cfb03fae94e005d42fc1102439ea8dcb5b06a6dc4216524a15b424e8795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708396, "uuid": "6141fd12-5367-4ce0-a0c6-2f8c26ad54cb", "value": "T13BA4D00127FA9A26D3BA0F76097300501FB1B4977E62E34F1D88319E257EF850995F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708396, "uuid": "b6d0c54b-3574-4ba6-a055-750fa5d3aa65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708396, "uuid": "c8ebf702-7458-4958-9b6b-f97380b4a191", "value": "12288:KktXy/gOnaQ0rWSfY7m2NFkZKels8J4F5MYAY9UJeR:NhfrBom2bk7s8J0tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635708396, "uuid": "292024cf-992f-4ccc-8b32-f5d7e7e05341", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635708396, "uuid": "6e56dfe1-26a3-45e3-88dc-a8dc46985d02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708396, "uuid": "a5fa6731-490c-4218-87a1-c972c67e76b5", "value": "Invoice #00442811-20211029.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d892cf-3a18-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635663665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663665, "uuid": "536562af-f311-49b8-9a24-f1bce3a0eb5f", "comment": "Malware payload (DCRat)", "value": "ee4e8fa33f9c8e228576c672c47dbc9d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663665, "uuid": "2f26db7c-b969-43e2-bb78-1408eae3951e", "comment": "Malware payload (DCRat)", "value": "d8973dcdc7704e93175add543a41e8322bdb15c4f92b2fa642713ed09681ffad", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663665, "uuid": "8b8bdcb4-0a8c-40e5-8de1-f71e7ad542d7", "comment": "Malware payload (DCRat)", "value": "7fffd471851a658d42adccf98d5a870d33865d4d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635663665, "uuid": "897c3998-8871-46fa-b506-5a0052252566", "comment": "Malware payload (DCRat)", "value": "6d401106942f40c5d5ef0086fbb4cf19fd115a369d6c1439839e019db80338f8d7c7061b4fe314294ce27098a70165ff", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663665, "uuid": "3ccf8de8-f711-4614-82e6-510c4d1a2fca", "value": "T112E308AAB7904F01C6581DB8C1EB993417E3A9C77677E3813F4453CA0E127A8DD8A7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663665, "uuid": "d4ae2d6d-1c58-4951-9926-d94120a56682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663665, "uuid": "9f7adc23-771c-43bd-a1c7-3a17f497ab8a", "value": "3072:4rsPtlS5Yy6LQWawZtfSTx94A8UErlJsUJ:4WwYy6EBwZtfSTzEhJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635663665, "uuid": "ac100588-ca3d-462f-b6f1-b5a170c25134", "value": 144216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635663665, "uuid": "0e81e147-095b-4e83-abf5-bb0e49f2b0f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635663665, "uuid": "ea955288-4387-499d-b478-2c4addb1b970", "value": "ee4e8fa33f9c8e228576c672c47dbc9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05576ebe-3a59-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635691455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691455, "uuid": "a2f4af57-9b91-4246-8c3d-ef72284139cd", "comment": "Malware payload (AgentTesla)", "value": "bd2cf63f64c40d9d2ea21055877525c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691455, "uuid": "879745dc-f0f3-49bc-9fba-1dc7336bdeea", "comment": "Malware payload (AgentTesla)", "value": "d99e4496bb7201ba92e993be463d39f459686c536a8db15f1b4814ab1c14b285", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691455, "uuid": "58b25ad6-a86a-406b-bb6d-bb3fa9e76461", "comment": "Malware payload (AgentTesla)", "value": "a4c0d98dc45150800a92358246ae304fa05b68fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691455, "uuid": "0927048a-6eef-48b6-abb6-418537613972", "comment": "Malware payload (AgentTesla)", "value": "5b931c875ad75ed64b2e69b00c6cd3e5c5b9ccaeee2c7d30afe5e9de6c5dd6cc53f5339c6f624fb8114cf374e68eaa51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691455, "uuid": "2e50a190-a383-4e7b-8b8c-aa878f7aba6c", "value": "T1CEA423FC11E2ED423EC81384D6F6B19EDD82A1D5E7D276644BA1B05504BDE7E28CE06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691455, "uuid": "7c5cf9fb-0f2a-4c2f-9f21-cad9fddfae6a", "value": "12288:B8yZSL1ZdWMG9VnruHD6ma2u8HTzBqkB7:ByLxrG9VnruH5uyqy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691455, "uuid": "baf8626b-b415-4900-8390-33adf58400e3", "value": 453287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691455, "uuid": "e1505b7f-54cf-4713-802f-873d8c64c941", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691455, "uuid": "69fbe1c2-7fd3-452a-882e-4bfaf72dfc77", "value": "(KOREA SHIPPING - KLCSM).CAB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d277ea-3a59-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635691478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691478, "uuid": "017f0b83-0e89-4f6f-8bb4-b95381978df9", "comment": "Malware payload (AgentTesla)", "value": "a602a2630d3f1146854b39da9e8a4600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691478, "uuid": "1644a0dc-efcd-42e6-a9b8-460bc2a65392", "comment": "Malware payload (AgentTesla)", "value": "d9ac48245f4bf1a7bd4cc87f43b2db6589a76da17c46b6e829ab04687875b2a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691478, "uuid": "6e7223ee-b728-4f8e-bbe2-d0caaec06ab8", "comment": "Malware payload (AgentTesla)", "value": "065674b548e5ecfb54cac4123cb22480ffd174cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691478, "uuid": "6a58e145-6212-461d-8143-dc082e084828", "comment": "Malware payload (AgentTesla)", "value": "a1870b4e4020b35c93cc3a57a7671167b9f84d849d488806cd54cf1f6c97a40028b6ce22c4a12b91b8af9ee30febc631", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691478, "uuid": "64ba5df5-347e-4dd3-bce4-bc94e678f5a0", "value": "T109C2E022C16BB2355F7C40A939D83AE7D7C839B0FC09F0E22085ED46DBDAD195B79820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691478, "uuid": "ff7ee1a1-55c4-4018-983f-c8179b04a557", "value": "768:oKBZIhhppd1JNjeHqgl4sBXDQ6x+p9lsOq3:rIhHxQrrx+Pq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691478, "uuid": "35deed23-2feb-42e7-904c-ceb0bf1ff20b", "value": 26276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691478, "uuid": "5aa9802e-6f58-4971-bb1c-52093a961be5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691478, "uuid": "0925cc9f-cba4-4293-82a8-937d808a2ce8", "value": "Payment Slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63739ad5-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635665414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665414, "uuid": "27191e64-b082-4b36-85c7-ebcda09a903e", "comment": "Malware payload (RedLineStealer)", "value": "933c01ab13997ae4d1e6f27e15ea4b02", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665414, "uuid": "6c2ecba1-0410-474f-8796-fe881831a645", "comment": "Malware payload (RedLineStealer)", "value": "dbc67dcafc4e95dfc5a071f38ef76910d34810a109379b61d6d1d2129500809b", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665414, "uuid": "f2c383f9-7721-4db0-a11b-8207b389b04b", "comment": "Malware payload (RedLineStealer)", "value": "2d55e9b7b6e5687db52cb33c6982d1c01c352bda", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665414, "uuid": "c45984c1-3562-48cd-a0a0-97e69b7ac088", "comment": "Malware payload (RedLineStealer)", "value": "eee5324c82b5f6aafea57f4673e1e9b6825316e868fbc532947f80ea5c13f5ef43a0ff976e23f6926a5172956e23d7e2", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665414, "uuid": "e1abc8c9-51d0-4070-b898-835bb709c748", "value": "T13CA21A05F3EC531AD8BD8F79ACB242110271F9838D22EF8F58CD92991E373985B15B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665414, "uuid": "af2e22e8-5547-4fa9-902f-901c142211ec", "value": "384:oje5WBZvsVt9eHOfDj8XNeVlnRMZ8QPU9Il3RCCwiZTpraY9uchbLw:4e2vsHsHOfDj8XNuN+aS90iN9aqbLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665414, "uuid": "d2b288e9-0157-4aad-9adb-39704f3d5f51", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665414, "uuid": "e262b935-9958-4d6c-ae3d-f9b1c619ec67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665414, "uuid": "c2ffb059-df49-4c71-a6eb-4dedd6e213e0", "value": "dbc67dcafc4e95dfc5a071f38ef76910d34810a109379b61d6d1d2129500809b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23388c38-3a98-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635718564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718564, "uuid": "5b3654ae-d1c4-4acb-95e4-c08b50bef94c", "comment": "Malware payload", "value": "11826557bef9436db70745e18f3c7127", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718564, "uuid": "33634e7f-7848-46fe-99df-37cec3a637bb", "comment": "Malware payload", "value": "dbfa2702373eaa5f0c0cdcc92e300fe4dc19303aed71bb9ede3efa5f9d64c0c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718564, "uuid": "ebbf1502-e7b0-4616-80a0-6aae2e896b6c", "comment": "Malware payload", "value": "39abea137d00a2d601ad0e34265055551e8a9ce2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718564, "uuid": "568d955b-65b3-40c5-bf83-e3372a39218f", "comment": "Malware payload", "value": "f4c54d29f08ecaf4356b8795c4c1236c8a92a412f7e144010edf19575d6f05aff02af1a25959aba935f8f95d14662f41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718564, "uuid": "0d6bf768-9c04-40f9-bf85-a2e602054868", "value": "T17F732903771D0B87C19FAEF029F727F087AAF96116A26580A10EFED41772BB02915F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718564, "uuid": "75ac3486-d325-43dc-9cb6-2553e908c4c9", "value": "1536:MH3/wcRBGdBhIu1XFSiWwIfCS9FLEhKOQtUo9O4C0J9mQEV6OjYofcOe:MHPTRcmE/jIKS8uilwJ9mQEV6OUofcOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635718564, "uuid": "8b493392-917d-468c-91e2-3a5f691fbeba", "value": 75987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635718564, "uuid": "a44f3524-6c82-4964-95ed-9716e55034b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718564, "uuid": "6e3a5bdf-e8a9-43c9-8b39-6507365584d6", "value": "11826557bef9436db70745e18f3c7127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa92e48-3a80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635708402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708402, "uuid": "d32a3739-83ce-4eb0-8857-6db012b5bbfc", "comment": "Malware payload", "value": "467418805993bd4ec025778ae7972673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708402, "uuid": "62f704fa-ad5e-4e9e-bb64-f3def597fe77", "comment": "Malware payload", "value": "de3d131bb29c2eadda833f950de1144d1c104fbd2cc6249ffc3aa1ac5ae651b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708402, "uuid": "761a9d59-1363-4902-84a3-5490e23208eb", "comment": "Malware payload", "value": "0bc812b6bf95f7c41c080c01b8669db9d66b87f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635708402, "uuid": "bae5637c-915e-4abd-a208-2dc6c0e3117e", "comment": "Malware payload", "value": "60c9ae8a9247a265a1210224751899d57be4b81d9bffa138e22c263fb28e99fa63fbfc0d852579da25da94f8c9a346f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708402, "uuid": "30883bfd-82c4-4dd1-aa56-bc930fff29e8", "value": "T1C394E001A3F917ABD6B997F9187301102BF6385AB271D71E4DC574EE6932F810A21FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708402, "uuid": "c0bad1f4-728e-4d51-9ba1-ab81f3ebcd26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708402, "uuid": "b48b16d9-95e7-475d-ad30-abdbbbbe23e5", "value": "6144:2kdrpusQahqtZ1kr8K3zKQkm+yCeJBdzHm3L5HoFoK5a0ojhT:2kbQah2TkwKj/L+SNHKL5HoeK5No9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635708402, "uuid": "a2b71e2a-00b1-44ac-b036-65c785f0b79b", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635708402, "uuid": "f1115173-0d45-4afb-94b1-690b442aa865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635708402, "uuid": "f1dfe8b1-f929-40ae-833b-7bb83792d440", "value": "Invoice #00442811-20211029.2.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38147c2-3a37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635677252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677252, "uuid": "0d024a82-a27d-4c34-ba39-4860f63f2397", "comment": "Malware payload", "value": "6321685372638a2f2482eb710d50c7e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677252, "uuid": "1849948d-a7b9-4c78-b8c1-44bb7bf2b4c1", "comment": "Malware payload", "value": "deac16af944cd788144c7ffb1ee97491b37bb50eae63fc9be5796b5d6d6c1603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677252, "uuid": "5a93ce26-0c5b-44e8-aefb-888fcea16b9a", "comment": "Malware payload", "value": "79504e1849e16aecd1b31b0432aefbe586b7095a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635677252, "uuid": "adf5f925-03fb-409a-8b21-5dd2da5cf3de", "comment": "Malware payload", "value": "fc8f78d7877111be91bfc8f475f3fd99956043b5a3d82fa12a2f3da1abf035ac9247403b44d3d9c2127177eb88b1ef31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677252, "uuid": "1c815527-81e0-400b-966f-d4f43b8b3245", "value": "T12C63021261EAC1F6D17A44FBBC3045D42320BBD09A45862FA3A87FF6CE1248579B518F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677252, "uuid": "79a388de-d5b6-4c2e-9a05-8504e35694a5", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677252, "uuid": "4cf69d24-6b21-4cc4-b98e-4b5ce1951fc8", "value": "1536:mqtsXIW70EQoiPQ1vO3BK1xGdjDzQ7nGtTdS:mqsI3EQoiPYGUx+jXSnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635677252, "uuid": "29bebc7a-70e8-43c3-8b59-f42ce418857b", "value": 68603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635677252, "uuid": "c718558c-ae33-4977-8925-a3e47e72270d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635677252, "uuid": "4b1b7925-3f2f-4cf7-be1d-ba63a17f9cdb", "value": "6321685372638a2f2482eb710d50c7e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1da9a0-3a2b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635671814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635671814, "uuid": "602bc92c-0975-40fc-9942-29e1f3f51ec6", "comment": "Malware payload (AgentTesla)", "value": "9eec8f03615c5146a37e40dc0218edaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635671814, "uuid": "bf4e7434-099d-4b2e-bf5b-1e8abaf52afc", "comment": "Malware payload (AgentTesla)", "value": "e02fa2cd0120ef8306528912ec91c05e3492eab55fad8f03bf675abe07a18de7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635671814, "uuid": "8afb9aea-01f3-46bb-aab8-4c44fc08d78e", "comment": "Malware payload (AgentTesla)", "value": "32e04cc119692d107381733f75b03492ee4e8590", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635671814, "uuid": "9ec39465-a5bb-48cb-ab57-ee7301646fc1", "comment": "Malware payload (AgentTesla)", "value": "29f7e53d93fb1503f25437b4cb8745914730115efbb225a8c234c4cbb435cc214fe3f3347920e6f3b5cce864b1b3e86d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635671814, "uuid": "b13804b3-c739-4457-9206-1f09870d85f2", "value": "T1307422066B69933EEFCF67B552462022D7FBF0550088DE998B9482CB161770A7F53B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635671814, "uuid": "96e2e5ed-fd14-4620-a824-c14eb54fc9a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635671814, "uuid": "f4fc8310-7518-4b14-9ab4-a21557b8bfda", "value": "6144:9bTzAIs/8h1oVM1OBp48RVbTH4oBj3LU11l6x6aFhUIM74+JPQ0iUQErPLTByytG:5Mv/AcM0BasH4ijbU1/6FhUIO4+JPQdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635671814, "uuid": "f14d5292-7059-4570-b092-3e7f87f6e585", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635671814, "uuid": "5287dd28-b6cf-4fa6-b82a-91e0380646ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635671814, "uuid": "f4cc173e-c484-4fe3-a842-f6743967abf8", "value": "Details OF Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67205921-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635692908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692908, "uuid": "78ae9249-53a2-4d2f-8d2a-2c5741100f91", "comment": "Malware payload", "value": "1f52e4245e81f470798474a395749130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692908, "uuid": "53ecaed8-462a-4ec2-9765-1a1d441ec564", "comment": "Malware payload", "value": "e5538b9fe4a8a69e5c51d173144edae8bcd8f4739cb265f9a9d5efb15fd1af1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692908, "uuid": "b0483baa-674b-4ac0-a1b2-e2abbf178372", "comment": "Malware payload", "value": "34e178e2a7f6f37913af1f1d4c398718ad005aca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635692908, "uuid": "e74b36c3-d353-4acd-9dbf-dd59db1329e9", "comment": "Malware payload", "value": "4367d625555c58ff4b1db90a62c3ea82b743cab2eb6bc73685f40684de24d340fd67844ceebe0ed8c27ff0b1a31d21ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692908, "uuid": "5b522966-c131-44fa-9dbc-ad05dcf2b5da", "value": "T1CC848ED17BFB9F11FB89283559FB9378A532F4091F17418B602223D85E2AE64EA1131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692908, "uuid": "2726ef17-9902-4ea3-9c4f-6578c85717c0", "value": "903119b637f155dd7ab6c6a49ae6012a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692908, "uuid": "02324086-865a-463e-9a33-abb787549b03", "value": "6144:dC4w8juap56y9dg4sIo9ZCf6YRZDYnDSb+Ox72aR914w6Fsh:Ynapvg4sz9dYRZsDy+M70sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635692908, "uuid": "1188545e-0aef-4944-b634-30929fe95a3c", "value": 382356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635692908, "uuid": "44f08496-3a19-4d1b-a2d9-a51db9351b29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635692908, "uuid": "a754d655-d6e1-4835-b3e7-eef1a5891a11", "value": "1f52e4245e81f470798474a395749130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a27b43e-3a19-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1635664110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664110, "uuid": "dffd8325-787d-4a2c-864c-e751d99bd5ee", "comment": "Malware payload (CryptBot)", "value": "5a3d64565dd4f86841a5cd554e18f37e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664110, "uuid": "304006df-c600-4f78-80fb-214ad07b04c4", "comment": "Malware payload (CryptBot)", "value": "e6b412634ddcc366688534a9598765327550a0cc5332a9b5ff23905a421cc78b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664110, "uuid": "48831388-e762-47a4-a8af-aabb41b4b5d6", "comment": "Malware payload (CryptBot)", "value": "d898084fb5c59daf7a7ca69cf81fac4c35efbad2", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635664110, "uuid": "ca7d75d1-a720-477f-8404-a8fabcdee17b", "comment": "Malware payload (CryptBot)", "value": "6853c5de5c78809d9abcaac9e5d07570c8f3dcbb89e10b4362516fa661e0af6ec69cb5f29bbf0403713a09f32c0e8cbd", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664110, "uuid": "cdb19bd3-7831-4a49-8a71-700d7a5bb53a", "value": "T170848E976AD09C23E3BA2434C4EE3877697657D3850EB81A34C0E86872ED7B6C151B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664110, "uuid": "b67897c0-79d4-4aa7-a6fa-a3cc50a18a0f", "value": "b33a3387c1026ad0a7bae29e123838cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664110, "uuid": "3dda0075-a886-41f0-b002-67dd4540f265", "value": "6144:7+4elZCVTQlYPogimDdTCSknWNfz0ErhMkXZz3BKMwK51qdqswT0Dl0YyaVYow81:77TtiSTCDWyYLhMq2VYpsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635664110, "uuid": "12c46af0-1e06-432c-9f26-fcb55e446db6", "value": 395240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635664110, "uuid": "e9c9a172-d4e8-433f-ae08-25923bc0d7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635664110, "uuid": "be518a93-17dd-4ffa-90c0-80e4d481476d", "value": "5a3d64565dd4f86841a5cd554e18f37e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6df58a0-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635665178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665178, "uuid": "43e66521-3126-4676-8c29-0d831da24b3f", "comment": "Malware payload (Smoke Loader)", "value": "5ffd37da5c2f2e86ab9184c222e08092", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665178, "uuid": "81a56a90-2c53-42fd-8a6d-06dcab121814", "comment": "Malware payload (Smoke Loader)", "value": "e82fdabc1734936b4601957850d098699eb69865e43040bb447d71bfa049f193", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665178, "uuid": "45a79fcc-8e55-4be1-b0eb-71e9d0f45dd4", "comment": "Malware payload (Smoke Loader)", "value": "e43eed8a46bda2b43790f784450a39dde8b98cea", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665178, "uuid": "bb047ccb-7bd7-4d93-aebc-c494aa610979", "comment": "Malware payload (Smoke Loader)", "value": "48da9b6269ecddd5cdef1c8b39bf18f5a68705515b847d321f7b133404f3051e2e766ed7e862252d5fde8aa691463890", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665178, "uuid": "c608527a-2f5f-4014-9556-daa94c290496", "value": "T119748C10A7A1C435F1F212F859BA9269B93F7AB1AB3894CF12D516EE46346E0FC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665178, "uuid": "ec21cae6-237c-4c46-93ad-39ab198ce830", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665178, "uuid": "9cbe6513-51fa-494b-b85d-e9b276856c0d", "value": "6144:y9UsJE7zSSvEOCXeSx7IvIJ1gbHtb2f7bYHT:ySaE7VE5dx7IvIzgbkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665178, "uuid": "f7eec7f2-5411-4b42-bfd9-074e64f22d24", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665178, "uuid": "99b91945-7510-471b-aa25-62f753405a92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665178, "uuid": "c588fa14-6627-4db9-ac62-c63ec1421868", "value": "5ffd37da5c2f2e86ab9184c222e08092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e609c71-3a50-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1635687685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687685, "uuid": "cef00324-60bf-491b-843b-e5384eff446b", "comment": "Malware payload (Stop)", "value": "1d8cfa1ed92bc6e56f519a2fe606873c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687685, "uuid": "72a0152f-1028-4637-a882-60ecac95b818", "comment": "Malware payload (Stop)", "value": "e9a93d1ce4efc043eb8468247cc34a142043714f6e7c3b6a42d17e2e78e37869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687685, "uuid": "deb27820-b24d-419b-8bc0-51e83806accb", "comment": "Malware payload (Stop)", "value": "d85ebcc58e16abdcbc076d7162e5857eaf3499d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635687685, "uuid": "2af214d4-82d3-4e98-97d3-56173f70b49a", "comment": "Malware payload (Stop)", "value": "709e271d631fcc949676e5616d65989f100e4de1a918059e423b447277b9451a3dfa8c590f0311a598337a2d9c259d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687685, "uuid": "580ce0a6-3eb0-47b4-929b-0060e853dc81", "value": "T118F41230B69DC072C4E716348C6495915A2BF8636B71498A77A0373D8F31E8C9EFA35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687685, "uuid": "9dffe173-da0b-481d-8d6a-7ad2dadbc3fd", "value": "c0df013463ae9c6441312a1218343a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687685, "uuid": "7a732000-7072-4372-89f2-225f953ab3fb", "value": "12288:li5PClwzlP5iFiZkxBYo0bL68oZYXdkYPpUWgNcXJAivU4Ey3KMkq+auunn:5KRiFiQ/ioZYXdkg+WGG7UTbMkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635687685, "uuid": "417c949c-d8ad-48fc-aada-ecd6c37b6759", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635687685, "uuid": "dcbf19c2-cf09-44ef-93a1-01b5832388e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635687685, "uuid": "103fb4cf-629e-4b69-b38a-64810c80b1b0", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062dac1e-3a84-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635709925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709925, "uuid": "40182eb0-74e3-4b93-85ca-34cad6f70dd7", "comment": "Malware payload (Formbook)", "value": "06cc46cf273d8682dac3c5acf941f8e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709925, "uuid": "168f995e-7011-4d2f-97e6-ce4c46b727b9", "comment": "Malware payload (Formbook)", "value": "e9d18efbceab67662dbcc02cb56edeecb1fcc30ee000aba193d72a66fd7f5f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709925, "uuid": "f35eb6be-3935-461a-941a-b650c1e21eda", "comment": "Malware payload (Formbook)", "value": "cafbac227ebdbfbc1d37cf1435fc36cfe57a1041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635709925, "uuid": "ec6ba3a4-76cb-41d7-ba43-b32853583488", "comment": "Malware payload (Formbook)", "value": "46f0fd121c87100f5ce04483d73cf1d0989b459a5e49e0edf7de71e6d9560c28eda0485536f771d796613096e28182c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709925, "uuid": "8e39988d-fd0c-47ef-9e61-148d43f82107", "value": "T13B155BB9325176DFC86BCD76DA642C64EFA17877431BC207A41301ADAA8D997CF201F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709925, "uuid": "16787c13-b3cb-4ab5-aa28-89bced134b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709925, "uuid": "aab44907-1adc-49ff-b84f-b24182af67d6", "value": "12288:KtHcv3VDEhmaqJFTPs5GNOGgRYFifo2Uea/3EKJ2nCoJWMZR8U+radkETMzu/E/7:KIlDEIaqgY8PaFiZmvE9jgMRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635709925, "uuid": "636e1cee-e2e5-4837-97dc-667400b78540", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635709925, "uuid": "3e450602-de40-442b-8578-5b9661a40f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635709925, "uuid": "28475b26-e8c7-4274-b25f-a81ed390d1fa", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a281ff8-3a58-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635691249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691249, "uuid": "9a4a5c96-7e88-4a28-b783-e4dd5ed4500d", "comment": "Malware payload", "value": "813b73a4ed96f1830d66ca5466f34401", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691249, "uuid": "edfb5b11-6237-4c6f-93d0-aafdc7a3c727", "comment": "Malware payload", "value": "eb6de10706d98425cf14ce593fc10a6f127527f5f2de8d3a07e03f14afaadce7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691249, "uuid": "5be006b4-ef0b-45ed-bf4f-84a481b292cf", "comment": "Malware payload", "value": "35a76c3cc656736b9f60e3b9cdd79445ce5ec795", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691249, "uuid": "e82a47de-29fd-4048-a48d-d888a7bb5fdc", "comment": "Malware payload", "value": "1952d0e9c279bf1ff2ea377c91d1c118ea26e9c82cda548e0daa19d83cd9269026ed7dda477a47fa2707a42dc3bfd526", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691249, "uuid": "dcd77277-8078-4bae-b5f2-5b0037a9d656", "value": "T19C4612FEA1583798D41AC8355023FE58B2B2541E07F999EEB1DB7AC17F87024E906F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691249, "uuid": "7f17f3df-fc75-4f3a-8577-588c76d2aa03", "value": "6ce0d2744cedd23b63e19b6ed1b3de3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691249, "uuid": "ce18f5ec-94b4-4289-9d37-08ba6bda448d", "value": "98304:F7Gi3kpBjqdXGn7xw9lWU7FpnM3Z9tAYKxuEvqobkmmattDWcPLEOT8jDzCpJy:9Gi0pSGY7FOpS4mrjDWcPLEvnqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691249, "uuid": "f38ca495-62f6-4d94-902f-92c0aeab96fd", "value": 5675520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691249, "uuid": "2d39d74f-e890-49ef-be8b-f2430ea0ea29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691249, "uuid": "285968ee-0268-438f-86b3-a6d86a991a3a", "value": "Genshit-10_[unknowncheats.me]_.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9030321a-3a5d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635693406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693406, "uuid": "c4d9bdd2-6486-403e-9b48-1afe42f81adc", "comment": "Malware payload (AgentTesla)", "value": "9de2296ba099eb83192992b3823c872f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693406, "uuid": "506968ad-da5e-4865-b065-876f395da223", "comment": "Malware payload (AgentTesla)", "value": "ecc3fe14f6a54aed4322268af43013cd8dbe53ae34e4c75a67796684a1cc6487", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693406, "uuid": "0ab5fed6-1979-4ae4-af32-bf068d632ddc", "comment": "Malware payload (AgentTesla)", "value": "07ae02ef223a0f8bf7198688b47eb33be8e9f4a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693406, "uuid": "358df3a7-8ad1-4391-93d5-3b9c482df327", "comment": "Malware payload (AgentTesla)", "value": "1602641be578aff5cb5260fc58d2cbc184946ea80a74e121473398c62b5b52e28cc6313077470eae2978b4240c4e9d2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693406, "uuid": "b9f0c1b2-d405-4d75-8780-45fb0bd81404", "value": "T1EF055BBA325176DFC867CE72CA642C54EFA07877531BC207A41701AD9A9E997CF201F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693406, "uuid": "38ae1721-c8eb-4b2b-bd5b-7723305a2d04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693406, "uuid": "ecff0de5-a2de-4d0c-b55a-3b30ee290fb9", "value": "24576:bifTBK3t6/qgXJylH5SrUZ8yA4on0DY80Dq:batTr6H8rUZ8yAln8Y8sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635693406, "uuid": "fa1d71b0-b0de-45f6-9f6f-5a1167dd3cba", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635693406, "uuid": "c12c073c-afa2-4a91-9200-2b0a2da34747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693406, "uuid": "f8d0799b-25fb-4d1e-9feb-02f1ff0721e9", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6f33f7-3a58-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635691388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691388, "uuid": "026bd8aa-0c7d-404b-ba50-faeb6ccbf46b", "comment": "Malware payload (RemcosRAT)", "value": "90614dd38d84eee3a0f20e33a4709d40", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691388, "uuid": "9deb7517-66eb-4b91-a197-82ff26ed70ca", "comment": "Malware payload (RemcosRAT)", "value": "ef0525d2b41997aab5ef72c68b9b686ea4f06c9597fef893bc09280fa9864b3d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691388, "uuid": "9b3b4fe5-6ec5-4b7b-91a6-94a7e51e297a", "comment": "Malware payload (RemcosRAT)", "value": "41cbe56b946a0fc5b0d74e5e4fbd445cf8bfbca7", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635691388, "uuid": "bca40f02-1164-40c3-9a16-5f41486083b3", "comment": "Malware payload (RemcosRAT)", "value": "ecb9c60dac8aad16217ce5dd98975924d66763d493643317f399e62706542da941ace1f7705ea05c8dcbce6a047a65bb", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691388, "uuid": "d4213f7f-ddd4-406c-9565-54d92fb24dff", "value": "T1F475AF33B190603AD176BA358E2696518449FFA03BE4E8873AFC2D0DFF6418175B9E17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691388, "uuid": "74a7d0ab-36ad-41eb-822b-bb28d5c7e744", "value": "12288:XXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4Jj6NuLpjqayC94M0LdEegD:X4uBfTG2pM9o6NN+swhY4oMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635691388, "uuid": "086b68c9-c795-4757-b9c4-d0fb667c9f97", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635691388, "uuid": "a396c902-7419-4310-b5f1-59f75d61357f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635691388, "uuid": "76aef738-f8b6-4885-8b95-46ae8b9a630b", "value": "Attachement.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd427108-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635693106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693106, "uuid": "4486b141-33b1-4205-ad08-917468f31d14", "comment": "Malware payload", "value": "fd1b1dd81c03e8faa1bed697da0d19f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693106, "uuid": "8e909699-9f1e-42f5-8b4a-558c4d98927b", "comment": "Malware payload", "value": "f0a7f92f4fa639da7f829e82242a21aa8861bc98f1783b51638e04dc148e81b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693106, "uuid": "a3ef01f6-256c-406e-a906-782dcee33897", "comment": "Malware payload", "value": "63709725be4c1e0d4f641542b800f2fa742ad42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693106, "uuid": "8ed3deb7-3881-4721-afd5-fdba42cd9564", "comment": "Malware payload", "value": "82313c4997bc4916e6f2f2ed5c8628bf56d8739bf7a85433c83a7aeaec1cf3b46888be7b49587bb8fe49981a402e6d02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693106, "uuid": "4f6c236c-caaa-40a8-b909-ee262119f796", "value": "T1B4B4BF3CBE1A5A73D26AC135E4EE0006F2A866863231DD1716DB274C754BB933A573CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693106, "uuid": "95710dfc-9645-4fc1-8f0a-dfa00fc18c34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693106, "uuid": "95aca6ba-e2e7-4a1d-b827-262f12ff719d", "value": "12288:Rl0en3bUkyXtX5b7HfMY2KZbwan2Y0VAoq5/AtbtCkdP8v:v/mb7//pvOVBwAtBCkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635693106, "uuid": "fe5febeb-03f8-4ff7-8227-95c0d3749427", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635693106, "uuid": "bffbbefc-922f-4cb9-bb90-fe27dd93e1bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693106, "uuid": "54416efc-55b8-4f25-a8d8-55b4435ee8f4", "value": "fd1b1dd81c03e8faa1bed697da0d19f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaa8f92-3a97-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635718254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718254, "uuid": "cc54d6f5-cf24-4954-8739-6a4c78e5e6d0", "comment": "Malware payload", "value": "330fb87c93fb94d76cb4fc6d8e4ab20d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718254, "uuid": "bffac2f3-0bbc-45c6-a1d9-fd7434d3bb56", "comment": "Malware payload", "value": "f2d672ecc7ddb8328945252dc5bf7a21f7c8a1dc6a90002e990f5f08b7dd3db0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718254, "uuid": "1a04addb-69ac-41e5-8eda-0762bdad828f", "comment": "Malware payload", "value": "c428bb332eb629b12b59caee1e90e5d8b0b3f3b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635718254, "uuid": "6f257c51-326d-48fe-bea1-8dac890f91d6", "comment": "Malware payload", "value": "b76013c98e179e944cdfc777f783699e92f2344f3dcbc19ad2d5a688ae6bec895e6ab6d99dedfaf68d3dc4bc9b0ed91c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718254, "uuid": "258c751e-847b-4107-8585-2ff5147eeab0", "value": "T1D9A3D807AB51CEB7C85FDE730ABA4601208EA55716A5772B72B4DA6CF70A94F0CE3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718254, "uuid": "d0f65b94-8f63-462c-8f94-6d1d3f084df3", "value": "1536:EDp4cG3rW8MsZo+jILds541ERrxkZV/xmkihF9MCWRjge:EDn8PoQ41gkZV/xmkihF9MjRjge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635718254, "uuid": "be2bdef7-d0cb-4795-9fd3-dee9ed3858dd", "value": 100026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635718254, "uuid": "6c28d86c-ef24-4dc3-b54a-eca489a8b36f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635718254, "uuid": "0df58ebf-bb1b-446b-85f4-0d7c355476ee", "value": "330fb87c93fb94d76cb4fc6d8e4ab20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47534aaa-3a1c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635665367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665367, "uuid": "60b093dc-a892-4f22-b1f2-afe849a17ed1", "comment": "Malware payload", "value": "9700040398fda18a7792d90a671f8667", "object_relation": "md5", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665367, "uuid": "93288092-efac-45a2-8a92-1b55e4615d09", "comment": "Malware payload", "value": "f47bf1abee95766948d720548fd6d9413595afe57d9366dd71bf9eae9b1cbfa1", "object_relation": "sha256", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665367, "uuid": "81cdbdac-e351-431e-9b28-b8b9516340ff", "comment": "Malware payload", "value": "42981593fec07fd14e8cb2478a6db72683bf0847", "object_relation": "sha1", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665367, "uuid": "0ea867fb-304e-465f-a1ff-9257ecfa41d9", "comment": "Malware payload", "value": "72b63d87a4aa44ba8ba49a30dabdc5392b60167cf00f09d14b073ceff219d8e00c3cdfafff5c4af859ffdac9f5d607d6", "object_relation": "sha3-384", "Tag": [ { "name": "113.212.88.60", "colour": "#725BEE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665367, "uuid": "f0ec3033-d49d-4492-a184-2e628bf13721", "value": "T12BA22A05F3EC431AD8BD8F7A9CB242110275F6834D26EF8F18CD92991E373985B15B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665367, "uuid": "d51b9344-59a5-4507-8bf7-41c27d99df70", "value": "384:7I0CBRr03t9eHOfDj8XNeVlnRMZ8QPU9Il3RCCwiZTpraA9uXhvrw:k1r09sHOfDj8XNuN+aS90iN9aBvrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665367, "uuid": "769d2f90-0e0f-49b4-8d4a-05a89ddabbaf", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665367, "uuid": "3e204088-65a6-46ad-ad9f-8f83122f3d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665367, "uuid": "e4ce35c0-3792-4157-9660-5a7459da7472", "value": "f47bf1abee95766948d720548fd6d9413595afe57d9366dd71bf9eae9b1cbfa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d209a7e-3a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635666155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666155, "uuid": "c92b6c88-18b3-4b49-b67e-698f26e2b283", "comment": "Malware payload (RedLineStealer)", "value": "a0b683676361fd47b3a285abf785d0b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666155, "uuid": "5da0b27f-66ac-4265-922b-97791607ceff", "comment": "Malware payload (RedLineStealer)", "value": "fb22d463b5a19f625c6c966b860e6cf91d79d23077b137c01d698bfc9f9eecbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666155, "uuid": "a2d04824-44c9-4df7-8ebf-11107eabb29d", "comment": "Malware payload (RedLineStealer)", "value": "f9fd3568f5a131b44df80212aa6080251a36c6b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635666155, "uuid": "1310bc11-356a-4840-b74c-011f5c602e39", "comment": "Malware payload (RedLineStealer)", "value": "12b7c81ebf18f4d7d2be402d850aedab85c1e066b98004bd08c36bfebca7cd37e291512f8e4bf7fef92f327bcdfa2a82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666155, "uuid": "f2bfc8f0-a7c3-4509-8208-ce31ae212fde", "value": "T18D9423A72374963AE6A7C2B0458960C583FA71523571EBA35DA4C2CC5CC730B9E4D93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666155, "uuid": "e568e4bb-688e-4f39-af8e-27076d02524b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666155, "uuid": "d1b6bada-aeee-4539-baf9-5065a76f3831", "value": "6144:JPcGXfZfZYQAfX53xs0C7NVZEPiuE3ttkzJeKQBnGMgoLRpymZB04u5nQNe1cydN:mG9ZYQk5BsZNfEPEzqugyvQ4FuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635666155, "uuid": "950d21a5-ebdd-4b21-972f-edbe5ad46399", "value": 432056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635666155, "uuid": "9cc4b4f4-9840-4519-ae12-83ea0198d650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635666155, "uuid": "c24c056e-2ffc-4448-bf87-7807346b369d", "value": "a0b683676361fd47b3a285abf785d0b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d518b241-3a5c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635693092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693092, "uuid": "9d3f8de5-e663-4cb5-8720-c59a70ba9b13", "comment": "Malware payload", "value": "f7accb64037c404efe3904e59bfa2883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693092, "uuid": "0f82e431-43fb-4fe0-9210-0936398994b2", "comment": "Malware payload", "value": "fd55ec8688feafba956d5b448eeefb45e19865995e5a6e5bdf89a60796f4c0cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693092, "uuid": "643e80b5-00af-4c8c-8e37-ec038094e54e", "comment": "Malware payload", "value": "655455acb0a9c1f8c689e49f2c76269d3cbd1d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635693092, "uuid": "3fec022e-ff83-4bcc-a3c0-8f822963c101", "comment": "Malware payload", "value": "5d60bebcb52cf6447143effa7f31aa42a6f11c897b2c1d42ab6dcc2cdb010ea95670a2cbfecf56cb1a6f1aa9aa7a89b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693092, "uuid": "fdb2964c-c46d-4cd0-a984-368ee1b6ef61", "value": "T135B51243B700879DC41D4C302A7BE2B61E6AEFD62D53D1B322DC7E6F297228A5A71570", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693092, "uuid": "af3f0083-575c-4f58-8c2d-f9f71d1899ef", "value": "c78a0fcf42332cbdf64de6b70bfc435b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693092, "uuid": "aad6490f-ac3b-4b0f-a09c-8ebd4181bfc8", "value": "49152:y2jJwLvRhKbvDWkcT7H2gzDlCtk40KzV8KFnHvLR01kZ8nJTpcLVP:y2j2rR0bvqD2GmOKzV8CHvLRQe4TOLVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635693092, "uuid": "e4c0962a-c9f7-4857-bafd-e05c5d03e371", "value": 2455040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635693092, "uuid": "64b9163f-4fea-463c-95cb-144d1748209c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635693092, "uuid": "59f6db5d-02fa-4694-afbd-07b1e9f0f10c", "value": "f7accb64037c404efe3904e59bfa2883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6057808-3a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635665150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665150, "uuid": "32bc7281-5b93-4277-8f6f-e9e5aa39fbf3", "comment": "Malware payload (ArkeiStealer)", "value": "4e79889f1ed630cc252814f471454f0d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665150, "uuid": "45def706-81a8-46cd-9701-d409f55ed629", "comment": "Malware payload (ArkeiStealer)", "value": "fe9c234f50ce222b6c197cc6b9950ac57f0c1f016bf689bbbae12e095da36b09", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665150, "uuid": "bd35e0d9-3337-4060-b787-6ab323cabfe6", "comment": "Malware payload (ArkeiStealer)", "value": "fc710d4b018251c70619e3020c956df3ff003a6d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635665150, "uuid": "216b4dce-f9ba-4917-bdaf-586696a4c54c", "comment": "Malware payload (ArkeiStealer)", "value": "0a2cf3ee375da01a4ac65bd01efb200cd1b5100578cf7f5c0924a85eb0118e48de4c85f04e4280ee1d4ac806ab348ecd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665150, "uuid": "1ac6998a-54b2-4253-aea0-3395ea4b967c", "value": "T16B75D022B2D0853EF12E2F3DDC9B656959E77E513E689D863ADC0C084F3624139192FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665150, "uuid": "676115ab-8784-4add-8783-863de43ed018", "value": "5310cfb88a05f7b27edf69bdc717fef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665150, "uuid": "54096f1c-7f79-474d-9be3-a0a7ceeb43a5", "value": "24576:5EQ8J0nvh49ggaax8nWGbwKQ6imFUG6MMtW3pYJMXRI3D8r/Ce:5dvgu0mFUG67gMMuD8Oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635665150, "uuid": "18cf5c45-308b-45f8-b818-5733e5d25277", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635665150, "uuid": "7f6660c3-9a01-4d0b-8d94-d36587d3b4d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635665150, "uuid": "557f7f88-8c95-4e96-8042-dee0e7df5a1c", "value": "4e79889f1ed630cc252814f471454f0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }