{ "Event": { "published": true, "date": "2023-04-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-02", "timestamp": 1680480181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "998e3894-3464-42dd-b30f-5ad082ef1af5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65a7150-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680395973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395973, "uuid": "928b9c56-0ce2-4796-a6a7-933e74aad168", "comment": "Malware payload (Smoke Loader)", "value": "c60669b0a340509e02dbde40fb0d5b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395973, "uuid": "78696749-c759-45fb-8c88-b8c2de1674ed", "comment": "Malware payload (Smoke Loader)", "value": "0177e5347dc981c4a60f0aa5a609a104d0dd6b9bac0b40071e6aa50f5dd45b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395973, "uuid": "94a5e1c0-329f-4ed2-81bd-1eb796485c89", "comment": "Malware payload (Smoke Loader)", "value": "37fed72a98af03387b383e66cec2802494559ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395973, "uuid": "a6bd395f-4df0-4cbe-ac0e-3bc78781cbab", "comment": "Malware payload (Smoke Loader)", "value": "ca9099982548e76063616685bb31290e468908855cc5a523a01122e771788728a737ba55477388e7c339b360a5527fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395973, "uuid": "4efefd99-6d0d-4ef3-ab17-8c88e90857e7", "value": "T151344B0252E06C71F6226B328F2FC6F43A1EF8629E357F9A2A577A3F0974161D131B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395973, "uuid": "b97b47d0-0f4d-4229-ab39-e76f43148331", "value": "44e37c428947afcbabc1447e2f3a149e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395973, "uuid": "27fdc3fc-26c0-4d68-ba20-669d45a0d53a", "value": "3072:QfyNVx6WL2TlaxSNZUfvLzdwAHwBzVrKMPwWR25Tdwkj9NLgMa7tHcn:H6EGaUyz/wBzFfPwBB5jXLWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395973, "uuid": "0acfb730-cb5f-47f1-9bb2-58868f09d34b", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395973, "uuid": "b8f254ac-34c4-46f8-aa2b-c5f9365028b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395973, "uuid": "5a7ab882-f6ab-45d3-8da9-ad008217b2eb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff2e4fa-d143-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680432550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432550, "uuid": "22247f92-5a14-419c-b2e6-887922dd25d0", "comment": "Malware payload", "value": "e3064efb0ea2030ce377b87c84b7a4f4", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432550, "uuid": "873a3e19-0ea1-498b-9482-34ad40f529d5", "comment": "Malware payload", "value": "020970286d5dcf0be719c57b01d94fe8814243702129de6f4d510dec09455aaa", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432550, "uuid": "c52bfd31-6580-48f6-9c2d-47c2e295b654", "comment": "Malware payload", "value": "ef97b67aa9aef9b7f114863013564b845443279a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432550, "uuid": "007d547e-d3ed-4279-b45a-3045abdd490c", "comment": "Malware payload", "value": "f31a3655bd41b450ceb324c9e4665e93e31457510b53e1d4e04ce3c201659da82141f5a371b0e8be885992cc6e09179e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-LLL999KKK66SETUP", "colour": "#082BCC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432550, "uuid": "dd6882b7-0cdc-4a44-b219-4a4dd2a1cc55", "value": "T1D04733EAB23BE967006EED52DED48A50C110AEC5CF73549A50FB93056A1CC0E4776FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432550, "uuid": "3dd5fd27-6b74-44a2-b660-3d2fd303b3da", "value": "786432:mwhnBuNsNMnmZ3XpgfjQbvuxV17xJpwIfGZinK/msKM:mKCs2mB6euxVDywnRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680432550, "uuid": "f69f4b20-872f-424d-8129-cad36974d542", "value": 25719342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680432550, "uuid": "037cd0d8-d616-4e39-a8fa-899554d745df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432550, "uuid": "9de32fbc-a8f3-4062-af2e-2bc33fb01cfb", "value": "setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2146e0f0-d132-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680424875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424875, "uuid": "ef401305-a472-4ef3-94ea-fe408d8de330", "comment": "Malware payload (AgentTesla)", "value": "796099660c004943c505c3bfaa6da30f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424875, "uuid": "b88c2847-4c29-45a1-98c3-9ea6c66ca72f", "comment": "Malware payload (AgentTesla)", "value": "057aab2a096d3eb60389b2a679c5e328da91507d6bf3cf018152f36829bffe54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424875, "uuid": "8c374ea4-a467-4acc-a320-aeffe5059134", "comment": "Malware payload (AgentTesla)", "value": "1510aee13f7eff42a9af258221f4f39bb11ef9b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424875, "uuid": "d6c97714-862b-4eb8-9b45-555a51f688e9", "comment": "Malware payload (AgentTesla)", "value": "a681508f8e9962de90ac0fae90213029a7cd3882633c288626f2d66d8de2d1e1fb8bbac1a0fd8a5a72414c38617b3476", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424875, "uuid": "ee3b7772-7cb9-4f7c-8087-de05c7063b43", "value": "T10A74121137C0C917F1A906B22E36D2FE2A91FE508C109A073BE4BF1F7977962851EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424875, "uuid": "5c01b25c-50b5-48bd-87fb-17a204676c4a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424875, "uuid": "62b4fabc-f820-4c6a-8b2e-57706f5c0575", "value": "6144:gYa69/gr8YUy4Mi7nX5jEC0dBAOnrhMKlmi9WEKbinK0I0AFkWV/ql:gYn08YUy4Mi710nZnrKKMiH6iK0xbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680424875, "uuid": "4cf93331-69e8-4c21-80ac-4b7efc55b2cf", "value": 355480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680424875, "uuid": "9ae4f53e-dbe0-4c15-b762-d68d20b16b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424875, "uuid": "f29912be-47c1-4f55-97e7-6f1d6189337d", "value": "796099660c004943c505c3bfaa6da30f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954301e7-d10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ImminentRAT)", "timestamp": 1680408319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408319, "uuid": "04351266-98fc-4eb4-b174-47ec03165923", "comment": "Malware payload (ImminentRAT)", "value": "da42ca9550a5ce32c9fbdd96e86680b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408319, "uuid": "91e45fbf-4637-4310-9e0e-8bd287273841", "comment": "Malware payload (ImminentRAT)", "value": "0646d2001e43eac37c568ac4972998a50dfdf3068b2991e4045208ad4e9f97c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408319, "uuid": "1706014d-f503-477f-8021-dd60445a482d", "comment": "Malware payload (ImminentRAT)", "value": "e81731fba69da8f160b6ca378b866a32b6802545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408319, "uuid": "ae9f1963-7ca6-432f-86c0-74e7cec781eb", "comment": "Malware payload (ImminentRAT)", "value": "640d4a72fd62016f97ab70e66f186ab9f527b7f6132c493704059cea6e3c0db6de4de7dcb065fc2cf456dcf28ffb5e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408319, "uuid": "25507991-99fe-4918-8c23-a90aa4fe8e18", "value": "T11D45D023B2B04833C1ABD6748D1B5B6DB92ABD243D34ED461FE53C785E35780386A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408319, "uuid": "8130d78e-156d-43df-9231-93adb8371d4b", "value": "725f16679d82998f672dd0cf32ac5a08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408319, "uuid": "38e9e815-45da-418b-8f9f-0a0afda16b2e", "value": "24576:GBx7bZDVyMQzuH/dwoILLOZ/OUIfHz1D75D2Xlvft4DRaaDp:OzyMqAdwooUWl6vO9aaDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680408319, "uuid": "d10ec012-5a31-42df-8bcc-a594b355bc56", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680408319, "uuid": "9c25ae4e-fab4-40b4-98cc-c27d6a66f866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408319, "uuid": "3842ca8f-0e2a-404f-b5ee-87add3cadb8e", "value": "0646D2001E43EAC37C568AC4972998A50DFDF3068B299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4438ad-d0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680397221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397221, "uuid": "ade4d822-f105-47de-b81a-8106762c01c5", "comment": "Malware payload (RedLineStealer)", "value": "ca3ec44d06d111040a32d1712c68df84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397221, "uuid": "53ff0260-04d4-4e06-aeaf-c932e8cd6ee6", "comment": "Malware payload (RedLineStealer)", "value": "0b84442475aa8d924f66f0083535cf3f814f918e544080030d75eaef493c9923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397221, "uuid": "86b4b036-30b8-4de0-ae71-c68b60848796", "comment": "Malware payload (RedLineStealer)", "value": "06fc448b39c42138e93d8a7ed8d79c5f4946e5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397221, "uuid": "a571c17a-f388-4a7c-b73e-afe3d296a188", "comment": "Malware payload (RedLineStealer)", "value": "6e6e3e324f8eddcaded5a11d606fa13e8353ae7e72d33cac3a5753c95c7820833dd8d461e084678c4cd062461d4b02dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397221, "uuid": "8d17e26f-ab9d-4497-8b55-43649d9b0f42", "value": "T16F74C5568AA2C26DF23D5C741F4BEB7E185AB425273808C3D338181517B65A3E0B9B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397221, "uuid": "7bfb12c7-0cf8-4949-9d38-8131d258e99e", "value": "1da7baa8e055f9019d8110348ac589b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397221, "uuid": "47877001-c5ab-476e-bb16-78d52b9bd26e", "value": "3072:4oxxQztXuocDyBCQai98++TfiK5imNLJlBgKUtxD7NTBipqUvLGPx:402zt+odai989TfB3sxxDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397221, "uuid": "81254329-5db6-453e-8850-cf28f95b793a", "value": 364656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397221, "uuid": "1c2915e1-76c2-4fab-8f7e-5aeebebdca9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397221, "uuid": "48a75871-a547-4919-ae5c-a8288639ebcf", "value": "ca3ec44d06d111040a32d1712c68df84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86546a92-d166-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680447378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447378, "uuid": "c1a723f0-24e9-43c7-9a3b-0f4156a96e14", "comment": "Malware payload", "value": "4031226b2d2f93beb0ceb391cdb633e8", "object_relation": "md5", "Tag": [ { "name": "4031226b2d2f93beb0ceb391cdb633e8", "colour": "#9122BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447378, "uuid": "d4221ba5-7e7f-4cd4-8a37-31b1ef1b0d1e", "comment": "Malware payload", "value": "0bb0a4d14663ad9e84769a88de1fc38c43b7ec66a6ff16228e7a1aadd5e5448d", "object_relation": "sha256", "Tag": [ { "name": "4031226b2d2f93beb0ceb391cdb633e8", "colour": "#9122BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447378, "uuid": "d0ba6eb1-e5f2-4674-9c63-7cb79bf0e39b", "comment": "Malware payload", "value": "f33873740206914aefffa85bbce0a209eb208f48", "object_relation": "sha1", "Tag": [ { "name": "4031226b2d2f93beb0ceb391cdb633e8", "colour": "#9122BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447378, "uuid": "9911985b-8408-4e1f-a3d2-43915d469e37", "comment": "Malware payload", "value": "2433849a1911d6e62c9849e11ada4d93d2a459cc5a2635a87052f336172e644c3317536f0611172131d41f41a35ab8db", "object_relation": "sha3-384", "Tag": [ { "name": "4031226b2d2f93beb0ceb391cdb633e8", "colour": "#9122BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447378, "uuid": "c03b7a3f-a0ed-4558-8305-fabbc343b17c", "value": "T14C66338B5CDF50F8E9C61A30A11B6BDB22F367F64950D459BDC0E4C38962CA690FE913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447378, "uuid": "439fc886-6a9c-43fa-b488-2dd0bb017da9", "value": "ff33eadca45c6385bfd8315e8bf376d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447378, "uuid": "abd72c9d-51aa-4617-9699-0932a368ac87", "value": "196608:j37uUXBBbMQ+hrEAkmJ7wqd/qsSk+CQVDx:+UXfb3++IKJsP+HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680447378, "uuid": "a01c161e-f2ea-45fe-8c5b-d43f3f897303", "value": 6935571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680447378, "uuid": "735067a1-c86f-4cac-998c-1f1b35dee492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447378, "uuid": "198a79c7-6338-467c-a804-3d5838b3cca8", "value": "4031226b2d2f93beb0ceb391cdb633e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f4a8b8-d193-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680466620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466620, "uuid": "2df0cf5b-3881-4fc4-ad2d-8158ff40dd01", "comment": "Malware payload (AsyncRAT)", "value": "67939715807a0c7468304dd0810a2377", "object_relation": "md5", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466620, "uuid": "69975f11-e3a4-42ec-b8d7-3d3081467d7d", "comment": "Malware payload (AsyncRAT)", "value": "0bf10b6e76f8d806eea10b1dd886ce9620ebc79d3c1cacf4309e5d437ed64c91", "object_relation": "sha256", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466620, "uuid": "4b737cf0-3af2-4e26-b5b1-a5293a9b147b", "comment": "Malware payload (AsyncRAT)", "value": "4da1c87312e1cc77fee908157bde7e4ef570dab5", "object_relation": "sha1", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466620, "uuid": "ca50e4b7-f345-4c3a-b996-d163f72469fc", "comment": "Malware payload (AsyncRAT)", "value": "d898d600a14ea0c93be7f985b6781b4f886284503c1e62c0d01731423970bbbbd2fed4e90ec89b3586a90990edcf92ed", "object_relation": "sha3-384", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466620, "uuid": "bc57fd06-4b36-4ccb-b5ee-36cf3bd6eeae", "value": "T1A3533B003FE8C12AF1BD9FB499F2758449F5A5676902DA4A1CD4018A0633BC7DD43AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466620, "uuid": "e9004372-24cd-4bbe-8748-46f3802c34ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466620, "uuid": "41a10c4d-c6d9-4404-a003-9ed437562193", "value": "1536:lnKDtaNvPmM5Ojym4hAknLwblsyanrCcwkqtocnq7Px:lnKYNvOM5Ojym4hAkLwblf+rLwkqTnq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680466620, "uuid": "112baba8-646c-4e4b-8794-3506b284ff71", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680466620, "uuid": "3260f0b8-bc84-46ce-8535-c47b94c5ee79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466620, "uuid": "5c459d07-f07a-4abb-af3c-1e0e25e1046c", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7a3feb-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450341, "uuid": "933561bf-60dc-49b9-b9e3-8d7ec9877425", "comment": "Malware payload", "value": "108f3aaf97590a6dde9480690d049820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450341, "uuid": "31f049fa-fe19-49e2-83bd-496c22ac246a", "comment": "Malware payload", "value": "0c15af92c46087e688d726fa7e08341ed170a8d217c1760ad29d7072da0b43e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450341, "uuid": "845704f5-390a-480d-9ac4-ba921475f4bd", "comment": "Malware payload", "value": "b881d546c503083a40e674a553e8426c76a81e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450341, "uuid": "927b7481-3e25-426e-b91d-e4e4e5eb091a", "comment": "Malware payload", "value": "513cec1badec70a94e6e28a007e9fb38ccef800961455142da572e6b2fff42fff516163413ab7e2a2797a0c4d7fa55df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450341, "uuid": "8a2fd19e-a3e1-48bd-9f2f-bf458b5e28d2", "value": "T104959E217BE1C0B2C69114308DEE4F15E2E6EB609F755AC323891D6D1F72AF6ED31268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450341, "uuid": "70bdf066-e90b-4a80-b4e0-a53671efc996", "value": "24576:JMXKHxeUWKYBcJltQhNwoAV8D395GRIAMwaTCQfWp1XmCQAxIaQZsmM:JwKReUUBpuotvUOZsmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450341, "uuid": "6da3e850-dec9-4bca-a417-1442660b4660", "value": 1995776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450341, "uuid": "0e051508-3a13-4f7d-a3d2-127951077650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450341, "uuid": "1b5ca490-ffff-4ed6-8a67-0e35f230c1fb", "value": "SecuriteInfo.com.FileRepMalware.30422.17077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1ed083-d1ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680477317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680477317, "uuid": "2adfd2d2-0b61-42fb-955d-001cdb4711e4", "comment": "Malware payload (njrat)", "value": "9ed07382a06bf2f0381b8f2bdc42a94d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680477317, "uuid": "c082baee-6d69-4097-a9c5-cf35ce7bd2fc", "comment": "Malware payload (njrat)", "value": "0c6648fd9a49c1a11e04f31d444ca6b5fa009459559f2b88bc51f90f938b44df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680477317, "uuid": "c5e9bdfc-f461-4e5e-94d6-6463ac6aca9e", "comment": "Malware payload (njrat)", "value": "4beb3a4798b0ac1508c2a71f5d46dfb60099a722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680477317, "uuid": "4ea27a04-cffd-4c21-896c-42cb05c168c2", "comment": "Malware payload (njrat)", "value": "36cc52af2c23dc97272d85b5bdaa4b8a8bc856cce1cc5d86d077bed42822cca7b285aee1da3acf11936db30f320353c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680477317, "uuid": "cf3f3723-c186-4ab9-b9b9-bc98875b17e5", "value": "T1F1C2E62D33F58272C2EE067F5562EA1542B1E04BE226EB0E0CD998ED4B5B7C60B41FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680477317, "uuid": "3efde84f-a055-4fa2-adf4-46cdae2422fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680477317, "uuid": "26749fd1-1bc8-44a0-8692-3bc3c9022431", "value": "384:lL1M2XwBNOaLNOFs/Av2yeCP1BBvMo7AQk93vmhm7UMKmIEecKdbXTzm9bVhcaVd:le220U0Wo7A/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680477317, "uuid": "62091776-f5c2-42af-b1d0-49d073380b73", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680477317, "uuid": "32497a89-58f1-4379-9533-87e4b2d58fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680477317, "uuid": "796a9ebf-6c82-4eab-86f5-be9f4943ca92", "value": "0C6648FD9A49C1A11E04F31D444CA6B5FA009459559F2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f2d43b-d0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680397199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397199, "uuid": "73d165ae-ad26-4495-a39b-3756542854e6", "comment": "Malware payload (Rhadamanthys)", "value": "d89d311e0a036873ed11397fb4676308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397199, "uuid": "d481117b-218e-4107-8c7b-4d632721fb3b", "comment": "Malware payload (Rhadamanthys)", "value": "114ab4c2b403e2aac309a711fe4b7292de9ae66de2868238bdd8c64fdae6a074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397199, "uuid": "ef0795c6-8455-4659-9aff-f294609980e3", "comment": "Malware payload (Rhadamanthys)", "value": "3ad0188155fe9945db3f451b422d3d151b9fe131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397199, "uuid": "0ae2d995-57b6-4813-a5a0-601f053060fb", "comment": "Malware payload (Rhadamanthys)", "value": "44e88dccfa9e45b52878a15f40355b84c65e59372a7dec12198e42f22147319f65281e66d9bfe5cb18e7265482a24ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397199, "uuid": "f5cef53d-7e64-48da-bb98-9e15d2037262", "value": "T18284AE0206E46C70E53F47B28F2EC2F8260EBC929E597F9E2679BE7F15701A1D522711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397199, "uuid": "fa8bfbb0-2808-44a0-8f31-4588e555029d", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397199, "uuid": "28450e4e-5bc3-4204-a8c6-e9ab0b5b7233", "value": "6144:/KTopOTs7Xj/DlvYo7sysLnz+/mH4OfpfT:/SopOTsP7lg3jz+e75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397199, "uuid": "59c8e3b9-bd28-43cc-87c0-900b74b7935d", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397199, "uuid": "8261fa60-7f9b-44fd-8cd6-ed2d3fd4dea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397199, "uuid": "a5c5f742-53b1-4548-9bb0-99f76a6fdc85", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fb2e2f-d1b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1680479718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479718, "uuid": "00385dbd-42af-464b-b396-aeee240ddad5", "comment": "Malware payload (NanoCore)", "value": "a1ac8ab0e95b7c79a10324af32df0952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479718, "uuid": "1a3e838a-f1ce-465d-9a67-f438394f31ba", "comment": "Malware payload (NanoCore)", "value": "15d081b3c1388f4ff2832fd1af4a85a3c540078ab3a89c44adb94a542353e0d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479718, "uuid": "964c22cd-1df7-47c9-b90b-126b3f117340", "comment": "Malware payload (NanoCore)", "value": "1a88885696ca7eebf5b7cd3aa4d8ebea2d278a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479718, "uuid": "9ed1689b-cc29-4be8-83ee-12192428dd63", "comment": "Malware payload (NanoCore)", "value": "0dc2d89a9f87986c022a9c663eb8f3dfd51ae05137de0e44fb50eb7a308df7bbb7e2427aad5253171e35bb85243a88af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479718, "uuid": "12732cce-87f2-4e17-9364-3398efb2bac2", "value": "T16765C043B3A580B2FE46A2F3BD65B786477D5D354133402F23A93C79AE721B2421E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479718, "uuid": "3e54c9c2-758e-470c-af61-09eee82cf9e1", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479718, "uuid": "0e1fb1d8-ae14-4e2c-9e69-417ec88a2285", "value": "24576:dA7LDMKOYac6idXy2xwO6cJ0qzaEOhm3Au5ZUYbqU2Kj5H:qMKO3cVMIwbcyIaEk9IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680479718, "uuid": "52e857f5-f1fc-49e0-bdbc-f5328536fe0a", "value": 1486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680479718, "uuid": "b9e0f524-4aff-4c7a-9454-53e63da5636f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479718, "uuid": "e6d88bb6-f82d-48d6-95d8-16ebf950838b", "value": "a1ac8ab0e95b7c79a10324af32df0952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e0e612-d0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680396850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396850, "uuid": "ffad8472-d65b-4007-8142-5c940bb03d63", "comment": "Malware payload (RedLineStealer)", "value": "17b80d6ed108b7b9c4363f1a666b96be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396850, "uuid": "16b2f4c0-6285-4dae-ba41-37f563407c9c", "comment": "Malware payload (RedLineStealer)", "value": "15f8d1406c1bc419682804cb636dfbb84020b3bf48ed15ab7fa4613636ffc5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396850, "uuid": "079e250d-aa3d-497b-9ba6-938af67ede47", "comment": "Malware payload (RedLineStealer)", "value": "4d9555e0d87a31126d8eae2b41eeb7223b6ca223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396850, "uuid": "57ab5d3a-2a28-4c61-a144-ea53a97a39c0", "comment": "Malware payload (RedLineStealer)", "value": "c6bcc8f9d5f04ebd9e82800fa33d338c9c3c84f3c5ea2b9bc1a39478b71e610819a29d643500c64fcbae46aa4ee2d3e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396850, "uuid": "a421beb6-aef4-41f6-8e05-982241a7f9ef", "value": "T1BA252303EAD99423CDBA473418F907830F75BCF29D78A6562292A51B0C73694F9B4B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396850, "uuid": "ab7b307d-bb2d-4dec-92ef-51c75cfe3f0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396850, "uuid": "b34c522c-fac4-4d83-88b6-a3dbda8b7a5b", "value": "24576:GyDpy8SWdpDllqKPJlBZCCKi35SHAhr48gkq/0gIa:VD7H3zBg835GAhcHkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396850, "uuid": "fd6f8e59-5d43-4bb3-80e0-1c4f0bbfb4b0", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396850, "uuid": "ed06856e-2177-4335-8a5c-6e95aaa54190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396850, "uuid": "eb859a53-7729-4ceb-927c-edc875ca7b76", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d15b38d-d0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680397461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397461, "uuid": "319f73fc-5d68-4648-9c23-f76055d75eb6", "comment": "Malware payload (Rhadamanthys)", "value": "7fb1a9aff7e9f22621eedcf7ab334a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397461, "uuid": "2de91644-b991-492d-bef7-71efd6798ab9", "comment": "Malware payload (Rhadamanthys)", "value": "1682a7f8f229e62c379fca3c6c989c748aef985e51fc6bcf76d06bde9b0484cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397461, "uuid": "597beab6-04f3-4b66-868e-3ac206f80395", "comment": "Malware payload (Rhadamanthys)", "value": "a323bdc552e2c0fe4b0417c933031450bb2c206f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397461, "uuid": "c01bca88-315e-428e-931a-60c8ccfd2aee", "comment": "Malware payload (Rhadamanthys)", "value": "2fbb7bbd5a42888ec47527f22fbd0b9fee2932492fb5d6695747627200bb9ceeaf69211b1879f5d1204ffdf1465c2ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397461, "uuid": "bd26f367-e242-4d2a-8800-5731c3fdee7d", "value": "T1B3649E0262A16871E6124A328F2FC6F43A1EB8724F757F9E1A5F7A3F09701B1D162F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397461, "uuid": "a45d6541-a86f-4e14-8e5d-5ef41a9cc127", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397461, "uuid": "7917ee6d-7c6f-4ce1-9913-1a3776bd4298", "value": "3072:cJdnwLsGs4XabZo4LumHWJT65JHppb+L6oHOnkuMFG5lbxmVOR6/SJ1qkEPQ2sPV:TF1EZo4L/rpb+Ls7lGORaSJ4I9lQn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397461, "uuid": "f4c76e5e-82d1-4b2c-86a3-f2c48cad1b09", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397461, "uuid": "1e185a34-7705-45a1-a83a-c3f996fcaa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397461, "uuid": "0bb7b037-9265-49d1-b374-e60ffee56e14", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca9676d-d115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680412627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412627, "uuid": "2a40456f-3f79-4f15-a92f-25202dcd880a", "comment": "Malware payload (Mirai)", "value": "5595ac9b89f85b025c045f92b661a712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412627, "uuid": "f0068883-ae9b-4655-abf0-d00344149253", "comment": "Malware payload (Mirai)", "value": "191fb1f4b9d9b1f0d76461030ccbe054df6e594029dd2eff57769fb1ee15d883", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412627, "uuid": "76c99367-2455-4085-984f-8eb8171372fe", "comment": "Malware payload (Mirai)", "value": "f5209b9c9f167c6b5c3cb4d68a13c7dc58c9cada", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412627, "uuid": "009a92ab-1bb2-4dce-9b27-d0cee02aa267", "comment": "Malware payload (Mirai)", "value": "62e65c46e051ee64c8fa9bb2707018136770fd4666b90ccdaaeb5280eaa480e7a3c7eeca126e2cdf195be5a0341fdf3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412627, "uuid": "a929970e-0dc9-4d91-928a-5347b1f3c42d", "value": "T1933308CABC029D3CF94FE6BE54164E0DFA2167C15283072767ABFDA36C721A45E06D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412627, "uuid": "76131d6e-0e0a-4834-ab25-9265edd34982", "value": "768:kOP/6qogU5evEdusJfHci2bJ9tTFD8P6MZYiz/KCXOYCi8z9Gz:HHEusVHciKJ9tFD8P6M9/KCXVCiVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680412627, "uuid": "ce28c45a-4b21-4f0e-bf75-44b3c6462e5e", "value": 54244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680412627, "uuid": "a5faacbe-eac5-41b8-a504-5b14edd42d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412627, "uuid": "292c579d-4bf5-4a7f-8cf1-6f2a2d163a05", "value": "5595ac9b89f85b025c045f92b661a712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f99ce6-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450408, "uuid": "920d9c52-6358-42b5-b329-3814854bea77", "comment": "Malware payload", "value": "71d333e7d629c67b3ce1a8fd163b1ee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450408, "uuid": "9d1ea453-b3d1-4465-a455-ece008ff6d2c", "comment": "Malware payload", "value": "192b4cbc3ff332328543bbbfd57e329277b40768614f4a8a075074e4347cb680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450408, "uuid": "ab76274e-4674-47ae-bcf8-9163f30aff72", "comment": "Malware payload", "value": "3e1749ce6ea5b642cc2f44cd1ac90e5aa8bc847f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450408, "uuid": "7fb5b60b-0264-4dea-8318-7766ea15cc40", "comment": "Malware payload", "value": "018cd72b5972125a3efcfc70bd380720e74d5f5445baa80ba7def198ac5617cb68c9c52dade83b5f30f8727ea2f2f743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450408, "uuid": "774a1d5f-3b6d-4390-acd4-794d8824f7ea", "value": "T137C67C02F6A580B6E1A6853DD4A3AA79E6723C554B3087CB12507F6B3F337D19D39322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450408, "uuid": "dfb3ebed-e2a4-4a0e-af11-bf5504051350", "value": "98304:8l4UpgpAMPZVrSd3+lS52YYYYYYYYYYYRYYYYYYYYYYWGsWGVki3UDEIW22z3Wnt:8l4UQr3lB33IU3WPkIFZ2GXZ3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450408, "uuid": "e581e3a2-1176-4dc7-80af-4cadfe7df27b", "value": 11671999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450408, "uuid": "d290c854-cfaa-4dbd-8ac6-838ddfc5102b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450408, "uuid": "eb8ebe33-676e-4411-91b6-fce50611ca6b", "value": "SecuriteInfo.com.W32.Fosniw.N.gen.Eldorado.30977.26567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1029e85e-d127-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680420122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420122, "uuid": "e4320c92-f2db-415b-97d2-5baa17c37084", "comment": "Malware payload", "value": "518e2ff5498de6c3b906856e2b6d3450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420122, "uuid": "f4118831-6f09-4b76-93f6-55076bf6f807", "comment": "Malware payload", "value": "1adf756ef37963df8e963b1e079ab7d0821ddd6eb2937d6832221caf273a3008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420122, "uuid": "ba71b12a-6338-41a8-9b23-faf62e967518", "comment": "Malware payload", "value": "a13a00d52de02f40a8b1cfcde24627d73448c81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420122, "uuid": "f2857ebd-5704-4f83-b72a-a6531737599a", "comment": "Malware payload", "value": "0292df052e0a2f50558cf535c6102b659897f7bcbcf96cff772fe2f198d6c6be7dadb2956a36e0c375346358d79ccd5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420122, "uuid": "309fc04f-4058-4570-ad88-e7112cad14b8", "value": "T17F96335A6CCB90F8FCC61E30E0066FDB13F657E64D809469BDC0E8C395A2D96A0BE517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420122, "uuid": "bd3324f9-c625-4096-b248-e7b2ed075ac9", "value": "ff33eadca45c6385bfd8315e8bf376d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420122, "uuid": "eeec95fb-5113-4622-bbf4-d723491fb08b", "value": "196608:j37uUXBBbMQ+hrEAkmJ7wqd/qsSk+CQVDHmDW3YyJcY:+UXfb3++IKJsP+HjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680420122, "uuid": "c07ed01f-9a59-4eae-8d80-7d1b47ac6abb", "value": 9159267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680420122, "uuid": "694c3137-ecf5-4d2d-be69-c1e002a2312e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420122, "uuid": "5205cfc0-85bb-4c79-8fd0-0ee131530e3f", "value": "518e2ff5498de6c3b906856e2b6d3450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769d206a-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450359, "uuid": "f11c48ab-b400-401b-bc76-a34ffdd23c0d", "comment": "Malware payload", "value": "d43cd4544d1a899b8695bb434fa7d274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450359, "uuid": "fab96789-c999-4ce9-820e-f68b42681ff7", "comment": "Malware payload", "value": "1bc9ea6af81574c2120adafae21431b66c2ecf2a8ee3661e7daebded9e8d6f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450359, "uuid": "95f96800-0bc0-48f3-89f2-2a533899b875", "comment": "Malware payload", "value": "4bd3cc9d0c70bf200f3ef1d896361a45f61cabe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450359, "uuid": "95464a5c-797b-4127-a3c3-a6b714ea6255", "comment": "Malware payload", "value": "1e52d75cf2c323768bb979ffb0a332597bd27d6897ac97058942cd1f78b6f5ce517dfcb1f74607e3a890a1338307e071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450359, "uuid": "fedd6824-c247-44c2-b059-8cded9709e3a", "value": "T12074D6081B89EF20E338A17412AA9128DD696C8746364A74F54C741B2FFFE5B1D3792F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450359, "uuid": "57511822-ad4a-4095-b6b0-23c7a83cc666", "value": "15d5ce8268c726819df7f9fd77fa35b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450359, "uuid": "e4fe0fd4-3da1-4bc3-ae23-6f23f0e4a0fc", "value": "3072:IUW2SUq2lA0rYLcSzK8YLcSzK8YLcSzK8YLcSzKJ5cqdzATZ6RMsdSqb0ou:s2RqtL2L2L2L453Q8Cqru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450359, "uuid": "9e814959-879e-43c3-91f5-3f21cc62ca7c", "value": 364688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450359, "uuid": "7e68e251-909c-428e-b6b7-55fa4804b710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450359, "uuid": "e03e0748-445b-4d04-bbb6-f6cc8f3d86a8", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1339915.12544.22222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00435121-d17c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456602, "uuid": "ab4482ef-a23f-479a-8fb3-67c4b5285815", "comment": "Malware payload (Mirai)", "value": "92e8e9d21c29edfe28edb79310f214cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456602, "uuid": "7913bfde-88af-42b4-a353-0c0782de33d2", "comment": "Malware payload (Mirai)", "value": "1c068e5b94cda5e94d6c8ac1816b5f6929fa4085395849f868c7ab7f4d216309", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456602, "uuid": "a6f5c444-197e-4adb-a052-d8e80fa67cc6", "comment": "Malware payload (Mirai)", "value": "ecc3d0e3c78a6f58c9302fa207e0a10c1eb02bad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456602, "uuid": "204030cb-518d-4c18-b1c9-ff0eee068ae4", "comment": "Malware payload (Mirai)", "value": "56b9f8b3e0ca1da8b351a3978f05bd7d75d229653a75d647ed81d32e6b54032176d7fe129fb1659f9aa8c52b2f3e7310", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456602, "uuid": "2b179f2a-27dc-4526-80a4-9351e52d856a", "value": "T12C2329DAB801AD3CF84FEABE8017490DF66123545093072767B7FD936D321949E1AE87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456602, "uuid": "ae514526-e9df-4277-8c92-054eab021733", "value": "768:swMeUJYQNzuuarjJ+VkJx43iPOUUoUOquA0ALpUHZ1F1AIiy88d7:s7uQ9uuwgVk4dOzA0aUHZ1HAIiT8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456602, "uuid": "e3745199-ce42-41bf-b7d1-c670a748e8e1", "value": 48668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456602, "uuid": "d54ef25c-0c0b-414c-890f-85b6b6a31c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456602, "uuid": "3b1981a3-12d7-45df-b45f-93c1aaf7b54b", "value": "92e8e9d21c29edfe28edb79310f214cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bae7fd7-d115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680412598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412598, "uuid": "6bfcb011-c5fd-4de4-8d63-3e41b853319d", "comment": "Malware payload (Mirai)", "value": "9733b44f68fe0516b860619caf7814c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412598, "uuid": "a1859d29-ca08-48e0-8757-b37a52dd0e77", "comment": "Malware payload (Mirai)", "value": "1cf5fda695dc867a6fcfc804152a2ff712503c317640c878ceec91d69d5311b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412598, "uuid": "abf405c2-18cf-4afa-8904-ca1316547966", "comment": "Malware payload (Mirai)", "value": "867b8d4cfe3b4dcd734a2ab0111a67a634594234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412598, "uuid": "3443b586-5d37-4a01-8c69-577f1aa06629", "comment": "Malware payload (Mirai)", "value": "d46e48aab75e673f49942cf277b285f4468bd0b7c8668f0ba920e4c263ad3baf0d817aef3d962d7a32d7a537b78fe7bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412598, "uuid": "39354845-4980-492d-b8b3-e78c7c6ffd54", "value": "T166237D31E01DAE94C8864134A4ACCF751F53F1C483535EB72AE642B5A8A3D78F918FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412598, "uuid": "65bb8738-2c2f-49a1-b80c-60c45670435a", "value": "768:+aPcLeRUQqwee1tZLrj2UlfSatOpoun9mLdCZ+Gnq62SxBX2koLA5nXJBCsaw:+aPK6ishtlfnJdLdsWTLAXBCsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680412598, "uuid": "b4caa63c-15b2-4975-bd3d-b5f41557cf9d", "value": 48508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680412598, "uuid": "f37d0846-4640-47a5-8b26-5d6daa9831d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412598, "uuid": "41c82941-307f-4b46-8f96-0cfde5e0f207", "value": "9733b44f68fe0516b860619caf7814c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be4416b-d174-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680453213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453213, "uuid": "bbad1c58-fd84-4257-951e-273dff0c19f4", "comment": "Malware payload", "value": "d2829d67c58fbacd09f8d0a23451fc30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453213, "uuid": "792f6a19-9f4c-484c-a329-9481dadc41dc", "comment": "Malware payload", "value": "1d854d717ddb81b7553ca4b656abff486e9c9b88f00bb5c7c32439f0f0ec4a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453213, "uuid": "35ef9d14-af13-43a8-94cf-1c884815fdf2", "comment": "Malware payload", "value": "273ecdd5b7dd155356acd6bc56e718cdf1ebb537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453213, "uuid": "c12508d4-2778-4cce-aef0-1d90c6e23e34", "comment": "Malware payload", "value": "918acf7a9148c8b0859bba7685b372161d254f1914acf8d79360a91fac1f6479c7c3cab94192ecafd83ef4da381236bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453213, "uuid": "9e42ddca-ffdb-43df-b3da-65042b0d71d8", "value": "T1E7B51204BBE19A13F1AE9F75A4225E45CAB4A4C6B743F72F08BC60710CD27E99D122D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453213, "uuid": "e2b5120a-1e6a-4fbc-b716-c4b375d62754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453213, "uuid": "63b8edd2-23cd-4eb8-9268-0f0ed2622854", "value": "49152:JrZblZvo10fSJtySnq1xKa84rJDWBHUu5G060Q:JdHo2fUEo6tf9bu/60Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680453213, "uuid": "deedd728-4ce6-4a19-a527-2f4a25a3550f", "value": 2406912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680453213, "uuid": "492eb872-6076-4e6e-8db0-3f144c7eddd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453213, "uuid": "a3a0935c-2900-4294-8cff-20300069f53b", "value": "DiscordUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0840692a-d0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680397775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397775, "uuid": "cad523a9-0aeb-4909-9998-9e2316e89f55", "comment": "Malware payload (Stop)", "value": "3b95a5c2a3496ef9e033c965a2cec6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397775, "uuid": "e63f0705-bdd1-42ca-9252-4945d1d035bb", "comment": "Malware payload (Stop)", "value": "1d9ef7ff4fffd831821ff189dd939ebe24a6367638dd61075250bb694417dbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397775, "uuid": "906fc27d-4e18-4275-9e77-dd834aeb5065", "comment": "Malware payload (Stop)", "value": "f76b304e4682f50b529ff647a448531e63903ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397775, "uuid": "1e2a007e-90db-4b85-a49c-069f93d33893", "comment": "Malware payload (Stop)", "value": "d5190976b06bd6362c107d144c779ee03172ef8fbb87a7f6951350304a211216a06ad038475bfbf11fc31be63f6338fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397775, "uuid": "d2fc2e1d-aa1e-4195-be68-24944e830a23", "value": "T17D05010246D46C70E63E47329F2EC6E5261EBC679F097F6F1679BA3F05301A2D962702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397775, "uuid": "e3c2cc93-2926-42c7-bac7-782a8140486a", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397775, "uuid": "4d26c9e6-f230-4634-8c45-e63493fcd4ba", "value": "24576:whH+95hyjkJq61cVFHHeHRRnuTtOJyCzkWV:wheDafYD1JbzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397775, "uuid": "c93ded3f-eacd-4dbb-b784-34da115d9dd9", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397775, "uuid": "1492a0ad-c3b2-4cc1-a597-887198bfdaae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397775, "uuid": "e96e3535-d8a6-4da8-a8f8-8d08924f72e0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e1c3b5-d12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1680421660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421660, "uuid": "9b455826-330a-43e7-a16f-d5cb05421e39", "comment": "Malware payload (SystemBC)", "value": "cc4f80bbbd81cf14599c74e9f8e970ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421660, "uuid": "d83b1c6f-5c2a-4f32-90ae-d2f111bde72b", "comment": "Malware payload (SystemBC)", "value": "1dc9a3c5d28e2e20b5bbbfd229a356ec88364280fa19ecdf0882a9533e7de3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421660, "uuid": "d3f63276-6ac3-40c9-bd45-c42182196ebe", "comment": "Malware payload (SystemBC)", "value": "c73b8e764bd16cc885143dee674a18ac98a1199c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421660, "uuid": "11c29a19-0144-422a-a9f6-8581d62f9be4", "comment": "Malware payload (SystemBC)", "value": "dd507a62e686f1e804e99a631ebccc888587505da42a5214f0d410881e15bd3d4cd225026f5f85c2c31966351017d054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421660, "uuid": "5fc85dfa-af2f-4368-b649-ddc22a14d72c", "value": "T1B3E39D2E3BA1D472D0236570A975C3B2262B7C725A38C98F37791F6E2F302C15AB5356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421660, "uuid": "43200d22-ec73-4f2b-bc22-34e694058715", "value": "6c71e5ef2e307960397b8ee58edbf067", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421660, "uuid": "b6f60aee-d130-41f3-9f45-125161863a25", "value": "3072:v/0zSzwIPgTY2nTnIKAlrym0jzGtnOfLn6bdVsPH6:HJXPPAIKPmIgOzn6bkf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680421660, "uuid": "f84175c5-805a-4a43-be14-ef196d0d8cd7", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680421660, "uuid": "6e61b79d-a60d-4792-9874-3ccb340ea171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421660, "uuid": "f9c0a3cf-8100-4a70-927e-b947f5711344", "value": "cc4f80bbbd81cf14599c74e9f8e970ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b10a792-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450339, "uuid": "cc326ebd-70bf-4958-82eb-b6317204893a", "comment": "Malware payload", "value": "2848cd6b622aadfe8aacd44e4d38c8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450339, "uuid": "6f5ba443-e7ba-4075-9b18-b78b61f2b9b8", "comment": "Malware payload", "value": "1e24ad87cd18a1a37c6ac01a04dff9c49bc6ceaeeba03b7d920fe48f0a96f66f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450339, "uuid": "f3f61a3a-353d-41e2-b580-1b7b39dad8f9", "comment": "Malware payload", "value": "e88f2922f94d89496c718e73be4345adf74f0a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450339, "uuid": "fe4ef9c8-3d00-4767-ab33-72a72915cb4c", "comment": "Malware payload", "value": "36b07a440161b7c7442c350dc0c5d283c9541744abb22d6657b977b54ab797bce3f0c012d997ac4312f85fd050669a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450339, "uuid": "d77f0096-5fb3-4ced-8379-ac32747fc864", "value": "T1CD7341B6721ADF90F488FA769476466C4326D89903AF4BCB3E05355D2DE1FD24CB230A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450339, "uuid": "a6b87b5e-5f41-4b55-a92b-65264be0aa43", "value": "768:RivgKvnL6U2rEW5VW4eaLMw1rryJmJW0/ewNM/57UyN+:RfKvnmHQW5Z/eh6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450339, "uuid": "8fc98719-6b6b-4d4e-b174-6704c759aba7", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450339, "uuid": "74282413-0037-403c-be2e-b36798c2b797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450339, "uuid": "a54f97d6-fd01-4b65-b9d1-cfc86ceb9dfc", "value": "SecuriteInfo.com.Win32.Evo-gen.14820.29463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1d8e5f-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680448063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448063, "uuid": "d98fff94-5d97-4d2e-924e-345b70de7ea2", "comment": "Malware payload (AsyncRAT)", "value": "ec15f6dcfb1e13d5cc6eb8785b5f3de4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448063, "uuid": "555890ec-1d5d-4b09-a3a0-46bd04599397", "comment": "Malware payload (AsyncRAT)", "value": "1ea51ffeedaf6acd0283aa25275ed87d7514659a90449bcd40d236e2fd8026d1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448063, "uuid": "130ea120-2f20-4f13-b275-8a98643f921f", "comment": "Malware payload (AsyncRAT)", "value": "6ba1d3af7195151ea2bff44d817ea628349155f9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448063, "uuid": "a9571882-c3e3-4258-aeff-1fa1babec166", "comment": "Malware payload (AsyncRAT)", "value": "ea09cf4202b05fa8871788b83cce819d13f68508d4f4e7a2404e05060d208786142fe98b7cb7c6d128db23004f041a76", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448063, "uuid": "2cf0f9c6-870d-47cf-b4c7-fe8a914de2fc", "value": "T1F9232C003BE8816BF2BE4F7899F26145467AF2633603D9492CC451DB5713FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448063, "uuid": "8ff7fafb-11f1-4b86-8af3-add70c4193c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448063, "uuid": "97ed4cc9-7ad4-4480-b947-d0e99ed57900", "value": "768:Pu/6ZTgoiziWUUM9rmo2qrjO5QyJ4PiNjPISzjbwgX3ide+u0ljCQ14AkIMEzBDD:Pu/6ZTgle2IO52iKS3b3XSdeBhAkUVdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448063, "uuid": "b52ebcb5-4229-44ba-89e3-2125bfaf7eb1", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448063, "uuid": "0c9ee422-c54e-4cf3-a598-11ba04cc5730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448063, "uuid": "18f47f77-9b98-40c1-8739-b90682273092", "value": "bLhM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ddb111-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680422651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422651, "uuid": "5982c4e9-2a5a-4780-b037-5e9a914e066d", "comment": "Malware payload (Stealc)", "value": "53ce3c478fcfafc89749ac3b6eec69bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422651, "uuid": "e2a38721-b6e7-44b4-92a8-53d3451b6b33", "comment": "Malware payload (Stealc)", "value": "1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422651, "uuid": "893cc4d6-cb65-45ac-8cbd-f81aa670b8a3", "comment": "Malware payload (Stealc)", "value": "e59dea08b60c0a67ccb135c2521e4d16631a904f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422651, "uuid": "94748c1e-2a3f-4b11-afdc-bd45fb514643", "comment": "Malware payload (Stealc)", "value": "eb34463030bfdd8b878c09b0f1bd043e0c9d084aa384fe25c0f74de16fed4905723a3e14618cd2c40cd9f7221a6b91f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422651, "uuid": "af681d21-4a2c-4cea-88f5-25b79964e011", "value": "T1E0345C0252E46871E6225A728F2FC3F43B1EB8615E35BF9E2E5B7A3F05301A1D162F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422651, "uuid": "6bdfd8ef-c3fe-4f0f-882e-c04aa3988d0d", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422651, "uuid": "edac3229-40d3-4a10-a127-a7063be00faa", "value": "6144:Reh/H+Zhyu8Jfc080/OmUMo4gW2UhgSWtAg:0h/ahy80WmUMo4xlhgFtAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422651, "uuid": "ecd6485b-0a8e-49ff-b32c-49dfa2c27b1e", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422651, "uuid": "de7f3d4f-b242-4430-89f1-ee001b9691d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422651, "uuid": "fc65461b-d82a-46bb-97ff-44ab72de5dfa", "value": "53ce3c478fcfafc89749ac3b6eec69bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bfe780-d182-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680459477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459477, "uuid": "3e0a49f1-5427-4cdd-93f3-b2fd2eaf8076", "comment": "Malware payload", "value": "d52bc7b7387084dd2955db4c0fff5f79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459477, "uuid": "f8c928db-4cbb-41cb-8711-f60f8ec3835f", "comment": "Malware payload", "value": "1f6dd6b383c6194e7658f8ad2b91d599c391c5b89b19d03c0e46926cef2d2cb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459477, "uuid": "d0e725cf-2b44-47a0-ac04-2c289d8fe524", "comment": "Malware payload", "value": "7d9245d439225867a367b254acd0f202950aa9ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459477, "uuid": "bd05b97c-638c-4532-9cfa-49e77e871b16", "comment": "Malware payload", "value": "1a8ccee7372f13e0a0fde7fa1e7459d2dfbd75a5592690704aaadf96c5769ca449cf7ddffd96705b0fa33b49dbc4e70c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459477, "uuid": "532099d2-e954-420b-a0c6-4d7c4d5745aa", "value": "T174528393F38E8A3ED8D992341497467771B3A4B08B2F6317174821761E623C85F2E797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459477, "uuid": "5981449e-7d02-4321-9a29-93533f5615d8", "value": "192:Gyvxz7boXl591N+Kx8xOooiNRCfSCyPJSTo:VJboPDN3TniNR+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680459477, "uuid": "9dc1c33a-db99-4063-866b-583e0216b23e", "value": 13277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680459477, "uuid": "fbffac64-87ab-4ae1-974e-07efe3df1486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459477, "uuid": "82ef4cdf-d243-4769-b04e-25537db53c7e", "value": "ovh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede3d16c-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456572, "uuid": "2e8373d9-71f0-4af5-aee5-288d484c235f", "comment": "Malware payload (Mirai)", "value": "76a8935122673dd47a0b405b48ef97cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456572, "uuid": "69e884ba-ead2-4379-810d-60475902d7df", "comment": "Malware payload (Mirai)", "value": "1f8eb0477223d98f187a7297f548310d653aebf074e3e0ac46791c97973557fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456572, "uuid": "910f94a7-5d74-4b42-b78f-07db40eee997", "comment": "Malware payload (Mirai)", "value": "e84e71df162370307fdfb576b2d6ee75b4903a53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456572, "uuid": "bfaa28a4-bfaa-46e6-8aad-229a2f240944", "comment": "Malware payload (Mirai)", "value": "acde16ee5d9eac163dab3fea868edafb4d832ba495c7f5191d8f5473f5735e8d132e1dcc77dbd9f0aa24ac2567bce7e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456572, "uuid": "e97a0ce5-f25c-473b-afe5-4041ef45bdc2", "value": "T1CE13E795B8929B2AC6D0637BBA6E518D3321A3E8D1DF3217CC112F147BCA51F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456572, "uuid": "dd8b115a-19ac-468b-b71b-f7a4f22c80f8", "value": "768:PLZmO9+ZnkUmrMqGf1RByKs4p1St5jQi+cSX9z7NVShrKK65r7J5DyYINNtr+fwI:VAZaYqGv85jGcSNz7N8h+rTPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456572, "uuid": "1bcc032e-b34a-4686-9aef-c878b6f77d0d", "value": 42232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456572, "uuid": "774e24fb-dc1b-4bec-94a7-9b8509c1f8c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456572, "uuid": "b6823983-a3ab-49e8-8d00-c0b62d99fcd3", "value": "76a8935122673dd47a0b405b48ef97cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988f8c8a-d0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680397587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397587, "uuid": "60834687-c68b-4a3a-b4d7-635876a8fafe", "comment": "Malware payload (Rhadamanthys)", "value": "92e4d2d94881dff2fa95da697617578d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397587, "uuid": "2c602690-e937-4e26-b175-5ae175249789", "comment": "Malware payload (Rhadamanthys)", "value": "2071bc5af974d4dc52d26c8ab0a127aa3120e6cb6dbeeb0b48a80336ad210057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397587, "uuid": "7b01e7ad-374b-44fd-b43e-612d25596cc3", "comment": "Malware payload (Rhadamanthys)", "value": "c7b3bda7d018097d86cff06e36bdb7c60da66e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397587, "uuid": "12b7dd9d-9f6f-433e-ae7f-1ec8e8d19053", "comment": "Malware payload (Rhadamanthys)", "value": "b556988284f86a8b4b704bdaa00f8b48ace2501993ebbbf501bb02835429c532b1dec8ad4e816360e36c036e871e3326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397587, "uuid": "8c0368c9-6670-41ce-bb6b-d8f5ca45eb53", "value": "T113649D0212E06A31E6235B328E2FC2F4361EFC629E357F5A1E4BBA7F0975161D162F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397587, "uuid": "0cdd5d6d-2679-41e9-ac23-cd9b69409872", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397587, "uuid": "c19a6786-7d70-42ce-a7b2-44118665d8fc", "value": "6144:OMlE586IkCkzEQtEmZYZbVbsMhRj86/QaUv:BlEpIkvzEQtyVXnQa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397587, "uuid": "cb27b828-e897-4c7b-8f92-ad9daeb06ba1", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397587, "uuid": "a13fce06-d3da-45ad-9090-0b3a9ac39a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397587, "uuid": "99389fe0-c777-465d-a1cb-0ecbe5151908", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a91dde-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456528, "uuid": "3d5dfe2b-08bf-4e75-9155-c9b48219fbae", "comment": "Malware payload (Mirai)", "value": "75e598fc72458a1a71210abc84cd68f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456528, "uuid": "0b82a734-26cf-4b2e-b541-155f11fb91f8", "comment": "Malware payload (Mirai)", "value": "20a83ababa42dee17081b5762d03c1ba187274d867509d42e83e6d66df1ad5ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456528, "uuid": "a2ef422d-2d86-4bd4-8d8e-d7b025b91cf0", "comment": "Malware payload (Mirai)", "value": "d6edc3cae152d3021557bdc95a804f2c93b8f6fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456528, "uuid": "e8c97f9e-b2f5-47c8-afc9-3007500617d3", "comment": "Malware payload (Mirai)", "value": "cf7c54382e1d90ae7ea9466910d153315342a114695f0bcca5802694db0a3d0dd1f9feebebfe76eb2a565b83966d206f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456528, "uuid": "a15126c2-ef58-4d30-8676-2a428a0dc0e3", "value": "T18A336A35BD7A2E17C0D4A47A52F74769B2F2235E35A8CA2D7C720E4EFF10A40610B6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456528, "uuid": "11f9f832-f4bf-4b5e-ba62-add00786d9d8", "value": "768:aGoKKvt6NTq9RssWFCcwMJljZIlr3UPkMYqkO+O6PwJ:aGcvt6BSRRWFCc7bZAMn+jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456528, "uuid": "902134d7-f789-427e-85cc-621eeb351bfa", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456528, "uuid": "ca2bc2fc-3895-4e98-a645-034862d91320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456528, "uuid": "88d53d86-e2c2-41e2-8cc4-7e92ffa0ecfc", "value": "75e598fc72458a1a71210abc84cd68f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb96b4e-d132-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680424866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424866, "uuid": "96ee9f71-0e38-490f-ab19-542db33d6425", "comment": "Malware payload (Amadey)", "value": "c57652e0f2c1a46f9d8059bb0e804490", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424866, "uuid": "a4d7c3c6-5a3c-417b-b19e-a878647b9922", "comment": "Malware payload (Amadey)", "value": "22a46afe4487622e6a743ac13d34d5a35628a1d1d9e4dc4f6a7530abefe68775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424866, "uuid": "30374029-354d-40c8-b894-98b9d8e99397", "comment": "Malware payload (Amadey)", "value": "144ae6382565bfd0c7d783bf76c2355f5f4632cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424866, "uuid": "8e808bc2-96d7-43d5-9414-7f9587f2bb90", "comment": "Malware payload (Amadey)", "value": "a13aa7b00315e65bdebb8cbeaee9b3b5917cae7f0a3a45eab40a37114c0ab0d381d2da482bec1942a142b690dd00bb79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424866, "uuid": "46a5f456-c412-4e2a-9cce-3a91aa73f975", "value": "T122252352A5C48033EDB01B70B8F205D31E37BCA18B38925A674FB59A1DB25E1B47972F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424866, "uuid": "933561a4-ab93-4799-95f6-37cf6443d337", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424866, "uuid": "335f1ddb-74c0-43b7-bbcb-8b42793ad0a6", "value": "12288:BMrny90RKMc3JOaT+HOBdrCKkb9OdhqB8WePOkhH0nzOxB2zmHINUbswmZhw6V:uyl5OhCTgB8DP56zOP2LNxw6w6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680424866, "uuid": "79632c7d-989c-4022-8060-c5d2cd9a87e5", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680424866, "uuid": "16e5e45e-3e38-435f-885f-952e0de7be32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424866, "uuid": "253dd24f-d12c-45d9-a8c5-cdf785e20143", "value": "c57652e0f2c1a46f9d8059bb0e804490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1b1692-d16b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680449700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449700, "uuid": "6e8c7884-bbe7-4da8-b1ca-951062c258a0", "comment": "Malware payload (SnakeKeylogger)", "value": "424dfec83dce99fa96b86004a269ab91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449700, "uuid": "e8157197-6ce6-4169-b625-1df602b79387", "comment": "Malware payload (SnakeKeylogger)", "value": "23823da92c2209aeb163f1dd759e48d02847c2e6e8f1e6c2f2b94d43162fd110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449700, "uuid": "9617dd2e-e229-4942-a410-32691181c545", "comment": "Malware payload (SnakeKeylogger)", "value": "93332bddc03006730b5144a23cce74a1326c445b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449700, "uuid": "8d0ad3b0-ec2b-45ae-a9c2-25d21b39f5d6", "comment": "Malware payload (SnakeKeylogger)", "value": "ce23508e8e9b16e518c00a33c11eb516229d65653de24a31ff9b1015ddebe30a547b455a6ef06f57349092f8508236e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449700, "uuid": "864aa7a6-8e2c-4915-ba61-3e13396070b1", "value": "T1E8C4E0826FD0F7B4F6870A7575BE8318D2E67CA86A77BDDB642243D41063783483688D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449700, "uuid": "8b38b5fb-6440-400d-8c0a-185bf9782a89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449700, "uuid": "647f0c6f-d838-4ca3-a713-2babcc38f19d", "value": "12288:enjy8Ug3AgEqWTDx5t28p8ngQuOW1A+o0vidiappEo:mjxAgEDTN2Rn9uygmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680449700, "uuid": "82349fe6-9b83-48ef-a6ed-2fc027034368", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680449700, "uuid": "0cc28e27-3972-4558-b498-ab00bd88d7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449700, "uuid": "48167ece-277a-497d-ba8e-61ea891e3e43", "value": "ScanDoc9465785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec11c51b-d0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680395580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395580, "uuid": "ad460d32-0893-4cb0-96e0-3e9ae5d69a25", "comment": "Malware payload (Smoke Loader)", "value": "19f4f044dc2352625b28b43366d7496c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395580, "uuid": "407abb2d-f9dc-4193-a8e2-1029cbbe8907", "comment": "Malware payload (Smoke Loader)", "value": "2433be5583730e4f41391d8248c9f214d81775279441e2f23ff78efa71b27405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395580, "uuid": "e5a5515c-35e6-4315-b849-d3a97cd7282b", "comment": "Malware payload (Smoke Loader)", "value": "5dcbc25ccc76ed77885c9fda3ee905dc8e04580d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395580, "uuid": "d4cab397-214a-409b-a5f0-1a56c4862c17", "comment": "Malware payload (Smoke Loader)", "value": "7f2072a9381589ae32c8699379c3517d5ade6bc94bf0730016b6c2132a0b41d1b7031bef711dba7528383ba606d8cdd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395580, "uuid": "40e26b6c-8e5f-4022-80a2-464b6fd03662", "value": "T187346C0253E0A871E1225B728F2FC2F43A1EB8625E757F9A2E4BBE7F4570162D121F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395580, "uuid": "6c41c248-adec-4085-a76b-5bc2ea00f3bd", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395580, "uuid": "a936e618-5073-4fec-a3ba-e7ddf79bcc72", "value": "3072:JlrfNgl8xXTNBhBdm1WeVQf3Hbn3VGWFUzV5mTAhTqYzKNFX3JccbN0Hc2:R6kRBhBxroWyikqx5cuN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395580, "uuid": "e5442fcb-dabc-4b76-a110-5457a811b431", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395580, "uuid": "6000f926-101a-4c4c-b9eb-cc2b2ef44280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395580, "uuid": "858bc487-8340-4dff-834b-16a936680f1d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e763333-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450372, "uuid": "1e52db1b-59af-4433-a35b-c2d8db80764b", "comment": "Malware payload", "value": "37c78eb6ce1d458f9e81229862e258aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450372, "uuid": "0f393f58-000b-4f47-a8ec-00daa9d997ac", "comment": "Malware payload", "value": "27c63323845847527182de1dbea016671414dfd3b9aa42379abf1ba2e1f97ce2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450372, "uuid": "0625b941-9c23-4a81-93a6-eee10f5b2470", "comment": "Malware payload", "value": "d4baafa53816e174fa57568253c155c5f3c17864", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450372, "uuid": "6ecf7dea-20ce-4023-947f-72a494fa8868", "comment": "Malware payload", "value": "6f12d2ff1d36bfb1ac0595cb0a1849e1928a2a2a28187458fc42a689da29897f0e7784cecae49ff36b6409d046a63f52", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450372, "uuid": "589ee176-a5e2-49b3-9746-021960b02d6a", "value": "T16A862303B6C18071D2A6177055BAB775877ABD310A65E28FE264FD3A28B2602D73374F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450372, "uuid": "a144f81d-d490-47ec-9d54-8900566c9adb", "value": "b09cd7cb9ae5a48bd10d5b61d744b752", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450372, "uuid": "8fdf8779-eb98-4017-93ea-75d4b82b7bb5", "value": "196608:iIPnflTOg3dgLu3RRiHfD476X1Y0GL+QnzY807iW:DNtdkURiHfD66epY82i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450372, "uuid": "6dd4a181-3820-4f5a-9f1c-a78c4e351430", "value": 7955456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450372, "uuid": "66a2e08a-2094-483b-8d17-2758eeeee69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450372, "uuid": "15d23b5a-ff99-44bd-92d5-570485fadf8a", "value": "SecuriteInfo.com.BackDoor.Zapinit.140.16576.30710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c703129-d127-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680420116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420116, "uuid": "ec822dee-cabb-4f97-b106-5e6125ff0830", "comment": "Malware payload", "value": "7d8219b69e3ed084c1ffe8f9fc43b05a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420116, "uuid": "e9d248f2-e646-4de4-a29d-ae126252c7c0", "comment": "Malware payload", "value": "286b72c44d7b0af7870a6c75b16312f1a21cb0be88b940c41dcc733b0778f62c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420116, "uuid": "9021e614-86a4-457a-b079-cfbf5afcb224", "comment": "Malware payload", "value": "76d47fb91b7ae137ebd5b6bd9db7ab25ffbf764c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420116, "uuid": "05878f85-f212-4a2c-85c2-fbd60dcfe174", "comment": "Malware payload", "value": "49c9d04c3d47967d716617bb162113531124416402f07a38e80299bcf547c567d5910e777d91ea64f4c3ade241c6dadc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420116, "uuid": "7484c4c8-810f-4b7d-b140-cf7c2d2478c5", "value": "T19E244C2D73A58F62CB580576C4D3D52043ABE6A39B72D7463E4409E90D023EABC5EBC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420116, "uuid": "8877054a-b862-470d-826a-622e6539e7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420116, "uuid": "eabaa27e-5b82-42e0-938c-6e3feab43cc5", "value": "6144:NwpRPxPDMwcdtIoH2uvwJ/IJcx7DiLcQDhq:Nw/Px6DWuw6a7DdQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680420116, "uuid": "cff29241-5203-49e3-a448-6368d6761f4f", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680420116, "uuid": "25dd90d0-f42a-4fde-9c54-d1eaa2a07793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420116, "uuid": "90437a0b-b133-443e-8794-8337fdbfe5b1", "value": "7d8219b69e3ed084c1ffe8f9fc43b05a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32be06ab-d0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680397417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397417, "uuid": "af31780c-66a7-4158-9301-c747ad403c19", "comment": "Malware payload (Rhadamanthys)", "value": "b360dddf2062b302452b29dfff343629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397417, "uuid": "5901e582-14d7-4153-a0c2-755dee19b982", "comment": "Malware payload (Rhadamanthys)", "value": "2a674a9a0acf0532c3816df01af80e8a95fd7530a30ca31664cf82d4ce639a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397417, "uuid": "4a1ec94f-9681-4529-882c-eb77eb815f3d", "comment": "Malware payload (Rhadamanthys)", "value": "3f28dabcd78d1116e9d87e76ec45635ee6918d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397417, "uuid": "c9a07eff-e0eb-401f-bbf3-3eae60f24d58", "comment": "Malware payload (Rhadamanthys)", "value": "2876f26636c8c84e7e4f90243d3469aa41f6354c90c5c0919576fb21e612e0ba13e1191ced73604ba47f32bace420d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397417, "uuid": "9fd0a59f-6775-48e1-9963-c51840e0caf2", "value": "T1B1849E0297A06831F6225A328F1FC2F43A1EBC629E357F9A1E4B7E7F0970171D161B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397417, "uuid": "fbae20bb-cf2a-483a-98bc-a851b6378ad5", "value": "bea0621f64bda454c259fb9cfcc3b2f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397417, "uuid": "32ab43e0-1207-4056-b0c9-b3955de08c87", "value": "3072:/+Kgs8LHQ+GRUqYVWFczDSYicP6hX60rV+E6B/F/UFVl8zSYWwHFfgF+exho6qta:Cs8TERSIvrcZB/AVKzFW6FIZUmYhOJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397417, "uuid": "73e3410e-f517-4231-92d3-7181d62a4d3c", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397417, "uuid": "fe62e0b1-dbae-44d9-a95b-3dd723f20e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397417, "uuid": "fb131c3d-0366-4f85-a4db-be5979da9cdf", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e38512-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450433, "uuid": "f4593f9b-13c2-496b-96e1-1cd977098c40", "comment": "Malware payload", "value": "4248a9f7c71dea63d10d8386a4ae09b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450433, "uuid": "d6408ff3-2730-43a6-9fe2-b137f06b25c5", "comment": "Malware payload", "value": "2ac9c716c9de76cb0af8bc9f083a99d44df538818df030bcf62cd8321784a50f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450433, "uuid": "5b00ad5e-4582-44e0-a982-615bb734266f", "comment": "Malware payload", "value": "f2ef3cdabd491ee1a8b5f6d9265d437c55df5ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450433, "uuid": "c65c8f9e-a95b-43b5-8292-a882a980ce07", "comment": "Malware payload", "value": "21de0ea583973f77524f3c6b946c70fb3d9f726f50a8268e520bf88bf662c1c3b18265dc8dd7ba8f2b204e9089275078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450433, "uuid": "4a942ccf-29a8-442b-8303-017d420398f2", "value": "T117F47C8AB6B1F437C87E35309CC387B66A22FE805D4AD717A9AC7E1D2C71A506D32057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450433, "uuid": "74970531-4385-4f73-ad10-0f86546f2321", "value": "7c0b3a779d139ecc2dd5f51b84b45783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450433, "uuid": "cf4033ac-e0c8-411e-81c2-c2c3896db014", "value": "6144:IMIxqCDN+ietGBPI0cVlvTDduu2usSanT9TUboMMMJFusO3/KbL:I/JN+i+8fgLhtxsP3/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450433, "uuid": "67090bb0-4fec-4ed6-9a28-73b5ce8e48a5", "value": 757474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450433, "uuid": "a5b2b3ed-9c6a-4a37-bad0-ceb6fb495840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450433, "uuid": "db0b04fc-7467-4f54-bca5-f6b1cdcb71ae", "value": "SecuriteInfo.com.W32.PossibleThreat.29930.31300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9512a455-d115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680412614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412614, "uuid": "9825e1b6-988d-4362-8c98-e734a54dfb21", "comment": "Malware payload (Mirai)", "value": "0462ac5f619d84b10e17bd2250325c1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412614, "uuid": "e8e0b7b0-be3a-418d-824e-6a9dedbb5ca1", "comment": "Malware payload (Mirai)", "value": "2d03b969a82afda7a7eeba5a3116f09dce7bd1242cea3c7e111b480673d8c3db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412614, "uuid": "83995e39-9bd6-421f-981d-92cfacdf9969", "comment": "Malware payload (Mirai)", "value": "a7dbcb3eb31074edc341f6493df1a4303c99af6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412614, "uuid": "808b2635-f957-46e4-a4d4-3a5bd3e52029", "comment": "Malware payload (Mirai)", "value": "8a58804d38e4edf8e7792b550d7384d685d2ec0f78807279f96ea2b3c4d8dcc2e178318162945b16608c8fc7ab0842ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412614, "uuid": "1dfc4239-c9b5-4718-b998-94c78b04ef0f", "value": "T1AFA2D038D5138EA7DDFEFD7158C5E6D623A00B4773E3ADE0C0896B361057A328204EA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412614, "uuid": "adefa186-6047-46ad-8ebc-27dae9054dd4", "value": "384:ZXRRVxlz86MVau3/20PGuq+FdXYXBRJFDdscf8sROM4uVcqgw05VxJ5:7x1wVag/HwWdIRRJFqQ8sRN4uVcqgw0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680412614, "uuid": "fe4b2c89-10b5-486a-b4cf-010b936c202b", "value": 21808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680412614, "uuid": "716f20de-6b8f-4bfe-904e-e682871efc34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412614, "uuid": "8af34092-55d9-4997-8d75-7fd3b1e5f10e", "value": "0462ac5f619d84b10e17bd2250325c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8170f63-d173-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680453018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453018, "uuid": "2c7ba178-ed06-4af7-a08c-59fb236f0380", "comment": "Malware payload (RedLineStealer)", "value": "0671e541dd49a75a51d3190702aa9a61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453018, "uuid": "fcc5a232-9a1e-4f54-91ba-4ceab062ab8c", "comment": "Malware payload (RedLineStealer)", "value": "2d48bc00f7f660d2c78d3a01559ca4a8e16761fc074d225ab6af4954b80282ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453018, "uuid": "1528d5e5-22e4-4b4d-8977-ec604efd5949", "comment": "Malware payload (RedLineStealer)", "value": "4b259b247e91d05518f998c1d2e0f1456b5392b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680453018, "uuid": "b33b2803-3c1e-4764-8aa0-0441c263f303", "comment": "Malware payload (RedLineStealer)", "value": "cef102aeb906f28f6f43bb160ca7012c6a67df23b1f110ef006b8de5ebc869986972ffc2eda71239a416e72a49668042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453018, "uuid": "e6d04b04-2d7f-41fe-9a53-87e3a2fc59e1", "value": "T1CA544C73F1ACC105D378AEB8B0F09735912630A07A9140A96A777F35045EEC69A7CFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453018, "uuid": "a74087f0-73fa-40e8-9d1b-0ff1a69f0487", "value": "853e226a0e0caf1288b221f1c013407b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453018, "uuid": "ef9082d0-3f6d-49d8-8648-06a6cd83431a", "value": "3072:XhVbaRGSFaMmFWFu8RYN2yDc4TqkuqCMisloA4dKfslVBVNovhSxov3xB4XhfxV:y3mFW8bc5jMrloA40fsVVESyvn4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680453018, "uuid": "9d03ec1a-d1bc-4616-89d9-63c409c20b82", "value": 301832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680453018, "uuid": "cb6f4500-a40b-4f92-b1d6-b95c3045a224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680453018, "uuid": "1315ded5-799f-4848-a2b3-820ac5a8305f", "value": "0671e541dd49a75a51d3190702aa9a61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f8b724-d130-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680424353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424353, "uuid": "b6472d77-f305-4f4c-8a5a-b3c371282896", "comment": "Malware payload (DanaBot)", "value": "5423e83eb805a342371dedfbac267517", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424353, "uuid": "5e01b20d-d64e-49b6-8e46-93dd87a9cbff", "comment": "Malware payload (DanaBot)", "value": "2e28a091e04b9edbd773ceb017372f28c761da2fe3c013da06fb067b1f7b0c75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424353, "uuid": "288f41f4-e110-4eb1-b1e5-4b2bc2c566d3", "comment": "Malware payload (DanaBot)", "value": "973cea557bd92ff62eeb8d833ca836c92b48ffaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424353, "uuid": "42f96a16-63dc-4da9-8dab-81593930f2fa", "comment": "Malware payload (DanaBot)", "value": "ff15bd4259bb2369370f9e55bbf84d15af4c4b07e61b4819e7571b9c49da853de417a0c1a9b53f1aeec8746c593cb165", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424353, "uuid": "92b5814e-d47d-4913-ad58-ee583d9db04c", "value": "T1D9363301A5B87572F43F66361B2EC1F1270EBC465D486EBA4A34773F0A345E1EE66322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424353, "uuid": "3e512e2f-21af-41cf-adae-f2d04676cdcf", "value": "1b6416dd291a09c30fa39a9eeb2f405d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424353, "uuid": "049cd37e-a948-44d0-9c1c-bc7875c11fc8", "value": "98304:UFpE8QbzjRR7HAmAonldLflRqqXfJiDA6Q2pXHqKDfXKka6:UvSb7HAonnnDfJi5Ri4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680424353, "uuid": "cf297e7b-ecb0-4739-9275-3f67b223c006", "value": 4950016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680424353, "uuid": "e2fa945c-c164-474a-8d91-5665a27bd3a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424353, "uuid": "7904f6c8-bb3c-464c-907d-bfc84dc33f27", "value": "5423e83eb805a342371dedfbac267517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee93fe5-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680448171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448171, "uuid": "06ed1be9-9070-47da-9d99-0491c1667e50", "comment": "Malware payload (Gafgyt)", "value": "8ac55eb79226a4439b38626bf686bb12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448171, "uuid": "c6e719a9-f0a3-41f4-882b-ec5b319ce247", "comment": "Malware payload (Gafgyt)", "value": "2eb9f19c4e3496021d72877b73034a7811870bbe8e1a3ba7aaad4e6db018c123", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448171, "uuid": "4389161d-cfcd-43bb-8a90-e73cd6c53117", "comment": "Malware payload (Gafgyt)", "value": "d6fed85a5512d9aa7946dbba227e1f0a0cf2129b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448171, "uuid": "5a321870-858d-4445-94c2-f8fd950d7e97", "comment": "Malware payload (Gafgyt)", "value": "125b19455a9ed498e168c88ca549375fb3c2f7c58878444ab888f1577ea43702d584c72ef7707282b901f6a2cc8f80d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448171, "uuid": "67b71fb6-f8aa-4b8b-9f98-22d78819abde", "value": "T1B6A34B377B230E23C0CA947112E30B31FBB5D2D629B65247B9D06DA86F269803956FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448171, "uuid": "9a8034a6-2d2f-48ac-8a38-8ea6f9abb5bd", "value": "1536:CczVXeNM5+8AietGUt8GphazSzpxvmQmF6OXj6ufeuTe:tZeN8+8AXRphazSbvmQmF6OXGufhTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448171, "uuid": "885aff3c-b224-48ce-b064-f38771922081", "value": 99862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448171, "uuid": "f7714e42-280e-4efd-ab3b-85c1256ba4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448171, "uuid": "e0730d51-ecd0-4376-8014-8deeacd6e92a", "value": "8ac55eb79226a4439b38626bf686bb12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b04eb1-d17a-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1680455857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455857, "uuid": "3591fc4d-54ff-4e17-9fd8-59762c417259", "comment": "Malware payload (ModiLoader)", "value": "4e0528c2f1f5f636cc72a5e87f891cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455857, "uuid": "1487e85c-6de1-4da1-9662-c782cffdbbdb", "comment": "Malware payload (ModiLoader)", "value": "30e0958d76246d8347b4b074fb499140b61941f1e94c662adacb0a6497acb2af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455857, "uuid": "be762d24-9621-42ad-87a5-a703fc115bf5", "comment": "Malware payload (ModiLoader)", "value": "6a297c89723c4515e1cab4319c078f2ad68bf64e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455857, "uuid": "70224a8d-2553-44ad-8b94-770314049733", "comment": "Malware payload (ModiLoader)", "value": "dce52f11651c848052f5b3d083150e29be98d7a6af75cd445391197cf2f3593b88022932948ad470e45009e4a1deafcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455857, "uuid": "56d73988-ef64-4e82-b1a7-0628c1f2ea1e", "value": "T14625BE92B66D4376D5E359FBAC0FB395982EBF202E28D4866EE81D0D4FF5251380025F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455857, "uuid": "76d68236-d14e-4ca0-b664-20ef986bc408", "value": "b3ea304bcab66bf73b1913e96c70020c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455857, "uuid": "1a5da043-0e51-42cd-a6b1-ae2a394ef1b6", "value": "12288:uYcH/Ym8m40U1g6LfYdOKMhhLm733R3VoctIRy3+AhSsKySOVgA0klqUUm15dHuh:uRgkwg6LfYdShiDtuUP3l75Shklq0Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680455857, "uuid": "fdaeef7d-a1d0-4d9e-9e82-d33740fc9d50", "value": 1014496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680455857, "uuid": "a300479c-29d7-4e58-b213-94ec38220ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455857, "uuid": "e7b299c2-2bc3-4ca8-8632-1d30ae5c5a54", "value": "SWIFT New PO LI-2204 (Etd early Septasap).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e665f55-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450345, "uuid": "9eb7d884-4f25-4355-b5e0-2e1651786abd", "comment": "Malware payload", "value": "626f52176d2f12617193c5362f885f5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450345, "uuid": "c65668f5-1dff-4ee0-a579-5c906084f184", "comment": "Malware payload", "value": "335b489ac1036d915efe947b51df10463139a543c516111f39457d074587465f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450345, "uuid": "cec7d919-ca2d-4f15-8853-b5489acee57a", "comment": "Malware payload", "value": "4cd5b44206379f648f765dd6f6f82ac03dd732be", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450345, "uuid": "9c77cd55-fcec-48b1-a38f-d67c9362e4ab", "comment": "Malware payload", "value": "6aca471c3f67645cdf63d0090f76a9282d4a5c96cac68f6d8f416ca00eba1eca994928a76648e681ed072ef4625035d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450345, "uuid": "4227350c-9fcb-4dc4-b623-b5f4f9a69d63", "value": "T11F17BF1273E4453AE1FB2731A976A3355ABBFA221E31C74F359C5A2E1F327409A15323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450345, "uuid": "b4479f51-6968-4bec-9233-def697fca0b4", "value": "196608:+cp6H9CKecYPe7tKEGtt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:+c4H9C9W7tKEQ8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450345, "uuid": "05b2c38b-39b2-4dbd-aaa6-179ab43d0c81", "value": 18481981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450345, "uuid": "2a46ff3a-08a9-4875-85e7-0b5f4cd16a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450345, "uuid": "bbb8ddf7-54cf-4cd8-8a97-8b321a8de907", "value": "SecuriteInfo.com.Heur.16365.7287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ceafb1-d10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680408399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408399, "uuid": "aa373e97-a288-46d1-a3dc-13816b3be01c", "comment": "Malware payload (Mirai)", "value": "bfcc7d2ed1fe95960da073157f29bd51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408399, "uuid": "041e1c33-c7d8-458d-85fa-d9611dde2b73", "comment": "Malware payload (Mirai)", "value": "351c03ea5f27b9cd0fce9b5502a08e62ee647b1adc6cdf56633bd1d958696552", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408399, "uuid": "342546a7-5e7d-40bf-97f5-159b704e0c7d", "comment": "Malware payload (Mirai)", "value": "64f1ccfd3f4d14a1980f32b2b38d405e05e12270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408399, "uuid": "d3cef648-4bee-47a2-bf5f-727da3f63b93", "comment": "Malware payload (Mirai)", "value": "556cff5fba2e8c141f6e67487c571431982bb0985d91a22970825e7e515ea31acdc9ca7f865b18c44294a59463deafff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408399, "uuid": "aa362bb1-1f61-48bd-8944-89d1215b6b5b", "value": "T1B2F2E1C7DA5CD545C1EF01B9050EB905124C355CA184C6F26A8C24BEEFA6FCEABB019E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408399, "uuid": "275dbf77-9889-4453-96d2-58cc2a155817", "value": "768:kwlwD3ZE0ElS8A4sKW0SGrn8WFdy5grkPTDe+kVOnbcuyD7UJLUR6:kaeElS340GzTHynnFZnouy8Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680408399, "uuid": "254b1be4-8837-4202-8abb-d24304fc5d7e", "value": 35784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680408399, "uuid": "e051ee13-64c8-4a8c-8e58-71f6a82f7ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408399, "uuid": "ade4af91-c15f-41e9-9df4-b58ec317f542", "value": "bfcc7d2ed1fe95960da073157f29bd51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8369f106-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680395834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395834, "uuid": "4bcd7bf4-8ff3-410c-8d6a-842ade2ce0e5", "comment": "Malware payload (Amadey)", "value": "98c02acb0401448098dc6c09911c7053", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395834, "uuid": "2c0f619f-09a8-4f28-af19-1ba6b9a76789", "comment": "Malware payload (Amadey)", "value": "3568a98b73da0f7ea6d2b5593d39eb22ad01fded9c3ea9dffb04d8e1ea2b97dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395834, "uuid": "11b4f29a-4dce-4e04-aa28-b43b59b33387", "comment": "Malware payload (Amadey)", "value": "5611794292c3214d0ffb0491c23377e866ccbd46", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395834, "uuid": "19848154-3a02-4f64-acd9-485ab9b5c7d8", "comment": "Malware payload (Amadey)", "value": "bdb8abee8ef52290ca8174b35598ff94139fcccb5f96176a4a4b8bff2fd762837363e64d7b49931b9d48699cff597a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395834, "uuid": "3fd284ea-c428-4aac-8aa9-6dac4cb2339d", "value": "T1F2346C0252E06871F1325A32AF1FC2F4361EBDA29E357F9A1E5B7A3F0930162D562F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395834, "uuid": "97dadc39-85f3-494d-9d2e-59287ec27060", "value": "44e37c428947afcbabc1447e2f3a149e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395834, "uuid": "74435d4e-762a-4f36-a86b-fa23448f421e", "value": "3072:ZP55LCODn2vojx8NZ8lx5UCwZMqs3gIIn29UH++mKqfCDicC6nCzHcn:cOTDjqYUnXs2nOUepCDicy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395834, "uuid": "d69fce8b-b643-4301-90fb-f3a0eb5435ab", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395834, "uuid": "6c236bdb-7575-46c0-818a-428d0dee5a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395834, "uuid": "b9fe06e5-0c45-4f1f-8b0b-be37678eb655", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057e6074-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680395623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395623, "uuid": "257681b5-b8ca-4aa4-bef7-e342f35bd5bc", "comment": "Malware payload (Smoke Loader)", "value": "e0e485a564dffd839935f1f98f5e8758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395623, "uuid": "46f56156-f4ed-4814-aa57-9098dc35c15b", "comment": "Malware payload (Smoke Loader)", "value": "36f150620ef85178fd36a1ba1a7bb87dab1cd1a997e69ddf9c2bb30c1956f875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395623, "uuid": "413e35f2-bace-4ee7-a0b9-dcf20ca47e15", "comment": "Malware payload (Smoke Loader)", "value": "1c302d156f4387b6aea797bcf9e7a3f03714e4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395623, "uuid": "e01f2d32-1bb2-4465-be8c-c9d83a4d491b", "comment": "Malware payload (Smoke Loader)", "value": "977fa2b7bbd6475995a1f9a8d5ca5e7b6b2f35ba41fb7c7e7908d65cad87723bcc8ce48719bd56fc06b4073a5c0e4704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395623, "uuid": "e78c3e02-2b95-4e1b-94b7-ce4831e0be59", "value": "T1F6345C0253E17871E6225B328E2FC2F43A1EBC525D757FAA1E4B7A3F09701A2D162F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395623, "uuid": "91bbd599-cbac-47c3-bfdb-c938e812b912", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395623, "uuid": "5c942e9e-8205-4520-868b-adb724f4cb23", "value": "3072:Y1CDQMuxEXCT+WaFmhWd5E1qHU6Vq12k16MHVDqs8svT7xlNRtHc2:o9Kk+WaaJuq8R8VDqstTNRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395623, "uuid": "4e1ec17f-5ec9-4b2b-8132-121d1e6eea86", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395623, "uuid": "9601579c-d1ea-4951-b5a0-8654ea76b424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395623, "uuid": "8553e751-c0a3-42e2-89e0-5baf556bbe8f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6661a1b8-d0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680396644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396644, "uuid": "502de05e-68d0-40a1-b5e3-24af8212275a", "comment": "Malware payload (Smoke Loader)", "value": "9565c4e50403f986850f3ac801c689e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396644, "uuid": "4f6c941c-7da7-416a-86af-9e4bacbf9c3a", "comment": "Malware payload (Smoke Loader)", "value": "3839360d8e8a552ce9feb89f88bc276c85bfeb16b6a4a6021786e4a0ccf8dde1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396644, "uuid": "fb87484a-201d-43d6-9233-95522c975f88", "comment": "Malware payload (Smoke Loader)", "value": "3549fd573035fd54230821ff5bdb946d30dd4ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396644, "uuid": "58b2c635-957c-4893-9281-f6383f68010c", "comment": "Malware payload (Smoke Loader)", "value": "e7317d63ffd463e2634c2e538a1b8edc8602b0a21ee9c957e105558ffb7197f4a190e97cac10942bd0c589412e763fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396644, "uuid": "434859aa-0e07-49a2-9eac-ef572d45e288", "value": "T19A24CF227690C0B6D42F40745866EB797A3D78715BA186CB33680BFF0EF06D15A3A3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396644, "uuid": "6b72390a-2313-4687-8546-5399d9470d74", "value": "724f7af50306908b18449bf42724cf5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396644, "uuid": "4179b81e-aea4-4998-986d-7510fb145fb7", "value": "3072:1QYiyN9drOpNNkXDZ0SdaSkvIt3MnBx0OnOpCFM+m/XbVwj5gruLarg:1eCdyy07SnyBxuonm/LVhKkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396644, "uuid": "470f7ba3-fc3f-4aa4-9c10-a4f00878e5b5", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396644, "uuid": "00dadbd7-6459-4340-ae71-8d86dcd656b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396644, "uuid": "8c5f464e-cdc1-48b4-be3e-ac3a0184b735", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee305b2-d12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680421703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421703, "uuid": "fb02ba36-4ccc-4cc9-ab42-4b05fb70c480", "comment": "Malware payload (SnakeKeylogger)", "value": "66300891985d774e47099fe6c8610e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421703, "uuid": "509ef327-11e5-492f-ab54-f7e4e2b7598c", "comment": "Malware payload (SnakeKeylogger)", "value": "3bf0987f3ee1c806e453a828fc01fa55707f7b859c01243c9f3f4bf7f642dc64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421703, "uuid": "d242d15e-02a4-44fc-825b-2cf0666accf0", "comment": "Malware payload (SnakeKeylogger)", "value": "96f08959257927f23c4430186d76f42af4c6ff81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421703, "uuid": "9f6cf14b-8828-42e8-a694-b0c3e13cccef", "comment": "Malware payload (SnakeKeylogger)", "value": "c567b0a5d2bdae256dc973a15f1c6f6b927b90cc9faf126ad3c51e3af9fcb1d97e5d6d3eecbd476c84d2e186be8bf161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421703, "uuid": "7339ec4d-4744-4f6f-b8a8-47409e915419", "value": "T14985BF7207AAFDDBE3BEBD26D45725508C9874BB5218DD5878C8278E60B4B04DD33AB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421703, "uuid": "38ff1740-0eb5-43e4-b345-f386081577d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421703, "uuid": "40bd415f-6d63-4d68-8259-ae51a9e86914", "value": "24576:LCa+lNsYuHjkovo61rJyOXvPYed7JtZWdNuRyX5O/w8gXcs7Usp5wIQIN/ePHGyW:omjDT/UduutcsoI5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680421703, "uuid": "df5b0d3f-9df9-4db4-967a-44f60c1ca0e6", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680421703, "uuid": "c96d540b-c477-4314-8795-0248424a30eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421703, "uuid": "e9c006b5-f98a-40b4-a858-4bd809dab122", "value": "Airwaybill and Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0eb5f78-d179-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680455718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455718, "uuid": "e8d211f0-b7b5-40d8-83ca-6192090eff0b", "comment": "Malware payload (AveMariaRAT)", "value": "0995f482fad92be561d02ffe44d776e5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455718, "uuid": "55de5ded-f3b8-447d-963b-3019dd77ff2e", "comment": "Malware payload (AveMariaRAT)", "value": "3db3ff194e7b9f9c7c2920a4ad11783d3b5ac3e0f6f03eda11c4078c8fb53738", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455718, "uuid": "428cd8f1-dcce-4ce7-a560-d139d36b1927", "comment": "Malware payload (AveMariaRAT)", "value": "aedc04675620843386507892c8d3e0bcee7ca21c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680455718, "uuid": "3e68e33e-a792-4ae7-853a-aed0c53d3d98", "comment": "Malware payload (AveMariaRAT)", "value": "1f64a68221893ffa73666b3b4d50cd9ed4fbd805fc63a60cca33830999789239ad506d3b7351536cd333a32b6feb8ef3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455718, "uuid": "72b13f08-77d5-4500-b128-efcf5b05b9fb", "value": "T1C3A2D619A6E84337DDFC0BF54892154877F1A023B723FB851E99A4DA2B3731D4883A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455718, "uuid": "e0332ca1-c286-422b-b0df-aad01710ca43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455718, "uuid": "e2c86d1d-7b3d-46ec-ad95-6b66165a4081", "value": "384:sCauLcPKagsl5yu3HJw3LgFJ60Mx29FBuQjJYfb2:32j5wbgg0uQNK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680455718, "uuid": "c02c6eea-ae38-472c-acb3-f9da3dd15586", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680455718, "uuid": "808381e9-b8fc-4839-a6b7-d57eaa903338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680455718, "uuid": "7119cc7b-3fa0-4249-8578-91b52c899237", "value": "0995f482fad92be561d02ffe44d776e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b41cf69-d0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680396545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396545, "uuid": "d71c3239-d89c-4631-a8cb-5b9666787ce2", "comment": "Malware payload (RecordBreaker)", "value": "d46bfe4c28ea8f730a1121e5a1d879f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396545, "uuid": "c8254e30-59cc-426f-a55d-5fe5db3a7da1", "comment": "Malware payload (RecordBreaker)", "value": "3e2a098995005be31fb1c2add68d5371c7e8cdfc0906e77f77b2526766b1a772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396545, "uuid": "6c1e55ac-eb7b-48ed-ada1-3f6617234d07", "comment": "Malware payload (RecordBreaker)", "value": "ee3621586e90d8776dcd352fdae32355a6615ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396545, "uuid": "d3a162c2-bd67-4126-bd53-b8285a8d4a18", "comment": "Malware payload (RecordBreaker)", "value": "bd7a687d5249e77a3bc96c440ae727d498ddda63938af461f4223bf10fb2480995cb392f4a2b7f67a142f4ae200eda95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396545, "uuid": "8e787d61-8e60-42b9-a87b-2ec36c98c7ad", "value": "T1D524D0317BD1C0B3C65F05700425DAB4AA7DB8715BA5869B33B41B7F1E312E09A3A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396545, "uuid": "30857b88-a388-4edf-9979-8d84df911fb0", "value": "724f7af50306908b18449bf42724cf5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396545, "uuid": "702bdc11-07e8-4c0e-89f1-8ace8f78d529", "value": "3072:hWwyj0OLNtamEPrWv/+mGGbLhKzlx/33lQj5g6Cox:naD5tv/+mRKZx/lB67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396545, "uuid": "5a9f85aa-cc33-4998-88a4-455e5089ed15", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396545, "uuid": "72841a91-2b75-4c06-bd8f-a4a59f423694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396545, "uuid": "fb450e04-e9f3-4e86-8710-5e1b40eb0282", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe29350e-d0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680398187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398187, "uuid": "b69c26ba-44fc-4642-a72d-f80d15c8ccf7", "comment": "Malware payload (Stop)", "value": "5faa37823a06a9aa29caa050e518ec4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398187, "uuid": "4c35922d-f7d4-41a0-8e90-74a250c9ba5f", "comment": "Malware payload (Stop)", "value": "3f063fd7e94f03475056fc4a24beb28da821ec5cb8dabe9c7d4f958d8f21a397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398187, "uuid": "6c4db936-d46d-4e06-b379-d835f35fe01d", "comment": "Malware payload (Stop)", "value": "6b05966ebbf13b4f804372657841bd9590283435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398187, "uuid": "6371542a-548e-4a79-b625-b43755f0945f", "comment": "Malware payload (Stop)", "value": "aca9fa2ca00e306c9f9587ce0c4c72b522c98a7983a166e250238ec60c3d47c3e6f76ba9afab784bec6972ff483279a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398187, "uuid": "ee8cf089-8162-4bc8-a478-eabb6188ca22", "value": "T1D505F11252E87830E53F4A328F2EC2F4270EBC629F597B9B2639BA3F0574562D971714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398187, "uuid": "cf9286bc-3fdd-4124-8a06-d02e7cc450d3", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398187, "uuid": "a0684eea-4d83-4d2e-977e-97797817823b", "value": "24576:XidwAZaNZPLeQl/xMBR5LSNS6Id2vWes:Xiipz46IdkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680398187, "uuid": "b455109e-d161-44b7-80ce-399d814f8687", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680398187, "uuid": "c834a2bc-a2c5-4b91-a720-b305f7c8ebf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398187, "uuid": "342d21c5-817e-4a29-883d-379ef530a020", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58b28ea-d191-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680465926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465926, "uuid": "d0753490-fbd1-4519-b022-28e2989c5126", "comment": "Malware payload", "value": "4ed499a01050c74c1e5a7355e98b9510", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465926, "uuid": "146ada65-34f8-4925-ba63-520e12cd5287", "comment": "Malware payload", "value": "4057d6b8b3ceda48e5c3e92336e9ddaa7a10adef523ad55f2dfc3844d3041182", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465926, "uuid": "77680c05-8903-4fba-82ff-58333c1c8884", "comment": "Malware payload", "value": "245f947fa2e050be31ebab81bb5a60e79e4c5493", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465926, "uuid": "5dd229ce-45d2-4471-b947-5088417117cb", "comment": "Malware payload", "value": "3629401f21956e61f5b568544bcb00ab09d962ba21bd67add2292259924ae24044ba0a4fdaaf135a888fc471c3dda37d", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680465926, "uuid": "5f722d45-e735-4fa2-9a26-49d733bf3b15", "value": "T1BD557DEAA7BE982CD451CA70FD1C52F281CDD0B28E18B037342C45D637CDA62DA667E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680465926, "uuid": "a324114c-310d-4156-80cd-0f2ca0e17e62", "value": "6144:GUG/XtZ2Io+mveD+KI3cYm1ioI/9khpDhMpM5UQsQyGoXfzVvgz+psh8j2XBMAr0:9g/LGvGyoWuhZU4yVxggsFPhwZJBU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680465926, "uuid": "50667712-d6da-4c33-984c-2bcb0f0881f9", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680465926, "uuid": "bcf2380d-f777-4fec-85aa-1d1b4e0eb79f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680465926, "uuid": "9058ae8a-d4ef-4548-8ce7-090d2424b8f9", "value": "TaxReturn2022.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8747d2-d112-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680411147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411147, "uuid": "39435185-a839-4056-bf6a-74bee4cbacc1", "comment": "Malware payload (Mirai)", "value": "d2b759efe54a7cb740897de0a0cb096b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411147, "uuid": "aa58635b-a2c6-48ee-bd94-9682afee4f1b", "comment": "Malware payload (Mirai)", "value": "40c04e0fafeb5fd10d8f3ab966cb1dedf6d02e6370a0e11f17495b6d3955783d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411147, "uuid": "39ed0c10-c870-4efd-a164-c33b6f6db433", "comment": "Malware payload (Mirai)", "value": "b1ed86cfa84fb46587986c74e2d8232d1723053e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411147, "uuid": "afb29d5e-dd64-4c9e-9311-aa96fa713c97", "comment": "Malware payload (Mirai)", "value": "d434388cb82fdbd7c705e855d2ae7992635b9e518636e9d745a9497d7b48f02d5b2071572b2024fcb3f0af59c98f5d6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680411147, "uuid": "802d4a99-e35d-4f4a-9765-cc81d7de134c", "value": "T10AC2E13A4F01DC72E97138B978F8075A4A438FF4841A36A30501EFC8A6D720756F9AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680411147, "uuid": "7bbee027-35e7-464c-ac3f-eda22017ee26", "value": "768:Zt2+khZ6s1JaAl2yizVV8noT/ixscjvbE/h9q3UELh9:TJS3DO/SdOcjvbyULr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680411147, "uuid": "9fe81c4c-ce6a-45e2-9857-6b1e43c569cc", "value": 27216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680411147, "uuid": "6ddd113c-0e05-453c-bcab-807aaed16aa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680411147, "uuid": "4ce249a6-5375-40e8-b3bf-2b099c77bb87", "value": "d2b759efe54a7cb740897de0a0cb096b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720dbd4d-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450351, "uuid": "b19555d2-d1bf-4171-a4da-10359fb253f7", "comment": "Malware payload", "value": "e97ea0621cb5a7f0af680d463a5412bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450351, "uuid": "6c80f990-cb02-412b-a8b5-50794b03513e", "comment": "Malware payload", "value": "40c0e3520fff0555fa7d77cfffc267486882f750daf141adab69c70003e1aca7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450351, "uuid": "875bb1fd-0061-4a11-91a5-8d9c03cbdf8e", "comment": "Malware payload", "value": "88b57ca13526240b11aed98e410fe3580dc755e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450351, "uuid": "25079be7-a284-40c0-ae5b-556eaf4d5a7d", "comment": "Malware payload", "value": "ab9fdd39691f9485d901e6380d416ea19ecf28a9bbced054ab11accdb2357ecb66e3c6f0cc6be7b7de7de190aa596849", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450351, "uuid": "db9688df-35bb-4fb4-8ddd-a4c5bf0da248", "value": "T17D17AE1273E9453AE1FB6731AD76A3215ABBFE221A31C74F358C652E1F327409A15323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450351, "uuid": "804dc8d3-a44e-4801-88c7-01c962fb04ef", "value": "196608:0Mcp6H9CKecYPe7tKEGtt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:Xc4H9C9W7tKEQ8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450351, "uuid": "99cfe077-80fb-40c6-b8b1-ab67a6f36225", "value": 19229685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450351, "uuid": "0775c0a4-e271-40ba-9353-3672ae05fe83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450351, "uuid": "acba57fa-642f-40b3-9656-7fdd574c996e", "value": "SecuriteInfo.com.Heur.27213.20687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728442eb-d195-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680467531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467531, "uuid": "a84db934-d465-468a-953f-b9e8f39272a9", "comment": "Malware payload", "value": "cfa306c7cae61b3ffef8c6af0c521bf1", "object_relation": "md5", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467531, "uuid": "01aa15fb-2e47-4c1b-9fc9-ea2736151b42", "comment": "Malware payload", "value": "4152aa9073b4490e5e07590c816e5bea59285e51649f3dc1a6f001bb2045ea9f", "object_relation": "sha256", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467531, "uuid": "8b8e13c8-b7c0-4494-b119-d91fe2dcd00d", "comment": "Malware payload", "value": "6269028daacb6ae8bf6b78b1d076fa0abf606939", "object_relation": "sha1", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467531, "uuid": "1c5c1b8f-33cd-439e-a4b2-06dfaf6b7276", "comment": "Malware payload", "value": "ea9681b30d8801ca1f43390ae67f4271a54b5621c0b38591972fd53a95829b31e663ba0e17e4e29c9deae938bfd40d33", "object_relation": "sha3-384", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467531, "uuid": "d26340b3-f65c-4cc1-9652-eff484c4baee", "value": "T129C43E8DC21B8B59BAA1235E83D12D4D1AA27CBAF80BF854360FE4764016DFD15F44EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467531, "uuid": "3ac3f68a-1d68-43b1-aafd-1ab01f9f2db2", "value": "1536:M+fNYbUBC9rBWPSPmtPtSh/FWUHUQ7ql0GldT897z3MlXHX62nkJWz9vfhaZffcT:Bo74Pdw32lk0VhEeAq17d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680467531, "uuid": "fed62848-1dfc-4c9b-8e61-e2da468af291", "value": 585695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680467531, "uuid": "b71a70a3-bff6-4219-8696-8c6880faeb99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467531, "uuid": "40e02c98-5fdc-49c9-826b-29dce8f2c614", "value": "J.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d6a397-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680396086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396086, "uuid": "61e1a7ae-a36b-40c7-b802-87327a4ed4d8", "comment": "Malware payload (Amadey)", "value": "8cb4a90ba1552d8f14ce1937fd40402c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396086, "uuid": "480179ca-0f9a-4ba3-9492-cc77d01ed187", "comment": "Malware payload (Amadey)", "value": "4216159ef512a25abf0c6db65d1d766a3e6492e11c9723eb2b4fd706dd963ec7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396086, "uuid": "8f095208-d078-4363-8927-2ce6ccffd991", "comment": "Malware payload (Amadey)", "value": "ab4f7fdb3aafa87fb870ed14e19c2b965300c128", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396086, "uuid": "c291a8da-1b46-4d7e-ab91-79a399bf6dbe", "comment": "Malware payload (Amadey)", "value": "618fca3a33e6dbe8b4539ec484f74bc50c51f479c494dd26e2211dedbdaeb29b585ea4a7089250b4428865c1038e254a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396086, "uuid": "75640608-db5d-412d-a538-770c95ca7909", "value": "T1F0346C02A7E06821E6225B328F2FC2F4361EBC629E357F9E1A577A3F0935161D161F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396086, "uuid": "b21e525c-168f-42aa-9ed8-47c73fcb0aa1", "value": "2a3446625592e0299ff9a4018647956d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396086, "uuid": "20f72f62-48a0-45f0-ab4a-53a505bd2075", "value": "3072:HtlRbvgDw2sGFRSNIuvzaWkuVqAi4IvElnV8za4fiwR+rNYAFHcn:Jg0iFU2W4YTgx+reI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396086, "uuid": "f0f6bceb-8ea5-4d31-b2be-0dd7bb9bbd9f", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396086, "uuid": "cffbb7df-3598-42c3-83f8-0a3176a9ba71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396086, "uuid": "d4ac87d5-a757-4680-8aa6-cb6c18d406ff", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b99cb40-d10e-11ed-88f6-42010a9c006e", "comment": "Malware payload (FFDroider)", "timestamp": 1680409511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680409511, "uuid": "ea25778b-ab98-4fdc-93a4-eca543234700", "comment": "Malware payload (FFDroider)", "value": "e0075451ca38929f3215fe53d14ea7ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680409511, "uuid": "831aa92b-9faa-4b5f-87fa-c3518a27497f", "comment": "Malware payload (FFDroider)", "value": "42c3da89a0fe1ffb934b035c421fbf621cb2f6eea481485469bf3c711f878bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680409511, "uuid": "99f8b11c-c932-4208-a755-d13e236903ae", "comment": "Malware payload (FFDroider)", "value": "ade946ed933e02d1569d4694783ecf86fd427de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680409511, "uuid": "7d4ad10a-b07d-4d9d-8039-ce7fcb2c5044", "comment": "Malware payload (FFDroider)", "value": "fa3d081f4ebc5172259e054a0f38a822eca15c17539bff4a2bd7db57a7fb49852ba3d1e5f07cd14726cdee9aee1bfc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680409511, "uuid": "683a468a-caea-453f-ab59-1ad4a71b31a6", "value": "T16FA633A2F9D105B1E86229712978BF24E9BFF0201B340B8F57585F1E2D74A84F736762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680409511, "uuid": "8dcadd7c-aaf6-4fd9-87a0-c834157f8398", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680409511, "uuid": "c6227876-da1a-4b1f-a870-fee31ca1158b", "value": "196608:JeXSnFrBnEboyukjwioL1ArXXk8Y/3OXEPPtvew651nHdEht6a6vkIzQUwGT:8inDnooyDkGXXkTBew651n9EhAajIJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680409511, "uuid": "fa5e2292-954c-4003-bef8-9afa5fe185a2", "value": 9604878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680409511, "uuid": "4d6516a9-4dac-4a66-92cb-354234fc3cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680409511, "uuid": "336c2539-62b7-4590-beb4-7e9569c3acab", "value": "42C3DA89A0FE1FFB934B035C421FBF621CB2F6EEA4814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69cf4a9-d138-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680427703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427703, "uuid": "46786f3c-226a-4f43-b032-fc9be87afbc1", "comment": "Malware payload", "value": "cd6f468002ec4e8b8296c77ad7ada594", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427703, "uuid": "13f18d8a-6748-4fd6-9565-91c4de72d0f5", "comment": "Malware payload", "value": "43dba2bbd2085a515e2be3dfe53b31a0fb467e976a66e7af38832ed3ef6a7310", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427703, "uuid": "97498aad-928a-43e4-9066-76ef3e1bc8b9", "comment": "Malware payload", "value": "b78ac56f538195ce2709d55a9cad1604b2b204db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427703, "uuid": "0d1a5616-d7a0-44fd-8e3c-1880e16ce2d3", "comment": "Malware payload", "value": "dc45374deaad00592766124196b2d64d77f5bf8afe9b724a863e0e1f19a1db8a0329046e12b893233521cd641e40de55", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680427703, "uuid": "77fd5e4f-762e-4a5e-88e6-dbceb90806d0", "value": "T1DFC633EB84525F55CAC89236153BC5FD1CB701582D8612B38A6BF263AF102D38E9DCB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680427703, "uuid": "934ba1e4-c4e9-44e7-a521-d9be735a094a", "value": "196608:4ippVUn+a3vEFByYoNBJWbPoTFyfvdqUAnKLu800AVCV8470zU/ge/gBgM:JLUnl3MjKrJ2ohSvdyhXCVr7VoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680427703, "uuid": "c40b28df-1ac0-4a06-8192-9f0f6a1f79fc", "value": 11913642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680427703, "uuid": "9a55be32-076c-492e-a0a6-ace0ad2d5779", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680427703, "uuid": "ed22c56c-aa18-444d-b21b-9cf8cbecc2bc", "value": "Fast & Furious 10.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137a350f-d17c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456635, "uuid": "700e971c-7730-401b-a5a3-bb10cdec7c9a", "comment": "Malware payload (Mirai)", "value": "2245c59c9e00092826f5b88ce8422d25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456635, "uuid": "de629254-4d22-44eb-a75d-b31a8c676aef", "comment": "Malware payload (Mirai)", "value": "45e03a004d1ef52f1dd5a1d1df90d9dfefc4789fb5b62370e4c4a45db603432f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456635, "uuid": "d0c13805-e3f3-447b-817e-029943c6c753", "comment": "Malware payload (Mirai)", "value": "2f30b090a362be1fcd097985112f5133ec867f33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456635, "uuid": "e0cb2a33-45c4-4a37-86c2-ef69e1d22088", "comment": "Malware payload (Mirai)", "value": "3635275285abd2433989e32cbbb8c0aebe158c60a4b40b7b45751bbfd2228083f93e54d2723578ddecc5fd666b8cc864", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456635, "uuid": "d48fe3cd-5f34-405a-9aec-98cb749c8e89", "value": "T1DD53A61E2E21CFBCFBAC863547B78E209648339626E1C584E15CEA015E7074E785FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456635, "uuid": "face7f7c-bbb5-44f0-8387-cc29fce1c013", "value": "1536:AwZDllDaxU/R9+kVihZRyu5pA8x+ON8n2iAcpg+5OqqsI:/ZDjDgS4Z/jAijN4AcpHOft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456635, "uuid": "0fa64709-6709-4bd6-a527-26d54184e77d", "value": 63384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456635, "uuid": "256b50f9-293b-44b9-9290-5e5f56336892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456635, "uuid": "f6014d75-7b2e-48a7-b082-9ab11e985a10", "value": "2245c59c9e00092826f5b88ce8422d25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305419f5-d191-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680465702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465702, "uuid": "9834babb-4a4a-44c2-8a90-6195faef99fc", "comment": "Malware payload", "value": "664b1e31dfe2a502e76c1bfe4d4b7593", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465702, "uuid": "ab8b4db9-8c6d-46f3-b45e-09603e192028", "comment": "Malware payload", "value": "460d093a55b930e733c60575f82183cd0edd52ec6b927cdb4a93dc5da7f0ac9c", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465702, "uuid": "65c8770d-a377-454d-bb5c-89a3225e630a", "comment": "Malware payload", "value": "cb6442df1aa65a7a1d12123a38c2e4e5de07d99d", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680465702, "uuid": "3e22efa3-dd55-4f4b-a8a5-c095320e393b", "comment": "Malware payload", "value": "d2825562fb83635d5827485a640fae9ed714209bbc5f3ea96ebfff347fb9430df9b954d8747fed3077f76df1ee28339f", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680465702, "uuid": "1fbb347c-a71c-402a-bf42-a26cbd1408f9", "value": "T1C624CFE25F3CC96B5F8DD75EE0026F47E63491AF1065046A2B8B654DD06EF12F32EA08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680465702, "uuid": "d31d50f1-cc0f-4653-9938-62a561aaff12", "value": "3072:hTPTwLhFrOBsc4VsTKkcU/DNv9O9djB3zNn42SSeAq1ldm:FwLKpKkcUbNv9OPB3zNySeAq1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680465702, "uuid": "a883abaa-3b2e-4b99-a0a7-5ddaf27c33dc", "value": 218021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680465702, "uuid": "90cbff5d-bedc-4ee1-b25b-cbbf6ed8f4b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680465702, "uuid": "9a8901ff-7713-4567-bd5d-38b0f17f5309", "value": "j.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb6d633-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680422643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422643, "uuid": "b13fe85e-883b-49fa-87ed-5e07cd6fd743", "comment": "Malware payload (Socelars)", "value": "6418bc223b6880e2276b4ef2415544b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422643, "uuid": "509a5eaa-6e93-4911-ad90-ddcaddfb421c", "comment": "Malware payload (Socelars)", "value": "47d79e9977b50909c657e4497073b797e898f833e0728602a8d75ebd0abde021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422643, "uuid": "45dcc23d-edf2-49aa-9dc8-b62101c25717", "comment": "Malware payload (Socelars)", "value": "39148b406f0aa76e629af5ed45ff4ad72de89ac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422643, "uuid": "47f46114-2fde-4685-8919-721c3d8b8df2", "comment": "Malware payload (Socelars)", "value": "4a30c67679a3b3603e8a59c215b3b7ed2e8c22752f1da9c011530b5c7cd873d39939241545a614bcb59b5d6213ea6fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422643, "uuid": "684399b1-8cc2-45ab-afe0-e7fe9e0612ff", "value": "T1BE658D21F7C26032E8E310B745FF66BE8D2C6E11470894D7D3C82D999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422643, "uuid": "dc4dc48e-299f-4fe1-a318-7cc4f8be5d7f", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422643, "uuid": "877bf672-70b0-4ae4-acf9-8ad049ac24f4", "value": "24576:ZGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRXj5hgSe:8pEUIvU0N9jkpjweXt77z5q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422643, "uuid": "b2a206c8-f14c-4404-bcfd-10b695f01ac7", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422643, "uuid": "c0165483-ba3d-465f-8f68-077ddbc2d744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422643, "uuid": "fdfc0178-f0d2-4dde-bce4-e2c919a8ef4e", "value": "6418bc223b6880e2276b4ef2415544b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2a791a-d15a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680442157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680442157, "uuid": "11737919-0de1-4402-86f8-5a8d31b8039d", "comment": "Malware payload", "value": "3f2760568cf5d05eab47ff3c688310a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680442157, "uuid": "2ec0ffad-b996-4687-90e9-db7d6e0ed02f", "comment": "Malware payload", "value": "4a084e9255d05f145326f8a8c9ca7202e5b94f5c844b08a5541c288ecc96704c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680442157, "uuid": "6ec85d09-4f50-4c08-a6a0-9a69a46c83b5", "comment": "Malware payload", "value": "b7914ae395c531eef6a8350d9f62f7b630b3a940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680442157, "uuid": "a8f4179d-603b-4afc-a220-0cdd9069f7a0", "comment": "Malware payload", "value": "f72bc4a88a58c5ec17d75a9ba25a2d0bddb4f6cfa125a00403600a2cdc720470fc3469e2e64bde8bcaea61a9faabd199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680442157, "uuid": "fe10f642-2e07-4bc5-9b5c-7f648a55f436", "value": "T1F43633026BA87412C82EA7318F1BC2F9761EBD618F156F2B1724FB274EB0563DD61B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680442157, "uuid": "588af3a6-cb9a-4d59-ac4b-f5709f089e4e", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680442157, "uuid": "854d5890-3e5e-4bc4-b130-0428e5016ce6", "value": "98304:51XxwGbh8v31QM70GA2+bYRs859SPos5VpFjsuq0ShqIcbZXCO3ahPd9:tx8dQMgGAnbYRh5kDnFjsuq0WtcbZXCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680442157, "uuid": "54215201-f4b2-4642-b6c8-657ed4d053e3", "value": 4948992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680442157, "uuid": "c5347dc5-5558-490f-9906-c1617bd2d8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680442157, "uuid": "8f8b5977-d5b8-4a9c-84c5-6d5c2471e3a4", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1Y731WE.28496.4112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca24ce03-d108-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680407119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680407119, "uuid": "b1992705-19e0-406d-8e4c-4ae847a921b4", "comment": "Malware payload (AgentTesla)", "value": "d44278a6d4f3cb1449ead2ee3834857f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680407119, "uuid": "72ea9d94-efa6-4f4a-af6d-0a13d07c1cc7", "comment": "Malware payload (AgentTesla)", "value": "4a290f482706ab37bf00ce655653f7d07c3617416ed69cc95376a22f74cef765", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680407119, "uuid": "84772198-b7d6-42fd-982f-8e3ff2a81764", "comment": "Malware payload (AgentTesla)", "value": "795fdf14a505ec9d450c5547df1f8a32a9b9ba00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680407119, "uuid": "b6f2d7a8-1f53-4ea3-970a-a7e2a3ea5835", "comment": "Malware payload (AgentTesla)", "value": "9b84d9af1203e4664be1e48f98d27a0589f4ed55f6214e6ba6c79a723e9818cf18500690d9c517fccb5e31ee6aa9ecba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680407119, "uuid": "c3894da3-135d-44ab-8e2b-c41303ee827f", "value": "T1212402804AF04F35D61A2B7F4CB7E82874A2DA4DE902AD9BE09DFD76995E91103C7730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680407119, "uuid": "55594513-5208-4408-8970-9027fe376c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680407119, "uuid": "8699478a-cb81-4e13-8c58-6f29f9b73f04", "value": "6144:cODko6cOQmjrI9+kG107Nd+pSZlHyuOgficRQgf1qxC:cODkKOQmjksz10JdJZR1OgflRQgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680407119, "uuid": "94d85580-61d9-4cbe-92ce-3bc776e29617", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680407119, "uuid": "60a8eaea-4df0-45b1-81d3-bd9421e70d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680407119, "uuid": "92abb1bc-56df-4f07-825a-191e4f3b02c4", "value": "4A290F482706AB37BF00CE655653F7D07C3617416ED69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff666ae3-d182-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680459607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459607, "uuid": "15f5f558-47b6-422a-bef7-49371e891afb", "comment": "Malware payload", "value": "1a7eb7d2ae1a6be79b316c0098d5ca9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459607, "uuid": "b06f7581-93a3-4921-80d6-0f1a94f94a3d", "comment": "Malware payload", "value": "4c4cc9ee6936e8949b19c09270297f9f0200307eb9bb414e0120b389ed5d285d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459607, "uuid": "85da8376-4566-4827-b2c8-291883e87928", "comment": "Malware payload", "value": "f9e436373a81def7a928ecdd8ca0b6f4623cb7a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459607, "uuid": "733d0735-a2d4-42c4-993a-8713d8d4a815", "comment": "Malware payload", "value": "e535d4fd1be8450df1d4f9fc8adf6d14f90ca69b8b530c434199ac7fb3c0c51d1d661f3324466d1ae7a464cab410f962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459607, "uuid": "1459b629-bbcc-4bee-9f8f-afa0d8ee5aec", "value": "T10282B80AA691DD7EC095D3385CD7C1B0A2B060B4DB25D3773944A3B939623C89B6F68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459607, "uuid": "ca56c345-e6e4-4484-8ad1-86411b802316", "value": "192:RPA8P3ielnDndX77MCDOLnkOXIwCLimeuR9P+s1USVPGlGUxtrlixt0SCpm1Si:48dH0XCL1euR9P+s1USVPGxxtrMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680459607, "uuid": "b6d164ae-9035-4b00-8277-e172f43eb455", "value": 18056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680459607, "uuid": "6d6e7c02-6cb1-4ace-9c74-089b525d437d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459607, "uuid": "ded1d504-0ba1-46b8-b792-b65e25988bf5", "value": "pubgm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65f7735-d12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680421689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421689, "uuid": "c2c7d0df-57f3-4fe3-b6db-bc5a9b5082ad", "comment": "Malware payload (SnakeKeylogger)", "value": "3d5ce84fd9d34f1179d64a0a6a1cbfc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421689, "uuid": "105750c2-5a2b-434e-84ba-679be59f067a", "comment": "Malware payload (SnakeKeylogger)", "value": "4cf676b3b8de4cb561acd7ddffeb5e7c7f7f853df8727b42380553d7a88138a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421689, "uuid": "b233601a-689c-4c5b-b03d-c9bb5b7673ed", "comment": "Malware payload (SnakeKeylogger)", "value": "58608bd6ab2906cfeb0c2da806a6e1b419c1637f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421689, "uuid": "4325091b-3a9e-4877-9f88-13c55545fa2a", "comment": "Malware payload (SnakeKeylogger)", "value": "abd2102efc79f7ea66e7d9c8a404ddc829a3b08096a55e2385a3e018c1a9d54da4d67d491c8edd3af35093520af15b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421689, "uuid": "4642ebbb-610d-4b31-8e35-3868abdef68a", "value": "T19AC4AD8537707962F4AE32BD050A57CECB38BC462016F1272B26368552B37BF775E462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421689, "uuid": "2bcc15ce-75e6-451f-b95b-712278a3492e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421689, "uuid": "b2a29651-f2e0-40e4-87d8-137109601fda", "value": "12288:xsofrtV8bdvmZipfrdwpcQtHZFEap0Py504QGgHeUjE:lfrHIdvGkrvQnFOaOHGgHzjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680421689, "uuid": "3f1dd657-f2c8-43a4-b62b-5489c4586879", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680421689, "uuid": "1e9057f0-1810-4ff6-968d-a6321b1a6c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421689, "uuid": "38f2e413-b6e9-48c6-a30c-4e16eafac3be", "value": "PO AFUNWA.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba79fb88-d12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680421696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421696, "uuid": "924a8724-39cd-42ed-a126-00a8b5c0ecd7", "comment": "Malware payload (SnakeKeylogger)", "value": "a9482c5392f5b1be43881252bd8f09ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421696, "uuid": "5030fb5a-d538-4cab-8ce6-92292118d2f6", "comment": "Malware payload (SnakeKeylogger)", "value": "4d2295b264de302082940248ee43c9ba5f9b55b280e8fbed3cb3117f9cb1ea62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421696, "uuid": "619c9c5a-cf88-4160-a2fb-d0c7a1b3d42f", "comment": "Malware payload (SnakeKeylogger)", "value": "d381898726abfe91acbb20b2e96a59f037a2219e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421696, "uuid": "11621c34-7382-47b1-8689-2202f0c406f2", "comment": "Malware payload (SnakeKeylogger)", "value": "1c959c94eafd7e0181b752667aa3e9e2d5fb740ce5ba6852818463950fbb2296f1b845346da100936070d1e278cf09b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421696, "uuid": "cd56386b-a968-47c3-b5cc-73cf9bd354e5", "value": "T19E54120967A4CC6BD08623730B7B23A797EAD158A4FE930B13601F6EFD336119E09765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421696, "uuid": "af153e13-70e1-4f10-b938-133e6cd608ad", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421696, "uuid": "89f49f8f-eb2e-4165-b639-f5a2646840d3", "value": "6144:vYa6Ncn79KlAJWSzTlQUOczT12UbDT8NTkKcdKfQFuC6Z0eXjWG:vY3k7EYWSz0czJ2cTRldSQFuCbwKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680421696, "uuid": "bc7937a1-4979-4803-83f8-64aa6f962b65", "value": 290441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680421696, "uuid": "59a6a941-ec11-4c8c-9dfa-796fcce55eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421696, "uuid": "6b0be0a3-1e7b-46ec-acb6-413aa9985b42", "value": "a9482c5392f5b1be43881252bd8f09ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24fa1fe-d182-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680459532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459532, "uuid": "3ecfd7fa-25f5-400d-aeb7-19c941e5e268", "comment": "Malware payload", "value": "19fcec4fff3578883a596e66633314b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459532, "uuid": "2bd5988f-7a12-419f-aa13-9e8e1b06953f", "comment": "Malware payload", "value": "4fa4c613edd0f15f94eb99f39760688311f31c5ae59c74caabeae2426f03822e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459532, "uuid": "0778ea86-0f04-4bfa-a661-0ef2c9404f78", "comment": "Malware payload", "value": "f9abc4032630cd6ced5cf3fa947d8d32cd0b79ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680459532, "uuid": "09ccd5a9-e185-4109-84ab-47b6738a9e4e", "comment": "Malware payload", "value": "68d43839e931fa30f0519d6b97e9ca1c41ea147671d647577a8782f7dc612af58d61fd7afcc5ac2890a2bc6d898d640b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459532, "uuid": "c80eb4f9-1197-4a71-baf8-1e195383ad77", "value": "T16352B54BEBA2CD3AC4D197341687D670A1B398B09F21A32B150153BA3A317C94F2F747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459532, "uuid": "10e23d82-a471-43eb-8801-5412099c2418", "value": "192:GK1UW9TeN3ld5wK6SasbQUqVivyrJ4TlZXztnwAF50Zht4XoWqHpDDyr5Si:MNPNassUqIvyrJ4TlZXzNw8SZ0XoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680459532, "uuid": "2feaa5bf-62ef-4441-9f06-3db3275c298f", "value": 14392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680459532, "uuid": "02546b65-b5d3-4e23-a600-35b92239ec29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680459532, "uuid": "485ee46f-dd7d-4dc8-b856-e967a46b5268", "value": "ldap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e7e88a-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680395779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395779, "uuid": "62474f2a-4712-4a12-b7d5-29a7199ad2e3", "comment": "Malware payload (Amadey)", "value": "b27b89b27b109e38cbf776096847b093", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395779, "uuid": "10dd1003-4a30-4b32-9573-614495602523", "comment": "Malware payload (Amadey)", "value": "50a0861f4047703d375540921f53dfb1dcb1074232f1c511ebbd71f2aa7aed18", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395779, "uuid": "18ced3ca-c499-4f4f-bab8-4f4a0f3669b8", "comment": "Malware payload (Amadey)", "value": "d22ae194c0244a5791171972b4e17e03b65a74e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395779, "uuid": "3b57354d-4520-4036-931e-59aec3d54f83", "comment": "Malware payload (Amadey)", "value": "d7e6e6570ba60811e4223c466fd0839b6161c43123642afb418cabefa30a39c3b976ea45305424d6a6c5af131dcb9693", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395779, "uuid": "200b09af-a9e9-4fca-8522-c26351f43fde", "value": "T1A8346D0263E06871E5225A328F2FC3F43E1EB8525E357F9A2E477ABF0676161D162F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395779, "uuid": "36d1ecb0-ac36-4c62-88ce-d1f1f65e2b7e", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395779, "uuid": "c6f9c058-e536-404a-a7df-f2e09210e437", "value": "3072:GJJDU1vWfVXwAU+nxmQWkAdqFHHdIc+1Ue8xspacogXuSWrz37xJFHc2:j1+dtU+nB9dd+1UVKCgXdYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395779, "uuid": "ae2d0290-3ce0-4672-8582-50d0ae546a63", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395779, "uuid": "08b45557-277a-407f-abfb-6a3f247c4e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395779, "uuid": "97cf2ca8-b729-473a-86ef-c7bc65828d4a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdfd78a-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450394, "uuid": "0ab8ca46-2b99-4fd3-b53c-6b8c26b8ad1b", "comment": "Malware payload", "value": "65a1b5cbbf714de9496b0666ab2b4383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450394, "uuid": "4b952b89-c126-437e-828b-eac6553f3a56", "comment": "Malware payload", "value": "524ccbd2a7c6ef7c65ac7451641f1de0f2bddd60e39708fa5cd643d926b6cfab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450394, "uuid": "281a49cb-f24a-4ba8-b91f-9ca495fd3104", "comment": "Malware payload", "value": "e6d4ef2dc9c9374bacd712f5ad2918bd9cad8ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450394, "uuid": "c5956434-198d-439d-94c6-5d843fbf93d0", "comment": "Malware payload", "value": "0d3ea3c9dc39c0ef0ed8c96a112bd9d0e78461d3f7acb1fea80d7e030bd21448fb912eafc658ac592ddf19607d4e8a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450394, "uuid": "2d4c268b-0bc5-423d-aec4-68341a948ba0", "value": "T16D3633C076D59839EA2C0E709D0FC1B42579BE056D285F460AFE7F7F0A785A5E27230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450394, "uuid": "15d704cf-76ac-46be-be55-3e170ae95177", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450394, "uuid": "e6652abe-1455-45c7-8138-abac123e4fa2", "value": "98304:ibV8xuuRIGDKYY9DI5FkpoGutgrNhmv4Uwb5z6yFlnMYUt:iCxuAKd9DoSp5hmvtk6WNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450394, "uuid": "267e3c7a-ec65-48e9-9657-dccf0a68e23e", "value": 4948480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450394, "uuid": "d6d7f52e-d0b7-4f8b-af0e-ff15c8219f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450394, "uuid": "32e6499e-e29a-4b33-8070-733677adc07f", "value": "SecuriteInfo.com.W32.Kryptik.HKJI.tr.17729.14403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e29e76-d171-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680452105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680452105, "uuid": "4187957d-5394-490f-89fe-2b2ac34447c6", "comment": "Malware payload", "value": "85b8270ea892901994a35719afe40e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680452105, "uuid": "ae6faf3e-46f2-4860-ba70-90141a9f8d2a", "comment": "Malware payload", "value": "52e798a8040650a15e1fddd293a8091930cdab85550da07273198de890f56b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680452105, "uuid": "ebe896bc-9c08-4e2c-888f-0ae78f1103c9", "comment": "Malware payload", "value": "53273b885d907c7a8dd962686a29bad5e59421b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680452105, "uuid": "027c267e-e079-49d5-b3a9-0897f69e1b3d", "comment": "Malware payload", "value": "eb2de6db4cf372b9cc62df464624c9cc4ee37830d6ad47176817d7bcef5339d8fe488b1e1632057b7745eae5ca9cb8e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680452105, "uuid": "424c6d02-42c7-42de-b92e-359b314dbe89", "value": "T1C025BF01F643A0F2FA87357820BBBE3F9725A51457265ED3C3D02D57E5123F12A7A0AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680452105, "uuid": "a675fce8-b5f8-4f94-a6c1-2b34af5aa3b6", "value": "5047801ed1877e0cd5cb9c2ecec3de36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680452105, "uuid": "522b446f-ac3c-41d7-98d9-de01669a6ee7", "value": "24576:CdZjSZHElaTW2tcigdXqSNLmTLeDQYEd2AcsQ:gBHj76E6vekYns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680452105, "uuid": "93d0d12d-c393-40e4-b9b3-299ad9982d7c", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680452105, "uuid": "75b266f4-5913-4e8b-8f2b-b34be0ba481e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680452105, "uuid": "bc292928-83f8-4bf0-a684-f9d62ffff987", "value": "devldr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907507a5-d165-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680446966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680446966, "uuid": "f402d2eb-105f-4fae-a5d8-b8673f199e39", "comment": "Malware payload (AsyncRAT)", "value": "c589c1c86fb29930db0936c4f0ffc1bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680446966, "uuid": "37a207a4-d0fc-4706-91ff-b762fb92b025", "comment": "Malware payload (AsyncRAT)", "value": "53fbad53e7cc585776dab505bc37883c9ae455092439f2e8b310668bfe195139", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680446966, "uuid": "4106dbb3-f8e9-4825-b81d-41eb5432cd1a", "comment": "Malware payload (AsyncRAT)", "value": "f20ea69360571f2aed37f546bebbb70427f294f9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680446966, "uuid": "2ba07ec5-503d-416d-a313-eac5e1fa690a", "comment": "Malware payload (AsyncRAT)", "value": "94ac9b738877aa89c6dda2e1f686f9063342a34388f80b12429ce12fb7248d9f8617b3a64eaea664ca48349f2379e855", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680446966, "uuid": "60cde4b4-27e1-4c1a-bed2-6aa7e5ed4a7d", "value": "T112235D0037E8C13AE2FD4774ADF3A1058275D6672903C7996DC464EA2B13BC596136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680446966, "uuid": "c011fa1d-c761-4c8f-be38-a7e3a362aa4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680446966, "uuid": "bf6a4290-922f-4e57-8427-d4926e1ee2d7", "value": "768:wq+s3pUtDILNCCa+DikFZdgrcqis+8YbLge1StffUOdvEgK/J3ZVc6KN:wq+AGtQOkirUzb0wGxnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680446966, "uuid": "1c73db29-b59a-4753-97ed-f8371ea47779", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680446966, "uuid": "74478ddf-b167-41cb-b411-a95a54810644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680446966, "uuid": "d7f07ef4-fdd4-47bb-a9c3-e8379c178b55", "value": "xdORVzTqLoQp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a26948-d13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680430816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430816, "uuid": "80c76699-e5a7-4c85-a846-420b1deeb9d3", "comment": "Malware payload (Stealc)", "value": "1638ee87d285ee17b7f8f5f42dc7fcd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430816, "uuid": "5c2521ee-4ddd-40fa-861f-5518a03f3851", "comment": "Malware payload (Stealc)", "value": "54ed2290fd82e95f25beba1a1de081081dd9f61d39051a3fca5489532379088a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430816, "uuid": "08753a10-5e67-4179-b892-e2a71772ff23", "comment": "Malware payload (Stealc)", "value": "88e6bac7a04c2011300fd34358d882773e3e4883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430816, "uuid": "1050756f-3b1b-491a-9d6d-ee7ffc9dbf16", "comment": "Malware payload (Stealc)", "value": "94a771120e73e6683e18281af5529dc8f85c179fdcc0a17f963210f2700a1d8be7d36abc7192fea748dfbed8fc1ee344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430816, "uuid": "21d48619-3fee-4054-9ee3-258b32b0013d", "value": "T17C858209F1C4DEB0C789513A334DC969E198BE712E16E956FBD2B35F0A340EAA10F716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430816, "uuid": "56d623aa-b03c-4245-a3cb-52f7233c793a", "value": "b9d8bc68a5ea557813e8092a59732cab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430816, "uuid": "5923b765-57e2-47f8-ad76-b848ec5b81d0", "value": "24576:oX0aU/1vm5X61PoWQvZte1YcWbTS/BGiNf:CO5mE1PKZtjbTSpPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680430816, "uuid": "d89b3589-2739-4c34-81dc-caafab3cd520", "value": 1714112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680430816, "uuid": "e753eb2b-dc22-4b18-9605-ea395d6d851b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430816, "uuid": "ca1a88bf-4851-460d-b7a1-ca1fcc43a834", "value": "1638ee87d285ee17b7f8f5f42dc7fcd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74e6831-d18a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680463003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680463003, "uuid": "530ef5b8-8d1b-4270-ad05-24db31e09f8d", "comment": "Malware payload (Mirai)", "value": "3acb51d3c2d3284172058931c17d8218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680463003, "uuid": "d8a3765a-4c51-4c07-8088-19dac7baf95c", "comment": "Malware payload (Mirai)", "value": "55850d890f80ee21123e7a3a79c82f82b88067dbe8741eb6368509b772e5dbd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680463003, "uuid": "a287a541-71b2-4f9d-9a77-56bf8ba43edc", "comment": "Malware payload (Mirai)", "value": "ba703a07c26c5a168c2c4f70db20cfe3d1ed9da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680463003, "uuid": "ac79442b-a428-4150-bef7-8993654103f6", "comment": "Malware payload (Mirai)", "value": "d46ac8b20b742da943fbb23d02bcfb3ac692aa967a6878bba1feca7809ddcdf339b1aabffb524fdb4455fc6bddbb7956", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680463003, "uuid": "bb8c9718-f697-4e7b-bee7-5aedbf7c6344", "value": "T1F5133BC4D883DAF6DD1105B134B3AB729A76F17A203DFE93D7ACA532A901501E2073AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680463003, "uuid": "e3549f50-13b0-4df7-b29e-a28eafbe5f52", "value": "768:3MuozdZ4Bi8ec5VT5qoWfJviWPv3K3hEtdrfuKC4AiuRlSA:3MuozT4Bi875x5qo4KgLFCXFlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680463003, "uuid": "df8458b5-123c-4bea-b703-717625cf9332", "value": 41560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680463003, "uuid": "c90892ac-acee-4813-ab89-11007b872370", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680463003, "uuid": "f0939120-2d95-4bf0-825d-fce558945318", "value": "owari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78153a42-d15d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680443489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443489, "uuid": "d0b047b1-7e84-4e31-b420-6289abb1645a", "comment": "Malware payload (RedLineStealer)", "value": "43cd163dde26b9e2b8fa01e4d532d098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443489, "uuid": "d6055aee-5d6c-4a32-8237-180fd8e453d3", "comment": "Malware payload (RedLineStealer)", "value": "5595c56f4f6ee983a5d70eefe383e4b1ada955bf4ba1e95e5f279756e6b2cd01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443489, "uuid": "94aa92a6-9a4d-4e8c-a574-e3ed05e5f825", "comment": "Malware payload (RedLineStealer)", "value": "c17c6002fc59ea420b8b4e5a178b3ded0774da00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443489, "uuid": "2103a7b1-7dee-406d-9ad8-4d4c2c6784e7", "comment": "Malware payload (RedLineStealer)", "value": "12a231e802871e270a2302c796fa358380993e8c9962fa64706f93c6ed3c340633accb73de49a8efbdd43c33f979eb16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443489, "uuid": "4d5d07e8-611f-4064-aa82-e4bb05f246ff", "value": "T1C5542A03F10493B2DDB062BF49A7B539AC3532260793A48F7A4F2586C76F97A245C5BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443489, "uuid": "4800570a-c4f4-419a-b9ff-1fdc2b039fd2", "value": "748856617c99ed4a3fc59c5565f7792f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443489, "uuid": "19ef0e36-2889-4bce-9a6e-ae2663eb5763", "value": "3072:p7tNHaQFoYnYlyyNQWoY+Agx+lUWCbk6lZBFxSB95WhgQvunEUr5bt4SrfxV:dtNHbCYnYgWL0+aWCbk63Bvo6rvuEUnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680443489, "uuid": "3c81ede2-7a3b-45f0-9731-f264110e9cba", "value": 281864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680443489, "uuid": "df8c945b-dd79-4f2c-b162-835b3b89c576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443489, "uuid": "e183b18d-0523-4034-83b3-e2b6b8006b1b", "value": "en_xachinaproject_fun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be40b64d-d13a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680428574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428574, "uuid": "d884fbb5-9c9b-455a-b7c7-664860db2676", "comment": "Malware payload", "value": "422e2658c130115d29f3d34bfd8baef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428574, "uuid": "27f6d215-369e-4968-bffa-c8ce45ea3b8f", "comment": "Malware payload", "value": "55a882d3e119f17163a14f13175f7903a6321da1ac565b7e120d0db59b2b394e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428574, "uuid": "fcf60a5a-7cb1-4c31-a8da-50d4bc3a9128", "comment": "Malware payload", "value": "8829edce182336fdb7ad4d5791c4dd031e756494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428574, "uuid": "0b3c9ab8-ae76-486a-884c-5394466bd467", "comment": "Malware payload", "value": "dc9ab5c325d8618c6c4f52c59d9400cd90c1409280d7330cb4385631a7f4e15f674fbf6dbbc2aea74d1e078110dd57ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428574, "uuid": "c3b4355d-3200-497b-921a-cee6dafc7661", "value": "T1DF26333C385F281DCDD72E321E23993EEB8EB29D0BA3D9299E7D716763096934138544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428574, "uuid": "d18d3d83-b010-4d9a-a369-63e70954bc1b", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428574, "uuid": "45e82cc0-e6bc-43eb-9e63-c0588f603715", "value": "98304:JOrfO2hYm8SmMtSVA0GWZ2XRwKfP+XlufA8y5GAYl:JOrGMgbZYx3+VIZyMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680428574, "uuid": "12d5d67e-ee9f-4685-959e-16ce0718c0e3", "value": 4512256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680428574, "uuid": "2146d109-9c2a-4528-9d85-2a5ffc157ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428574, "uuid": "443ee1e9-ffa8-41b9-a1e3-0edd790a5cc8", "value": "DefendUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16db937-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456551, "uuid": "cf88c36b-5f2f-4ab6-9442-80307c3e7849", "comment": "Malware payload (Mirai)", "value": "e8775518cebfc4a24f04745c43c464bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456551, "uuid": "dae7a17d-c95f-421e-93ba-e0706502c4f4", "comment": "Malware payload (Mirai)", "value": "5622fa3cd15daa0d4eeea31576b210baf8697b731f72adf13e227dfee8abdfd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456551, "uuid": "0eb7d83a-fb40-4cb7-abdb-d8ca67173762", "comment": "Malware payload (Mirai)", "value": "9236b97a78a127eb8dd51d06f63b2f80e3bc3773", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456551, "uuid": "ee292b5a-6b58-4280-aab7-bd9e3433cc20", "comment": "Malware payload (Mirai)", "value": "5185983c9a6ea800215d6bcb68f2a59f2468d4e28c73aa23d1dbfb949a5b710bb2b54b06d21cda688d49b85a06055a95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456551, "uuid": "7b891207-e2d5-466b-b0d0-1b2ef0b9052e", "value": "T132C34B46EB418B03C4D617B6BAAF42493323E754D3DB330699186FB43F86B6E4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456551, "uuid": "4872ab20-883f-43cd-a090-963ab4789314", "value": "3072:n4Qt8A0stiM9odgWh3JliVRxIBjB8bH3bWM/9EHx/:4Q+A0stQa85liVRx0jQH3iM/9EHx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456551, "uuid": "40f30ae5-e729-4b9e-88d8-0693165f44f8", "value": 120883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456551, "uuid": "245533ff-a8bf-4ece-9ba4-2afc3171ec3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456551, "uuid": "555a92f1-c74d-493a-a684-4ff9937bb944", "value": "e8775518cebfc4a24f04745c43c464bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0466dc67-d12d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680422679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422679, "uuid": "8bfc7aa9-c83f-4c6f-8202-9edc54fe0fdd", "comment": "Malware payload (Smoke Loader)", "value": "32ed8839ca889c10b54006e325eacbf9", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422679, "uuid": "78fb75b3-4e1e-48b6-b432-bbe8b2304c8e", "comment": "Malware payload (Smoke Loader)", "value": "56abf041e401d3f3015c0c9c581642291da84263763da4bb2328c28d1d4da07a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422679, "uuid": "779f149b-da6f-40c9-8650-ca7dac997d06", "comment": "Malware payload (Smoke Loader)", "value": "ae497678431ef8aa90978a3fc95c5445e832a2e4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422679, "uuid": "48a0c255-e429-4da9-9188-97b0bc01b388", "comment": "Malware payload (Smoke Loader)", "value": "50107fab55d57b997108e80d555ee6e414aafc2367f47e847823dbb57a7d62d7ac6073f0b1dbc292c2f97c5c45a76490", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422679, "uuid": "93c0f034-54e3-46ec-93df-fd5d09135039", "value": "T1AD646C4247E46830E63F57328F2EC3F5261EBC629F197F9A1679BABF05340A1D522711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422679, "uuid": "fe91e6f3-95b3-4f57-b080-00e67cb12143", "value": "b7ed7acef08b08a4e6cd3f03e874595b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422679, "uuid": "93d02a4c-6b7b-4415-b0d0-4088c8c50771", "value": "3072:oJQ/wy+fortGiLnZpsfclhyxPP64fIxzJatBlAbq+XQGBXVEP:nd+gJaOyM4fuJCBu1gA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422679, "uuid": "f589a518-fa80-4a70-9ab9-df4ea5b66eb5", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422679, "uuid": "574311f9-1731-4347-afd8-8b9536fc2668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422679, "uuid": "4b893840-4244-4d22-a2bd-4c15d6847a64", "value": "32ed8839ca889c10b54006e325eacbf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826fb3a3-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450378, "uuid": "e0e33250-9265-4438-9fd0-e1272877c18b", "comment": "Malware payload", "value": "5e49a07242867d4a6537a6dc174eec18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450378, "uuid": "0baa995e-834d-48e9-a1af-8dcc8d4fc1bb", "comment": "Malware payload", "value": "57176d94be5bf89a2f4f9baf1f87198791b00d8f49b22ed015360ddfd1642721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450378, "uuid": "34447533-11df-4bcf-97f1-7d9708e0d87e", "comment": "Malware payload", "value": "99c57743eae3e7ac1abad767420b8f6db1a40e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450378, "uuid": "cc42680f-83f7-4fd9-a13d-1db58c3d4475", "comment": "Malware payload", "value": "904e8fe661784a0eae6e53db9559d8e0401e7ac3bea7e906669f6d4076ff89a58c0867dca1af122c80e3b3f514cc761a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450378, "uuid": "144e7cde-db41-4f6f-a7ca-a157f83bf802", "value": "T165D59CF8311AC54DD0E08D3B2ADBE575F0397D5C283C8BDE19803B1A35F2BB29A16965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450378, "uuid": "add98f80-0b87-4abb-b55e-961d809f25be", "value": "4914e7de4b47f81a08d3f7e71b120465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450378, "uuid": "f2739af0-1451-4556-9b94-ea0478a7f248", "value": "49152:kT6iHTQyHR5b2sGFCDJu3QdU8a0zqtLcUVRJyDTPZtjh9k:sTQ+sau3FQUVvyJVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450378, "uuid": "580e646c-b438-4da3-a9f6-e53ee3b74e6b", "value": 2823072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450378, "uuid": "ea81c67f-9432-4cef-b6ff-86c046090796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450378, "uuid": "15f36a04-d993-49bf-95eb-87c57935e59b", "value": "SecuriteInfo.com.Trojan.Click3.30871.7221.6274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1e722e-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680396355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396355, "uuid": "c2199be0-3d5a-4b56-bb07-2f9ab8ac2c14", "comment": "Malware payload (Smoke Loader)", "value": "b472079763289a1a0f1d936a1c051167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396355, "uuid": "b17eaeb7-9bfc-4ca8-abf4-2f368fe8aed0", "comment": "Malware payload (Smoke Loader)", "value": "57829febf39ecb18c05698bf9731d1b747c0f05d8208a7742a973ae2cfb339fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396355, "uuid": "d53bc2ce-dfef-46ab-8134-926ca07a00b7", "comment": "Malware payload (Smoke Loader)", "value": "5cead0f3a46947bfdd707df491c51a9a5c658890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396355, "uuid": "d87901b5-bc2d-47c1-87c0-21c0ae8217f0", "comment": "Malware payload (Smoke Loader)", "value": "5c327c1632f5180b8d6a1c309a44d6ca639535c3f7756722eeab096d97628c1510a13ccbbd4f52c0a5ec4115cf926604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396355, "uuid": "c7161ebb-fc9c-4eeb-8b21-12157711eace", "value": "T1D7345C0262E06871E2225B328E2FC2F43A1EBC525D357F9A1A5BFE7F0975172D161F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396355, "uuid": "5bbb41d6-32e3-4944-9137-4d39b137ca91", "value": "cbd684b5c2d7ad7fbf4a9d5a3ed4fb3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396355, "uuid": "7ad21c93-f907-4919-9dba-9cf37333e8a5", "value": "3072:yV/9uZMhK/KzqUBNy90fZLF6F810Kn4GEoxoyBB1r1Q8jCDaY0eWHca:Q+mKiGUB+gn7Duj0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396355, "uuid": "a9c4434b-5bc4-4095-8e10-8c3128c455be", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396355, "uuid": "5a43500f-d666-4014-b6dd-443001d55ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396355, "uuid": "41849d24-3598-4647-824f-9c8c683e087a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac29e1fd-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680422531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422531, "uuid": "2e9ec150-4dbb-4620-bd4f-ce8fe899ee57", "comment": "Malware payload (RemcosRAT)", "value": "13ac6c14ff93c838960a60b64681c838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422531, "uuid": "16f9d1b2-9f2b-4282-bb4f-d069039170ee", "comment": "Malware payload (RemcosRAT)", "value": "587b6cfa2c17da4ee0468dbcc1bfe438acaec0c8bae49961e1eaac5c9b889c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422531, "uuid": "dd0b009f-2e17-4a6c-ac94-664d862b7ee5", "comment": "Malware payload (RemcosRAT)", "value": "14cc962c3e5b58209a712b30bd246dbb29e5c8e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422531, "uuid": "5f1e6a69-6466-49f0-a2dd-05f63056a767", "comment": "Malware payload (RemcosRAT)", "value": "145fe363535e5d5d179fc4e9a58c2ad3bc7c4441b9c43dda039bfd54ca1566e16c67dd0f8375ccfa9d51e36a38f59e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422531, "uuid": "a357b459-0360-4e94-9ac5-c45bd7c71074", "value": "T1C374D62277A090D6F2EEFEF3D8A31204D9B5B45A5901EE0D4844348E98FD774ED136AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422531, "uuid": "7aac2a25-9f2e-4d0e-81ff-8cfcff919982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422531, "uuid": "b86717ef-d603-4263-997b-6b5982d71c34", "value": "6144:NH/N6rs0uRlQB1wIViLDCBJztWr1jTV6E+LJAvZG9nvGc:FN/Rdj3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422531, "uuid": "17174b27-dd41-4805-8dd1-c5b9b52d639f", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422531, "uuid": "dfa60e14-1166-4940-af42-8870afe8ba74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422531, "uuid": "988cd1f3-6aff-4f48-bbc2-c055d1eecae4", "value": "Solicitud de oferta (Universidad hispanoamericana) EUI894 - CRR633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9be7790-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680422634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422634, "uuid": "b218f2a1-7c56-45e4-804f-3878cd7e1dae", "comment": "Malware payload (Socelars)", "value": "a5977cd99e079810f0e47d9dab195b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422634, "uuid": "d46b1ef2-24e1-4352-95de-1c89e1adfb57", "comment": "Malware payload (Socelars)", "value": "5af3e8c539cdb221ad65abc96ff87b98e3723a82acdbe26a4a9f0acf23720605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422634, "uuid": "bdfc0812-b4a0-4560-a641-331287bdffdb", "comment": "Malware payload (Socelars)", "value": "b1919a146634101f08166950438eb903672754bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422634, "uuid": "404a0cb0-85af-4cdf-aeac-efdd6962f410", "comment": "Malware payload (Socelars)", "value": "71be8a9750760f6bffbe79981098166d50b5f205db4dbcdfc55af8ca3e261afa34ab7c4a9f073a21d67328aa16dfa048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422634, "uuid": "1ea9435a-fe17-4566-9d28-cc4ff623e62a", "value": "T116658D21F7C26032E8E310B745FF66BE8D2C6E11470894D7D3C82D999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422634, "uuid": "9472ed1b-6015-41e0-abd3-2f523fd94907", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422634, "uuid": "d2472acc-8587-4e92-904b-3af37d00d844", "value": "24576:hGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRLQ5hUSe:UpEUIvU0N9jkpjweXt7705m/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422634, "uuid": "db6eda75-bb71-4052-bf74-71cfa3985649", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422634, "uuid": "78ae104b-a0d2-4044-ad5f-ca156a6025f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422634, "uuid": "a425f657-e522-4177-81ad-9eb466f468a9", "value": "a5977cd99e079810f0e47d9dab195b65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca061631-d152-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680438902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680438902, "uuid": "eab1190d-2710-46cc-8002-0d6923fb65f7", "comment": "Malware payload (DanaBot)", "value": "57eaf5a62708c5aefc653870f1e5ecdc", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680438902, "uuid": "1b825ddc-11fb-4e4c-955d-3cc2654171a5", "comment": "Malware payload (DanaBot)", "value": "5db1bfae28fbc78d8fe77c4299ee6ccbb064d4c0270a6db87345e914c7c7a94c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680438902, "uuid": "47975d0c-f428-4be3-82bf-de7d0d424171", "comment": "Malware payload (DanaBot)", "value": "24363df1f9df3bdee2d137caa8ebf76070bb7afe", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680438902, "uuid": "3b63db5b-6958-4cdd-a155-4c4b757fc3a5", "comment": "Malware payload (DanaBot)", "value": "6244574285ac8b2596aea0fea24872f728e7a43ab7af46daa4af9ddd47fc8f3f62495a8133562c984ff5d3cf75991f61", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680438902, "uuid": "3d9037af-1502-4764-b6a5-b93bce52d2c0", "value": "T1D23633165188B451F62D4F368F2EC7F1251EBC925FA63F9B2270BABF01B4562E912F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680438902, "uuid": "a982875b-f74d-4f0e-84d9-27ef51a35bd1", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680438902, "uuid": "af22552d-3c71-4fae-a54e-0f383ea13a49", "value": "98304:Or/xk7L2M47rlXulzglRXb1LwBIF2ns17BzCBdTHoXdnP:ObxML2NrlXeRIF+wUUnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680438902, "uuid": "31e33aee-4729-4c80-9690-2323295e643b", "value": 4948480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680438902, "uuid": "afefc0e3-5e42-4f9b-9e8e-bc38e32a48e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680438902, "uuid": "d3e55f50-93c4-4f62-a0bc-532f8ed91c21", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1Y731WE.6634.26302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844c58ef-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450381, "uuid": "dbfe1afd-7de0-4f2d-b697-86d4f335263b", "comment": "Malware payload", "value": "8d69707a4ed7068c6b1d74af8b59a149", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450381, "uuid": "df77c6f5-503f-42d4-b228-1683e423cea9", "comment": "Malware payload", "value": "5dbf4253cee61fcf7972897c40f2d846a2ddb5e04cff52e1e2a96a3f0049db1a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450381, "uuid": "230d074d-6eae-44a1-8187-ac7285b63513", "comment": "Malware payload", "value": "8c84001d2d9babf1a0b79d2bbbc1042f1cab4605", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450381, "uuid": "1a61b7f6-355d-4afa-a6cd-8dd88d297392", "comment": "Malware payload", "value": "5114ee0cee91bce5d4102a4a96e7bc993ae8c045c4f519e2544d2bc36a015047777e0fbf615c63883f9c27709fc72780", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450381, "uuid": "e507bea1-cd43-44fd-9da2-4f7a1763992d", "value": "T137C68D1133E88A3AE1FB4B35A87692115AFBF9615B32C70F754D262E1F727408E21763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450381, "uuid": "2ab7e252-3f36-429e-a2f7-e722248edc8f", "value": "196608:dGtt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:dQ8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450381, "uuid": "5be787d9-1738-4b73-b5bd-c1ede307e4d3", "value": 11545245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450381, "uuid": "d6523a50-a466-4117-a6b9-d366323815f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450381, "uuid": "26b62547-e352-44e3-aafd-e5a425a8c10d", "value": "SecuriteInfo.com.Heur.18137.1949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63d192a-d0ec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680395141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395141, "uuid": "f8de46f5-84c1-4957-aa81-02b07f55aec3", "comment": "Malware payload", "value": "d50186a6fddedc1f0524f196b9086687", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395141, "uuid": "28cd8771-afe9-4a40-a29e-9a778d45c8fb", "comment": "Malware payload", "value": "6036d11d610f4ca7e2cf19bee3610de2e868d7382dedd8d331428f774bd9dc66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395141, "uuid": "337a417e-ad82-446f-8f38-5a606dba1f76", "comment": "Malware payload", "value": "b99b58dedb737832915c4fe762ff98e157cf7891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395141, "uuid": "17207793-f544-4920-a7df-eeb46740969e", "comment": "Malware payload", "value": "f849df4d116e938add614aab5a5a04e87d6b40cd941c90937e400f001c948b04054fb0e9d6a130e0088a7703cd87f1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395141, "uuid": "613e2e16-3b1f-4e4b-9a76-599bef888fa8", "value": "T1CAB4E7405FFB4A57F5ED2776B47408959AFDE82EEAEBE32F00012DD50F5AB8448413A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395141, "uuid": "29144773-dd22-4db0-b4dc-96584cf5a380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395141, "uuid": "c47f3ee0-67f3-4fc9-b4ab-61feb0557b13", "value": "12288:MYUP5lsa0jCAN52YrRWVAYzhtzlvyN695R:MHP3oWANHNWWOtzlvys95R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395141, "uuid": "b74c5338-b75b-4a34-aaeb-e51752088962", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395141, "uuid": "ac3547c0-b700-40e2-b855-ee3497fa1ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395141, "uuid": "91e7d8af-3581-4801-aa01-5fc26569d9ec", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0923f24-d137-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680427343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427343, "uuid": "86a42d00-eb76-494b-9b89-e011b9d79756", "comment": "Malware payload (RedLineStealer)", "value": "5505566d972e0071d10de09af76392c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427343, "uuid": "b1d69b41-1857-4471-991e-04cdd9dba6dc", "comment": "Malware payload (RedLineStealer)", "value": "6071c2e180975e0c9dd5c39699b9c681deca9de83a6ecdb13a625567663bb497", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427343, "uuid": "19c7cae1-0cb4-416c-b5bc-3e161cf71d20", "comment": "Malware payload (RedLineStealer)", "value": "f55b9014093d418324e958ab5a311beb358a077d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680427343, "uuid": "4b12cd93-8190-4eed-968b-02e0e67d2eac", "comment": "Malware payload (RedLineStealer)", "value": "600c471e5d89b01de8dee5384dfc80590dfc5b8a1c6f7b9b0abf9ff0b5688aaa0953b7d4c00fdc5215809b10a0daf7cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680427343, "uuid": "d2d5462f-6bf2-4b0a-b492-8af22f7b74d2", "value": "T13325220253D84031DE3653B149F303870B357CA05E79A3963BD9A96F4EB27E8A47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680427343, "uuid": "a1b25cee-0742-47b3-8fec-a7a7eb82f6a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680427343, "uuid": "e595f6d9-3524-4b0b-b551-3d79126fcd22", "value": "24576:AyY/YDNFmxmxFPN/pV/F2k5lK7y+QrXK:HzDNcxmHftUOOytD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680427343, "uuid": "84e1918f-02ef-40b6-a0ee-954f0416a91c", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680427343, "uuid": "760ad7ed-0f6f-4d65-9f58-1f3aa60d04dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680427343, "uuid": "6c7825ab-652d-49d3-b356-534ba0502134", "value": "5505566d972e0071d10de09af76392c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684c6529-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450334, "uuid": "9e5c3257-5723-46bc-97ce-b3fdaedad8ac", "comment": "Malware payload", "value": "5fa68bb0b00a5291f3403b2becfa034c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450334, "uuid": "bbc4dab1-c54e-4e4a-8357-6f962a0ef8a7", "comment": "Malware payload", "value": "61dc186048cccd9eaff669bd08bee3426b39fe1954dcdccc2bb3d43792592dcf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450334, "uuid": "1803224f-bb90-4cb6-ba1d-1bd2f4ce52e3", "comment": "Malware payload", "value": "ad44919b6d32c7227acb58a328af1eb54d53e27e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450334, "uuid": "7b057409-02ff-4b4d-ba51-639ae25c576a", "comment": "Malware payload", "value": "1072f69c498897123ad6d223361241795a782748fca46bcb103dd221c5b42859917ec7da48da66833a9def501decdfa9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450334, "uuid": "2b5c76f4-61f2-498e-8b93-5a1b8538ade0", "value": "T1A8A6AE1133E88A3AE2BF4B35A875911156FBF9225722DB0F758D162F1F727408E217A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450334, "uuid": "3b961f92-b500-40de-8dea-2d6537d21a9b", "value": "68d1a5fd762d0aa37c2154530da9c160", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450334, "uuid": "c2e5056e-e48e-479b-a83b-e00fa5160868", "value": "196608:ftt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:l8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450334, "uuid": "1034ee0b-7a9b-4e3a-a7b4-d657ea11f1c3", "value": 10357789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450334, "uuid": "47c00848-ec2b-4d80-9421-e05d8cce7d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450334, "uuid": "fb91a16b-1309-4083-bd64-65ce99989512", "value": "SecuriteInfo.com.Heur.15325.27732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ba3a13-d0f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680398361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398361, "uuid": "b8ffefbc-e8a0-4335-ad57-17c55b39c09e", "comment": "Malware payload (Smoke Loader)", "value": "ac8eeb869e99023a345aa45080632e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398361, "uuid": "11b23d12-0fad-44b6-95f1-4dd6051f166b", "comment": "Malware payload (Smoke Loader)", "value": "63375fadaa1a111bd4655c03b272e3505bd1cba473b5004b85c962f40f9f2c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398361, "uuid": "c4f9caac-77f6-4246-a9e6-1862b818761b", "comment": "Malware payload (Smoke Loader)", "value": "166a4009e726688cc08fe602341558581b1d2cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398361, "uuid": "f18674a8-5764-4ee0-92c7-c01d6d6949e4", "comment": "Malware payload (Smoke Loader)", "value": "c1e98c43560d26fc40a4186b8d94d46d5b0cce9d220b66c3888cd96142ca483d85e2c87b0048866c1f74e916a55e4be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398361, "uuid": "803a60ef-80cd-479b-b6eb-ea7c9ab827a0", "value": "T128345C02A3E46874E712473BCE2EC7F42A1EB8719E55FFDE36496A2F09B01A1D162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398361, "uuid": "058cbe4f-6f59-44b7-b03e-ac16249fbcc8", "value": "95bc20777b27de7eca3c1140e79c380b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398361, "uuid": "0124fa5b-9feb-4803-ba54-9b7f714cba63", "value": "3072:hnMvqwl/hqb8nAXu4vSzMb7SSmeu3tJUAkjNhOxZyLXPsT4IFHu/iYulzFp:eJ6tXu4vSzGAkBh0ZaPYOif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680398361, "uuid": "79d899ec-3adc-4540-9f54-d44de7829b8c", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680398361, "uuid": "e548f078-6452-4a5d-abfb-486171f2a878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398361, "uuid": "401a324f-27f1-4b1b-bace-aa89fe1e11ed", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfbf804-d128-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680420680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420680, "uuid": "87049610-d6a0-49a9-84f2-f58ae4f230cc", "comment": "Malware payload (Vidar)", "value": "1f0bd8dad5c7d6e33df065910e42f16c", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420680, "uuid": "c8aff63f-e373-464a-8a7c-edf82450a67f", "comment": "Malware payload (Vidar)", "value": "6539c30f02fe8e92c6f66c8aacab4bb7dc10d7509db597fc883805b158c5ed18", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420680, "uuid": "594b8c56-5875-4d1a-9771-1d6a151b44f4", "comment": "Malware payload (Vidar)", "value": "b062cfb8689245f8f776769fb30b4fb7f4166823", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420680, "uuid": "b77446fe-4879-43d9-beed-68c69460ec1a", "comment": "Malware payload (Vidar)", "value": "fe4af463d6db4a7c18bed5a2b121ef3228b30a8dba8f2358daff28ee3a2dc5bf83204abd2250869d1595ebe1963844b1", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420680, "uuid": "fe1a1a4d-fe4f-467a-a319-a074fca35891", "value": "T1F4B6D89C766072DFC85BD472DEA82DA8FA5074BB831F4213902715ADAE4D997CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420680, "uuid": "d94384e8-9afb-45f7-babc-52c8625958db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420680, "uuid": "820373ff-decf-4ba3-804d-377e571d6285", "value": "98304:AsEgsAhlmmj1H9dJNdRyNdBOT2bY7Kc8W4IVkut38nHURnZxx3OKd1S5a9RKcooz:7llbmmhnJNCfvWemZXOs11Olpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680420680, "uuid": "a731b883-69bf-4c26-8efb-f8bee9557c70", "value": 10981376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680420680, "uuid": "2b79d3fd-0d65-4896-a629-5321819c49be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420680, "uuid": "e4e18a4d-3c50-4ab3-82f6-dd5f13715202", "value": "1f0bd8dad5c7d6e33df065910e42f16c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7008432-d192-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680466412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466412, "uuid": "de8b3f6b-7d48-4e9c-b31d-d9d7ea5bca72", "comment": "Malware payload", "value": "3d953c1834009aba36a19b678fd96eca", "object_relation": "md5", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466412, "uuid": "4ae4bf15-e5d4-4bb5-80db-8434833eea73", "comment": "Malware payload", "value": "653b690864742246d27d5a217a69e216478dd0ddd8ce7a86d996e87642bba19c", "object_relation": "sha256", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466412, "uuid": "23a8af0a-eab8-4ebf-816b-bf9dab9b89b4", "comment": "Malware payload", "value": "dc748463e4f276082730ff37990873fcef9a351c", "object_relation": "sha1", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680466412, "uuid": "27fbfb9d-a6d4-4930-a83d-1bed8457f865", "comment": "Malware payload", "value": "96cd9ffea7b0f881cb26c235d95e6e58166fcb57b86465e66b15541aa19e6ebf0233de8e82682ebf82f9f9c80a3cc43a", "object_relation": "sha3-384", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466412, "uuid": "1382dd01-1d65-48e9-9be8-f941f409faf6", "value": "T1D713628C765075DFC89BC876DEA81C60EA60B47B430BD343A46726AD9A4C69BCF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466412, "uuid": "d5663fc5-52c2-4743-9f46-bdb2e30ede85", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466412, "uuid": "752daef7-a3bf-49d7-b2f8-c3bb57c7e9a9", "value": "768:HTqHK8gD399LQ7ir2PvyOt/VZtpYSzjmaNpd80Pl+:H2HKtD3j4vh/tCSzKwq0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680466412, "uuid": "ad25f81a-206b-4740-9059-e47e99013ecc", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680466412, "uuid": "7413d253-5c11-4815-8c5d-4d72c51127df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680466412, "uuid": "f1110554-b28e-42ff-95bf-c9cc2ca616fe", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1ee95e-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680422529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422529, "uuid": "3bfa8d97-d352-4ebd-b56f-1ded7bca1d39", "comment": "Malware payload (RemcosRAT)", "value": "c3aeb8c4e95455bdb8e1f68ce3e7e929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422529, "uuid": "206ed677-0eb0-4c2b-886a-9906e484c154", "comment": "Malware payload (RemcosRAT)", "value": "6760ae6bf21620a631a5fd3c6d56a01080be0fa127db8322ec2eb87ce17728e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422529, "uuid": "210e9e1e-73e0-4c12-a7b1-0d3181511f68", "comment": "Malware payload (RemcosRAT)", "value": "a10e8965659d1f0062ed2b6227d3cc6759cbd62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422529, "uuid": "e23b63ba-6756-4e76-802f-da1dbaab9944", "comment": "Malware payload (RemcosRAT)", "value": "d512863f52ca5e89424e52cb29b89cc450ebc31c0bc04b45d46828e0e13b658a72fbde2f76c4d6c313ed16e876e819a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422529, "uuid": "e13c9698-c6f6-4456-83d9-82db183386a0", "value": "T13115E0823774B562F8AD32BD051A53CECF78B0822016E02B6B27799152D37BF765F162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422529, "uuid": "251ca945-46c1-4671-a631-bc2da8e9c219", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422529, "uuid": "3115e91d-ffc8-41e0-95fd-1848a9d4a393", "value": "24576:huXqkoF40j3KgIM7AcofotrjEkpaAS+t:huahj3cM7Towtrja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422529, "uuid": "91487dfb-4d9d-49c3-9096-6c391bc632d8", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422529, "uuid": "e8dac6de-b9c9-4cff-9536-9bb57c55ccac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422529, "uuid": "ba8e9c9e-6a78-422f-ad11-a1822fd7a65b", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75206e86-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450356, "uuid": "5a5702b5-fee5-4cba-a7a9-b0155742c3f4", "comment": "Malware payload", "value": "d1cf94b70261ae305229366304775e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450356, "uuid": "4b653432-10ec-47c4-a31a-d9aece751f59", "comment": "Malware payload", "value": "686b360f8915e097c660689427939dc24796265b30aee447d66287d982a29283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450356, "uuid": "49b8f6a9-ea0b-481f-b69f-8b1a59cd62c1", "comment": "Malware payload", "value": "aeec7cd3a4b847750f6556f02287ac62a2a468eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450356, "uuid": "de52e1dd-78f3-4038-b799-f721a339cf08", "comment": "Malware payload", "value": "7aa75cc662dae56fa487bc5a65a7ba4131ba37b10f5ebbba07b04b1b4ed1d7aabca14b440d56e2c79f1bee9307d6c3d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450356, "uuid": "cc2cc252-4e65-43ec-8ea4-042d32a96d5c", "value": "T128F48C15F9D0D952C03DB83EF892576AD6A2A42C9C42AF8F7B5B038D0C36FA49C5605F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450356, "uuid": "2e777338-e929-4e6a-a66a-0ac84b1963c2", "value": "064f35439a181be0288853445e7025c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450356, "uuid": "d3834e78-3285-401b-bc46-f24e105d0653", "value": "6144:e65dA78alDIEnaqaqpblD3wTW7Xe4Ohp6u9urP7omhoYkWMw4Nve9j9IRqqDLu6c:yU5qpbh3wTWr8hUkQsW3XJIsqnu62VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450356, "uuid": "6d54f157-5a4f-4aaa-b326-c9e5d013400a", "value": 756202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450356, "uuid": "9be581a7-d7bf-49c8-9bea-c6b5c3e03269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450356, "uuid": "582f80b3-6c27-4848-b9b7-6b16662f543f", "value": "SecuriteInfo.com.Win32.Malware-gen.32641.31894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ecf38e-d129-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680420991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420991, "uuid": "fcca2106-dc4b-4fba-b7d3-9aa78ab8df21", "comment": "Malware payload (CryptBot)", "value": "7937b144b975d32b71f237e999433895", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420991, "uuid": "5801d388-529d-4454-878c-78ada7535e15", "comment": "Malware payload (CryptBot)", "value": "69733cfa5d9577338754f0828a9f970cc5e941a60e30c4a7045a20bab8da1bb2", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420991, "uuid": "06fa135c-c819-4217-bb93-b86e8aa7e55c", "comment": "Malware payload (CryptBot)", "value": "faa391e0e80e0aa1bde41a8a9e55e617aa87a3a8", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420991, "uuid": "f84cb6a3-57d4-4509-9e7c-b44344d50a01", "comment": "Malware payload (CryptBot)", "value": "80ed07ddf00fa6dcba11dc9c581322cfdaf6900c74e26d57018c72f6b37dba257217396c0f73413d116d8e1dfa5b0b7e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420991, "uuid": "d3928279-d49a-4c18-89c1-55e136398777", "value": "T1F9A3D646BB16CA1ECC650EF264934A060F31C2C704A6D7861D9E9CC56E33BD53A9D3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420991, "uuid": "9e183689-124c-45b4-9828-5dfd507f71f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420991, "uuid": "9d59cd79-3860-4d5f-b95d-47428a2c62f2", "value": "1536:J3REPYv6ai/LGDXVchRx3qKYRPP11z5Jj4QOOtCTQ1ID1PxY3hBq:Fqwv6ai/LGDlERxatX1h5JDtCc1IVxGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680420991, "uuid": "e26d8f73-ae61-4b67-813c-b2bee44532fe", "value": 103976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680420991, "uuid": "271cedba-4240-4679-8b45-88385a41d73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420991, "uuid": "9ee1f168-00b9-46a1-a17c-2479a697b46e", "value": "7937b144b975d32b71f237e999433895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ad217c-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680422522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422522, "uuid": "56484395-12af-4876-adb7-7b0ebedafa12", "comment": "Malware payload (WSHRAT)", "value": "3c707a7b93f50858c1d0f550e75bf37b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422522, "uuid": "dadd7843-ee1d-40b0-91ed-4dcde14f49e6", "comment": "Malware payload (WSHRAT)", "value": "6a777b549217c374615a6a26c7181fbef94ff5d239b8e1986074ed7c93d62338", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422522, "uuid": "399ef86e-8523-420a-ac80-a58dc5415af4", "comment": "Malware payload (WSHRAT)", "value": "f613234ed9aaabbebbb3518d38e68c1ffad1a2f4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422522, "uuid": "19d5de39-42ca-421f-81d8-83205fd0e531", "comment": "Malware payload (WSHRAT)", "value": "965bdaa84c1e29f23ac49b297c5c53c74e31d26d76cc1ef65501e8877a4a5539f2dc34a1406fb865e2d9110ddf6b8333", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422522, "uuid": "e282fa47-87c5-41b9-9cd6-946b3a29f9b6", "value": "T1F13441123E47F93C154F2D0066382E7A0F8DFE61C619A51A26496FBD83BB58C07BF919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422522, "uuid": "db766020-1d60-4e1c-bf0a-ec4976560fdc", "value": "384:6r11tNILKL/QO3BaQ1F1kxTgW0ejBHTYjp4SMo3q7p7O8zF7C741ZYc8COT737Kn:s1xfxtjfG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422522, "uuid": "cf399787-a030-472e-acff-0964940f9c7c", "value": 243610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422522, "uuid": "9c1df6a6-c854-4139-a6d7-9f86cd0610b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422522, "uuid": "bb2cc141-cc45-452f-9b1a-a264a53fa487", "value": "ORDER_230401.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0e17e6-d16b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1680449594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449594, "uuid": "80186c39-326a-44f8-afda-fe8f58ba0637", "comment": "Malware payload (Gh0stRAT)", "value": "44f50973ac66fd83be9411d6ab53446f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449594, "uuid": "3ad2e1d0-f2d2-470c-9209-a6db3d27501c", "comment": "Malware payload (Gh0stRAT)", "value": "6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449594, "uuid": "c6f3f122-1a5d-4832-a564-ec5691de0434", "comment": "Malware payload (Gh0stRAT)", "value": "6660ac4bf320699b43776f0d3f96c2b1cab104d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449594, "uuid": "fba2eb19-eee3-49d5-80a6-68db00e3dc6d", "comment": "Malware payload (Gh0stRAT)", "value": "5fcddebc1394c812cff31bd52ffb1ae671a8c7dc962857466bd0b6d114b07155019a8b6d275b45689e0b90ae4c791ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449594, "uuid": "75559a0e-ca91-42cc-aa73-4abef47eed59", "value": "T1DB4533C6E2CC9534D96EA27C7D4770037718B966FC2AC71B2408E388083D67BAEF9565", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449594, "uuid": "265288bd-0d45-43a0-8624-db08304f4494", "value": "73ec795c6c369c6ce2c3b4c3f6477daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449594, "uuid": "a15c39e6-10e8-496f-8c40-b37b1def565d", "value": "24576:uyDoTqctaY5effnW8RDsXOvvYh1BKy7ILN7qxx+HP288pu3WPs2/:uwoTpE/WwDIngzRqI8p0R2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680449594, "uuid": "1fa2e418-4c3e-4c7d-a7ee-a97d0fcc3028", "value": 1245755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680449594, "uuid": "69f49065-0762-4138-a851-7fe006537cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449594, "uuid": "6ea27e44-bcb0-43a6-8751-3a5fe00fcbe5", "value": "44f50973ac66fd83be9411d6ab53446f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8febc7-d0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680395529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395529, "uuid": "a8c54104-09ef-47c6-9ee6-cc150071caa3", "comment": "Malware payload (TeamBot)", "value": "16cd3fbd41f28459c172d2442415a86b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395529, "uuid": "925bbe27-8eb0-46fb-b718-3b486e6d3743", "comment": "Malware payload (TeamBot)", "value": "6c1046a34336ada9e1b8ed73d721a4fca2382dbe52fdc0d84a2cbcd885a806a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395529, "uuid": "d5c29fee-9e18-4f9e-894a-3fbef9656a14", "comment": "Malware payload (TeamBot)", "value": "826348fc3cedbd4fce0f1cb93c6762f190e38267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395529, "uuid": "d48a3e7e-cd37-4cac-b0fe-faef60accb8b", "comment": "Malware payload (TeamBot)", "value": "db318b316131a4245387154bd0a7c561a104dfca1dedfb59775fc0c1f168df73fcfa01c0f6a813c3db2fb643731657fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395529, "uuid": "4cd98884-aa03-4919-8394-6e5d3a1261ab", "value": "T175346C4263E06871E22247728F2FC2F4361EB8525E35BF5A2E4B7ABF09B0171D162F55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395529, "uuid": "d2b93e2f-fe25-40f1-9f1b-360421935df5", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395529, "uuid": "8d6d07e6-a9d8-47be-b61b-26219422a708", "value": "3072:2SWT6tYblX3/H+ZMm1WeVSrThHk2DXh/83aFOC61ut3ex/nvWmk7Hcf:Reh/H+ZMnDXXYhIt3q/nu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395529, "uuid": "fca2f3ee-df1c-445c-8ceb-344ef3e39106", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395529, "uuid": "4532bf2a-2d3d-43bf-8276-4724d43c18a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395529, "uuid": "e1522418-2332-4ea6-bff1-100ee30dba24", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f23b6e-d129-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680421120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421120, "uuid": "b5bbafc3-08e8-406b-8bf8-76a4df2bbc6d", "comment": "Malware payload (RedLineStealer)", "value": "918f47d6f70fa2b90008d4defe44f555", "object_relation": "md5", "Tag": [ { "name": "918f47d6f70fa2b90008d4defe44f555", "colour": "#3D9595", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421120, "uuid": "23bbac23-cd61-4f76-9aeb-8995a2716c0b", "comment": "Malware payload (RedLineStealer)", "value": "6f17df45dd876aaedc0551c4acd7f22d26195fecff94c86aa38f68a823e4ed1b", "object_relation": "sha256", "Tag": [ { "name": "918f47d6f70fa2b90008d4defe44f555", "colour": "#3D9595", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421120, "uuid": "3222829a-70d1-425a-b5a9-bf16ff26260e", "comment": "Malware payload (RedLineStealer)", "value": "00bdb4cc61c9e97d807540ac4a23cc00b675060b", "object_relation": "sha1", "Tag": [ { "name": "918f47d6f70fa2b90008d4defe44f555", "colour": "#3D9595", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421120, "uuid": "e00f490a-e543-42ec-965a-ff0d6f883e62", "comment": "Malware payload (RedLineStealer)", "value": "bf57cb50ffdeb2d0596e793c8a62f91e0dc915f6e59903f6ee420b410a763745cf50fab1d8b2b0f12021d605dff8149f", "object_relation": "sha3-384", "Tag": [ { "name": "918f47d6f70fa2b90008d4defe44f555", "colour": "#3D9595", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421120, "uuid": "f7e42eec-929c-4aa5-8ee4-25f49e5e2e14", "value": "T106852302BBC1C972D46319365A786B21A879FD201FA9CFDBA3D42A1EDD715C0C6317A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421120, "uuid": "7a1a56fb-695a-4124-b703-06eb4c54efcd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421120, "uuid": "46af93b5-fb3a-418f-bd17-517fbf209920", "value": "49152:IBJA6GP52zZM8mCK6aK4gGRvZmfYE/ClJwFQ:yMP4zZM8hK6aK4gs4iw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680421120, "uuid": "8e453c76-b7f6-4bf5-a4e1-59eab40d2566", "value": 1765519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680421120, "uuid": "5c4fec53-d560-4de8-8303-5ce2c3ea2441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421120, "uuid": "b86680d9-c7b9-46a0-bcf3-6012d8956428", "value": "918f47d6f70fa2b90008d4defe44f555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa273f6-d0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680396499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396499, "uuid": "34e099e6-ad2a-438a-993d-e3660fee8ba8", "comment": "Malware payload (Smoke Loader)", "value": "19a7864c82e9e554d7e74a78e1678a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396499, "uuid": "c66be009-7855-46d7-a21c-24d909fb8a40", "comment": "Malware payload (Smoke Loader)", "value": "7031b866659a0a3071215ca0ecb8efeb02e825064dc9b6d3c8bbaf6d4f236ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396499, "uuid": "c3458c28-5c0c-496e-9472-ccd06a598b1f", "comment": "Malware payload (Smoke Loader)", "value": "589414b8d69c728c8cd10ff7c9a16314f32f5769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396499, "uuid": "69bee001-8df9-4c42-b9ab-83b13d83763b", "comment": "Malware payload (Smoke Loader)", "value": "25d86cf13ea9dad9e792bc938416ac8acf60ed896f31ec7c86d45a9830f9b68eba3666edb569b57b8a19fd80c4c5cb19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396499, "uuid": "037d55d2-87dc-45a6-9ce9-a220f1244c52", "value": "T1DC24CF2276A1D4B2C45B49B00471DBB06ABD78317BA185FB376A077FCE302F16A39356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396499, "uuid": "beb0bfeb-7c59-4d3c-8520-7f95fc14fd4a", "value": "724f7af50306908b18449bf42724cf5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396499, "uuid": "c933e503-439f-495f-ab01-40c635d737b0", "value": "3072:82NyFFKsI1NuFZNwLePCqQvuBg9ZdOzj5gN:3+K7uLN5PgGKAiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396499, "uuid": "6c020f0c-a364-4bf6-8bc6-613e282e8364", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396499, "uuid": "6c207873-7f26-4352-b954-3c61a9446d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396499, "uuid": "9235fc98-97df-4494-8a2c-50c6da9b8912", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bf0715-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680396455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396455, "uuid": "3d799d94-2b3c-4ac2-a2d3-1c471907d37d", "comment": "Malware payload (Smoke Loader)", "value": "945e69f3541d88d8eec6890ce682f879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396455, "uuid": "01f454ff-f572-46cb-9489-796cd65b9b2f", "comment": "Malware payload (Smoke Loader)", "value": "746a246d8d4028900502566f7a121bb6c801fa8442d7544c712d58a1790993e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396455, "uuid": "44ca081f-544f-403d-ac34-72852f7ef464", "comment": "Malware payload (Smoke Loader)", "value": "c01fc0ae42cf94ff6f4e3499235e2d68a35141a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396455, "uuid": "b039a035-77cb-441a-b606-6a99206ed1ae", "comment": "Malware payload (Smoke Loader)", "value": "9cf08ab7639e08438e75b303c676f411d8fc853818b2645cb02b0dc60181ad39229d380453779d41fce7f62b1b0e552a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396455, "uuid": "4a31cbf7-dd9c-4e09-ab8a-1cb91b608513", "value": "T13024D021F6A0C0F6C42B04751824DAB86B7DB8316BA642C7735C3B7F1E316E19A7A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396455, "uuid": "9f84ef93-44fb-4199-a72a-b885b6e2c910", "value": "724f7af50306908b18449bf42724cf5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396455, "uuid": "e26052d8-35d2-4714-bf21-964926a30a4b", "value": "3072:yyCye96wHpN9ikz0s8Em+yOwVS0t+9mkYR/fOqvwlNgFmWNj5g8UGdd7j:ep6I9Vz0tE1iS/mbR/ZwlNs0sd7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396455, "uuid": "292026d6-5f64-4806-8b6d-f3e19ab46229", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396455, "uuid": "eb56273a-01e3-4670-9f6a-607f8135f0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396455, "uuid": "8e626929-517c-4155-8a0a-9cd2f00219ed", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dd9f9b-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680448040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448040, "uuid": "e41a046c-c19d-47a3-90a7-7fe6764523f0", "comment": "Malware payload (njrat)", "value": "be1a2f6f1e570df2f2cc2d60652c58cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448040, "uuid": "be61151a-f5dc-42f8-8541-14b728c0cc4f", "comment": "Malware payload (njrat)", "value": "7641cfd408654206057d2f5d5af9579e28714c4d4dd92359550cebdf3c70c562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448040, "uuid": "3cbf4fb3-eef1-4a86-a3da-087b5d19dbe1", "comment": "Malware payload (njrat)", "value": "5b582744ce1fe3e25240fcbfb1170316712feea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448040, "uuid": "a21b08ad-62d0-4aa8-9b19-ea1bb81afb71", "comment": "Malware payload (njrat)", "value": "ddff96be1f49e717c17785640a633a1e8478b103ef86f678ed012dd6da65bcc3292685fc77ebdcdd55982d62f4ee0219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448040, "uuid": "a6863a43-78a0-4bcf-8b8d-e44d30796d45", "value": "T1B7E207067BE94215C2BC2AFC8CB313114772E3438172EB6F5CDC98DA4B676D40656EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448040, "uuid": "4b49fa57-9ada-46e0-a5c8-e2936d54538a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448040, "uuid": "69a6528c-b065-470d-9c52-c21c0ea93353", "value": "384:C0bUe5XB4e0XGOnjHdqlzkB8N/uWTHtTUFQqzFYrObb3f:bT9BuVrdKTybv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448040, "uuid": "45e437c9-fc7b-4882-9994-4b1302da4dd8", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448040, "uuid": "3cd4b4b7-b81a-4f01-83da-1891130cda99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448040, "uuid": "a52cbeed-77f1-4055-a4d3-47b9aa426be1", "value": "bLhH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9c3b6a-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680395928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395928, "uuid": "e932814e-9c7e-4a10-8e28-2f695062094c", "comment": "Malware payload (Smoke Loader)", "value": "67ee64431d8375db35048cc7416f283c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395928, "uuid": "2424a116-d32e-4a41-a8b1-1b5e21c3b4ff", "comment": "Malware payload (Smoke Loader)", "value": "76f2c560339aa08f67968ff5ff675e52c1be7c654a803096fa078af9878af467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395928, "uuid": "08c0a022-df38-4ed6-9514-92901067f537", "comment": "Malware payload (Smoke Loader)", "value": "7eadfaecb6a9b468aee95bf7e68adec84f0854bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395928, "uuid": "a7677d6b-84b9-40d0-a56c-2bf23fb6e906", "comment": "Malware payload (Smoke Loader)", "value": "11d7cd55ac4dd233e2963fad438ee4bc94a72e3964c6d4489fa7087e35aaa9459dd818c402c8fcaf9da2732268b03710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395928, "uuid": "8d10ade6-6faf-4f17-b742-96451d90c966", "value": "T17F345B0253E06861E1225A328E2FC3F43A1EBC529E357F9E1E5B7A7F19702B1D162F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395928, "uuid": "1e5dd812-def4-4264-9f34-47305a93ac83", "value": "44e37c428947afcbabc1447e2f3a149e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395928, "uuid": "ba233990-0d1d-47d6-89b4-e6915e8d02bf", "value": "3072:J6QhUuRQ/2K84x1NZGwReoKwBn0NAPf3309jxh9EQTdOnCCfu76sHcn:7Ra64fioH0NwH0jVTZCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395928, "uuid": "a89867a7-1e9a-454b-871c-a7ff8fba1b07", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395928, "uuid": "e18dec8e-3d94-4ba6-a56c-f45fc4917880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395928, "uuid": "35bedf3d-4ec2-4325-8f6d-1c25da1d6485", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d55771-d0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680397314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397314, "uuid": "0ea3ea08-0703-4909-b91a-9e3d18217c42", "comment": "Malware payload (RedLineStealer)", "value": "94ca2cd6b4c3e4673d5341b2fc824f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397314, "uuid": "1f36a803-f0ad-4cb4-92b3-9826b1248486", "comment": "Malware payload (RedLineStealer)", "value": "798f0fb03c8b5bdbc66f9e76ca53d7955a700358372aecd512433a48e67569ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397314, "uuid": "9ca8e8ef-1b45-4e1f-9860-33ed2aa0d178", "comment": "Malware payload (RedLineStealer)", "value": "14a20248874f227549148a9931708a1ebb40a9a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397314, "uuid": "e763966b-687a-48ee-bf20-dcbffdfc25f3", "comment": "Malware payload (RedLineStealer)", "value": "fce2096381019c819787f543712332b1f970c77a9ca76ca6fa98ce5e3a62ff423e304884978d300697cdff69ef062354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397314, "uuid": "e8e46c14-5d19-4c23-a811-75ea5fbe6ea1", "value": "T19E252342BBC99273C8A61BB058F6078705397DD18EBC837B1AD60D5D0D726E4A0737AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397314, "uuid": "bd2e33bd-b100-4c8d-a080-55d5f337489b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397314, "uuid": "4aa901fb-36fb-47a5-b4f8-1af1a9d90ffa", "value": "24576:iy5Lkscs/xiSqSwUtvl22Th0PhATUhnw6m+i:J5lcs/QEtvl2eh0PhAT8nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397314, "uuid": "d7122ddc-332f-41e1-b420-4eb279132a1c", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397314, "uuid": "0396c799-a738-4cc6-bb17-87fe62ac0a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397314, "uuid": "a2377685-b563-48ee-a5e0-b7c6d35064c2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad94299-d146-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680433562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433562, "uuid": "e173c159-fecd-4335-b99c-f565b7526e67", "comment": "Malware payload (AgentTesla)", "value": "580602f533ec1d304cfa8a4cde612456", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433562, "uuid": "9122067b-b37e-4f54-a024-4fef3c73fca8", "comment": "Malware payload (AgentTesla)", "value": "7a3fc9a413a6a1df187dd2aec1b0e8930462fc251a1547cbced4aa907437b1ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433562, "uuid": "7eb12038-917e-4934-9ab3-27271f205b87", "comment": "Malware payload (AgentTesla)", "value": "b0117998ca059d5f00c631f56f8c01e316a58ce5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433562, "uuid": "ec63940e-892d-4347-b3b0-8f269125ccaf", "comment": "Malware payload (AgentTesla)", "value": "ccfcfb84037bf8ee8f2ab90b9ed048b0735ab5ccd94a6e3883e6ba9be98ce5663c6e5f0f4190b904d538d0d1108425ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680433562, "uuid": "7591167c-afc5-484b-825a-a25955912670", "value": "T1F4B4231D182ABBA674D0E9A2724B05B108F6F1C4E659B50E6AB5F8E32304D1B34E5D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680433562, "uuid": "a9f8ad33-52e5-4d51-bb11-f6d518115df2", "value": "12288:0Q/WBHsHs39599NZKbw0soQQpf5KwQ+3s7bjPCh+Q:0Qg3959rj0spSRKwQWybjPCh+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680433562, "uuid": "8357da10-7742-41d4-adc5-ab77970cb4aa", "value": 495284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680433562, "uuid": "261a4b76-ccee-4008-b82b-e06230cf034b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680433562, "uuid": "79c852b7-25be-46e1-9d77-f1ddad94c492", "value": "Payment Swift USD45,000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640569f8-d15c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680443026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443026, "uuid": "3d107689-cc26-41b7-9013-040a4af0e56b", "comment": "Malware payload (AgentTesla)", "value": "b68d2d763d668c02198d3e7b9790d643", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443026, "uuid": "a4396ecd-e0ba-4039-8960-95dce0873a7d", "comment": "Malware payload (AgentTesla)", "value": "7be800543004524d306ac5da65ba76133ccec42616a06a75de21e8b958693993", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443026, "uuid": "870f856a-0520-45b1-bd72-a3b40d7fddbf", "comment": "Malware payload (AgentTesla)", "value": "ac65465f888c83f1ad1697e111273b144d9d6635", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443026, "uuid": "ad0d0ee0-d02b-44bd-9be1-b30c6b30bd9d", "comment": "Malware payload (AgentTesla)", "value": "5da0cb91eccf77e7648898e6ec8f23aefc34bf3b627a056c80798db890e92ee9dc1fc46a3717e30032b85ea72b645ac1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443026, "uuid": "56972b49-a69f-4d5d-9ce0-6a64cd299dfb", "value": "T18575BFB209C9FFD29EEB2C70DC6A32080C485C7B5368D895F98CA66B51F4958ED5CCB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443026, "uuid": "7db98510-30d6-4a43-8f92-aadbf746ce2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443026, "uuid": "098277f7-33e4-40cd-9b80-c9f79934a81d", "value": "24576:br/NMFJMwNTEVSNaDxIefc3Gz/WMbQ6SlAd4HkcUR6Ds5ogeXkC9i8DNnQCIjyx7:baxTf6wlA+PVkCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680443026, "uuid": "d2c2a4d8-5415-4f9b-b678-136958335c3a", "value": 1600000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680443026, "uuid": "dd2f3abe-d651-4d2d-921e-6fb653137191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443026, "uuid": "97efbd6f-48e0-4d98-8d00-b96caf1e34ed", "value": "DETAILS AND INVOICE .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fc5223-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450332, "uuid": "97dc3ab2-92d1-4506-88e9-d7204b5575b8", "comment": "Malware payload", "value": "88456780bbdb79f303286d8283048247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450332, "uuid": "955a5d0f-2046-4b84-a682-b89780343325", "comment": "Malware payload", "value": "7e574a5a664ca46b7b3ccac03655553e3bab5033b435aa5bbb12dfb80adab21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450332, "uuid": "881ca953-cece-4175-ab21-df748a3dbd75", "comment": "Malware payload", "value": "3a4de37d37418dbf4c2e371104af71daa53ac965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450332, "uuid": "8fce568c-5dd6-4325-858c-ecf31fc425ff", "comment": "Malware payload", "value": "a0229cb457f440c0839e0e3a1b134a2b65bbe31a9b43bebb258c64fbcc3a56ead74d246ae320ff08f5fc4e5a5d2743ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450332, "uuid": "a1bcad76-271c-44c7-a847-06f6333bb77d", "value": "T10C55F1CEF8B48912D00E0E3304BE7B55E9765921DC36867B6BC86B0F18F36517A22C76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450332, "uuid": "e596782a-c570-4a6f-b503-9433b0a10cd7", "value": "c519475e15ed02991a4a2a6bea17e253", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450332, "uuid": "e447d6dc-7ca3-4c3d-96a9-6b027f5df5c9", "value": "24576:pxnjyFdHg6ZEUEYGnqSNK8WbxXO6TftfhkRn6vAm3/2AZF3AvKM:zjyFdHUlxM8WlO6Tjk1KAm3/lZF2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450332, "uuid": "d7410d3d-21d1-48c7-9176-2bd2768a4396", "value": 1372549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450332, "uuid": "8cf5140f-d770-4147-97a0-902eb8910040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450332, "uuid": "6daa700c-f032-48dd-9cf4-612e03eefc82", "value": "SecuriteInfo.com.Win32.Trojan.Agent.NYGZ5W.17363.7868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72edbe7c-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450352, "uuid": "8c891589-733a-41f8-adc7-bfdc2ff52554", "comment": "Malware payload", "value": "027264f63967cc689de35c34b3720cba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450352, "uuid": "6a3d47ed-4b7b-42c4-b1d8-a9038a710b2f", "comment": "Malware payload", "value": "7f0c64d88ed943e27084c9650d96b5a69e5bd19f50abd5fa68d662711909f3e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450352, "uuid": "32344fba-76b8-4ef1-a83b-60ffc78e7ebc", "comment": "Malware payload", "value": "d3e053437ea8488bdfc2517fd51e22c0b64199bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450352, "uuid": "b4787f40-6d56-4d36-aa06-141bfaf90c5c", "comment": "Malware payload", "value": "ae04a1bfde25733a07b54b94cc7b0c6e55131eae13379e7cea2176b664d3e2929473ca5082e86a361be6a7b95a8757f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450352, "uuid": "609d59f9-e671-4225-995d-bb75c7a7ead5", "value": "T119E45A8AB6B1F43BC87E35309CC387B66622FE805D4AE717A9AC7E1D1C71A506D32057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450352, "uuid": "d7d55c0d-1ce4-49dd-9223-79fae09243cf", "value": "ab01ea2b4d17b83d0cf64ce5fad9346c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450352, "uuid": "eac32240-ae33-4d97-b098-7aeaf0bfcaf8", "value": "6144:LetGBPI0cVlvTDduu2usSanT9TUboMMMJFusO3/KbL:L+8fgLhtxsP3/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450352, "uuid": "a83cfae8-717a-4559-bf0d-d09e3bced3a4", "value": 699230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450352, "uuid": "c6f45551-6a63-464c-83f6-dca046a690c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450352, "uuid": "3300353f-d4a8-4adf-874a-6af14041ce26", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1354813.2224.24199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575f91ed-d150-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680437851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680437851, "uuid": "09a07977-647d-4939-969b-fdc2792e8635", "comment": "Malware payload (RecordBreaker)", "value": "8b4d096362f33380663f8d555ab4be9f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680437851, "uuid": "fbc38333-a10b-4820-b1cf-aba037767ecf", "comment": "Malware payload (RecordBreaker)", "value": "7ff1efed8113a193788dabac9d3cdc748ebc71cb1fb70c6cc8541673a4904645", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680437851, "uuid": "ee0a4667-1b4b-4ab8-a53f-9f62bc363496", "comment": "Malware payload (RecordBreaker)", "value": "8232a123cd8fe03c5b2905d7ba22045de062447e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680437851, "uuid": "909492a9-2f5f-408e-b281-5aaca1e24e58", "comment": "Malware payload (RecordBreaker)", "value": "4e6071d2055097297c6a6b8332f9e0339c7cc1f2c243ec1218ce25ce3af6be7bd3224536aa0ec456158c97a7a4774422", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680437851, "uuid": "2882fbd2-3653-4839-8ea8-60b808cbdeda", "value": "T1214533857E1C6E347F524784C138219B7C3BE90AE215109E7DD9289E1CFF7AB4BCA168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680437851, "uuid": "0661f25d-4f1a-4eed-81ab-2fe33c0e148e", "value": "24576:Fpg4cYhJqy6uo0inR3nzRBh6mFP2tGJnfz+7FtwplTRLTOFkkb7irkM9k:3g42O8hvFP2tGJi7TkBOFkqZck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680437851, "uuid": "17077492-9dd7-44b0-b3b1-c8b4ae407d69", "value": 1273694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680437851, "uuid": "5bf2302f-99ff-43e1-bbb7-677fe5ef7cd7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680437851, "uuid": "53cefe9f-4b9e-437e-9e09-0c30fbb9e6be", "value": "new_version2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a711666-d12d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680422904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422904, "uuid": "8c59dac0-3d86-426c-822a-db5849566a22", "comment": "Malware payload (AgentTesla)", "value": "6b086fd896d82d0707ac4fa29eee1569", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422904, "uuid": "37595f4e-6fac-4e92-81f8-685fb346cebc", "comment": "Malware payload (AgentTesla)", "value": "8065d7457588be9190ebc01cc9a6f42ba2e63eaeaa2157b6525f0a186548da00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422904, "uuid": "9066334b-ae94-488e-b7a6-e096cea57acf", "comment": "Malware payload (AgentTesla)", "value": "ef66a56b2910aaa72c91310151d93fe8a2ca9738", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422904, "uuid": "ec4e9639-6b2d-4b77-a552-ba556e0d7cbf", "comment": "Malware payload (AgentTesla)", "value": "5e9d437fab843594668a1cd88ed96965aa519143fdf19b6c57ba8302da6f2e6e3b1bbc15645d49284c1b92dffa1141a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422904, "uuid": "106fa393-e3d0-407a-bbd7-5763595eafdd", "value": "T17FE40114269DD10BC817C37E81E8C2F037B6CC99D291C7925EDDBDC7B38E7AA1A25096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422904, "uuid": "5777b81f-5b85-4b4d-ad8f-65751e03842f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422904, "uuid": "e9c91769-e898-4a34-bda0-dd9978403958", "value": "12288:a442y8kGK3yVAID28p4DJGOA9kHwC5ojE9cPPqyCDXZP8nwH0q+TXLOfsevimOMM:Qb3yVAYp4DS9qw/jE9cPi9Dt8nw2fOEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422904, "uuid": "40f7fe03-821e-49a2-85da-e6b7dd2770f9", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422904, "uuid": "1db084ca-bb18-4fcc-beaf-6db9715b362b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422904, "uuid": "56f2b7a6-3ca1-40cb-b53b-b8bfc0c3800f", "value": "Order PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eea6d35-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450399, "uuid": "74a22ba8-1034-4c8a-bb68-ab0b8fa0a909", "comment": "Malware payload", "value": "f53fcaddf383d99c37651fa07d8132d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450399, "uuid": "a8daafab-eaec-4572-a499-381d19dd99aa", "comment": "Malware payload", "value": "83509fd3d24e5600f13fc2789d6e03cbe9f47fac32a3a74a4392ecadd35e4db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450399, "uuid": "d6a6be85-fc61-4428-9f41-a1f10c903a20", "comment": "Malware payload", "value": "63464912ca6c5b2bea42ccc2b92dcc28082949e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450399, "uuid": "5ba04642-9d31-43c5-a7b4-72bc292846b6", "comment": "Malware payload", "value": "c343c6993e5b4f115cc754d381e1651546d254e349827acb7d019498e84200639c614a37dc1c3bc5e942c53f5a0a10ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450399, "uuid": "c1493a5b-f2fe-489c-ae47-ac788f104f3b", "value": "T1CCA6AE1133E88A3AE2BF4B35A875911156FBF9225722DB0F758D162F1F727408E217A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450399, "uuid": "d340d45b-b8b4-46c4-bf1c-341ac065e6c6", "value": "196608:3tt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:d8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450399, "uuid": "11c91d38-c73d-43d7-829e-32ed15207bd8", "value": 10337981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450399, "uuid": "a9d602a4-2140-402d-b3cf-ffa35930cf10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450399, "uuid": "2da4a843-3cb6-4641-92ab-d2273f6c6d59", "value": "SecuriteInfo.com.Heur.6881.28880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b118e39-d166-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680447306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447306, "uuid": "9abbc264-b9db-4266-817f-8d0b9fa48b4c", "comment": "Malware payload", "value": "784389b08b7a13b311e6815261bf4c06", "object_relation": "md5", "Tag": [ { "name": "784389b08b7a13b311e6815261bf4c06", "colour": "#5FFA47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447306, "uuid": "21edfa51-2008-4d24-91f3-138bd4ae1434", "comment": "Malware payload", "value": "837582f38344fdb66c0927ed1cc83924b90d160d0f524519501e183139e48c94", "object_relation": "sha256", "Tag": [ { "name": "784389b08b7a13b311e6815261bf4c06", "colour": "#5FFA47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447306, "uuid": "120c1f37-2f87-425b-a182-7b81b3130390", "comment": "Malware payload", "value": "4a45af5402b0af16ca2312fbed5af14aceebed69", "object_relation": "sha1", "Tag": [ { "name": "784389b08b7a13b311e6815261bf4c06", "colour": "#5FFA47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447306, "uuid": "4f94eb73-0875-4b1c-847b-befe66149992", "comment": "Malware payload", "value": "a7e356ef600d098654d34347b899dcc3ef653310aa2822d6eb1b6bf487c4dae2ec9f160c7b47e7520074bac8855f6184", "object_relation": "sha3-384", "Tag": [ { "name": "784389b08b7a13b311e6815261bf4c06", "colour": "#5FFA47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447306, "uuid": "91878e18-6951-4b39-9021-929db583e1a4", "value": "T1C6C6338A5CDB50E8ECC63A30D10B6BDB26F657E90DD0446D9CC1F4C295E2EA5E0BE427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447306, "uuid": "6db0690b-a640-4fea-ba10-50d0325e9b06", "value": "ff33eadca45c6385bfd8315e8bf376d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447306, "uuid": "e7e6bac1-4c59-49f6-8dd3-4de0b1128f8b", "value": "196608:j37uUXBBbMQ+hrEAkmJ7wqd/qsSk+CQVDHmDW3YyJcowjhIWRLfUk+/h/:+UXfb3++IKJsP+Hjcjhvy/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680447306, "uuid": "f5a0e5b0-df8f-4089-8cb3-6ac171d50a8f", "value": 12562104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680447306, "uuid": "d6daa2fa-c39f-4a80-b5b1-dae56a2fe213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447306, "uuid": "ec330005-5afe-4ed6-a1ee-d6c512d0c24b", "value": "784389b08b7a13b311e6815261bf4c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb82c98-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450340, "uuid": "c06ed397-a347-432c-a6aa-dbabf357e24e", "comment": "Malware payload", "value": "a39de794f1ba699d20424dfe88e03317", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450340, "uuid": "76a11342-5456-4cc5-aa21-5337dd13717b", "comment": "Malware payload", "value": "837b440949fc77add8605b039270d7c479f63b8d1e0e8a45c8da16d20858ba0f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450340, "uuid": "b03bd534-44cb-4577-bb3a-71205105291f", "comment": "Malware payload", "value": "bc8123fafa53ff3acb79fa4cb321f40b6237b04b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450340, "uuid": "ae6a66a4-081e-47d3-a628-860e752aa56f", "comment": "Malware payload", "value": "e8b44da2cfc83742dac4fafdf744dd9dbf74c426c339f78f678bbb7429509367d48e06eeb00bb08ddab7f99242c3763e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450340, "uuid": "c685cd0b-8bf0-4c75-b97e-b8656f39d406", "value": "T15B746CDEF8B18512D00D0E3344BE7B91D9765932DC7686BB6BD46B0E18F35827A22C72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450340, "uuid": "d6864b67-0f80-40bd-9433-be26c66e0478", "value": "469b1bae2575baede5bf1f06a01b4767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450340, "uuid": "206e5ef1-bb62-48b4-a80c-b38b176fb633", "value": "6144:SZ4yYoP30t7rDtTJRPw6azSFwHexzTF0JRPw9:SOU30t7vtTJKoxK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450340, "uuid": "98dd8b12-2391-46a9-93a2-bdac5e0c3483", "value": 352624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450340, "uuid": "f0635f78-e757-4c54-afec-ed1f70567468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450340, "uuid": "615eef21-2fd7-4f4f-aae9-b8eab4d6ea4c", "value": "SecuriteInfo.com.not-a-virus.RiskTool.Win32.IMEStartup.18509.9465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956b245b-d160-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680444827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680444827, "uuid": "32910a8c-cb4c-41a5-85e2-42d7db272b8c", "comment": "Malware payload (Gafgyt)", "value": "b3fefe0638fe6ec9379250b7828c13c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680444827, "uuid": "d49f379a-83b2-46c6-a070-652cea235350", "comment": "Malware payload (Gafgyt)", "value": "8437eb713086dda49d5e636f97bb100ca9c35d7a6f6b00d335f060bc2e9155bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680444827, "uuid": "3485df27-3740-4dfd-86e7-5b59b91460eb", "comment": "Malware payload (Gafgyt)", "value": "8acdd6917b5f3d742de9e30f083a585bfcb92450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680444827, "uuid": "8da15e46-ca23-41ae-93cd-356473f75257", "comment": "Malware payload (Gafgyt)", "value": "54830150fcf42c9f06be69f9f13f6984112bc4ab7ec0a5cc2b3769708c05f10c093d58f3943fe3b0b903564aefac2073", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680444827, "uuid": "cecd9dd9-ae24-410f-8458-d2b78d301754", "value": "T1ECB3C86A7A21AFFFD06986300BF7AE3097D421D626915387F15CE7581E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680444827, "uuid": "033230c0-8614-4980-8462-1c6d0c8af1fd", "value": "3072:7ExVvKY9cxN5hZXynGuExmkizF9GhsRiAe:o7SRN5hZXySxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680444827, "uuid": "3d3b6ae9-9ef4-4c18-9ecd-450894e015da", "value": 113835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680444827, "uuid": "5fa29509-018b-4703-b7be-d01767dd9643", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680444827, "uuid": "b6d3316f-2b75-492a-b90e-24b91198ea0f", "value": "b3fefe0638fe6ec9379250b7828c13c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d9208d-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680422420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422420, "uuid": "141b7e4c-6df6-4e3a-a83d-09baf484487c", "comment": "Malware payload (CryptBot)", "value": "139641caeeac43d0c18c4d59a55670d5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422420, "uuid": "33c8fff7-6e9d-45e5-938e-ac45099fe210", "comment": "Malware payload (CryptBot)", "value": "85821ba279517102d76a622bfe36b997eb1772cc6ec6d3b80dd501bc34c250c6", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422420, "uuid": "647f4a68-d9b3-4435-8832-c2039c3ccd06", "comment": "Malware payload (CryptBot)", "value": "f901bd492ccd69e550da59f508c446520ab1f860", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422420, "uuid": "6bf821c4-32aa-473d-955e-1794bc062b2f", "comment": "Malware payload (CryptBot)", "value": "2b5aecfaf85d2c2be175cf3cd89d9668272722936543ac4fadacfeee172448bc113a5c26c169d345f2da9c40d22a3398", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422420, "uuid": "db865bb5-f2c5-4da4-ab16-225255401ea9", "value": "T1CB6623DB227E4084E0D68E3B5516FDBA71F25E774942CC3CD4EA7AC03636DA1A113A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422420, "uuid": "92946b4c-2b4f-423a-9c1b-b1d4eaa40211", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422420, "uuid": "7cd5d40e-58dd-4768-aad2-e983b0b22ce9", "value": "98304:J4EgfJrhAaTg+Y5ybY3TNANcKQBeV4T0sUBtxMFcAs6HoQQQ9URySD4J+n6gcVDy:oFa5l3JTBYO0xkskoU9YySDBn6gcTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422420, "uuid": "0e4fc3ee-0ef7-4c15-be79-77c701a919e3", "value": 7075328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422420, "uuid": "f03302c6-5225-4036-8b80-c5e47ea1b8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422420, "uuid": "58f2b0b8-b320-480b-95ad-c5c740d248a2", "value": "139641caeeac43d0c18c4d59a55670d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46da39f-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680396399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396399, "uuid": "858cd248-c495-459c-8168-3afb9313ef7a", "comment": "Malware payload (Smoke Loader)", "value": "4b7f14e379b3368a2cd72efd078e6ad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396399, "uuid": "a082f961-a174-4ea2-8d1b-1bf9e411cb27", "comment": "Malware payload (Smoke Loader)", "value": "8743b58b94dd12cfebb11f0ad04dca414f293c0b43201fd772d77923f3078f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396399, "uuid": "dbf15163-3ca0-445f-bd0b-d08e33e06537", "comment": "Malware payload (Smoke Loader)", "value": "d1651cae96e9bedab1287b252f4b94e8e5d6bd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396399, "uuid": "71465e6a-eaa5-42f0-bf60-7dc30830e1ba", "comment": "Malware payload (Smoke Loader)", "value": "2082579d839c24f02520792f8731ac857efb335e55f0ddff9ad9c761bf23e345c37be08d82e11edf51b2a57e94410e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396399, "uuid": "a9784625-a8c9-45ee-b378-32fd9a5b8193", "value": "T1BA345C0253E16C71E6224BB28E2FC6F43A1EB8629E757F5A1E57BE3F1970062D121F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396399, "uuid": "9fd95158-453e-4d14-ba8e-c8cf0c9905f4", "value": "cbd684b5c2d7ad7fbf4a9d5a3ed4fb3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396399, "uuid": "c08cdb23-491c-4b4d-bd55-22dae4b682db", "value": "3072:YLvAupcBgLz6PxzC90fZsF6Dy4PdU2uckYqIgX5fKU2XJ4k3JnwvgnYAqHca:FuWyWPx22j2fKpXJbnpYAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396399, "uuid": "ccb8658d-5834-488b-92d1-b9da6a56347b", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396399, "uuid": "65ab3308-e5e0-4a28-9ca8-036767ff0776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396399, "uuid": "8a7192a9-cb48-472b-a9a7-80cabe7e7734", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1bf3f3-d13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680430446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430446, "uuid": "474f558f-ea19-4e04-9df4-e1180e8d8a85", "comment": "Malware payload (Amadey)", "value": "c3a26dc2347361342a8dc26b6d93f40d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430446, "uuid": "5c899077-f86c-41af-afb5-ebe92fcde9d1", "comment": "Malware payload (Amadey)", "value": "883ba2ce6eb977c3630999e146b4a2bab9539339a4cf4453e4538fb1299a8eed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430446, "uuid": "6b4ce963-6ed6-4404-b0d7-1c5196cd813d", "comment": "Malware payload (Amadey)", "value": "f11c35041ff14ca0c783c93f797f8abb3c7fe633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680430446, "uuid": "fa848aa4-ffe0-49c2-853a-e3daadaadc46", "comment": "Malware payload (Amadey)", "value": "d89c1cf402aff48a784b1e0f49cce7168cd26150fb14b8f960167c114b3e79bbebc4decd43f5b2c9c5e1dfc697f9438b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430446, "uuid": "98d31509-75cd-411c-a3c5-c983b28121a0", "value": "T144252312AFED4061EC75077158F707871B39B8E71E3C63BB6381B98A0D629D8A430B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430446, "uuid": "c1c91e07-306e-4fb3-8c66-462837197de3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430446, "uuid": "f733e50f-4866-43f5-9d6e-1e13b1205d62", "value": "24576:+ycG+QoRumRQwxYkXRNejAR984sr+DuPgKUTi:N9+VWwWORNuCK4U+qPgKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680430446, "uuid": "2e5413dc-52c4-4e47-a552-c60b6571437b", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680430446, "uuid": "28d45622-6953-4675-9155-405df25638c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680430446, "uuid": "bef4b3f3-5b8c-405a-85d7-2f05bb5925e9", "value": "c3a26dc2347361342a8dc26b6d93f40d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30d968a-d157-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680441118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680441118, "uuid": "07f178ae-be15-46fb-8613-81e5a2b2c51c", "comment": "Malware payload (QuasarRAT)", "value": "5860ecc5ddaec49dbe5224ce9c66cfc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680441118, "uuid": "74655b35-5d12-4afa-914f-ea0c15722d51", "comment": "Malware payload (QuasarRAT)", "value": "8a69059cb39f960058cba45dd63b1b33eba4011bff0cc3e374e4d844393f3acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680441118, "uuid": "04d42397-8f0e-4aa2-9f8a-3df50f687fc2", "comment": "Malware payload (QuasarRAT)", "value": "31dc052e3b63b475fc824a785192a7ad1b99681d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680441118, "uuid": "dc7bae64-fe2f-4e37-9f28-760176029f69", "comment": "Malware payload (QuasarRAT)", "value": "a380d84776852494b63c01215ee1d2722e20492dba4bedb7e5a48332b18377ad9a26c282a99a866f750b30b0456b8658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680441118, "uuid": "f6e7f38e-0ead-4788-b45a-5dd9bb2f8aed", "value": "T14CE55C143BF85E27E1ABE27795B0041267F0FC1AF3A3EB0B658167791C93B5098427A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680441118, "uuid": "81b65527-b345-4211-bb69-b4ee5a7bacc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680441118, "uuid": "dbd92bb1-f46c-4824-9309-49f0366591ba", "value": "49152:/vOI22SsaNYfdPBldt698dBcjHNJ88bRALoGdJNTHHB72eh2NT:/vj22SsaNYfdPBldt6+dBcjHNJ8j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680441118, "uuid": "eab11d0c-297c-4673-bfcf-985f39c5a90d", "value": 3270144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680441118, "uuid": "f3fa3f4a-65f4-45c7-8e06-1a4e0fcd6a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680441118, "uuid": "48f33e9f-414f-41d4-af24-aa9286ba9200", "value": "Era.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c327a309-d1b1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680479693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479693, "uuid": "dbb7a4df-8093-4cd8-878c-de8cbaee9483", "comment": "Malware payload", "value": "61131c939b98075c07e189830ff2879d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479693, "uuid": "66d8478f-2955-4ed1-ab80-34c1f4be62f0", "comment": "Malware payload", "value": "8b9b5bd8b2621c1c2fd22bd488ec94882c93539b51f14ac29e64951c0b84cee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479693, "uuid": "6d9c58ef-fe7f-4923-a2ad-be39f6f13226", "comment": "Malware payload", "value": "f281bc3ec5028650c8211afbfde6ee1a6caff067", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680479693, "uuid": "4aac368e-de8d-4686-b672-534e4d139d6d", "comment": "Malware payload", "value": "b949b6346d4fadbe179d6be571b34b65baf36d260a3b216513e9c49232df33a67dd4a877b85505360a67a7a8c0ef4c4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479693, "uuid": "7bce8101-a506-4809-b4c9-d7594e661181", "value": "T1311723863CCFC0F4D5C115F4953796CB03BD83BACAD8852869CD2846E9A5EB3507E8A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479693, "uuid": "11728e72-701b-4a1a-b82e-9c42126efc75", "value": "cf8ef006d63bd96dcb0864e86a35f0f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479693, "uuid": "23bba390-1d6c-4fd2-a727-4e84f6ac7fdd", "value": "393216:h+1bdhXQJbhhYK8tjYQJf8adkTUwAly0XWmDRvyCJSx:hebbXyVq1J8qjTB5yRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680479693, "uuid": "21479988-01c5-4b0e-bec5-1ac71bb3fc25", "value": 19922432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680479693, "uuid": "e0715ab1-442e-4b9a-9bdd-176b230533dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680479693, "uuid": "c929b643-0636-4e61-b842-87c68f3d94ea", "value": "61131c939b98075c07e189830ff2879d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7826cbc5-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450361, "uuid": "bdf5024a-a53d-4e32-9db5-5c88f598920e", "comment": "Malware payload", "value": "83d15fc8311af1aff188d35e87e7a62a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450361, "uuid": "4cb10349-8386-49ee-b780-00c86e5cc045", "comment": "Malware payload", "value": "8bd6c9d6ae0741965626019f773ee967aa935b36781aca9200038a12407ca982", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450361, "uuid": "52f754cd-613b-48a7-8e32-9096a83c0f07", "comment": "Malware payload", "value": "5d5c3e4da5e4a9fa6a5b7c40664d49b542f8d9d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450361, "uuid": "e6da63ce-41d8-4136-b145-b5f9b257cb40", "comment": "Malware payload", "value": "55f6ac5c3781d495a52274b47fe859ff0244375dbf43ae606d3ba96e74845cf7bfa345c30c72a8cb774765d6a66eb874", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450361, "uuid": "91594ae6-8919-4e51-947f-5c4f8402cdb7", "value": "T13FC67B02F6A580B6E1A6853DD4A3AA79E6723C554B7083CB12507F6B3F337D19D39322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450361, "uuid": "510528cd-e203-44c6-9dd5-7167f8d1f59f", "value": "98304:n5S6ul4UpgpAMPZVrSd3+lS52YYYYYYYYYYYRYYYYYYYYYYWGsWGVki3UDEIW22k:xul4UQr3lB33IU3WPkIFZ2GXZ3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450361, "uuid": "2db16456-8e44-4db3-9dc6-4b91010b0548", "value": 11983879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450361, "uuid": "d517ef4b-ff29-4d8f-a630-9bd9bbcdcd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450361, "uuid": "aa9be13d-79b4-4590-b1d0-50caf31ea6d0", "value": "SecuriteInfo.com.W32.Fosniw.N.gen.Eldorado.10634.11584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1d12c0-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450364, "uuid": "76273510-6b69-46cd-86a9-232acdde3e61", "comment": "Malware payload", "value": "53f6ed05b86b2f377fab9cf965fa00aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450364, "uuid": "93ba15a9-dff2-4f97-b50e-fdf17543a951", "comment": "Malware payload", "value": "8d2d41858173ec7c8148079c940a58aad459e47acd8fb0c0843a9ac8adb34308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450364, "uuid": "586c6653-af8a-4531-908a-3fed91f52776", "comment": "Malware payload", "value": "197ac01db1c41e3b054e1860dedd5034aa5494fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450364, "uuid": "5849d053-da4c-4fb6-aa60-24a221db642a", "comment": "Malware payload", "value": "4b84477c90eea70ec6b4f84a010cd53af38b062ebe5f6e1d22f0dd0cf5937f17e68e8d426befa34f96d041dc454de553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450364, "uuid": "4f2d16d1-b715-4956-8d86-d6e523981046", "value": "T1F8B58C22B290C432C1635D38DC5B97F8A939BD106E6498477BE53E0DBF36B817836297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450364, "uuid": "56ffd83b-4baa-47ec-8f5a-f16b91bd9d29", "value": "0bac8921daf0b5bda11471e860ca9169", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450364, "uuid": "c11be739-c765-4e22-85f5-344f7021db43", "value": "49152:ZEvT5BeIqkdTIO4rNZfnEvT3BeIqkdF0Fn884:ZEVBbqBzZVEjBbqzBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450364, "uuid": "34a221b1-dbb9-453c-8705-a858d138d1f2", "value": 2493492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450364, "uuid": "d13b4ec6-e99e-433b-a88e-c632b995bc76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450364, "uuid": "4d8e2330-afb5-4961-b687-2e2843ca9c7f", "value": "SecuriteInfo.com.Adware.Agent.TNL.11006.8714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e718bb4-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450425, "uuid": "704d3b80-0365-4768-9e24-6c93a8ea482c", "comment": "Malware payload", "value": "ee83a081485ac25a50832420a1da9db1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450425, "uuid": "96918dc6-cb28-4236-b964-58b091917579", "comment": "Malware payload", "value": "8ebe495a47dcc0f4449e34acd84c45b240f0a1ae1cd0d70a9c0f9808c4f9962b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450425, "uuid": "5a82f05a-3cf2-4323-b1d0-85f10641760e", "comment": "Malware payload", "value": "2a368d43679d7f019afe996c52583708b7d2e063", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450425, "uuid": "3510faae-00be-4cd0-a773-f67cc77a8d1a", "comment": "Malware payload", "value": "f3f9155c2bf592a45e02889e2e031ecc7402a54d5d45e10fe01c7d0179557a6f064e9eafd8f69ed65c13d1e2fa77bd21", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450425, "uuid": "03e69cd9-2083-4603-a13e-f734afd72a50", "value": "T1E4E4498AB6B1F43BC47E35309C8347B66622FE815D4AE717AAAC7E1D1C71A406D33067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450425, "uuid": "f816204e-9919-45fc-a69c-40b9963e9239", "value": "9c7f81eea37bf2092bccb5b02a68c843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450425, "uuid": "d68ac0c6-1b36-473c-b411-7509b5786571", "value": "6144:+GBPI0cVlvTDduu2usSanT9TUboMMMJFusO3/KbL:+8fgLhtxsP3/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450425, "uuid": "a3f0a309-daf7-4b16-a4b3-9a621fe66d65", "value": 671766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450425, "uuid": "3f1ae4e3-4391-449e-ae2a-42756907ffae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450425, "uuid": "7de5e1f5-46d5-47e3-80b0-e25cbd529990", "value": "SecuriteInfo.com.W32.PossibleThreat.23379.15696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3733bbab-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680396136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396136, "uuid": "8c912c81-eeae-43b8-af61-fdd4dde80959", "comment": "Malware payload (TeamBot)", "value": "0788f5d49eee054490cebc8a02df877e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396136, "uuid": "46bbc4a9-14e5-420b-852c-005d36b47ed7", "comment": "Malware payload (TeamBot)", "value": "908e4aefed17c00709274e5af47d6322c3597cadf4750a21abadd36005115281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396136, "uuid": "b470c79a-b074-4937-811e-6e77beda1995", "comment": "Malware payload (TeamBot)", "value": "81f70140ef7e8459bf8f510784364a8f5431842a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396136, "uuid": "9b1a4e11-2f5c-4228-8cf6-0dafa469ad28", "comment": "Malware payload (TeamBot)", "value": "42d75a51145e5e81361b3d1321e1e24baa192737a52795ca8d5a0ada5cd4c2e912ca31700ec0578384c310c99222670e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396136, "uuid": "2a357bf3-ed07-4c14-abe2-fd65187c8241", "value": "T17D346C0262E46871E22246328E1FC2F43B1EBD629E757F9E2E4B7A7F0974171D162F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396136, "uuid": "cfce881a-8e26-4cbc-8ca7-360e5254aa3f", "value": "2a3446625592e0299ff9a4018647956d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396136, "uuid": "7df92fce-b878-4bf5-88a9-d89bcfd8b98b", "value": "3072:etNp7T0LY2cqlReNI+TPMq8uVPNR7ZwkBgjHPs5YcQlOp81Pwr6VclYVcbHca:M00mlIAqvR1ZGEhBuVBVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396136, "uuid": "d2f6cb20-f99b-4c96-b9a6-d04152da0fe6", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396136, "uuid": "497c89af-c716-4321-a663-45b2b8b644a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396136, "uuid": "c429fe55-1a9b-4779-95b9-63a9d5160ecb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff65937-d0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680395372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395372, "uuid": "e2399735-e5f9-41de-9c8c-51294fa199c8", "comment": "Malware payload (CoinMiner)", "value": "5b960890ed6518af295dc6a18129549d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395372, "uuid": "cd33ef6f-5ae5-4ace-b158-3b14194aceab", "comment": "Malware payload (CoinMiner)", "value": "91eb4acd7e16923cc03e7c148d3ba5f0bb6af34f566c52976767f316a80d8935", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395372, "uuid": "d214cf99-8e3d-48c0-ac50-1d5af06c290c", "comment": "Malware payload (CoinMiner)", "value": "309c4a765aed75b2a8dd07c5aba9eb026ec1f2ca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395372, "uuid": "0ef06253-a69c-4236-944e-9a93408ee542", "comment": "Malware payload (CoinMiner)", "value": "473aedae7fae6b97b62ffe653366c3c16415b84f5e276a43011928d4be8a541eb0947d928dbc456cd4f2e35718933184", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395372, "uuid": "b26fae2e-184e-4adb-9711-87b536e50142", "value": "T146F5334E3892A831D7D7DA70523A0B9217D78225FAD466731457C0E7CCF3C1BBA7A48A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395372, "uuid": "f77c10a1-6064-488a-b3a9-76c46c53156b", "value": "4f0aa5246671bac81facee87baa42ea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395372, "uuid": "34d0cc26-fef7-406b-9ecd-0e997008ea3d", "value": "98304:hK1xSdXvKNmorEZCXZcVrx5EibycA63ZZQi/hmnbpHWK:amohXZyTl+d63pmVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395372, "uuid": "090d2171-4bf8-4a66-839a-b0fcd8459576", "value": 3563640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395372, "uuid": "549b0a89-14a6-4a54-bb1e-491ce4521af8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395372, "uuid": "d8fa6781-5540-49b2-a325-49d8071aaf4c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663d16e8-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450331, "uuid": "f7d698b1-3fee-4a2e-bd58-718bccb79f59", "comment": "Malware payload", "value": "77fe46c0e7ca75c4a4cf1736d04cf89a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450331, "uuid": "2c506177-4efe-4482-8b5c-698ba2814901", "comment": "Malware payload", "value": "92bf58cf62ad24a5c34ffabab7ced48b6ab164e827eedfc0756b3c089856dbb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450331, "uuid": "889f8c8a-e458-4150-bf59-a269fbad0a33", "comment": "Malware payload", "value": "6741385f269108921bb87a33dbe38faed293a526", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450331, "uuid": "362826dd-9e76-43b3-b99d-63d8ae750a11", "comment": "Malware payload", "value": "c9c8454a5c46e5680ad8b3684fbdeb6fe4b60e144e33c262c38ec927f4a5c64e6eff197f76d815270af4cf9e7a27da60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450331, "uuid": "4f636549-7964-48d5-8649-c6e7755e2b7c", "value": "T1A7C69E1137E88A3AE1FB4B31A87692115ABBFD615B32C70F754D262E1F727408E21763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450331, "uuid": "355f4dc0-3449-44c1-9f8f-18889522bef2", "value": "196608:dGtt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:dQ8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450331, "uuid": "615b7761-3812-474c-b4a1-5fdd570409d7", "value": 12558741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450331, "uuid": "f487f617-b8a5-4d56-bb80-f106507223ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450331, "uuid": "13a635bb-5011-4013-9909-0102664ace4b", "value": "SecuriteInfo.com.Heur.22908.25818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2a2118-d118-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680414018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680414018, "uuid": "c374209a-8e6a-438d-b2cc-327b322d3761", "comment": "Malware payload (RedLineStealer)", "value": "f68190d02dd017828c9e457b80a369a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680414018, "uuid": "e418fe49-a4c4-4dc5-8b37-b4f6f7e3eb6a", "comment": "Malware payload (RedLineStealer)", "value": "93112b749d371ad66f0f856a1c0c93d14f67960c644b6634a5d78dc33d0d8e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680414018, "uuid": "481d40a8-02ae-46e3-a6e9-5c0f97860697", "comment": "Malware payload (RedLineStealer)", "value": "73c454855ad2613b223f7793397cff5b636e3511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680414018, "uuid": "858065f9-dcae-410b-b8ef-e07a872b0e2e", "comment": "Malware payload (RedLineStealer)", "value": "1122c8af732cd5e8bcbe0faa423df4d7e17c8a47da38f73be0d9294992f8b2131cc2d30c9cd9aab45f8083493cb9d800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680414018, "uuid": "bab5fa93-517e-438a-93e3-5bde5c09ec88", "value": "T12336236721710096E4F78C36872B7DE233F2176609C36CBC74EAAEC93562590B617E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680414018, "uuid": "eadea95a-2f56-4055-9c1a-1efd56b6cf57", "value": "f540b6d6dcfc33b21d0deb0ccba24751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680414018, "uuid": "3190c432-aa00-4e99-a2fd-a9ddd93e4ea4", "value": "98304:HE1/qHZLs2db/0lTp94U7mZCvSZVdBLvuUKGzRVddpyetVjqKvuEPi4Fs:HE1/qHtrLypiU7mZCvSXWoVtRtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680414018, "uuid": "c0f0783c-8b72-46c2-ae17-476508e9307b", "value": 5157376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680414018, "uuid": "4eb8aef2-b144-42b6-812d-763071208bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680414018, "uuid": "ec1b72ad-eec2-48c7-9e31-d994256ae6f8", "value": "93112B749D371AD66F0F856A1C0C93D14F67960C644B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ab0e04-d115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680412640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412640, "uuid": "9123677b-e0a8-42ed-aedf-1326195cea2f", "comment": "Malware payload (Mirai)", "value": "9a97ae8b67e56f214320891b4c619921", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412640, "uuid": "bbaf3966-ee54-4b80-a6d1-150b74690d76", "comment": "Malware payload (Mirai)", "value": "934a6ee37a36a4990dcccd3b5317476ae5357e14000c6ff32253da855aaa1aeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412640, "uuid": "b6ee0a9a-94cf-4869-959d-ba8887a0b143", "comment": "Malware payload (Mirai)", "value": "75bf6dd02a7dabdc30a653feeeb137c00eb63077", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412640, "uuid": "d7be363d-a699-484d-bd01-e8ab3ad7f440", "comment": "Malware payload (Mirai)", "value": "47d499056ba548b69d072ed3973638691a03bba41b03507de1c0e949475fa0c2f5980df8330c59dad4e3f516f1e225b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412640, "uuid": "bf9a41b6-9c2e-4657-bb39-4111d34e0262", "value": "T126432A21B5751F23D0D1A47D22FB4B45B2A1A7CE26A8C64E7D720F9FFE216806902DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412640, "uuid": "c80d401d-c476-4853-b98d-f4564c397442", "value": "1536:2R+NCrAocxuquMY7X81b+OA0L3/dubsLZh:GSwGA0D17LZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680412640, "uuid": "cfb040b0-a011-44b6-8734-767710a08411", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680412640, "uuid": "a2bf14c5-ee47-4d16-b12e-e0acb65a51c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412640, "uuid": "4e9c9afb-c526-4cc6-ac14-f8afd169383d", "value": "9a97ae8b67e56f214320891b4c619921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484da8a1-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680395735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395735, "uuid": "59f80e1b-bb4f-4c4f-b4d7-31c2214aa133", "comment": "Malware payload (Smoke Loader)", "value": "7dd41b4330a7fe1c19ac4b21109ef04c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395735, "uuid": "b98942fa-dfbe-4614-bf50-23f1d587a421", "comment": "Malware payload (Smoke Loader)", "value": "9434761bac0a5b9546fa0dd8084f8a17335700ddc96cd51f92ec1c9d5264a444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395735, "uuid": "fbbd7c7c-71e2-4f6b-8a20-66da473002ec", "comment": "Malware payload (Smoke Loader)", "value": "c1afc066459ac85f7423692e2b16d4af7a6c2f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395735, "uuid": "c737247f-ff6a-4dfd-8dac-5f003388a120", "comment": "Malware payload (Smoke Loader)", "value": "a1624fe99198439651b74088e02bba192f719114c0408ca2679e817992215abe48306292567fb87fc56490526e09a670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395735, "uuid": "7a776e84-8fe5-4f6d-a478-31ee88856caf", "value": "T1C4D2D08ED220C4BDC36B8576346ADAC2C5B564CD23F4EA0544BA8CB1155FF11B8AF31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395735, "uuid": "dc64a114-76a1-418a-9440-e228633d8b81", "value": "768:ljq75mMkBaBrQV4jPb7dfbeILKyANn515MH7G3ENuTThyb:ljgmMkBTVOzNZANn515MbQTFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395735, "uuid": "793371ed-b513-4d70-b48c-7d59d1fce6f2", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395735, "uuid": "5690bf1a-55e9-49a1-83fa-e66f3cbe0bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395735, "uuid": "946e5869-dd9e-4650-809d-b9658be95fd2", "value": "final.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d17741-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456592, "uuid": "4f54042b-293c-4659-b981-aef6e63117e2", "comment": "Malware payload (Mirai)", "value": "6986ffb695d0c7d0c73219d7e293e05b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456592, "uuid": "7f59a960-f7c4-46b7-9956-ada747628887", "comment": "Malware payload (Mirai)", "value": "94850a43396313b7cf2ef3ae48c91d28ceecb4e5f7af4f88e0a99d3922b2e5c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456592, "uuid": "97d94f58-aa0c-4439-ab8d-b6dafb8c6f6e", "comment": "Malware payload (Mirai)", "value": "df9212f0e94815241035bc785e9da8ad44d1e5c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456592, "uuid": "da2b705f-8850-43a1-b000-c01865f5161d", "comment": "Malware payload (Mirai)", "value": "3d5ab053e33454dc8fb4491aea59d5b75b6a2f8c6bbbf401c0c58d73528312ae38eef9d696f3ad8885fb3771f492c662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456592, "uuid": "96321d1c-7eee-4a18-9f85-a2158987dda8", "value": "T1CD138DB3C42EAF98C2184634A8259E781B73D111C6632FFA9AC985679047EECF51C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456592, "uuid": "63987286-91b9-4403-a2ee-dfdb1b156599", "value": "768:ZaDkvwtTbxTjF/1OeJTqNatbKJee1TOsbCpCoPVjMtCO:ZaIvwtv8DNaFKJ1OsbgPatCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456592, "uuid": "84273bcd-2fd0-4130-a5c7-9693acddc6ce", "value": 44212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456592, "uuid": "0a2a1a99-17d8-4b40-a66f-8c5ec94dba3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456592, "uuid": "f74cca8f-1fb2-477d-a76d-947b42c766f0", "value": "6986ffb695d0c7d0c73219d7e293e05b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63fcda5-d127-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680420481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420481, "uuid": "2c37f76f-29f2-451d-8187-d99ca4e647cd", "comment": "Malware payload", "value": "3f0d1dc02c90e1a763a1a8910580d95a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420481, "uuid": "3091e287-ba9f-4568-844a-cea2861077a4", "comment": "Malware payload", "value": "9529ca512de7704c99db3daf534d57eb61aaf14ffe8693b1e2fc7419ba90a207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420481, "uuid": "4e7dac82-a3d1-4eaf-a5f2-1780c3ad5a07", "comment": "Malware payload", "value": "79599bae707a23f3ac7dc686ac366075d21f46ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420481, "uuid": "0fd7cb18-933c-4304-a093-2841155a4d82", "comment": "Malware payload", "value": "982aef6cf74bfc3d0bd6a6a47802b298f6bec4fae98fca6a6a0e9383271b6f312c65f7898b351fca75a11d5bbd57b64f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420481, "uuid": "01cd6e45-da99-441f-aac1-3a038bbbedb6", "value": "T1D336338A5DDF50FCEDC92A30901F7BEB23F357B94994C428ADC0E4C29563C6690E9963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420481, "uuid": "ef654cd9-cc4a-451e-968c-5b4c841ee0a7", "value": "ff33eadca45c6385bfd8315e8bf376d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420481, "uuid": "d806e318-df64-4914-a837-d8f85703de21", "value": "98304:j37ui1XB4LAatGh2Q+MI02dEorepVmsOZ5h7IT/:j37uUXBBbMQ+hrEAkmJ7w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680420481, "uuid": "9f14053b-439d-48d2-aaf0-f225a27a09e1", "value": 4935699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680420481, "uuid": "b9a5a33d-ca3a-44f6-af4e-e681936aa193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420481, "uuid": "4e6ac472-de44-4ee4-b63b-1d92f9bab00c", "value": "3f0d1dc02c90e1a763a1a8910580d95a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477645a1-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680448132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448132, "uuid": "be1833d3-aac1-4b47-8c1f-99b7f889b5bc", "comment": "Malware payload (Gafgyt)", "value": "b00b0c55d09a11d211689592ed4d0cee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448132, "uuid": "e6fbed63-c7b9-467b-b4f0-787fe1f9d8dd", "comment": "Malware payload (Gafgyt)", "value": "96593276e65c0a8ee98ddce2ddb2f62d39a6aabed91f5d372c716ad268440b00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448132, "uuid": "370cfb47-1ff7-4f19-934b-8e5b4f669746", "comment": "Malware payload (Gafgyt)", "value": "9d999ba94963b8a68f64404c89643283c3c37e45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448132, "uuid": "8cd85f2d-5eec-4ec3-ab22-cacc27811411", "comment": "Malware payload (Gafgyt)", "value": "bf3ddd690e3dcfbc7ce31bc6a630e0e702f38afdcc1e86901cb7b0e5acacdcc83bf76722eff068c68486b065b16ce0a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448132, "uuid": "9954373f-cc3d-4621-b5ae-e4df1f125151", "value": "T1FC931B05FD014B23C1C337BEF78F47593B2567A9579B3302A6246EF42BC27991D2AA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448132, "uuid": "06c5720a-b748-4ce0-bbea-5daf59e1d3ae", "value": "1536:Ymkqkx2jbJf2resF4O/baRTOc65hdZ0KIP8JmRxqQEqn/lJXfPe:EGj3s/ao5hD0KIPSmRxqQEqn9JXfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448132, "uuid": "c0dc54e9-c781-4957-b234-082b39b06e63", "value": 94100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448132, "uuid": "375e9c26-a20f-4fa4-a7ca-85caff27b534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448132, "uuid": "a1dcba80-f705-41d0-944d-af6d0f55a76f", "value": "b00b0c55d09a11d211689592ed4d0cee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f83e26-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450376, "uuid": "27240e97-2a99-461d-977a-57f2509c4af6", "comment": "Malware payload", "value": "dbd54cc3bc1cc66c02a06766cd9083fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450376, "uuid": "88466676-88a7-4863-861b-66da9c1af99d", "comment": "Malware payload", "value": "96712c7c0bcba8b255094e3379955b803cab3ed4263798072dacd4dfac271b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450376, "uuid": "798ca51c-6253-4980-b8ca-b32b3828481b", "comment": "Malware payload", "value": "5a98f16b3a77675e867d284ad1dbf67209190468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450376, "uuid": "5762ee23-e93d-42fc-94f1-ac1bf4347b01", "comment": "Malware payload", "value": "d6bc6478d5deaa0f537827e2544aa28e520cb05574cbc42d239c727cc3165d35e0e5e6fbc6ef38eae5004c2406e8e3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450376, "uuid": "9f2614b6-fe44-4434-950e-da1db4e7179c", "value": "T1E9E21A83CB057413EAD74B3096B6D631CEB26D561E51021B72AEF18D3FB13A52289DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450376, "uuid": "bd497b16-3851-489e-99ff-aff4eff783bd", "value": "768:jlMhYfT0MwswHwmgv77hOneaYm1RC29LiCzrO:jlMhuIMwswHwTUneaYK3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450376, "uuid": "d7d3b48a-3864-4670-9c02-99153835cd3f", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450376, "uuid": "7db27167-ec22-4fd1-a7eb-5da97cc59d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450376, "uuid": "ff070515-662b-40b2-bddd-9a6eeb6298b1", "value": "SecuriteInfo.com.Trojan.TR.Dropper.Gen.3168.32098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647d3ac8-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450328, "uuid": "7701bd7a-cffe-4d4b-8371-cf41273947bc", "comment": "Malware payload", "value": "49f73b648ff8402d32234f9628c85efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450328, "uuid": "8f8ad91e-240a-48ee-9ead-a6591374736e", "comment": "Malware payload", "value": "9684d0c3fdc4ddda1b426892d732a0a17fa3ba9ae328ff4a31c910e2744c0ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450328, "uuid": "17eab8a1-151f-4c71-bbbe-62412b44fcf9", "comment": "Malware payload", "value": "0400e9ddd7f9f88e3662769701eeec0e2b502e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450328, "uuid": "bb93f463-c11f-475f-8832-c0cc35baabb3", "comment": "Malware payload", "value": "d5d0c5d4236a78f67e7010caf2342d53b4f93dc5774a23f38fa82c2fc314eedcc9768c724b22692e602fd74c582cbb2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450328, "uuid": "22dbe2b0-132e-4ff5-8688-28632d004d0a", "value": "T1F6453B22B290C432D1A35D38DC1B96F89C39BD11B9649C4B3BE63E4D7F36B81B426257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450328, "uuid": "5d9781c7-67c3-43ed-8d3b-cbd1fffaf65e", "value": "ebf28b3df00da45274333bd97f49e07e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450328, "uuid": "297dd921-9dd9-4999-80ba-5b5d7238ec91", "value": "24576:MBpKnnIU9kp0RCXgwF0o8CDvYLIZr3R+TM:MBeIqkdF0Fn884", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450328, "uuid": "e8a30ed2-cdc8-4aa5-b9ba-52e8c355d870", "value": 1277908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450328, "uuid": "fb845195-e711-43bb-a287-53f9d02b3e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450328, "uuid": "267a2e8f-e9cd-44a6-8861-cbca570d01d2", "value": "SecuriteInfo.com.Win32.AdWare.7377.5898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d255eb2-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680448141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448141, "uuid": "8b07b1b4-b801-457f-b9d1-b9a144c74e00", "comment": "Malware payload", "value": "cf068be65e5cde6c25feb311671b0f30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448141, "uuid": "438c3490-50c8-477b-ac7f-1bc9918a79d2", "comment": "Malware payload", "value": "9702dc811c05ceb5a80b465c966ab392dde2bf6442f59b8dddf1b5106577b1c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448141, "uuid": "fa6b1802-f9ef-4c75-9d36-e5ab86c7ae33", "comment": "Malware payload", "value": "2cd3dbfd02f0964e589050c8ce5df06c2eb5dbf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448141, "uuid": "820ec01b-cf73-4837-a490-f5dccf670549", "comment": "Malware payload", "value": "2085ad548ed91130f1f63a2e06e83c4f559dd800d7b4bd205909ec9d1eb8bba1a361e2211d1126cbd1bad823edacb344", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448141, "uuid": "b43b15c6-bebd-4e36-9854-c3a0978ea28d", "value": "T125B31909F5518B53C1C3177ABB9F561D37236BB8939B332297247FB42B827A90E39910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448141, "uuid": "226b9e86-f4ba-4a7d-9394-dd66881b9b38", "value": "3072:Ld5aPO2ONvarAJy9n5h/8KkGdAQvkbmOQUJ1UXpTn:Z5aPO7s9n5h/8KL2QcbmOQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448141, "uuid": "f90233a8-ec86-4194-9824-19966dab85eb", "value": 114788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448141, "uuid": "75c78936-08c3-4f57-a879-2cbd8eb12cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448141, "uuid": "39c725b6-6f13-4c21-a91e-2d653a83392b", "value": "cf068be65e5cde6c25feb311671b0f30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d872c1-d146-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680433572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433572, "uuid": "9dee0c0a-236b-482a-aacb-035b3fc3837c", "comment": "Malware payload (AgentTesla)", "value": "2cdadb430d6398c3d479965903424159", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433572, "uuid": "3fa6aab3-1df6-4928-a318-d69ea889a0bd", "comment": "Malware payload (AgentTesla)", "value": "971768aa9e6a82e0236f07d5d38e0b1d32f998619275b1b5c72b3d3540507a0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433572, "uuid": "5abc517d-3635-48ec-a1ac-d08ef27b5041", "comment": "Malware payload (AgentTesla)", "value": "8178aa04e93d14c8c2edc4945bf3c7a7cbd94298", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680433572, "uuid": "c6301de6-e7f5-4a56-922b-b4b6943360c5", "comment": "Malware payload (AgentTesla)", "value": "0ce7d8ac9977483530584922d2e7e9c5e9ad005e02247adbe46456b69b59bfb0499e01c02f6f4ed400fcf6bc3d3e8c09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680433572, "uuid": "d3e59fd9-03e9-41e1-aa18-6f3988ea2e19", "value": "T12DE48C3D1D7CD7A2D679D3778AA94C60F7ECA02BB721CD1A3CEE01850A42A4232C365D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680433572, "uuid": "14fdff31-ddb5-4e78-bc6b-76952cd6359b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680433572, "uuid": "687269f4-ad4d-4674-8e52-d086d7663b51", "value": "12288:HjHXmbxzUnxUn7bNVVebVyywVR0wKQQpf3Kws+js7bpP0XEP:7XmbCnWn+wVR0wjSfKwsIybpP0XEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680433572, "uuid": "3580a967-5911-462f-af4c-1da0cca51f21", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680433572, "uuid": "82d6ed2b-198f-4002-acac-ce68bc5cb792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680433572, "uuid": "5527eef4-d47c-4fb4-9d6a-7d34ed763592", "value": "Payment Swift USD45,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cad6597-d178-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680454959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680454959, "uuid": "a3dd7590-7ab2-4cfa-88f2-32c82869eba5", "comment": "Malware payload", "value": "0914976d102b273a072e11b40f8dd7fb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680454959, "uuid": "c15ec945-eb24-4110-b592-9cf9b74615fd", "comment": "Malware payload", "value": "97354ae890b2ae6e383713f54a3afd37cccc104db90d7413d787e2c633ec0ecc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680454959, "uuid": "c228575d-c6b7-4a1c-a1dd-969c6bfb5527", "comment": "Malware payload", "value": "ac2dace77be86333cb899133edbea47a250fd346", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680454959, "uuid": "fbfe6402-82fe-4737-b84b-7d1e95acc992", "comment": "Malware payload", "value": "c0211c10b12347cdfab91f90c68995f34d51c257981f05cdac2f03fe7442ccaf0b94477f92c09697fef6784a16a7a0ea", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680454959, "uuid": "8d58b5bc-b606-491d-bf21-5944fbdace6a", "value": "T15EC6F122FD0F7EFE299DAD9A608A5AF4E2D91D76563C71CB80A13C8981051005DBFC6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680454959, "uuid": "da0223a2-51a2-4892-8e91-e52c534e57d4", "value": "49152:5WIFv8cmuDivNGhM2dZ8dMFwiXYjOydQPjbanxiwIEQzvpcm75QwdGsMVtwRMuXB:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680454959, "uuid": "2bf18561-0645-46ed-ae9e-38a22cea3067", "value": 12196255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680454959, "uuid": "acec1143-e060-4aa2-a677-c33b41e3ddab", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680454959, "uuid": "efca0733-63f7-41cb-9b65-afde6bf983d4", "value": "update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce39dd6-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450369, "uuid": "69e395f4-2d80-4753-881a-95d5805a4b74", "comment": "Malware payload", "value": "692ce4b2b27e913a9834d97a7a716cc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450369, "uuid": "ccf56da3-5695-4e62-b9ff-20732b069ef0", "comment": "Malware payload", "value": "97bd9dbb96e7952936447bce64aa3dadee13fb5e13d56ee390ef1bfffc60f1da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450369, "uuid": "44706355-d796-48b9-8e02-fc9d73f30254", "comment": "Malware payload", "value": "a09e1f7494ccc7b5c699db854319b691d3f8648f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450369, "uuid": "854bd350-38a0-4581-9fd5-d8ff813bf30c", "comment": "Malware payload", "value": "05f6937e971e5e4ece72a33be06580760f239380cbf8b0460182d74df6de899782a7339391896ccf7e6a86b475f8382a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450369, "uuid": "e3756e8e-310b-4d37-ad88-542bb2989588", "value": "T1E5C67B02F6A580B6E1A6853DD4A3AA79E6723C554B7087CB12507F6B3F337D09D39322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450369, "uuid": "b15b783a-07cd-4a90-b9d6-fee4217f91e3", "value": "98304:35S6ul4UpgpAMPZVrSd3+lS52YYYYYYYYYYYRYYYYYYYYYYWGsWGVki3UDEIW22k:hul4UQr3lB33IU3WPkIFZ2GXZ3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450369, "uuid": "f17a0c2d-5f04-49d8-ae1a-8641e46a1aed", "value": 12368999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450369, "uuid": "c8e9cf33-15eb-4f38-a2e0-e4b336038a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450369, "uuid": "a9c56214-b7ac-4157-a9aa-f3904bb161cb", "value": "SecuriteInfo.com.W32.Fosniw.N.gen.Eldorado.17437.17329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5f29ec-d144-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680432843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432843, "uuid": "d8d2d356-5f9d-423d-83b7-519e6958dace", "comment": "Malware payload (AgentTesla)", "value": "7c00b7f52dd97aabc3f2f5882e1fc27a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432843, "uuid": "f401d538-26fd-41d7-b3cc-c856078b56fe", "comment": "Malware payload (AgentTesla)", "value": "97dc660f0cfb6909975a36775b43cf0140691be53b14960877f000d437e939ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432843, "uuid": "faaea55a-914f-40f1-b0b6-38b5e02b6d0d", "comment": "Malware payload (AgentTesla)", "value": "5bdff460107d3f0980ea6c0cb9204c76d277b471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432843, "uuid": "5ffeec1e-adc7-47ac-9148-50bb05a1bb1a", "comment": "Malware payload (AgentTesla)", "value": "e61400fa199ddbbff859e230b7f921dccaadd4eac63ee9e57e80aeacefdbd180ac09654d16b5fe512bec07149d5d9c95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432843, "uuid": "d1ad17a5-8837-447a-8647-7ed380670b5c", "value": "T10FB42315E05C71F02B13F3714D1ACF726FB2C3386B414FBB690428AB4DEA625D2D9A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432843, "uuid": "04776a78-9115-43b4-902c-830bf0ce6289", "value": "12288:t9XaGEE2LKfIL2hTmiJoMDdFqv9626Gm7okH1F:nazqhTJzdFq162Sk8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680432843, "uuid": "53a723b1-e741-43d9-aefd-b0c0bc0a92bd", "value": 519624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680432843, "uuid": "4ff7dd6f-6546-4952-bb47-e3d018fd93b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432843, "uuid": "939d1783-067f-40ca-b217-c9f22a9bcb0d", "value": "QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30c108e-d0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680396800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396800, "uuid": "830dbb43-b4e6-41d3-87ef-0574826bd5db", "comment": "Malware payload (Amadey)", "value": "0e1448bd2e211069b9e52d87bf0e41be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396800, "uuid": "223176fd-60dc-4e62-89c0-01b860f106eb", "comment": "Malware payload (Amadey)", "value": "9820a82c4af14402e8ebe74198ebb3be43fd3356eaef5f516dd6254f69271c64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396800, "uuid": "66ce8b98-907a-4710-b0b7-d2d4b6929d31", "comment": "Malware payload (Amadey)", "value": "aa112559a84cf25726903b14560812148ad98629", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396800, "uuid": "3a8f6947-556c-4c42-a8fb-f675b1b413eb", "comment": "Malware payload (Amadey)", "value": "0f6374103519e2c862f80ac628f577801e6e498e9f04cd472bb235d3e08396c85505345696fea7195513eb4efb2a4286", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396800, "uuid": "a09e2bb1-a823-46c3-8b91-818e2635c6b5", "value": "T10E252300A2D95167C8B1677018FA23C347317DF0DEB8572F2F51AA5B0C716A4EAB27A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396800, "uuid": "39566dec-8d92-4e00-9764-605edfbbde6d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396800, "uuid": "d479225a-66e6-4295-bcea-e87564bbac69", "value": "12288:AMrMy90G5OO4Jy8labh7V/tr24B++0otnbP7QnaV3AGMmEL4vKJ7WH5KXaaksPjc:cyJTTPr1Bv0oBbTQaKwA1jqqBDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396800, "uuid": "a8c57e1f-e7e3-47a4-a134-728c116684be", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396800, "uuid": "80f343a1-2140-4531-b113-1219e9f40bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396800, "uuid": "ccb9358c-a445-4265-b02c-2ab860c204d2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341eb4e7-d170-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680451535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680451535, "uuid": "736f7169-04c7-4822-b011-6e761ca2996c", "comment": "Malware payload", "value": "fa35be05b7444abd6b401684ff3ea91f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680451535, "uuid": "7a45b8dd-c51e-4894-a404-e0051c84c370", "comment": "Malware payload", "value": "99db024d086ad9e5f1849d8f792c1c9eabe32788739c2420c36886195b61fed6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680451535, "uuid": "81cb7a5d-8232-498b-9320-32a6985647c1", "comment": "Malware payload", "value": "fd7d31a8b839a9dcafd792dde65ca9e9a2fba343", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680451535, "uuid": "c170a4fc-80a6-4c1a-b2ab-c6b1d1e65d8b", "comment": "Malware payload", "value": "c0863990f2e50b343ad1c6e726e1c72b1226f32ed7a7e6f01d27456f584c40c71eb030ee7fdce8db0d9f6ff1c4544820", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680451535, "uuid": "996c56c2-6678-4426-af65-a30b8f90e3ae", "value": "T1B914233FEA043851619F668D5FF890065289E43E7F62D5A6209070D5DAA7BF0F0ECDE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680451535, "uuid": "5164d080-d16c-49a7-9e69-89087c04c810", "value": "3072:3UanJBSJuKn6rtiqWMg3RgTl++X1npPceQAtbgtf9Lv4RPN7ASlzuZhat:EuJBDU6r9WMg3RgTRBTtbgpiRl7AS9CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680451535, "uuid": "ceffa687-1459-4aa8-95fb-bbe45b978523", "value": 190639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680451535, "uuid": "26a91044-7323-4191-b4c2-b83aaa36ed4b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680451535, "uuid": "1e7335f1-ce41-4536-810b-2e41645a6322", "value": "Order nr 220489 (#E83308).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ef7b06-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680422626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422626, "uuid": "511ff6c7-ca75-46ad-a69b-04ac0bd0271f", "comment": "Malware payload (RedLineStealer)", "value": "d9417983ff1ede9f2ebd2cd627efa3ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422626, "uuid": "65613ef2-f718-417d-8313-a3d53dde4a51", "comment": "Malware payload (RedLineStealer)", "value": "9ab45e3b045c4dcc37f1eda903f3143f46332152a72efba9757ec9a3ee12023b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422626, "uuid": "c8153269-a0c0-4955-9ac4-3d41b2ef8e75", "comment": "Malware payload (RedLineStealer)", "value": "587e4a2e55cdb27aef635eff35bd72b0fbd467f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422626, "uuid": "a4e41c73-b946-4d8d-b80d-1e62e93fbacc", "comment": "Malware payload (RedLineStealer)", "value": "93c06917a642ff57077e0ce296b055a1ae90411d2be590883070d79bd7f413c2724d0cc0ca5dc834d5023fc16c6fee27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422626, "uuid": "35de9e70-fac3-4a61-b7f5-a16156235258", "value": "T1F274BF0256E86C70E13E46328F1EC2F56A0EBD628E197F9F1675BE3F09741B1C962709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422626, "uuid": "380b2682-ae88-415a-b428-ebc427c6855c", "value": "1b6416dd291a09c30fa39a9eeb2f405d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422626, "uuid": "323d3bf7-24f6-4de6-8a54-46af1ade7bb2", "value": "6144:qVFPeWfjWDvsPYjLa1u9vSErTVF8VJtHRCwj:qzP9fjjYjLaOaUTVeBC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422626, "uuid": "b28bdce2-572c-4912-8fd0-fe1fd6f5d38a", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422626, "uuid": "49611465-f61d-448b-ad10-6b5415fe41de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422626, "uuid": "0715c20c-3160-44a7-9ca3-0cb3ca00c464", "value": "d9417983ff1ede9f2ebd2cd627efa3ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f0ef7d-d0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680397640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397640, "uuid": "44392e10-4d52-4b18-891a-82e64e3b183f", "comment": "Malware payload (Rhadamanthys)", "value": "ce5af6f5a3c23a06c52d3d774972af4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397640, "uuid": "450f91e0-510f-435c-8b2a-cb28ddd6a15f", "comment": "Malware payload (Rhadamanthys)", "value": "9b3690f276bd033963aa380bc79933bf57c476e3584b5387b2ba2f19a8647c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397640, "uuid": "f4cdb718-0696-4428-8e8c-b75c1420ebe6", "comment": "Malware payload (Rhadamanthys)", "value": "058658eecfb81b903ef732aa53bb51985337f203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397640, "uuid": "eb04af87-39d9-4c89-80d3-53ef0539237f", "comment": "Malware payload (Rhadamanthys)", "value": "0968a3f051969abc071ead91e1d6bf210cc5b83220c25c89ed40659d1cde1617f68754646ec3b18fc094125b967f9ea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397640, "uuid": "7bafd4ac-cfc6-409a-b2a8-0bf8b6ef9c8d", "value": "T109648D0263E46831F6224B728E2FC2F4371EBC625E75BFAA1A977E3F0970161D121B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397640, "uuid": "711b86e0-b8a4-41e1-b774-9abc7e7fdb56", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397640, "uuid": "5fc5f4df-31e8-4c1c-aa73-3dc503635673", "value": "6144:M8ZdxItAKnA5FK4kdL5yu0fLcmyTyCnjAQzRou:3ZdWAKAPKXdL5yu0fwjeYjF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397640, "uuid": "87159a09-ceb3-420e-bc22-911fcb673418", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397640, "uuid": "9d72dc00-e938-43b7-817e-c9fa3b638f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397640, "uuid": "ef02ddc1-4e76-46ea-9ac6-8bfa6a6f930c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b273d1-d166-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680447317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447317, "uuid": "919fe4da-c5d6-4bcd-a8d6-becd59a76f13", "comment": "Malware payload (CryptBot)", "value": "396ad8d37a4ed7751a9f142a0c23818c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447317, "uuid": "dfdabd11-8500-4dcd-8ba0-cd3754bb8318", "comment": "Malware payload (CryptBot)", "value": "9d7b0ff63257985d614d7503b396b8d9ce6c2fcb5bcecbcbfcfbad9560da9ffe", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447317, "uuid": "cc36c38c-cae4-4fe4-beb9-189bd68101e5", "comment": "Malware payload (CryptBot)", "value": "91e007c643bda9553e57de1c3c4aa87e15d244ea", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447317, "uuid": "6bf1c846-2177-44b8-9a71-c282edee45da", "comment": "Malware payload (CryptBot)", "value": "fd77ea463e7a5d188bfed896297ba61475633afdb496000156cde5c5fcf97bf06d1fd86b5a2e51930ba3bf4575a59eb3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447317, "uuid": "037ff72e-013d-4199-97b3-b86cc16394f7", "value": "T122068C35C1763F1FD8E552B7D817C04138EC4EC853AD8FAA7A8A541DD2BC4602EA5ABC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447317, "uuid": "93279988-4ed9-42ef-bc66-b0eba45ea318", "value": "c619cf85c1f54eb17034f1ff57904fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447317, "uuid": "ab227553-a2f3-4722-8537-c0cf77949749", "value": "49152:yKY2GhhspR5RKJsBwQcE7Eg+O1SS6xEsSQcb0kIFs9ke:yKY2Ghh0AqrNRRG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680447317, "uuid": "05c8a860-af3b-4a56-bc97-1141bbd42b52", "value": 3791360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680447317, "uuid": "7b7cd27a-f4a4-4b86-ac03-2153730201b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447317, "uuid": "8b81ec1d-4f3b-420d-a7d7-7b7cd043d231", "value": "396ad8d37a4ed7751a9f142a0c23818c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8197e9-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680396195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396195, "uuid": "f7476efe-bc62-48a7-9dce-9660b3fb9691", "comment": "Malware payload (Smoke Loader)", "value": "4f9034c0189c26f78bab90362edfc235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396195, "uuid": "c0e28468-9597-4c02-b13f-cf032c9bac8e", "comment": "Malware payload (Smoke Loader)", "value": "a459e012d14b2c660e6a57d0315c56350a85396ce20248fd114b6b7ab1ef7cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396195, "uuid": "ca9b4079-960a-439e-9296-60a27d5aa036", "comment": "Malware payload (Smoke Loader)", "value": "c28ad157ba162b5c2ce3f6af3fed3ffc61160919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396195, "uuid": "32d2b811-7ee3-42fa-a703-61a922ab8fac", "comment": "Malware payload (Smoke Loader)", "value": "8183eb98e034958109983cbc47d552911993f953e6dcce44d9a1cc4023939db8d68b1b1427993931373c486877ea98ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396195, "uuid": "47996259-1bf4-4f6b-8610-a018ae262a58", "value": "T15C346C2262E06861E12297328E2FC2F4371EB9629E357F9E2E4B7E7F0974171D161F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396195, "uuid": "bc1c6959-f620-4045-92db-72b91727dc22", "value": "2a3446625592e0299ff9a4018647956d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396195, "uuid": "89d687eb-4d7a-439d-a717-9526a89d9fda", "value": "3072:YtbNC6PCU2yF1RpNIoMAcjauVVyvz+QOLVwGmwptqcYqaHca:8Pj3174ja6zLVwTnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396195, "uuid": "3a20fa57-6f97-4b03-a9ac-03c9e366b325", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396195, "uuid": "7b853da2-9f05-46dd-a2a7-6bed1fd3f6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396195, "uuid": "26d95ae4-f6f2-43d0-9986-bbbf62eaa89a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a03141-d112-11ed-88f6-42010a9c006e", "comment": "Malware payload (GurcuStealer)", "timestamp": 1680411170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411170, "uuid": "3c4c1094-a42d-42a7-8d56-07fecec3da11", "comment": "Malware payload (GurcuStealer)", "value": "943d66043301745e07da302743041496", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411170, "uuid": "027d03fd-7819-4a3a-a261-c3a67ccd87e6", "comment": "Malware payload (GurcuStealer)", "value": "a5fdd0406a9d46666bc43b46d2f23664750723fa4cd528379522cc1b2ee069a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411170, "uuid": "a3e2440a-b9bc-4652-9398-7068a70746ad", "comment": "Malware payload (GurcuStealer)", "value": "e652b28dc6ce50d92eb6d3eb0947e667cb4c6502", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680411170, "uuid": "56b99692-7ee6-4436-8337-eae5f756baa6", "comment": "Malware payload (GurcuStealer)", "value": "e822d6fd6375d4f0259be4279fa07f9311499d265c04c995d727938cbb38305f588b484ae5f435426046b9ea55f9c19e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680411170, "uuid": "c205a9ad-672c-4c6b-8b49-929e3f414b66", "value": "T1A203EA46FA088536E299473BD8736210877552837A53EF0EACDEF0D55FC36C86902E9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680411170, "uuid": "52a7af53-3418-4f1a-aca9-b16c69604bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680411170, "uuid": "2b4893ae-bb22-451f-8a26-763d2d2f744d", "value": "768:+mU0ps424uzzql7rbDwHVB0uRImp74OLBbXc:+mdsDzzqpbDgvHNsKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680411170, "uuid": "727f202c-52ff-466e-80df-85e04cec5dbb", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680411170, "uuid": "f645ab68-d4f5-49df-a8ae-081c8b2b1b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680411170, "uuid": "8abc955d-6fa4-4acd-9b4a-12123ecf9e77", "value": "943d66043301745e07da302743041496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094289fb-d0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680396917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396917, "uuid": "06fcbf6c-d694-4b84-9e20-2b0ff1b0eac6", "comment": "Malware payload (Amadey)", "value": "362c3399fc0324d7d3e4fb2304d32c00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396917, "uuid": "f3a15700-4598-4136-b672-a506b9383334", "comment": "Malware payload (Amadey)", "value": "a74dc095727c93a2721cbcbca1b8a984879d956bb9c17b0dd0fa1bbfa0a91790", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396917, "uuid": "5958b4f5-308f-484e-85f3-e6bdab9b1729", "comment": "Malware payload (Amadey)", "value": "67019c5b91942422fe05da753a353dee4990c6ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396917, "uuid": "e1a7e654-9744-4dd7-85ab-23c950a4d1b8", "comment": "Malware payload (Amadey)", "value": "186f7b13c093cd268e36259e716d3a5999b23bf9fb3774c2cbd5eb8722e822dedc5d0c249ec7f6ff366ea10c6cc309c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396917, "uuid": "d7ffcf0a-d5fd-43e7-9dae-4670258cd65e", "value": "T16B25234257F89133DDF64BB119F603832B3ABD92D8B806632742744E1D326D8A63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396917, "uuid": "44315b03-8182-4d10-87fe-48bf90d8c35b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396917, "uuid": "29a6be1d-4b9e-4035-b618-7fced68833b0", "value": "24576:5yNnhlyAuzDtZLDjFkQD864TwcAVyoERhjTwT9:sJCTLDiQDgAOhjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396917, "uuid": "6a46b876-e542-4244-b0d7-b0cd60542d43", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396917, "uuid": "dccde77e-882c-4366-85e5-3cd51f2126db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396917, "uuid": "37e3a68f-5bd1-4db8-961b-fd642d58dcd8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40d90ba-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456582, "uuid": "17c1ed1c-8b16-4ea3-ae20-ff960d061998", "comment": "Malware payload (Mirai)", "value": "cd54128c54893f9e9c4b6161e2ce41b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456582, "uuid": "2c727baf-4625-48df-b581-2abf76cc90f2", "comment": "Malware payload (Mirai)", "value": "a895acf8417b15ceb806e3928ef5f67293b1dfa565a1e4aef3e20b296b766cd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456582, "uuid": "05875e6b-5f4c-48a0-b6ec-eb68c1276608", "comment": "Malware payload (Mirai)", "value": "ce117657da04738de357973addaeed4fbf59400a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456582, "uuid": "cd65d637-88e0-4dda-9ef5-f5f454348efa", "comment": "Malware payload (Mirai)", "value": "e5a1c4a754d271ce25e7a3034195ecafa557db86ead167211826a506b38cac76a61142d2a92f669c031bb318d9263ebc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456582, "uuid": "b878da96-2d4c-4b00-9efa-4916fbb6b1af", "value": "T142232942722C0E4BD1A65EF0293F1BE093BFE99024E4F584654FAB468236F770586F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456582, "uuid": "120ae5d0-295a-4f40-a0a8-e225f80354a1", "value": "768:35e9RgRyRFf106ZMLjfRZpLeIGGyWcav8+pFyCaz8knWyP:UDgARFf106Z6zIIn8+GxvnxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456582, "uuid": "b49f5113-6c5e-4d31-9bb1-6c5c4f4e2635", "value": 46884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456582, "uuid": "a6907863-ba4c-4919-8be0-69eaf1428d48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456582, "uuid": "1c7a81cc-a09d-4b76-b9a2-e515899adbf0", "value": "cd54128c54893f9e9c4b6161e2ce41b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8791e3e4-d15e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680443944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443944, "uuid": "348846c0-d450-46f1-9630-61b9746c2ccd", "comment": "Malware payload (RedLineStealer)", "value": "2812898f15ae343b9cdf5091c5dd9011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443944, "uuid": "d7b876c1-eb0d-46e1-bf07-500bce1642c9", "comment": "Malware payload (RedLineStealer)", "value": "a8feeaba76fe2d4e54a853994ee4a047b24b2de4e5032d5639cd66f7791aa137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443944, "uuid": "fc0edc3a-eb7c-4cec-837e-545d9bd9c47d", "comment": "Malware payload (RedLineStealer)", "value": "b1c3e2193b73b0822327988f5e1571c31d2a6ddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680443944, "uuid": "6f195919-2b8a-4291-b906-1c25f72d49a5", "comment": "Malware payload (RedLineStealer)", "value": "6d2e0f6e4ba33295e70e51799523351b1d0bde634a007da5ca529b56ac00765df1d65e5f77133bda2a434d4f6e7c5d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443944, "uuid": "5929b2ef-4daa-47f7-8842-1a9f5bb5e9e5", "value": "T1F9543B03B10493B2DDB062BF48ABB539AC7532264793A48F7B4F2486C76F97A145C1BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443944, "uuid": "7a308062-71e2-48ff-8ec5-03141f6440ff", "value": "748856617c99ed4a3fc59c5565f7792f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443944, "uuid": "94b9a893-36b3-430f-878b-6aa9eb3a6774", "value": "3072:du1xGv3coHYZcyKfRvkBZbCXhcPAv9X5sAGp+tu/SNLtGSrfxV:d2xGvcoHYCfRAbscPANSSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680443944, "uuid": "1106c0d6-b310-4165-b2fd-528f4b962cdb", "value": 279304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680443944, "uuid": "c2f5ca95-9fe0-4bd5-b81a-ee5468a31cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680443944, "uuid": "3f495c6a-f975-4816-bfff-af749c0eb157", "value": "Gta 5 Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909e542a-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450402, "uuid": "984426d7-493a-4d93-876d-1a78e0aefdde", "comment": "Malware payload", "value": "9cc31673b0a9c696a9e33b0cf38c94f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450402, "uuid": "d6ed2c23-ca8d-44f0-80d3-a07df95e94f4", "comment": "Malware payload", "value": "a99b42f8fc67f5111c30903148c93548fe6a124ea6d7e533c223c5e54cd024d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450402, "uuid": "3e827d76-d98b-4100-90a2-4f7e3be2ab6b", "comment": "Malware payload", "value": "484f95d2eaea92a22c5510ec539ce75ca9da9772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450402, "uuid": "883c02e4-6e9a-426e-8368-818d27f2d04c", "comment": "Malware payload", "value": "07cde2b6c8c761a5c3e48e2461fc83bfd6710de3c21de9c39eddff25a22f8113ee1ff896b6321bf19c17536895384a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450402, "uuid": "f4c94f4b-73dd-4a18-bedc-4f4dda2b4575", "value": "T152655C22B290C472D1A35D38DC1B96F89C39BD11B9649C4B3BE63E0D7F35B81B426297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450402, "uuid": "dba0cea4-563b-488a-aded-7c7899f00910", "value": "0bac8921daf0b5bda11471e860ca9169", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450402, "uuid": "1dcfc69a-0d43-4599-944e-3c4a14fd8f14", "value": "24576:ZYjvTJ1PBpKnnIU9kp0RCXgwF0o8CDvYLIZr3R+TM:ZEvT3BeIqkdF0Fn884", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450402, "uuid": "245430f5-76ef-47be-be92-ec707eb8c37c", "value": 1454036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450402, "uuid": "8bfa43e6-2864-4459-9e08-ff29c22710d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450402, "uuid": "1a86522d-301b-4593-b7e7-5f00fb859047", "value": "SecuriteInfo.com.Adware.Agent.TNL.2484.28990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d150c7-d141-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680431318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431318, "uuid": "9147a60d-cc9e-4835-a0e9-3ae990f9cfb9", "comment": "Malware payload (Amadey)", "value": "eda4332822d25d1bcb85b2897e153b58", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431318, "uuid": "7895ea37-cb39-463f-81ad-0f2f35d7eb6f", "comment": "Malware payload (Amadey)", "value": "a9ac487622c97b88b5662746dec5d01ccad52c9174e016448a9ae03f5c3e3e16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431318, "uuid": "efa0bdbf-4ef2-438e-8a0c-3ba30fc8bb86", "comment": "Malware payload (Amadey)", "value": "616718a2f2c0e364ad620d0522a6c8d5331f1227", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431318, "uuid": "7ee27135-72de-4af1-80ea-bbd4183bdb68", "comment": "Malware payload (Amadey)", "value": "e08ee2838e52a870e8bd4f801af4ab742bc340fc2d04be5ddee405042d2139fd403349d4076f93af5f6f13fb8d95a906", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680431318, "uuid": "07e0d479-8346-4b7e-9a96-2cb249b7b58b", "value": "T1E2D6334771C63D8A465D7BF9B5EE524B78682105B0C6238EC3F93AD9E025D837C92B38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680431318, "uuid": "7d768dbe-5e53-45d9-b2b5-4657611d5462", "value": "393216:iM67R9lkdC07KpXIpGRKixvtKWaKOkUwVlxdT:x67qmpYpGcuvYBKiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680431318, "uuid": "1d1b5367-e49c-4986-a52f-2553b6ec8fab", "value": 13118572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680431318, "uuid": "7ad15a80-76a8-486e-a92b-33be9f6a2c6a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680431318, "uuid": "58eed35a-0cf6-4fda-a3d3-fb58cc3e879b", "value": "Unlock_SoftInstall_Windows.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed258ba7-d16b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680449698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449698, "uuid": "ff0d5a1c-32dc-4c67-914d-d9aca5393703", "comment": "Malware payload", "value": "fcef6c42dfa2028be59dc1e11f681bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449698, "uuid": "a1d265f2-a1d1-47b1-b3ca-da66bd1eeb10", "comment": "Malware payload", "value": "aa6c2ef24b150191c159fae081258ad96844a9dc1d02d4366168fc48640770ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449698, "uuid": "6dcef406-b4c9-4ba4-987a-aaf1a5834ab4", "comment": "Malware payload", "value": "fc0269c4f4570c52e8c18151b31150a23ee7c318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449698, "uuid": "3953e87e-0919-4f3b-9120-cc0234a288d1", "comment": "Malware payload", "value": "e20b7e98361835046752479ea45fe4b87f8e8d32dbd1befe01a2097d75c64ad5630fb2a72b1503081487af4b3417d219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449698, "uuid": "8c4eb8c2-9303-42c3-9304-ab98a3316546", "value": "T102F4CF9233757822F8AE32BD550A53CDCF38B5462051E02B2B27369552E37BF7B4E162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449698, "uuid": "e2215fe2-d3f7-4b53-9bb9-bfcc3f8df157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449698, "uuid": "b78345a8-1f4b-445c-ab85-51c9c19d8c19", "value": "12288:W49pWN5AlV5yRvhljHPiq7dMvUa/M6LMDG:D0VnhHPiGMcanLMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680449698, "uuid": "2b8fad03-5e84-4b47-8e4d-d0c613fc10be", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680449698, "uuid": "82648582-fe92-4e90-9e89-4faf7a2fe092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449698, "uuid": "f12514ea-2870-494c-9825-c955600ed5b5", "value": "ORDER RE20230002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f55f134-d0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680396686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396686, "uuid": "ef66b0ee-2e75-43af-9e91-b7415d72ea52", "comment": "Malware payload (TeamBot)", "value": "2351fcaa2679734221e7ced2ae67a71a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396686, "uuid": "f3261b3e-c9d9-4277-bb4c-3495cdec970c", "comment": "Malware payload (TeamBot)", "value": "aae5cb60b24052ab0ec486373794bf41506bb790f8d5fc75a32183c695afb368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396686, "uuid": "8d5bf764-bae1-49bd-b436-bdc8ea65be91", "comment": "Malware payload (TeamBot)", "value": "cfad643732d345e02008cd11866fdeb45252f35e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396686, "uuid": "6207295f-5e43-45d6-8a7c-39010fc4f2e3", "comment": "Malware payload (TeamBot)", "value": "fcec00735bbf8f5687af650bf7425ab77d638bf86451741968e87ae8376469bbba4a99d4aeca64dfff4a0d7993681f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396686, "uuid": "76af157b-f114-47b6-a012-b02afeb0febc", "value": "T16D24C0327A91C0B6C51B4D708465D6B46B7EF8316BA6C6CB33648B7F1D302F09A3A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396686, "uuid": "175ac185-910e-4350-867b-bc8643c272bc", "value": "724f7af50306908b18449bf42724cf5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396686, "uuid": "ffab0fc7-c264-48f3-b343-0588f95b946a", "value": "3072:bLiyfh33I1NTNh2D/7gaRDPDwIG0bDrbBL8j5gfeU:iA3ECD/E6zk+rB5GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396686, "uuid": "09a756e3-c5a6-4ae4-882d-c8b55e095f9e", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396686, "uuid": "96dec08c-a860-4738-b907-4a2ee334c417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396686, "uuid": "c3dc6085-c7e4-4c7d-a0f9-ef2cacf8bc18", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9a48e5-d16c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680449749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449749, "uuid": "3fed2d0f-290e-4899-bb58-4fd8d84fc33d", "comment": "Malware payload", "value": "a23d74ebdcdaf47344fbf8b8ae22466f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449749, "uuid": "d679482c-946a-41b8-b7e7-7f0440a7b650", "comment": "Malware payload", "value": "ac0f874cde22f4ecad5d7d3c22d64e475dba4a89a84c30c38a4497d691d66b30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449749, "uuid": "c07335a7-2f76-4511-8d02-f1fa8aee8ff5", "comment": "Malware payload", "value": "01be2249dcb802955b2650e9a956d5810ba36132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449749, "uuid": "3c1f7706-db65-4170-b93a-1eb8c7f4040b", "comment": "Malware payload", "value": "a5d9c84564b4f86580f2e9ddd14c02b49da280f8da96c618b5db1e9feb1d1b42e95808f034c2854c6db2d0bafa616e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449749, "uuid": "25ea3250-8372-425b-ac87-3a39cc685f17", "value": "T163A47BC5E98065A1DD19AB306A37CD3546237EFDA878A41D25DE3E2B3FFB2931026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449749, "uuid": "7fcf08b1-bc2e-4f6d-b24c-d47ea682a228", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449749, "uuid": "6440b75a-3e0b-413b-bb4c-7a73c3408498", "value": "12288:EEP7r9r/+ppppppppppppppppppppppppppppp0Y6zQVvi58kk5qZdpces:X1M6zQV6u5qLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680449749, "uuid": "c4821066-3f6e-4672-8261-99c1fe99ead8", "value": 450890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680449749, "uuid": "150edbc3-148d-48e2-abbd-ca1af2f87d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449749, "uuid": "4997984a-688c-4cf6-9838-ddbd2e9e45d2", "value": "Payment Copy pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe0f256-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450374, "uuid": "3f2b690a-3b3a-49b8-a841-f9d86565411f", "comment": "Malware payload", "value": "739c2110f4f011a876a85236b712a693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450374, "uuid": "35008b8d-5f70-42bd-8a2f-5d2598da6edd", "comment": "Malware payload", "value": "acd36a30f0a6b3a775ff39250f9b9daf724961b84467bc8825e6f006c531845f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450374, "uuid": "c1e75954-b584-4e80-8474-04cfc37dc812", "comment": "Malware payload", "value": "be152c5a2e0e359da75f2d0a288ccce2a4038b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450374, "uuid": "ccef5489-c98c-47a9-b15b-76ea5b99f8b9", "comment": "Malware payload", "value": "aa8a82ea56cc72d519cf12df6001789f7c9a5e3edc968ba1cf22b2dd41b4745ffb1c75a2079d51fe227d5869ff99228d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450374, "uuid": "9282fa55-f235-42c5-9515-2ce30c86ca33", "value": "T10EA5028EF9B44512D00E0E3308BB6B65A6B66D21DC35867B7BC47B0E19F36517E12CB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450374, "uuid": "0cdeee0c-3de6-4e9f-a165-a6f7eeeb4d48", "value": "f180bb694dad7076b23eb89b0fa5c4d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450374, "uuid": "09725b82-fe1a-426d-a30b-58a54431e4eb", "value": "49152:WUfEABj5fngKeWTAjyFdHUlxM8WlO6Tjk1KAm3/lZF2l:5EABja2Uj+dHo65w6PkkxPlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450374, "uuid": "2ec5d7e8-c2e4-49dc-8ef0-432700905397", "value": 2096701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450374, "uuid": "843256e2-f694-4642-856e-b81a9f47d16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450374, "uuid": "f679409e-d778-458f-9873-8290cbd1dde9", "value": "SecuriteInfo.com.W32.Trojan.JO.gen.Eldorado.30855.19766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1e8996-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680396310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396310, "uuid": "ef538779-d94d-4615-8086-88d66fde95d8", "comment": "Malware payload (Smoke Loader)", "value": "088bda258f8e982ab30a5bca2831af40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396310, "uuid": "65f07881-cda6-48eb-85d8-78a7e593431e", "comment": "Malware payload (Smoke Loader)", "value": "aec8b80ca4b56ac949515aebb55ebd384b18bf9371287948bc646bdafd12f2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396310, "uuid": "8a91930f-3768-4570-91cc-4b0a2a648b50", "comment": "Malware payload (Smoke Loader)", "value": "d18d650f6adf6833a1ffbcbbc9efbb7a15b0baf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396310, "uuid": "5d8981bc-0eb4-4906-a30c-1c113386802e", "comment": "Malware payload (Smoke Loader)", "value": "1191028ca652ae45871e358893c887e0c3ff8855d0b48e4fbf644a61316e68ab692527d4c118519b48882a283d4695d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396310, "uuid": "adda2682-8c30-45d0-9f53-1566dc187c04", "value": "T1AE346D0223E46871E2225B328E2FC3F43A1EB8A2DE397F5A2A577E7F0574161D161F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396310, "uuid": "8f5805e1-d134-4289-a054-e69af5660449", "value": "cbd684b5c2d7ad7fbf4a9d5a3ed4fb3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396310, "uuid": "4119752c-6d35-4cba-9e2a-2720e844e872", "value": "3072:UbDQAh2J/mz8TbIN96A2FF6J+fVE/3XGFibh4wFknuaVNYKp+xQHca:IAJeoTbIYtzREVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396310, "uuid": "def552e4-ec17-416d-baea-0e33a6c1966b", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396310, "uuid": "45fc32bc-4c34-429b-87ec-a72d8ecc4f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396310, "uuid": "01a9c83f-f40b-4973-b1da-c2c9ab57ac8f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c2dc69-d19f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680471812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680471812, "uuid": "772589a7-1190-4a8e-b393-ccf59e6293d8", "comment": "Malware payload", "value": "0059a8997ef0c0c2ca9f2b082c99817d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680471812, "uuid": "5076bae6-3d24-43d5-9c32-d2079051c4cb", "comment": "Malware payload", "value": "b0c845fb7294aa73ee7e3c697acc06ebf9a5e38f32425773b1c4e5aef5f58080", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680471812, "uuid": "f2acf106-6dca-44e5-b9d8-4f61a1032ffb", "comment": "Malware payload", "value": "950ed388d28a0ab05f320393e940ddb19cacf63a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680471812, "uuid": "518ca72a-f8b5-41b4-89da-fda43bf72d05", "comment": "Malware payload", "value": "3d8001061c240c8373bfb55441ec2a14def14b1d0459a0d56bcc23a67615d1c8fe6833111f3bbf77920dc8956f887165", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "Telegram API", "colour": "#20ED95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680471812, "uuid": "121e3857-2101-4f3e-a9e1-a593d959bb4f", "value": "T152E3124280F41479EACA7EB493E32B0C9E2DE2D74F70A0A4AFC40D7D176EB359E68551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680471812, "uuid": "7fe82773-5316-4688-b849-985a29caf27c", "value": "3072:hBd1rYw6nDIy7L9O0wgGLYbYMsJ3cTw1VaqeEe0jLmxCQOJeFq/:hBvteISXwgGLYkbcTjqeTISnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680471812, "uuid": "8aef4f11-c585-458b-8228-c5d77724717d", "value": 151441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680471812, "uuid": "10e1d7d0-970c-42ec-82f5-c3fcc601f76c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680471812, "uuid": "34a9630a-10ae-4bf5-81ca-975487824e98", "value": "SWIFTMT103-00391MBAP2308101.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83adc84c-d166-11ed-88f6-42010a9c006e", "comment": "Malware payload (Lu0Bot)", "timestamp": 1680447374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447374, "uuid": "d6bf804f-febc-4028-abcc-45a30b63f262", "comment": "Malware payload (Lu0Bot)", "value": "774f34a4c76cb6cc74e39124ae7684da", "object_relation": "md5", "Tag": [ { "name": "774f34a4c76cb6cc74e39124ae7684da", "colour": "#677A81", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447374, "uuid": "65f995b8-c717-4e59-8195-f713f1938d04", "comment": "Malware payload (Lu0Bot)", "value": "b13633b31e8704b63d977921d1c9a4284bfd4780c3f35a5bee372816d7beb005", "object_relation": "sha256", "Tag": [ { "name": "774f34a4c76cb6cc74e39124ae7684da", "colour": "#677A81", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447374, "uuid": "2a8c4eeb-4691-4729-a30f-07e8dc9c0f5d", "comment": "Malware payload (Lu0Bot)", "value": "13afc4291b20736c7191ea99ca6370bf16a8d0ad", "object_relation": "sha1", "Tag": [ { "name": "774f34a4c76cb6cc74e39124ae7684da", "colour": "#677A81", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447374, "uuid": "030aa789-de9e-4a66-8ab1-ea15e2936af4", "comment": "Malware payload (Lu0Bot)", "value": "ed8b00b4d8c25b26064f6d65097bab10a06f6ad581fa453f29f11d2f9f16f23d5962019e0c9a60013a85494a656c736c", "object_relation": "sha3-384", "Tag": [ { "name": "774f34a4c76cb6cc74e39124ae7684da", "colour": "#677A81", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447374, "uuid": "90a8caf4-288c-45e8-9d68-f7455d3cbe2e", "value": "T18EB5339326ED4678D6B3A7B448F389970F79BC012925855BB1EB8D8868F06C06D3437F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447374, "uuid": "969a4d72-3783-408d-ad40-afdd7464888d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447374, "uuid": "ea52cfff-67a3-4f85-9cd6-da24f3f05ab0", "value": "49152:pU2q08HdEFVwcQYTTekQ3YbF4tPKJ5pxP5SoNDGhg:dAlvCTWYbF9P5TDGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680447374, "uuid": "1ab402ac-967f-4c09-8000-949f99c8fd88", "value": 2316800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680447374, "uuid": "51a7c272-030e-48e4-b3bd-bbbd06b86e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447374, "uuid": "921c9c59-6b22-47e4-be64-a09b5e4222f0", "value": "774f34a4c76cb6cc74e39124ae7684da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d941364c-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1680422607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422607, "uuid": "0e6fbccc-a62a-4155-8cce-9bba6b1ffa55", "comment": "Malware payload (Fabookie)", "value": "70336369523d7426108c4bf0cfad3845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422607, "uuid": "1455ac01-e61a-496d-8a99-2693bef5ddba", "comment": "Malware payload (Fabookie)", "value": "b14e0e157b905ca0b38eb97543a72959d8308fa649d37510d5e94c7b624a696b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422607, "uuid": "0e262db3-5174-45b1-926e-2e10d0a85107", "comment": "Malware payload (Fabookie)", "value": "902555b8c820df6c10d91599674af6b3123f9981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422607, "uuid": "f7fda282-cef3-4ecb-8483-dcf3ee80ec48", "comment": "Malware payload (Fabookie)", "value": "8d03951f10d355018bcb4e6b314ccb71f5f62b2d7e2e19ca0ee0a9e33abb97b021587b6192feae20a57a4c32bd91272a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422607, "uuid": "705f777d-5da0-4fdf-9c44-f4ed94ee2ddb", "value": "T1D494F509FB7508B5D096C531CDBEC376E272BC835B25930B8241FF6E2EF36216969681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422607, "uuid": "a50e2ff1-003b-4409-972e-cab7805f6621", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422607, "uuid": "98703113-806f-4512-b142-c2377e79b4ce", "value": "6144:Qy0P7sQLwciHMBoiT4MKBz3I8JmGerEhgVIXFML:QDnUcACVrKi6ZerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422607, "uuid": "8df6f18a-8792-4885-a291-c76c02b31750", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422607, "uuid": "7086ecea-be1c-44ee-af90-0f058ac90012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422607, "uuid": "6261c109-9628-4a16-9916-78abda4258fc", "value": "70336369523d7426108c4bf0cfad3845.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c54b4d-d0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680395432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395432, "uuid": "22464924-d3c8-4bfc-8cd9-ec62094b73c8", "comment": "Malware payload (Smoke Loader)", "value": "0456df472fd5ce1f06f608334c3129e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395432, "uuid": "26f0e581-0d38-4114-b518-a4adb4349934", "comment": "Malware payload (Smoke Loader)", "value": "b1d1d43f4de2fa19f96bc3027b45a11e25e05f77ebcfd829729925d07eaa48cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395432, "uuid": "340be8aa-d013-4280-8b79-6ef3cc64d12d", "comment": "Malware payload (Smoke Loader)", "value": "2b41245daf0eeee8409b6b36af1ba0a3e236693f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395432, "uuid": "ab16e099-3aab-456b-aa27-41e245fb73cb", "comment": "Malware payload (Smoke Loader)", "value": "0e4fa7b9a60cabc6abbd9bbe04fca9777ed5010feef3a5eca58c30d0a1c3e55b3113cae897703a4ee52eea6a9122d58a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395432, "uuid": "e5c31b78-56cc-480f-9a9b-00bcc0eff638", "value": "T123646B0256E46830E13F4A368F2EC3F4260EBC629E197F9B2679BE3F05741B1D562719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395432, "uuid": "ebfffecb-59cb-4997-997e-139d96f00625", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395432, "uuid": "9c9989b8-8d5b-4df8-aaa0-6f05fe238bcc", "value": "3072:3/KtoFFp3yjNGGurbv6YHGur9EypJ9BrFTpErLxjOWzuTFKph5aEPS:vMoLp3ibQiw9Bz+0/BKjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395432, "uuid": "29592895-fa0a-44dc-94ec-8edeefeb26cd", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395432, "uuid": "95b3ca55-b6ec-4413-814c-0b7e41f37945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395432, "uuid": "bb58ba33-a35b-4580-ac04-0f2c92a45a94", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79ddd5d-d14a-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680435543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435543, "uuid": "a791f0d0-be65-4c35-9412-a22b34e3975b", "comment": "Malware payload (DanaBot)", "value": "214d0995f5a131d288377f881dfd2c2a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435543, "uuid": "af761464-0d73-4ed1-af03-fc05ccdec1a2", "comment": "Malware payload (DanaBot)", "value": "b291b7fc0eb49b35a1a62a96b0b55d1e821565280f508e03f7dbde82a6bd7379", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435543, "uuid": "07c12010-3a14-41e5-8872-0bb05b136e8c", "comment": "Malware payload (DanaBot)", "value": "86fabf777401ef7d875aafa690c98fc3e94f6d85", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435543, "uuid": "1b8753db-eb64-419e-bd04-ba26cf3d834d", "comment": "Malware payload (DanaBot)", "value": "02262db8583b925d1041f45fe5ca4051915054520a5ca0c9b09ceb2c87d6ec818f4f03f33692693bc6e38da63c3bf62f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435543, "uuid": "382be408-1aa9-4e85-b035-82ba73262ba2", "value": "T15636330272E8ACB1E46DB6320F1FC6FD221DFC655E457F9A1A76BE2B09750B0E425708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435543, "uuid": "45dfcf92-501e-4b85-b866-c6bb39ba5664", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435543, "uuid": "0c144ee4-f437-4d31-a773-3037b74ea6f8", "value": "98304:edXl85Sg5XmwhhryGLtGMWkel0tIBANzM8xgJ9wGQX/Hw:eS595Wwj/IFk80tIBMzRgJ9wvvHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680435543, "uuid": "0a1796f8-9f0a-4c8c-92e6-289869b58be3", "value": 4949504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680435543, "uuid": "9132ff9a-6a97-4c22-ae7e-10a2abc01136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435543, "uuid": "18f4c141-0d55-495b-8648-9a621da46464", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1Y731WE.11788.11754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522f34d0-d128-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680420662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420662, "uuid": "1b16a64b-495f-4f99-aac8-04c200aa045b", "comment": "Malware payload", "value": "508cc6e198dacd1a6f272e80960f931a", "object_relation": "md5", "Tag": [ { "name": "508cc6e198dacd1a6f272e80960f931a", "colour": "#6C35E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420662, "uuid": "f08af900-b8f2-4aaa-8cec-b57b84290253", "comment": "Malware payload", "value": "b48c3efba0d02c53e9ec66c2d45ec38f63d299b8dc01910951f9db15943afda9", "object_relation": "sha256", "Tag": [ { "name": "508cc6e198dacd1a6f272e80960f931a", "colour": "#6C35E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420662, "uuid": "019411e4-2e3b-43af-86d6-f3d374395865", "comment": "Malware payload", "value": "5f1cd2459dc48d035714d1f6a39e0548fca3a3cc", "object_relation": "sha1", "Tag": [ { "name": "508cc6e198dacd1a6f272e80960f931a", "colour": "#6C35E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420662, "uuid": "76541f22-5db7-4de1-a2ec-ed30f46939f2", "comment": "Malware payload", "value": "32fb3e39428b48ace673a98312bc390c599283957d435db973934600ed92987930b4d1bf74eee946e74b03ad718aa23c", "object_relation": "sha3-384", "Tag": [ { "name": "508cc6e198dacd1a6f272e80960f931a", "colour": "#6C35E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420662, "uuid": "5e219850-d2a6-4f55-91bc-ef4b9bff05ed", "value": "T102A4E002BAC599B2D4731C335A75AB21A93DBD202F75CEDB63D02A5DDA315C0DB307A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420662, "uuid": "674c4d44-49db-4736-9858-14c60eeca37c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420662, "uuid": "01007a00-3bf3-40cb-b78a-cf5236424b3c", "value": "12288:2ToPWBv/cpGrU3yVtX+t4VtAfoDDDwwMKd3rA5:2TbBv5rUyXVtAfKDwiK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680420662, "uuid": "4750edac-6cdf-4fd7-b069-a5ebd970fc41", "value": 486119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680420662, "uuid": "3ca84bef-69ac-49c5-82a2-62ba226ebc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420662, "uuid": "0629b442-1c58-4235-b5fc-19567861f0b2", "value": "508cc6e198dacd1a6f272e80960f931a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14baac4a-d132-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1680424854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424854, "uuid": "1709232b-74b7-4962-9b52-48c1b7e44ba1", "comment": "Malware payload (Fabookie)", "value": "ab28d926012b7cf54ea99eafe85e580b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424854, "uuid": "173021ba-600b-45ec-99a1-047b0d236bd4", "comment": "Malware payload (Fabookie)", "value": "b4ea2b4b198552bd5507a504480d1efe41343c84c317de4ed44f571f608c8d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424854, "uuid": "1167a2cb-6795-45eb-9a84-c2886a895ef6", "comment": "Malware payload (Fabookie)", "value": "b380a3b599700918032377f3c6ef363a7f365e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680424854, "uuid": "ef2e279d-73d9-4470-ae99-49b3b4ef29cb", "comment": "Malware payload (Fabookie)", "value": "8f4f6f70fed9b1891f0f7d6a184103d9fed79202801bf51991912af34abcdb8dda6db6f09c078ebeb47e707ad8336356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424854, "uuid": "0e279e90-9fc6-45af-b66f-a679766ea642", "value": "T1AD647C56F36540B7E0528035C9D2EBB2F6B27C562B20134F4790FB7A2F336626E29B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424854, "uuid": "6362a640-1adc-4128-9c94-9685d300aa00", "value": "070e553ddabe88527fa952a08fb09ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424854, "uuid": "5c0eb332-7669-437b-9e33-6b5ffd4c3cb2", "value": "6144:g/ji2H5h8EvzoWdN46Jd6VWxtoloBV+rLx:Yb8EvbdN9JsVJ6BV+rLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680424854, "uuid": "7fe92610-15c5-4f4c-b1ad-e75dde692c94", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680424854, "uuid": "ec9e1322-acfb-4a6e-98d0-99b7c0e2ebfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680424854, "uuid": "31ca19d3-f7fb-44cf-acc9-37b8dbb9accd", "value": "ab28d926012b7cf54ea99eafe85e580b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05d44c1-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680422619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422619, "uuid": "f7218f0d-1c8b-443b-bd13-e3a84b2b8be4", "comment": "Malware payload (GCleaner)", "value": "e923f2506ca1ec6f33a4cc4230d2d79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422619, "uuid": "31dbf133-d29e-46a0-9035-45212a2d6bde", "comment": "Malware payload (GCleaner)", "value": "bae5c7c3ef2f07138cac148d8a601a52225938c94f1210d1b6b44a236d9018b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422619, "uuid": "e73d0793-7bb5-4baf-83d1-2335bae75775", "comment": "Malware payload (GCleaner)", "value": "03cdaa5317f5fe81d286eb90b33daaaf54c8e30e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422619, "uuid": "b9c9ab81-bae0-42b5-b941-93db6e589ba6", "comment": "Malware payload (GCleaner)", "value": "f1d0007876342c4810363d99133ce84d0bd866ba99db22866f1ef407b5ddef174de3fc49511d71d76920dd47c9107608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422619, "uuid": "939453a8-c93d-4a49-b984-67e793c1f5a0", "value": "T191953313D694D935D4D2A4B1BE1A96C2AD37FD1B1D202509329D854E8B7F1F2EE00BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422619, "uuid": "f4155120-a086-46a0-95d6-ee33ee70fd57", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422619, "uuid": "72d4fa42-6bc8-4b18-8dab-bdb6681d76af", "value": "49152:EGlJfs0CB1goIHxWynwVD1JPHcF9XT6lIFUfRagK0sgRQ4yBNg5dlLYp:541go6Ry19cDXTxSsn4MCPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422619, "uuid": "315b9d87-2c92-4ec0-aaaa-bdbda5d4d053", "value": 2013731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422619, "uuid": "77a3d053-37b7-4473-8f68-1f25ddcbf013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422619, "uuid": "6a8ecf0e-b2af-4f50-8fbc-c8d642d1ef99", "value": "e923f2506ca1ec6f33a4cc4230d2d79b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098ffc1f-d17c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456618, "uuid": "d3334305-862c-441a-9753-e2005a90f060", "comment": "Malware payload (Mirai)", "value": "1773cc789214d4f5d34cf12888c60b90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456618, "uuid": "bccd7eaa-42ce-42d2-8e28-fa9977b12095", "comment": "Malware payload (Mirai)", "value": "bc923a6f4b70cfdd489cdc02fb5f46c999b43c86512dc862370e0494dbaac349", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456618, "uuid": "c5b04829-4259-44ce-8616-538836a24b9b", "comment": "Malware payload (Mirai)", "value": "3b49e8000c8477ff1c7dae0f640571b14b2fcae3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456618, "uuid": "13155721-eaa7-42e0-aa40-4a4b7562f729", "comment": "Malware payload (Mirai)", "value": "aea902f694280065330bd7698883633f1b6500e25e9001d3796d2c931405283d5cf2a018e4e91875deefdd68e49af49b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456618, "uuid": "8849b354-b2c2-416e-a5c3-01d84df4840e", "value": "T185430856B8818A15C5D412BAFE2E018D3317676CE3DF72139D106F247BCA92F0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456618, "uuid": "21cbf2e1-c512-4a17-81fd-3fdde343d020", "value": "1536:d9n5zBXsKjDuWjHYbMXH6Zmyyv1i8Mr6xL3I4ifnboXWV1:1B8K/7HCMXaNSk8ynboXWV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456618, "uuid": "f8de5ac7-632b-47dd-903f-cbaaf23ffe6e", "value": 59212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456618, "uuid": "80c5e03c-1797-4b18-a0ba-ac608d5c68a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456618, "uuid": "ff10d415-fc70-428e-90ce-05a720681900", "value": "1773cc789214d4f5d34cf12888c60b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9942d3-d12d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680422906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422906, "uuid": "b2b23fd9-5da6-476e-a795-7d3676056dca", "comment": "Malware payload (GuLoader)", "value": "934b4aa04d107f3f1e4df18c1f4602c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422906, "uuid": "43ea1cf4-43e1-46f8-8532-447c12cadce2", "comment": "Malware payload (GuLoader)", "value": "be2d13c0a69ec836fb9e404b03dbfa04d7adb067ff00bda1375182dcc6bffa6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422906, "uuid": "1b346a03-99d1-41d5-a6ad-88e6ba7130d4", "comment": "Malware payload (GuLoader)", "value": "78fd7a3ff4d72fc10dc2580ed51107d378a3917b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422906, "uuid": "bba23343-e814-49f4-a568-b288b2a01352", "comment": "Malware payload (GuLoader)", "value": "f3354f88aaa202fffc7ff6cc0022bcff471d525399df95f671d097b6b1dadf71f59d13b4caf074f5deed423eec24e6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422906, "uuid": "39bd538e-5de8-460b-9a88-8bb882a00a4e", "value": "T1A90512B233449C42D9A1327F0DA9D63A6BF29E15558D070626DC7E0FFCA73D22E1970A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422906, "uuid": "a31d1fad-7f5a-4f13-a779-446280d5bcf3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422906, "uuid": "2f29c293-e904-4c80-88d3-319083477cf6", "value": "24576:NuxnYfyuqYOEzbPDzse2IWZDNjpg2IRezTZ:Qh+yuOI0z9lNjp8RkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422906, "uuid": "14946ba0-34c1-4dc7-ae75-8d2703da2b57", "value": 837490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422906, "uuid": "ba78d73f-52ed-4016-bd59-0a9971dc0dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422906, "uuid": "b4e3e3bc-cdbd-46e2-99f1-5123ef6353cc", "value": "Perfil de empresa y solicitud de pedido-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adeb2985-d12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1680421675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421675, "uuid": "79b90885-2c25-4421-89d7-6ec6b5ceabff", "comment": "Malware payload (SystemBC)", "value": "83e4b4a68f4d077af08e3896756d89c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421675, "uuid": "a94adc45-33be-4287-9b80-f935e874edee", "comment": "Malware payload (SystemBC)", "value": "c0334c8e46cac33476c3b671dfb096c25983334ebbcf99e30d4ad31b492a5179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421675, "uuid": "4708bab7-9e64-4da1-ac29-c0d2fe587287", "comment": "Malware payload (SystemBC)", "value": "7dcc4a509a324a4494fca51d7494667ed62bf2c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680421675, "uuid": "2e95fafd-e557-476c-b08a-c7fbc1f9b7dc", "comment": "Malware payload (SystemBC)", "value": "efdf5bb2005a7927af52d217179b1fb56f1234aaf7135573faa6fb2e185794bb5dd3b6c7435cbffcadd2c50d5f65da25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421675, "uuid": "597985b1-4989-4718-bcca-84877c5db425", "value": "T1E132C525BE82A1A1C327D6F1774F9360D47F69326770A40EDFF21D1064B58B3DBA2809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421675, "uuid": "017be005-4766-48f1-a2be-6b821ea7e185", "value": "96:hNoCMDnHFBkGNutaR/3Mnh/MM4odWLqhZAoUyLh/b9U/:/oTH7kGsaBc/ZbdNdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680421675, "uuid": "ebcb0cd5-f936-4c6f-bc7e-0fa8c5c75b04", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680421675, "uuid": "143d84e7-bed1-4219-838e-fb2492a56d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680421675, "uuid": "1c61f46e-4ffe-476e-8c8f-a2ab3ddf5ad3", "value": "83e4b4a68f4d077af08e3896756d89c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48803d95-d10c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680408620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408620, "uuid": "73bdfd31-b886-4b27-a056-7c6c8cdd8471", "comment": "Malware payload (Loki)", "value": "dc0a2011193af50d686ca06c34df1969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408620, "uuid": "5935b791-551f-435f-8863-9ca0a524e297", "comment": "Malware payload (Loki)", "value": "c195bd941cad3162767da114b78173b16284a61be4643a4068a01e5fdd643387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408620, "uuid": "e99b8139-8377-4455-baa6-70e5e4624a3d", "comment": "Malware payload (Loki)", "value": "a9f1fdb2ce0e7666ea1941e563a65bce9984812c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680408620, "uuid": "eb6e3d02-fc7b-4f6c-a324-dc60f9e66b07", "comment": "Malware payload (Loki)", "value": "7cde7a42e28c0ecc0a359bfa693072af8775191f3967d09a55ec259c9f94537b50945365f2d646da0eaf696635a247d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408620, "uuid": "04d58067-85e2-4cb6-8e2c-33fa978a5b85", "value": "T17F04F181A699C22AFCC30730593B4F4517ABBD1338A5651B1B90BF1A7A73143AD2F387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408620, "uuid": "132ff195-830d-4d92-a32c-e0dd73ad3974", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408620, "uuid": "15fc9395-add1-4ac3-9856-79f6beca944c", "value": "3072:GfY/TU9fE9PEtuYTSkvVLbNOMTiMjsL6/603zxerDoDCiBuVE5TLPc3skqK8FRAr:wYa6IB9wMmr8GieE51jur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680408620, "uuid": "946aa809-fbf0-4b44-897a-043ca319277d", "value": 184931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680408620, "uuid": "deff4f28-7dd0-41bf-89ce-8799849bf3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680408620, "uuid": "41284377-dc27-47c3-8023-cb4ed577ee73", "value": "dc0a2011193af50d686ca06c34df1969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abef07ef-d0e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680393754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680393754, "uuid": "cdb92b35-3fa0-490d-be32-2c5f236e740e", "comment": "Malware payload (Mirai)", "value": "12f00cededc9bacb429d993623d3e60d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680393754, "uuid": "905f2bca-d64a-4b1f-ad36-72264577d9dc", "comment": "Malware payload (Mirai)", "value": "c32afa595bd19b018f2502915e073854e1e011621d936412050b1781ac328161", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680393754, "uuid": "e28a4d01-6b91-4164-87c8-4fc7ad29c2e7", "comment": "Malware payload (Mirai)", "value": "007228d1ac32c895d7c7902618d2fc2d08a7f0a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680393754, "uuid": "6e4efbc1-1bbc-4752-afb6-625d89af53bb", "comment": "Malware payload (Mirai)", "value": "74d6fe8161d738d24245d3df381f1e3cbefa7d232dc6ed19fa15222517f7c1bcd0638d1dc627d1ca214e159e9859004c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680393754, "uuid": "aae78e9f-8614-4db6-9d29-9185c6b6dc0e", "value": "T13B63951D7E218FEDFAAD823447B78E21AA5823D627D1D5C4E15CEA011E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680393754, "uuid": "72068255-3ca0-47fe-b924-632d7f47275d", "value": "1536:i0y4avHbPTn/m9cf2jqX1xr+0jRb+10W6D:ihTrfXfr+oReC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680393754, "uuid": "68f5966b-a9e7-4983-bf18-1c5710f2dc2b", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680393754, "uuid": "72facf82-cbdd-4350-9258-7641803683e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680393754, "uuid": "c89e4596-ddb0-411a-b28c-1ea07ca810c1", "value": "12f00cededc9bacb429d993623d3e60d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8a0d8a-d0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680397354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397354, "uuid": "69a3bf3c-b394-4470-8cab-d8bd4dd4922b", "comment": "Malware payload (Rhadamanthys)", "value": "532793f823b8be1c25057beb31637a3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397354, "uuid": "a476a1cd-728e-4cec-a079-b82676b53984", "comment": "Malware payload (Rhadamanthys)", "value": "c3584cdcbcf8a2bdf6a1dece0ab69208e4dceedd7b8be43072f1c65a68e13417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397354, "uuid": "3d97a936-06e5-4c07-90f0-09e10cd0bc2f", "comment": "Malware payload (Rhadamanthys)", "value": "f53ff0f7c34c09b80eb57ce92304344f5a227b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397354, "uuid": "f4d4fead-dd90-4a03-bd1f-2a5c564f36ad", "comment": "Malware payload (Rhadamanthys)", "value": "366c17899af75458f86272adde3cef347406f9b0cd47f852a5e06a778b2ca111e92c6fb65b4485a104b3b90c892c34fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397354, "uuid": "b3d85920-481a-4f7e-a4bf-d929718b2c5b", "value": "T1C6849D0256E46C30F53E6A328F2EC2F5261EFC529F157EAB2675BA3F09340A2D572705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397354, "uuid": "de7a4a5f-fa2a-4fce-82fb-b97cdac0e614", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397354, "uuid": "f4c66b3d-daf2-43f0-b556-9247b4419d4d", "value": "6144:wcC2pso8Gjn5djAOHK+GtkbnSbnD96Xi6ik:wJ2pso8GVJAOHXzaD9ui6ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397354, "uuid": "1a2ab959-51df-42cf-86f2-06f9a3b7a036", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397354, "uuid": "c275fb53-b530-499d-813b-67345d7e128c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397354, "uuid": "633c768a-0273-4621-bff3-39063f9d5d86", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10b90f4-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450430, "uuid": "1f25abef-98fa-4e94-9609-ee538dcfc059", "comment": "Malware payload", "value": "2c4d825bfc57e8aa50a4cd65aded111e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450430, "uuid": "0f436603-249c-4eff-b42b-af0f38877e10", "comment": "Malware payload", "value": "c368a84d0fe5fb7f2c8cbca5a995ec4e45f7bd71c980f0d34538e6b2814ce196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450430, "uuid": "2c1d1179-7fe3-4ea2-a9a0-8d79f564be7a", "comment": "Malware payload", "value": "f094b7694e7cd63765a2f849594d1da93efc0127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450430, "uuid": "18fb7634-5d01-472b-9131-ad169ea22ec1", "comment": "Malware payload", "value": "aff0a10aeec42ebf279baa6e6257da8de456a7b620061b9aa8ab91d198b5ccedfa786ddb803e11a7023aff4810098d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450430, "uuid": "955fcdf2-d901-4aff-931a-3282e9e06964", "value": "T196657D06F9C288F7CA80083014B76B367E76C7462B15CB9BA3A4FD657D23541BC6B2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450430, "uuid": "8ff55540-d7d7-4139-bbe7-13dfc359e9aa", "value": "24576:T0tvlcsyReCF9dgBgJKNul1RzVME6360jsbePn6G3sS:T0JlIZrgIL1CieP6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450430, "uuid": "c819e6ff-ab0b-45d1-ad0f-b3be913d819c", "value": 1524736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450430, "uuid": "8c88ee4a-8825-47a4-9f70-deded00a1e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450430, "uuid": "ede95d6d-1ef7-409b-9135-60235a51a991", "value": "SecuriteInfo.com.Trojan.Click3.30871.31421.15382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992c4199-d13d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680429801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680429801, "uuid": "fe8d7f6a-5ae0-408d-9ff0-009152a4dcba", "comment": "Malware payload (RedLineStealer)", "value": "1587d8f9f2e82feed5d61b33890cb4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680429801, "uuid": "e2c33fe8-e24c-4e52-9047-0a2307b78b6c", "comment": "Malware payload (RedLineStealer)", "value": "c48bcbebf8fb7708991777b7c0c5775a6640b28c8bfc595f1c8bb831056a3932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680429801, "uuid": "3e9bff6f-1c4e-42f8-a971-0eb4d890bcca", "comment": "Malware payload (RedLineStealer)", "value": "29386cdff5179d3cc9d4e82313990111f8fa3c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680429801, "uuid": "88068904-337a-41a8-a608-daa7c2e4d6d3", "comment": "Malware payload (RedLineStealer)", "value": "a7f6f6494a545abaab00d8bf9aa69114ae80365504d8801c9df4b1cd783fc13127c1736da9d6262a94894ab319b3fa34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680429801, "uuid": "bb230258-b3a7-4a45-ab5a-af7dda4ade8c", "value": "T13D642A03B200D2B2DD71227F49ABB53AAC3572260793A48F778F2595CB6F9B9145C1BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680429801, "uuid": "bb83fd77-abef-45f5-b810-ae8a5f3ad8ef", "value": "7e879c9e42959cb19fd6392966654445", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680429801, "uuid": "31e47cf8-64c8-4f4c-88b7-999ba75a58bb", "value": "3072:KQ0SXnFqqdA9NFw6OXy/QTcY+puhvjz7YYy6ElZBvz9su1wfhYahDEvtImfxV:D0opdm01TaKv/7YYA3Brofh8vtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680429801, "uuid": "bd529a8a-1ce2-44bb-a94a-f44d5b06c8a5", "value": 324872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680429801, "uuid": "462c333b-df5e-4f5e-bdb1-74856c3706e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680429801, "uuid": "f8bc1dab-43f2-4943-87d1-ea9a19f4ff31", "value": "ChromeFIX_error.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c68702-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450354, "uuid": "c5709d7b-e3a9-4352-9e3f-770776b03a98", "comment": "Malware payload", "value": "81a117520fc8830ca53f76a687533f2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450354, "uuid": "d6049be9-af06-4066-bab2-234e407915fb", "comment": "Malware payload", "value": "c5d24b4a21b5ce63ea8752778e37059f9fd0f4d738b760f6c03b2b902f67f848", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450354, "uuid": "c40bbb3a-911c-4b8f-b48b-8177b15234b6", "comment": "Malware payload", "value": "1dce1c81502716e6ae1d656d5c9f83e1cefb06e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450354, "uuid": "167f269c-66cd-4ba8-b8c1-ae596f3e92bf", "comment": "Malware payload", "value": "c79ad10f47dbeda72175191c384f3e5e053f03d815bf9b92966a67d13a164bebfb1578ab40fae69112e6be38807ae560", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450354, "uuid": "c2ad3f13-aa94-4486-b166-f4a80910722f", "value": "T11C054A01BDD1C826C4751638C89787F55662AC61DEB08E177ACC3F9E3FB23886A72B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450354, "uuid": "233f7177-e885-4e58-83de-3bfb2c1d0ba2", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450354, "uuid": "c4cbe61d-afcc-4a5a-b37c-f6a99e90095d", "value": "6144:2FwT7boSP1pSA8XaMYhtJum8mAOjeYFXXd:9/boSPiXihtJuYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450354, "uuid": "ef911c78-aa7e-4651-942a-7405eba05adc", "value": 808057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450354, "uuid": "21c1e69d-9d74-4a37-a3f7-57ad8cdfd2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450354, "uuid": "c73da3c6-b691-4756-9318-00afad05251c", "value": "SecuriteInfo.com.Trojan.0057fd391.23548.4449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe2d3fc-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450347, "uuid": "be5761b5-2d26-49fe-9718-468a10910d2b", "comment": "Malware payload", "value": "b3a281b6590cdc7be878dad13bd444b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450347, "uuid": "89e43245-a659-494c-bf7e-37e040f5f3d9", "comment": "Malware payload", "value": "c61323609b19f2c5b8a21d98b360f43f85992e89980511a3a5ac3e44246cfbbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450347, "uuid": "9fc434f7-2267-43ec-823c-79797f88b9b9", "comment": "Malware payload", "value": "08be6b8914b323b755775c8f421ab5287ee5bb68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450347, "uuid": "229d9bb8-18ba-4ba1-b8ef-60457a0c1285", "comment": "Malware payload", "value": "d2d719c4880255d6378c2ccf2f4b6144b0f70f33e9a43f0739793d2fbca9ac980111069d863e0a96662a533da87a6681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450347, "uuid": "3a34f114-6b9b-487a-b099-a4420deb0a6d", "value": "T1EAC67C02F6A580B6E1A6853DD4A3AA79E6723C554B7087CB12507F6B3F337D09D39322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450347, "uuid": "929577b7-36e7-4559-8e43-e15b93e82832", "value": "98304:s5S6ul4UpgpAMPZVrSd3+lS52YYYYYYYYYYYRYYYYYYYYYYWGsWGVki3UDEIW22k:Yul4UQr3lB33IU3WPkIFZ2GXZ3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450347, "uuid": "56fdcb79-fed9-489e-aa57-6ab37f59095f", "value": 12287567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450347, "uuid": "feecefda-1a44-4da8-97ce-3d28146614a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450347, "uuid": "7d58760c-f520-4089-b476-0631680449e7", "value": "SecuriteInfo.com.W32.Fosniw.N.gen.Eldorado.25464.28662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccdda1c-d0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1680397917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397917, "uuid": "73d53c4d-4996-4469-b0ca-57c8eb084560", "comment": "Malware payload (OrcusRAT)", "value": "3b2914252d4eb44178ea90b0d23dc2a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397917, "uuid": "d46c9b25-ff4b-46ae-9afa-5e25bdb6c8c9", "comment": "Malware payload (OrcusRAT)", "value": "c6689c96e5dac713d9c2993092f414ce6e7c84bf5243a9e483c672a505c333ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397917, "uuid": "ac166a08-7d96-4f7d-bd0a-543d7e8f0c60", "comment": "Malware payload (OrcusRAT)", "value": "6d924f3ca475734009ba562f7a63d1dfefa0ae43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397917, "uuid": "46d725c1-f568-427a-aa57-e83295c4037a", "comment": "Malware payload (OrcusRAT)", "value": "4a6fa2a427f282e0873607f9b4c205a73010d53cc3b898f4c171fd5e91f43d92d7bf9fa7ca162ecc1ffb7aa96bed9680", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397917, "uuid": "e8dc419f-c94b-4e98-9925-dd7a8c09312a", "value": "T12915BF013FACAD06C2BE7778F7731AC907B8E90A6052FB4E095891AD1D9B701BD16367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397917, "uuid": "8dad78fe-5563-4e43-8407-452e96574f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397917, "uuid": "bad38dac-9fe8-4098-9743-bb8b31057ee1", "value": "24576:hBB4MROxnFE3viIrrcI0AilFEvxHPXFoo/:hQMiuqIrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397917, "uuid": "8dad46c1-03fb-428f-a10f-f6b8833ac065", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397917, "uuid": "147794af-14c9-4e63-9017-cc31356100d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397917, "uuid": "07ae608c-845f-4830-8d2a-4f48dd5b2c61", "value": "virus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fcf8db-d140-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680431117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431117, "uuid": "75ea4327-970b-417f-ae31-475e5b008d26", "comment": "Malware payload (njrat)", "value": "11d2a8f3e365714d620c65300f060cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431117, "uuid": "8834738a-edbb-4ba5-aed8-a55b9c57133f", "comment": "Malware payload (njrat)", "value": "c6742ef6d4c010a548f85a4cbc46e0efed5c4e39b2c548564d16dfb427d6af0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431117, "uuid": "97612e5d-0315-4c60-b5fb-f9d543a2f35c", "comment": "Malware payload (njrat)", "value": "25b8d5c9ec9050dbd8d28c5a8a932ba755343d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680431117, "uuid": "3bdf54c0-e6fd-4c0d-b2ac-6500157fa30e", "comment": "Malware payload (njrat)", "value": "f3b8a9cbadaf2462fda81fb2beb6737f3c0bad16626535a63a6b0e20056d3856cfbc1394050ad1976b3f7990c6060f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680431117, "uuid": "084a9d48-760e-4ef4-b807-877c8fc67128", "value": "T1C34418A709500DFBCA546F70A962F77E5C554AA37E8BE712803290C97BF837C530E866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680431117, "uuid": "aa0d605f-5b09-4ca8-9673-ad3bea3cfa41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680431117, "uuid": "3e1fc215-2110-42c2-ad28-8d1165b525ce", "value": "6144:C7uLvrUqy4zjl1TB7A4C6/Kokso9ymYBrGsrR0wWY5xhJCSi5aoFExx+krF3i60:OavJv7AOKN8mQM89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680431117, "uuid": "51194e2c-aa97-4b0e-a7c6-7d6830f77ca9", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680431117, "uuid": "b28f17e8-238c-4be0-a237-5adf858dfd20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680431117, "uuid": "e8f1d64a-5857-414e-9f8f-450b5f885e53", "value": "11d2a8f3e365714d620c65300f060cd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690c49b9-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450336, "uuid": "6ef68871-c02c-4f16-8fc2-843fbf670bd8", "comment": "Malware payload", "value": "4ed01b1e95a4909c383837d1f9d8d5e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450336, "uuid": "b4b0d8ee-b1fa-45de-a960-e5091fdc2588", "comment": "Malware payload", "value": "ca3ab1ec4ecaa34d4f1b9b2b7b497f51e36f5b42c6663b6e1f241d4cb8c8dd99", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450336, "uuid": "228d3742-364d-4b71-8a51-7d44196bbbf6", "comment": "Malware payload", "value": "a7e2255cc395af11915a66780c58cfc71b6a4f25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450336, "uuid": "bbfe5d11-1459-4d54-8c42-4e5f894347c2", "comment": "Malware payload", "value": "269352a3f14c20da6206a67d6b59463546175e1aa4c743011517df33d8f2c0ba835eb7adaf15cb88cb1f801832ca6184", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450336, "uuid": "fecccc97-b353-4ebe-b2bc-48a0be9f24d0", "value": "T1E0650206F2D3C8BAC478053048869F96F956A8114D799ACFB6EEAF0F3F75150DD23262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450336, "uuid": "3536f7ca-46d8-41b6-9e66-fbec2a9e6f3e", "value": "b9c58cc94f62e38cb7f0cdb3587ca9f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450336, "uuid": "9e51f0b7-490e-4a03-8609-cfaa6cd1e1d6", "value": "24576:K5Qz2lEEarFnXfADwzKl99dstHATYUXOJlxtiNRmjqdaplgmbh:KA2lV8XfAxdoATY5Jnti78qdyem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450336, "uuid": "b9e6a903-0529-41d7-a28d-8760fdf7a1d1", "value": 1537840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450336, "uuid": "3db9dcb9-6845-42e8-9095-c774a09c62a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450336, "uuid": "fda627b6-4114-4e7e-bfe4-88718c35ac3f", "value": "SecuriteInfo.com.not-a-virus.RiskTool.Win32.IMEStartup.606.9722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad15ab5-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456540, "uuid": "701725d7-c669-4ad0-9cdb-4d3b72d275b4", "comment": "Malware payload (Mirai)", "value": "055d57d6b608dd46e30976fbdf4b24d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456540, "uuid": "1c3fcb97-3357-4fc7-bf00-9fb9679d3aaa", "comment": "Malware payload (Mirai)", "value": "cb9d92c99162447718e771dff49e5d1509c78efc7ddf24f6d0c9194880ff4e90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456540, "uuid": "4375fe49-3699-4603-a4a0-21e9658d570f", "comment": "Malware payload (Mirai)", "value": "0782a56618182e187162104134827c7bf91ea480", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456540, "uuid": "d2dc0ab5-4be9-410b-b4f3-90bc29aaa095", "comment": "Malware payload (Mirai)", "value": "19acc6e541ea62eecbd8ea139687490e084e1555409eed260c48b1bd483a713573e5ca9e781e7219e9e1af1043f6b893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456540, "uuid": "b588afe6-1814-46f9-ae3e-fdb56d6b4e23", "value": "T10153930ABF650FB7EC6FDC3749A91B4525CC641A21A93B397D34D828F24B24F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456540, "uuid": "169eac9b-bba3-4974-bfbb-ddb60ab6e4c4", "value": "768:J1jQIFUYxDCjXFqfu8Z5TeHiQ7WRhxI5NTeneUBeaPiwSkXiOoc7KN6:J1jQI2Yxao1PqiQ0xIHKJBdPilW75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456540, "uuid": "bf3bda68-c7f3-4200-8d79-599e0f2b09fd", "value": 65112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456540, "uuid": "ec414340-7586-413a-996c-6af816529542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456540, "uuid": "d61b156f-c741-469d-bb99-99c1b4c3a674", "value": "055d57d6b608dd46e30976fbdf4b24d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6426ce62-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680448180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448180, "uuid": "bedb5b96-6853-4cd3-9d13-ab87f9fcb650", "comment": "Malware payload (Gafgyt)", "value": "9001ca210c5fe144ddd337b1c8b0497d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448180, "uuid": "85062725-62ea-42ed-a4ce-bb5bfd6a98d7", "comment": "Malware payload (Gafgyt)", "value": "cbcf45cadd4c43d2817ef4e26a3213d1f4f0cfd96175118481d7da7f01e0135c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448180, "uuid": "6ff22b22-bc4e-49b4-9529-c16164241307", "comment": "Malware payload (Gafgyt)", "value": "8bbcc205c6b4489964f0aa84f1b0cda310228196", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448180, "uuid": "d71f2d54-9ef2-4c19-a86a-986d0b54a863", "comment": "Malware payload (Gafgyt)", "value": "24a8f69186433e6b3eb53ad42685a30e17a08957ccd93984f9d93cc423c8ed09f714b1c137bcfa30ee40957e6fa3d69a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448180, "uuid": "bfc5425f-9758-4e30-934f-36a56b4879db", "value": "T100A32B05F9114727C1D3277AFACF43493B2667B957DB3301AA287FB02BC27991E25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448180, "uuid": "71cbd46a-645d-4607-a813-9d03cb57e83e", "value": "1536:fUu5i8IgvI/o8NbpPGOO9eOn0v45hcpBKjSc38gXqHmCyrQ0KnWz4XnTe:f4gEYOOq45hQBKogOmCyrQ0Knm4XnTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448180, "uuid": "a38b6426-39a4-44d6-aa42-509c1b2fe00b", "value": 100678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448180, "uuid": "13e23c10-4b69-4766-8371-78d41a28ad2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448180, "uuid": "7f008c79-fda1-4aba-8f09-532a97a00bc7", "value": "9001ca210c5fe144ddd337b1c8b0497d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a64f85a-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450338, "uuid": "06e7bedf-6daa-4e51-8f23-324c1f081981", "comment": "Malware payload", "value": "3a1953dcb4af473501c9c1cb1f992d82", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450338, "uuid": "c0d83eff-fa56-4ee6-b538-9f9229260ed4", "comment": "Malware payload", "value": "ccaeda2ba316ee2c509e5554bff87470829b91df2d416bfe5c19ef213ecbdea6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450338, "uuid": "1890008a-5302-4e5e-afb8-bfc64a8ca98f", "comment": "Malware payload", "value": "57dfdc6738ad8d37254adc281b6791e6aab0e68e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450338, "uuid": "b1833c4c-f6f1-4e9c-8848-062e04f10097", "comment": "Malware payload", "value": "5d7a5fb3778c49fac9774c0ce4d3a510bdd9e559f4f267042a07d518f6d7b8d4f038b88dcfbcb7cb2fd6f930b5bddd5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450338, "uuid": "ee060e58-ad0c-4bd8-9e3c-550b5f99d94a", "value": "T11EB6AE1133E88A3BE2BF4B35A875911156FBF9225722DB0F758D162F1F727408A217A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450338, "uuid": "1f6f53b8-aec6-45b6-afea-19f5c7a4157e", "value": "196608:XGtt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:XQ8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450338, "uuid": "1b3c7a98-68ac-49bb-8ca7-c392c1b3d945", "value": 10784229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450338, "uuid": "759254f5-5ecb-4897-84b5-3a5675b9cacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450338, "uuid": "4a423e86-a70b-4a07-b5d3-6ceb0b3548e7", "value": "SecuriteInfo.com.Heur.18702.8351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3a3f42-d0ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680396251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396251, "uuid": "78986233-1cb6-4270-a571-187975f8f8bc", "comment": "Malware payload (Amadey)", "value": "70bbca836eb6ea4d5e483ddc64069e2a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396251, "uuid": "10f46733-b45d-4c86-b6b2-a0df7b01e34b", "comment": "Malware payload (Amadey)", "value": "cea0534dac1a695f30d89e65f91ee6d914b83e8d18cb8bc12734bbe59721ffaa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396251, "uuid": "cc772ba4-cf9c-40cf-a997-1343f824b9f1", "comment": "Malware payload (Amadey)", "value": "57c2644db9b00ab3c41e69fd53c15387e16d7c4e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396251, "uuid": "4458c07d-f3bf-48cf-b285-7c8a4a05ff3e", "comment": "Malware payload (Amadey)", "value": "0a2e9b1f870facca1f8e1b8bcd0f89751ed4df495d72c2ac850a8c753d631f765f7dbf3b035b5bd50bcbb9502c6f4026", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396251, "uuid": "e8bc45f1-2782-4e10-8dcc-93d1b32d3373", "value": "T1D6346E0212E16C71E22247328E2FC2F43A1EBE625E367F991E5B7A7F0975172D162F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396251, "uuid": "ac42aa48-42d4-460d-ac7f-cf0f87616612", "value": "cbd684b5c2d7ad7fbf4a9d5a3ed4fb3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396251, "uuid": "27254cd6-9346-4194-9f84-b38702f64d06", "value": "3072:0g3dgBRVi/yzd78kt96gWiF6t4dm8KwW1V/vwUXo9Q9T6dkk9YX1Hca:mX8qZ78DnwW1n49q6mX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396251, "uuid": "c96494bd-9d26-42b0-a142-84a766e00c47", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396251, "uuid": "73a67755-8a94-4f01-ab30-25d22912e4c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396251, "uuid": "dfc65722-7594-482f-9ce1-3bebca22ce54", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8c1032-d0fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680402587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680402587, "uuid": "ad9913d8-2f54-470f-8529-59b9f8a76345", "comment": "Malware payload (Mirai)", "value": "9b23389cf84c0a83e6450a1a39ed87be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680402587, "uuid": "7857d4f7-68a5-4334-abfa-922ccf79c365", "comment": "Malware payload (Mirai)", "value": "ceb30f79fa905c2c64a1c9cb3bb4b5b05c4f0de9fdb3cdad44571b571589d1bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680402587, "uuid": "0e003e50-52cb-4f05-bcf1-4534c5c4cd0d", "comment": "Malware payload (Mirai)", "value": "92a1adf38568dd9d587f0cfe334f4f5c74851c48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680402587, "uuid": "a72ce795-18ad-4999-95d6-d8272d454909", "comment": "Malware payload (Mirai)", "value": "6c2628ea353efb5eb3266e8d17f3e418414d40d89ade74d444f82d917f9116ef43796eb4a0c33892fe23702322211a37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680402587, "uuid": "7539a28a-e9ca-4517-a2bc-4541834f50d8", "value": "T189E2E1E8E6ABCD50F257803309BFB70F8F40514E8884DE24F95C5A67444BB288E7E6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680402587, "uuid": "70a40eba-8364-491e-9e2c-b91cb578d4c4", "value": "768:9Xgr4/5i1a1tGJZD/cv5050OWhMmFy86JG1AUtnbcuyD7U1gURD:9Xt5aiG3BCOWJF96J+tnouy81J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680402587, "uuid": "f7a3bde4-df47-47a0-a09e-8f267c94edfd", "value": 32292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680402587, "uuid": "c1e6c366-172f-4511-b390-fcdec89a0232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680402587, "uuid": "34b5d51f-101d-42c4-9e9b-7a9ff067715a", "value": "9b23389cf84c0a83e6450a1a39ed87be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4113beca-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680448121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448121, "uuid": "1097b83f-5158-4ccf-84ab-81d249a78503", "comment": "Malware payload (Gafgyt)", "value": "3832a7cfc035c66d84614505865e6041", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448121, "uuid": "cfb60b5c-6e33-4008-96bf-51a12f405250", "comment": "Malware payload (Gafgyt)", "value": "d2efc40937befc168f8d8c4c985a3375184c6c8db577cb926e51cd00243499e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448121, "uuid": "daefd613-43cf-41b5-8df8-9ae9befd9e01", "comment": "Malware payload (Gafgyt)", "value": "d2ee5ae8f9e75a83cd03f5fb4fed5cb0e3fb79c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448121, "uuid": "bf180d95-80a2-4e5f-89c4-7183fe68c252", "comment": "Malware payload (Gafgyt)", "value": "169fb4d17b0be2844cbfa99f81e54d5ac90de0cb6af7083ef0bf6e1ac2a3ddba1cc0ff9d614d8f57021e6578176a80cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448121, "uuid": "11e5c171-b2c8-44e7-a3dc-c5e21336c567", "value": "T12BB3D897EB11CEB7C85FCE730AAA4A05108DA99752D57B6B73B4C96CE70694F08E3C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448121, "uuid": "909590b9-9fd1-4393-bb3e-786bafebd9dc", "value": "3072:ZdfnOgVToszag5hVT+tDBxmkizF9GhsRiAe:Zd/TTXmg5hVytDBxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448121, "uuid": "64d39cfc-679d-4a4f-b6f7-4cec1c43c203", "value": 113851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448121, "uuid": "fbde66ef-5bff-44f8-9d65-c58473dc7c5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448121, "uuid": "81d9a42b-86db-4f58-b4af-b233d94ad07c", "value": "3832a7cfc035c66d84614505865e6041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839b7607-d162-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680445656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680445656, "uuid": "3c51e663-1a8c-480a-9a32-25d19ac770e8", "comment": "Malware payload (DanaBot)", "value": "5e6832dd99514db53d9aa8081340c556", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680445656, "uuid": "dfbf92c8-e634-4325-acf7-a8bc17a917bf", "comment": "Malware payload (DanaBot)", "value": "d4e7914fad1732d78bae940b5ad06c2fe1781e0916598949e35e62867c8deb23", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680445656, "uuid": "2dcf40c8-f1df-40f7-ba97-086ab6e2a2d4", "comment": "Malware payload (DanaBot)", "value": "19c717bc36a6fa724c63164937fc5952a9222809", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680445656, "uuid": "baa4cc7b-5670-4f76-bcaf-a68d2d592482", "comment": "Malware payload (DanaBot)", "value": "83a3213e48db5f34424eabcd6839c697c53c706a4c4351c0ff29efede840914af332a453085375b5182ccf88347f0aae", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680445656, "uuid": "be59adf5-9156-4127-a0d1-31a8ceee1716", "value": "T12B3633039BF55DA0E65694302F4AC2A9627EFCD12C97BF9E1F48733B1A74561D220F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680445656, "uuid": "5df6e911-58ff-4c93-8b91-7c81e26ec25f", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680445656, "uuid": "70b00d51-82d4-4864-ab32-5b3beb944624", "value": "98304:HtLyi3oL1GvIzJM1kOl0pf4og83I+q+zcZPV1h8ztKmCycbeI8kt:1F3eGX1kC0pf4og/RDZPqtKmLcl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680445656, "uuid": "e6342e1f-1243-47fa-b5c1-b741f1d96a04", "value": 4948992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680445656, "uuid": "055fd8e2-bfd9-4bdf-a137-7514d10f9ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680445656, "uuid": "4b84ba8c-6778-45b3-815c-7a1e32203df3", "value": "SecuriteInfo.com.W32.Kryptik.HKJI.tr.3760.19322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab3127a-d0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680398128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398128, "uuid": "a34fbc24-f768-46e9-bbea-45afc27c8e9d", "comment": "Malware payload (Stop)", "value": "23703f1cabc8a323aa86001f8f1413fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398128, "uuid": "705a7395-90b5-4955-9cb7-cb56a5976900", "comment": "Malware payload (Stop)", "value": "d50a69fc9368f536a7065f3873d5a542eb50caa0ce3a4a06b6f7282b32817bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398128, "uuid": "4a5be49c-0065-47d0-b0ac-1e89658d8838", "comment": "Malware payload (Stop)", "value": "7074d685c0ef0eee30eef69d1d59c2906924bd7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398128, "uuid": "2208b844-8e68-4385-969e-35ce586bca85", "comment": "Malware payload (Stop)", "value": "727a03103e110fbb8dc5f9d35c7024f398c21e2dd2d1553e9fc2f915d1f92736f91b8af5072d41f0a256f3182e20b737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398128, "uuid": "0f1bd342-f6ac-4e33-bd5e-e6e7aa2a3867", "value": "T19805F11207E57A30E23F56328F2EC2F9760EBC628E56BA5E1679FE2F0530171D962711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398128, "uuid": "89113a62-176c-44b5-983e-055b3215666d", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398128, "uuid": "b777246c-2793-4e82-bda2-22e2d86a5362", "value": "12288:4Rr/SmpJ7hg9B3clEOTyuGcyaPR/dkw6eaRr9RuT14Kzp8Mvj46:QSmzy3KnNGcUpLr9ozzGH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680398128, "uuid": "0f3b82a7-de8c-46e6-88d4-1d3d8bbdf808", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680398128, "uuid": "7300a91e-0bd1-4837-98ca-6882c25d91f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398128, "uuid": "3f8fb5dd-7f26-4ca3-b4ad-53423933fa2c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9f64c4-d135-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680426506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426506, "uuid": "4e3a3efe-5af4-416e-83d1-d1dca8184bb8", "comment": "Malware payload (RedLineStealer)", "value": "9756841c8acdd6daa5d1f4625f904624", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426506, "uuid": "d58ab009-b840-4751-97e0-ff01f936d5f1", "comment": "Malware payload (RedLineStealer)", "value": "d5cd46e9814812227a7dc28b9eaec4cefe102ba3f2ffe58256ec2c6ece90e36e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426506, "uuid": "0061f59d-a17d-4326-949b-52caf22bbe6c", "comment": "Malware payload (RedLineStealer)", "value": "515e9253e5a94fac53be76ac31a1903c13c9e8ba", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426506, "uuid": "28b9577c-f431-444b-848c-b0fa1a418aae", "comment": "Malware payload (RedLineStealer)", "value": "892c471325699e535f9e7da6e40ee80dc9e374b52ef517a43f6bf85457863c118b5e1254d857112434933607687f4e73", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680426506, "uuid": "fcfdda18-5023-4adf-a27a-8cac19761842", "value": "T1B684885EE8027F45C335D4AB1E8F98343CA702BF9E826F17752679939FC098AB02545B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680426506, "uuid": "f4856619-7f31-4fba-9bc0-c60b90756d3d", "value": "6144:eizIeWa+U11jZp0r0BFWzuHN2jxOyKXdAny1eQ63Zk:eiLd9y06AkNOyny1c3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680426506, "uuid": "4395aa2e-1f25-43bc-bfb8-b60d80b73729", "value": 371058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680426506, "uuid": "bf3f7034-1a73-46cc-8040-54de262ba033", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680426506, "uuid": "e7408449-273f-41fb-b294-f0d4f00dfc2c", "value": "Installator.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b28084-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680396019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396019, "uuid": "e4799420-c653-4302-89c5-378acf4d5377", "comment": "Malware payload (Amadey)", "value": "d3eec92f49c74769020c98b7a14b8321", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396019, "uuid": "a9016a45-c388-46a1-8adc-38e72bfe8363", "comment": "Malware payload (Amadey)", "value": "d83b79327ecb56d9d9af4be28a737ee1a598e2268ff6cbf4e18aa7918860b202", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396019, "uuid": "6b16be23-8e74-4729-bc0b-8b149a4b49e3", "comment": "Malware payload (Amadey)", "value": "6d5fe7fdf65278751190145b4dd44d66879b886a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396019, "uuid": "7ddcd48d-adaa-4c90-b8eb-5d5d375e3aec", "comment": "Malware payload (Amadey)", "value": "35193f628f90607babc4e392715a6061bce129dcad95300411361416196bb788d5a43741161ed645fa6af4ee4f79d1fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396019, "uuid": "0ed8e6a9-ccae-4a95-a199-607fd1a5a9b6", "value": "T1B2345D0252E1E831E1225A728F2FC6F43B1EB8625E357F9E2A4B7A3F0574172D162F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396019, "uuid": "b813c792-e976-4721-8b3d-958c12c97747", "value": "44e37c428947afcbabc1447e2f3a149e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396019, "uuid": "d712ae7d-db6f-435c-98e1-e24a371efbcc", "value": "3072:s6Yh8Yrs/2aGQxvNZi2OQO6wE0Sf1+hWYXfkh+IAwFp0DEyoHcn:armAQlROS0p0YvS0D1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396019, "uuid": "d8db66c4-f778-43ff-aaf7-6e8d2a093eb5", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396019, "uuid": "55674f5c-3f43-46e4-9575-28d4c782346f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396019, "uuid": "df833e47-5cd3-4638-a49f-264214d48abd", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a6c045-d13b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680428907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428907, "uuid": "2ba3bb27-8cd4-4a9c-9216-c782ef4a4985", "comment": "Malware payload (RedLineStealer)", "value": "92cc0efe8bb98facd37d212095cb20b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428907, "uuid": "eb2c718c-ae94-405f-a770-7967f069805c", "comment": "Malware payload (RedLineStealer)", "value": "d8a4882b4d55be87f182a56063408dc45145e8ca9e321c59de6c9c4206196b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428907, "uuid": "f13d403f-bc37-4889-90d1-da6cab86f87a", "comment": "Malware payload (RedLineStealer)", "value": "f5d5119619b9dcea36bb4728521ada0ece8ead40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680428907, "uuid": "c0912358-aff7-47dd-a8d5-c467705b13fd", "comment": "Malware payload (RedLineStealer)", "value": "7bd0de7be1fc431ba4791c858ef2ce08d804baa072d0260620170a9fab1b055f10ffcd79a611d1b0d72afd5e0bf56943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428907, "uuid": "764f54a7-e79a-4aa9-973e-da5fd31a4bfc", "value": "T16F643A03F200D2B2DD7162BF49ABA539AC3572260793A48F778F2595CB6F9B9144C1BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428907, "uuid": "c22e4232-a7fb-4d8e-9306-350be99e8ef1", "value": "7e879c9e42959cb19fd6392966654445", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428907, "uuid": "ca6aacf0-b7b0-4600-b1fc-3d4b90d4cb73", "value": "3072:Tz0GpnuqNdA2NQwHMnyRQhuY+LGVLzNxlub5ElZBVL931wOCaaJDELtImfxV:H0S/dFtHwheeLhxsu3B9E1qLtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680428907, "uuid": "e71d42ab-26fc-4682-8dc5-4f6e2f98fbe0", "value": 324872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680428907, "uuid": "e06b8020-2bbc-4985-b05b-49bd6dbb0580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680428907, "uuid": "56e72dd9-2273-4888-a697-5e9da169a001", "value": "ChromeFIX_errorMEM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201abe3a-d0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680395667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395667, "uuid": "85377d54-1365-44c1-96e1-e4841c337fd3", "comment": "Malware payload (Amadey)", "value": "08b3cd4ff5de7c949d82a0eef9d312e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395667, "uuid": "edba62ae-a6ed-43ab-8343-de031bf98f07", "comment": "Malware payload (Amadey)", "value": "d9538bdde61c8a263a3b546a6479de1fe27b72c72fbbdf21265ec2081a8e605b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395667, "uuid": "54a59d95-1999-4a4b-89dd-63f4dcee8cd2", "comment": "Malware payload (Amadey)", "value": "6f4c8ec82f55a76e910a6ad644b4ef1d07e2c702", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395667, "uuid": "cb4757fb-9fd0-4de8-a923-c4358159b392", "comment": "Malware payload (Amadey)", "value": "e7725592f525d6b90a5da141b55f3ba8145e6b01f3188099a59ae1463d50a21b2c03feb2cf83388d1e12d4a249558c3c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395667, "uuid": "fa1c93d1-ddeb-488f-bcae-b0b16e399b70", "value": "T1FC345D0253A5A871E2225A328F2FC2F43B1EBC525E357F9A2E677E3F0974161D162F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395667, "uuid": "6943ac93-acee-41f4-9ae6-2afe24032864", "value": "2131db44a5c98e05f373c247645871f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395667, "uuid": "a8aba88c-e742-4cee-94ca-d11faa957d24", "value": "3072:am+zUjSXFX1FPmZxm0W885KFHY6J4jQLzn7AaQQzPXOhU/1GHc2:f21TPmZtCLQbAaPehuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395667, "uuid": "9290cc6a-f8a4-4223-b8a4-423139e920ad", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395667, "uuid": "97435834-30cf-4e3d-bf47-04d84c979b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395667, "uuid": "8668dcf4-3bab-47a2-bc44-cb1801fb4f15", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf588013-d12b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680422134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422134, "uuid": "f0d9841d-251f-4dbb-b88c-0fee95737119", "comment": "Malware payload (GCleaner)", "value": "6820a3ee6adc057dcb2b9b373d60b71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422134, "uuid": "20696205-3b6b-4f7a-b7de-514d16022a18", "comment": "Malware payload (GCleaner)", "value": "d9b345020df8d580d21150d66da61ce6c4f3bfb1f3fc029a4b40fe9615006757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422134, "uuid": "afe65cb7-89b5-4ace-8d3b-dbcb8d19e6db", "comment": "Malware payload (GCleaner)", "value": "f9e9cc076b5567a03971a7ab54c2d1719a76751e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422134, "uuid": "c33e93fc-606b-448e-a7cd-e759288b5818", "comment": "Malware payload (GCleaner)", "value": "dff4a04e475d9cae8c8e3ea137ae953a98e912735a121f49bb5dc2c56b7f50c656d704139b1107682db9a6d7d8874a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422134, "uuid": "9ea2b1ae-5eaf-4395-9f02-986fd540cbc5", "value": "T12D949E0256D8A860E53F57328F2EC2F4262EBC529F557F9F26B9BA3F05301B2D522705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422134, "uuid": "8202f69a-3a0c-4194-826d-13c678204e57", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422134, "uuid": "2168fdfc-22e2-41c5-ada6-69e13e77997e", "value": "3072:5CWx2NjVNpkN+GWP9R4OqH1D7TabyrFEAqEMXggbuT1xC+jZY8Q6aIZU1SPlgLMF:IQ2NJNppafamBEAqeTDu8Q6BZ8nOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422134, "uuid": "12012487-b35e-4e54-950d-45bd615b19f7", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422134, "uuid": "b8032b32-9bf1-4159-8fc5-4b6c621e49ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422134, "uuid": "5a7cf07b-2b69-4079-84ac-af5cd21dca23", "value": "6820a3ee6adc057dcb2b9b373d60b71b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a77652-d0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680398035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398035, "uuid": "3b94f0c2-e011-4777-bb70-46729f83ec86", "comment": "Malware payload (DCRat)", "value": "f8b29ac8c789dfb6648b12fc5d7864a1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398035, "uuid": "1d47d87b-dae7-46be-a28d-a7b605bb8046", "comment": "Malware payload (DCRat)", "value": "d9f58e101d377205a0eb569403b16572d30e78c54aca01a2473f1f0fcde9fc6a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398035, "uuid": "e993b47f-4ffb-4ff7-9cef-f92f95f1de33", "comment": "Malware payload (DCRat)", "value": "be8788b70ce54c592bfd47f29f962a655f953081", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680398035, "uuid": "6594a777-165c-4997-aa99-568e57139e6f", "comment": "Malware payload (DCRat)", "value": "ec3d7fbfe55ca307d2b64b0e83b5da1ac91d230eb50d36c3f3631bc7d3fb029adfc898880ed1b7294f14f7959e658408", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398035, "uuid": "0cd2e3f0-7ee8-4df7-9ba9-cd997fa89fa5", "value": "T1D206F1027E40CE11F01816B3C2FF454847B4E9512BA6E72B7EB9776D55223A2BD1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398035, "uuid": "44152aa0-5f43-4028-9906-af9d67ed753e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398035, "uuid": "617197ec-d5d0-441e-87fd-cbb7c3a4f518", "value": "49152:UbA30K1OMfWcVv6Y6feCfkOqg0yWEwwFywwtwWRifupv5Vp7foapzOkGfWDriGvU:UbcDucAs2l1FywTgWCD7QapzOkLDr5RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680398035, "uuid": "10b8965a-a648-4409-80d7-457d70587fd4", "value": 3760209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680398035, "uuid": "83404169-c6dc-43f1-8c29-4d83958fbc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680398035, "uuid": "5b07dd25-d318-4719-adfe-70e85a7cbd0f", "value": "Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c2104b-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450411, "uuid": "10b3444a-2ea7-480d-a8ec-9d7d646b5277", "comment": "Malware payload", "value": "b0f9b6b668b8f100458e7cc4d7d2aa39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450411, "uuid": "c0af17ac-2d4f-46a3-b737-013edcdfa942", "comment": "Malware payload", "value": "da2ba6d1ee6b5090f82102953e3af55a07956968e67c9cb76936d5a0623fc010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450411, "uuid": "4e96d709-5706-4124-a16e-d84c3d504c74", "comment": "Malware payload", "value": "dca6eaaa6b04820c01c5120aa2222378918480a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450411, "uuid": "85d8ae06-fe86-432f-b6db-4a47088c8c49", "comment": "Malware payload", "value": "eabea1cdbc1b21491d0ede129c978892a328805b363811af55b1a2a51a0422eeb2d972ebc6bc067acd7744d4f2f51dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450411, "uuid": "90da8136-3894-4330-9c18-fdd3a8d23eac", "value": "T139856B22B290C432D0A35D38CC5B97F89939BD11BD64984B7BE53E0D7F36B81A436297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450411, "uuid": "ab0c1e8d-8f87-4ff5-8d8b-4ab64d5f5620", "value": "a01c133e11aa08b256d020635a4d6d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450411, "uuid": "660a1311-1ee1-42da-8500-cf0647416b0b", "value": "24576:jOUFFZzNvrdfnYjvTJ1PBpKnnIU9kp0RCXgwF0o8CDvYLIZr3R+TM:jO4rNZfnEvT3BeIqkdF0Fn884", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450411, "uuid": "ecc2046e-269f-4283-9cc0-168ce591faa0", "value": 1781716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450411, "uuid": "4020cf6c-7edc-4aed-8912-c4c2b5e2835d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450411, "uuid": "3d9a540a-c49f-4857-b840-94ed6c086f07", "value": "SecuriteInfo.com.Adware.Heur.Sr3@RiNjcepi.17679.13705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2bc4b2-d101-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1680403819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680403819, "uuid": "edf1f147-fa15-4135-b0d1-968e22db78c5", "comment": "Malware payload (Gh0stRAT)", "value": "ce3a3fa18dc1185f0a882e8e60c9de30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680403819, "uuid": "6ff0ac4b-f21e-4daf-8c15-2219614ec0ed", "comment": "Malware payload (Gh0stRAT)", "value": "daa5cb9d13639ed8372068ba4f4a72e51bd1d2875f7618073e04c5cd67a933c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680403819, "uuid": "dfd9706e-4092-43f5-87dc-c420a7a16761", "comment": "Malware payload (Gh0stRAT)", "value": "e08f6feea1e4dc7d1d16192bc0510356c70b08d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680403819, "uuid": "d9097a6d-b20c-438a-a2f4-0715a75ab545", "comment": "Malware payload (Gh0stRAT)", "value": "6c7ad31470ae5eb71d3be07ea0f31a53b8757b81e96783b864689caed66eb905b8f4ff79c8d89eb3bfc85ea13257ee90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680403819, "uuid": "922a794c-97c9-4687-9f76-0d1b64003a9e", "value": "T1ACE38E14B6C1C0F7C966117084E9D7759A39B831076889E7BBB94F3D6E202E06B7638F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680403819, "uuid": "3762fcc6-05a2-4700-91fb-ca90b166c3cb", "value": "be3150ddad9822a4415cb95e69990d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680403819, "uuid": "1ea7969f-adf8-4a5f-ae37-2b3b6538f672", "value": "3072:iKufkrUsb3TKMsBp3YSZUdq8IBCHUkgsEH5D8idt5cG9:iLOT9qPG4W0GEH5QiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680403819, "uuid": "83527d41-9e79-4d57-8000-f284f79a19cc", "value": 147478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680403819, "uuid": "3bf7fae2-42f7-4540-b892-76c847fffd66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680403819, "uuid": "683b6546-a932-4c9a-b0c9-71ef1c0f69fc", "value": "ce3a3fa18dc1185f0a882e8e60c9de30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211cb57c-d144-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680432606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432606, "uuid": "cfe49106-4897-4735-881f-6be49fcb905f", "comment": "Malware payload (AgentTesla)", "value": "ea3f3a0c8e12bc153f91c2872c5a8442", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432606, "uuid": "a82c8bb9-70c0-4aae-b058-857269619e77", "comment": "Malware payload (AgentTesla)", "value": "db21d3b937591adbc97ed7470468fe89e1163859ea6fa6aad1180ebbadc4466e", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432606, "uuid": "372195a0-dac7-4e5d-85fd-3cd601898e1b", "comment": "Malware payload (AgentTesla)", "value": "eb72c8a0b22e361e0c1bba552db1a56ad6d0ea91", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432606, "uuid": "557517e3-61c5-467e-a3c0-0e26360992a4", "comment": "Malware payload (AgentTesla)", "value": "0354bd0db3444fbbe74164c44b8f04b6b406cff7a1b7aeca4155e945e0ef4f5c9b114b02566600fa6b08b9e042d8b247", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432606, "uuid": "74fd68f3-39f1-4a40-b006-4259c47173fc", "value": "T1DAB42315E05C71F02B13F3714D1ACFB26FB2C3386B414FBB690428AB4DEA625D2D5A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432606, "uuid": "32e79ef8-aac6-44e8-9db1-5d737dc90265", "value": "12288:Q9XaGEE2LKfIL2hTmiJoMDdFqv9626Gm7okH10:+azqhTJzdFq162Sk80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680432606, "uuid": "40086c9c-fd88-42ab-8278-544a1530f168", "value": 519654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680432606, "uuid": "23baeeac-5cb9-46fb-8df3-23a6feef55fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432606, "uuid": "532e5132-7f05-49d3-a5b2-6dbd52658d18", "value": "TT SWIFT COPY $37,000.00.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e0c92b-d16b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680449389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449389, "uuid": "724be1a7-fe2c-401c-92c0-4154f71a270b", "comment": "Malware payload (GCleaner)", "value": "4654d5533c4a669a238b47dbb0fc50a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449389, "uuid": "328fdb60-b36d-4279-bef5-f56f6cf37484", "comment": "Malware payload (GCleaner)", "value": "db396e0845fb4e19743f8cc0c1233f21f14a20cdf5f5c2b65b4e4d7f2a3f8791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449389, "uuid": "1eab2d3b-2fb7-4cbe-ba5b-92785656d1f7", "comment": "Malware payload (GCleaner)", "value": "539d6e7d186315b27fd7b77957b488960cb5708b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449389, "uuid": "8ee6dcb7-8fd9-44e9-8cb6-87ef3621baaf", "comment": "Malware payload (GCleaner)", "value": "ee3ef913ff4a1237b0ec139149a8fb7e24ca355b509d5b6f2b007a7fb7b2eb343573950c778bf8c286681d31fc16e206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449389, "uuid": "bd1e5d03-2ba2-4309-b27a-fa4ec717bff5", "value": "T18264AF4267E86830E53E47328F2FC3F46A1EBC629D197B9A2679FA7F0934171D912305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449389, "uuid": "d41bbf17-81ac-4007-893b-d94bb091a8ef", "value": "1b6416dd291a09c30fa39a9eeb2f405d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449389, "uuid": "b388e21e-f9e1-4d86-96f6-bd4d571bf6ed", "value": "6144:AH13WD3tpBSB8coYJUTVxTOQeDp64Rotto/+qfsqpc:AV3g3t6BDoYJOBeDp6kpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680449389, "uuid": "24ea0ead-efde-4f2c-b38c-edd1e9b43f46", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680449389, "uuid": "7594c832-966f-487e-b938-a88fd9f2e4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449389, "uuid": "7a248cde-bf62-4c7a-b7e1-68b58b7ca626", "value": "4654d5533c4a669a238b47dbb0fc50a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74ad5c9-d195-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680467647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467647, "uuid": "16405b2f-d799-4fd8-b385-d2a457e2ed7c", "comment": "Malware payload (AsyncRAT)", "value": "861717db2006acc5c994f64200f11466", "object_relation": "md5", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467647, "uuid": "0f0b50ed-5323-4bda-80ae-d97ac33ab52b", "comment": "Malware payload (AsyncRAT)", "value": "dc3030464177cdf0d0822c1c8b745540a888b9e334da2bc560e034a09f973fea", "object_relation": "sha256", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467647, "uuid": "0b6ad2ff-f866-4ff9-aff3-dc87c669ee8c", "comment": "Malware payload (AsyncRAT)", "value": "599def93ef9d01cfbe2917475b47a95b4c9891d7", "object_relation": "sha1", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467647, "uuid": "13d834d9-e0ce-4e37-82db-dda7811ed6e5", "comment": "Malware payload (AsyncRAT)", "value": "0ff1b7daec6780f6c14528c023edb2a6b888bcd6e969396fda79de069a3dde4daf03151f392c566a01ddf91098d5075d", "object_relation": "sha3-384", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467647, "uuid": "0ffe8f22-c1bb-46b1-a468-329ac6390218", "value": "T1A7532C043FE98129F2BD8EB099F2664549F5E16B6902D94E1CD442D70A22BC3DD43AFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467647, "uuid": "2ec6b73b-94c3-4ab5-b8fd-cadb68e257bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467647, "uuid": "5f58b3dd-4773-4242-8db9-340404d472a4", "value": "1536:ZPrVFns05+wtMwgK7hnDYbdfx9Vx7lx+JermkRq7wx:ZPrVFns05+uMwgShMbdfxZOexqkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680467647, "uuid": "556c4678-abc0-4ad1-a9e4-e692f74aa54a", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680467647, "uuid": "9c5c939f-414c-4ec7-b192-1cfc4fb77e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467647, "uuid": "4857d047-fcd2-44ab-a4ef-a995c1638546", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b7cce0-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456561, "uuid": "306c9258-904f-48f2-9405-8663c835c713", "comment": "Malware payload (Mirai)", "value": "7f7653b26fc850159f0c1552e7a88b33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456561, "uuid": "f422c8df-e13c-4581-9c15-2941ee6b26e5", "comment": "Malware payload (Mirai)", "value": "dc3b6a4f7c7de1f0d29bf7ead58bf6b7f1d037d6ab4956159eac4fbb17dea18c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456561, "uuid": "3f15afb6-b895-4985-a015-79dc5ac2a89f", "comment": "Malware payload (Mirai)", "value": "de0b53d3a54f0eadf84706ea58013f504ce0c069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456561, "uuid": "52385c2f-65c6-4d8b-8c9b-09432b88409f", "comment": "Malware payload (Mirai)", "value": "0699d1e835142a11adce5bb090e763fe44dbe68dc261cacc8c66b9619f6e2923ce00f15d1880238bdfb729e4953bba49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456561, "uuid": "04c09115-c425-44e9-8735-a3214ae5cf49", "value": "T16F134CC0A643D9F9ED1906713177EB369B7AF03E202DEA97D3C59932B942601F24728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456561, "uuid": "d43879d9-e5ff-4abc-932d-d46cd4cb1c83", "value": "768:v8s2NBoj/HMIerthtKr63Ta06BqelHrFWymDGu0fImih0SAoP0m+UAlky:k5foj/HMIerTtKr63Th6BDH0h9t0q8mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456561, "uuid": "5a2ba363-ec5c-45b7-a2ce-509daef6432b", "value": 43932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456561, "uuid": "cdede400-0cde-4599-b98d-28f15bdf09ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456561, "uuid": "c9cfe3b1-1d66-46b9-b5e8-25175022ba20", "value": "7f7653b26fc850159f0c1552e7a88b33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a492d08-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680448163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448163, "uuid": "283baabc-839c-40e2-a6af-d490c66a7905", "comment": "Malware payload (Gafgyt)", "value": "45c91aff6a07ab7a90666be54a0e719a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448163, "uuid": "721fd37d-1636-4a49-b6d6-8c16cc08b87f", "comment": "Malware payload (Gafgyt)", "value": "dca18f9838c8d5ba9f3ca29d0405c47a90a91850449d331f2c36ea322a2712f6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448163, "uuid": "2f2f99bb-786e-41da-ac73-3c218de03813", "comment": "Malware payload (Gafgyt)", "value": "989850e72d3771a38a4270b0354e5c794465971c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448163, "uuid": "f7bc7da8-f65d-446d-a2d3-262b0cf550a6", "comment": "Malware payload (Gafgyt)", "value": "b9e7902877ca5bbf502bfad55576cc240a060ff9a05132884e69656b7fd3423298a18ef374551a4a828500cf6322388a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448163, "uuid": "db2fee56-f37b-47b6-b5e9-49f2e25b16cd", "value": "T1B9934A27A612C6BBC0C742F557DF9A11AE13B8FD1B227206B3D8BEF83B055C56D59A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448163, "uuid": "d3d9646f-1559-436e-a3f4-9b1feb1930b6", "value": "1536:s7WRz6TH6/8dvRuTQ/cPTiFnKS31phaBvn007emoI5um2Xj5YZA0e:iRHpdv4TJrinKO1phaBvn00ymr5um2Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448163, "uuid": "bf7aa19d-6807-465e-b651-20735caf5609", "value": 91204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448163, "uuid": "782c6849-fc33-4e80-8baf-d51b34b5287c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448163, "uuid": "989de638-4e11-42ca-9e07-a9707496ffaa", "value": "45c91aff6a07ab7a90666be54a0e719a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278899c4-d0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680396968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396968, "uuid": "19293dea-434e-47ad-83fb-f15a5d5d1fae", "comment": "Malware payload (Rhadamanthys)", "value": "50e38ea43a9123a2543cfc69d8aa7344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396968, "uuid": "796f0b78-8f9d-4ad7-97f2-ef534e753300", "comment": "Malware payload (Rhadamanthys)", "value": "de024a0f3bec127c794943c5d1501daa67d6717dd22946e6f6b08428c01a985e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396968, "uuid": "7a5da70e-a32c-4cbd-a012-46d78544bd09", "comment": "Malware payload (Rhadamanthys)", "value": "7feab8adf410a684aac9cfe9c8a0d088881fd96c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396968, "uuid": "224165a3-5bbb-49a8-9c5d-3b6b3fcd1e4a", "comment": "Malware payload (Rhadamanthys)", "value": "d8373425318b80f9c2c733aebd36f14608748dab2508eb1cb8203562fd8ff00428cadd131bb27c0b8779ea17376d673a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396968, "uuid": "42d14936-c94c-4cd6-b5b0-d53a0147718e", "value": "T1CE849E0257D46830E13E5B328F1EC2F8261EBCA29F987F9B1675BA7F09700B1D662715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396968, "uuid": "c8a3f667-d32f-42d7-9bd5-270df32121c9", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396968, "uuid": "9c54caa0-5089-4674-810e-a37a1ffd6b59", "value": "3072:0b+AITcZpO7NaG27R42OkHtp08j+5+cHWHFp8wF8pTGtFqSKxwHIzE4Mb2boOxBr:GKTopOL25e+cHUswulo8H+sFoP3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396968, "uuid": "758c9d22-0959-41ef-9c1f-acdf6c503190", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396968, "uuid": "c3049f69-9d16-4435-9ad2-74e45b5bb6b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396968, "uuid": "499802c7-baa9-4710-a368-677cc73989ea", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca164e7-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450422, "uuid": "644dcfba-1df4-4255-963e-320e6a6e0f6d", "comment": "Malware payload", "value": "8da28ad5702c4bac8c847dccb1241c78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450422, "uuid": "37f31ef6-8f75-4910-8295-9efb647ff416", "comment": "Malware payload", "value": "de28d0557448a6bb49639563f4f727a6d862fa9383167508e7b3b919076b8316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450422, "uuid": "28051fc7-b116-4b26-a8c7-d20fcb23adf5", "comment": "Malware payload", "value": "c4461d1e4111b69cfd5a87945edb36f5d1bdb7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450422, "uuid": "14b61464-8f00-4771-9b5c-73e5e4d1010b", "comment": "Malware payload", "value": "59e08094bda39cc3c0294e210e5566f63864a95714ab2e29b6f95d2496f6d55fd1e4c857e631f8a344a30710b4c3ee17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450422, "uuid": "42bfc3a4-4b1d-47e9-931d-527cce4b4ab3", "value": "T15B347D53F2C188B1E17619BCBC1A999C9937FD322C3848AB6BD95E4C0DBC7C0985D6D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450422, "uuid": "cb135efd-3fc5-4348-a091-ab3e11268fde", "value": "1536:lwwW6UjfEpxOt04laY/gmADgkncxTEbwXxAwh+U9:lwwW6iAAOmgm2gk0Ebwywh+U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450422, "uuid": "02e68672-c1f4-46c9-90c5-e690e5cbae90", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450422, "uuid": "f96887df-9d48-4b94-b10b-7dd42266f678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450422, "uuid": "57cbc7ee-d491-4a19-a049-638d1055862d", "value": "SecuriteInfo.com.W32.PossibleThreat.27179.5726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c58b06-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450362, "uuid": "42b41396-4341-439d-8fdd-393a660b85f3", "comment": "Malware payload", "value": "b40a929f8a00a1b34869ddf1556a1a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450362, "uuid": "11c59599-2d58-403b-9200-aef2452b3020", "comment": "Malware payload", "value": "dff9a9722f7d999b06a1e0961454550307a8c6886aa41f24fe34a34d94fd2b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450362, "uuid": "bfe09dcb-8ee4-41ca-b349-4501f2535f6f", "comment": "Malware payload", "value": "848f470a5c5f3975720038cac8d93f9cca9b72a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450362, "uuid": "98068271-7df9-49f9-9cb3-85d8f4b03fe3", "comment": "Malware payload", "value": "041cd17b82b9f2e6c51ca7c995a6766b454842d3965f4479f3eb20e804ecc3f654e358ba7031ef91682217964eafce1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450362, "uuid": "911d2ab9-1c28-4fb3-99f0-05d5b714c9f2", "value": "T1B8135B07FFD2A473C0C48470E964A0AB93B74B7158908E57AB405E5DBAF1B89D939B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450362, "uuid": "f14c70b6-33ee-4c7a-8270-0cb3252a62ac", "value": "b92682f5ffeb6701642dfd661de4ddeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450362, "uuid": "5f3fd9fb-f257-43dd-935f-ca7758c01339", "value": "768:iKTcCMzm81ZMzBU16VQY1NrlIioyLgLL4JRM8f935OHsw3:iKTcCu1snh1Rboy0P8RMGjw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450362, "uuid": "a986c4bc-e8d0-4b27-bd04-fe9425d08495", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450362, "uuid": "7de121d2-359a-4996-be15-f85ee1c05d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450362, "uuid": "514ad995-40eb-40b6-90ac-0efe17071d12", "value": "SecuriteInfo.com.Trojan.GenericKD.4302624.24222.24270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0b8be0-d187-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680461565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680461565, "uuid": "d73d6f92-5c59-490b-bc77-075000b75906", "comment": "Malware payload", "value": "379657ca31d7cdbcec7a305607f869ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680461565, "uuid": "75379b7e-5fc6-4409-bd9a-6c22804e739c", "comment": "Malware payload", "value": "e06ad57d007c9e4b7346de36d29581d82709419dab5ba2a80e578a771d71ecf8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680461565, "uuid": "ada8c839-5c0c-4b52-bdcb-fdb5ee11a94a", "comment": "Malware payload", "value": "930cbd45cabb49579066f86572ccb5de68962a46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680461565, "uuid": "ee4b4095-ddff-464b-8b37-56a7a4ed56e9", "comment": "Malware payload", "value": "dd37e4353035dd684e9d7cebcc8f69db3eaf306bd614bbc9c5146fe2972dbb2c6d26c6cb9903da1a6d68269dbef0ca5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680461565, "uuid": "6f48472e-6733-4501-a17e-d6b72bb5dd76", "value": "T1E9C407D513D50B26E1AE273F96F39A5587F4F460A7BED78F104409AB8CA3B924C80763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680461565, "uuid": "89df0388-c5c1-4c0f-b5ab-1e2cfcab6c06", "value": "12288:OO0oCm1IeGdvXWZqWWsYtYWg4bkVjafdXpkRvJkO8zi9:Cr9euvaV2dX6veO8zi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680461565, "uuid": "02836a21-2a80-45de-967d-8f624494f855", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680461565, "uuid": "7274442c-7c2d-4890-9c84-f30be0025ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680461565, "uuid": "a02bf00f-0b51-44c2-9bb0-24f742ed062e", "value": "RECIEPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899aa7fd-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450390, "uuid": "73b91c31-9b46-4578-bbc5-1d23fa84ccc3", "comment": "Malware payload", "value": "f1c90a3eae77b1067be4ba0ac6dde815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450390, "uuid": "7d4461a6-d1d0-43e1-8f26-fcad225155cf", "comment": "Malware payload", "value": "e1f14b3a368dea04f8b84d88538b1cafb18f602e29fac882dde81455f5258088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450390, "uuid": "ff4991de-9d06-46fa-9f1e-54e9456cb7d7", "comment": "Malware payload", "value": "8d5729e3e17635643481a0ea3fad3d82c21f49dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450390, "uuid": "1303a40d-ee0b-4630-a935-1b47c4f1bedf", "comment": "Malware payload", "value": "6461d321b15fb475ad2190af3f69b16b154ab86aaa5553585b032992fcb0b6b77035682ac01db1ab2d0887ce97a6beb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450390, "uuid": "c896e730-9760-4d8d-9b39-e701834fbc1a", "value": "T14717AE1273E4453AE1FB2731AD76A3255ABBFE621A31C74F368C652E1F327409A15323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450390, "uuid": "4d4eea25-3330-464c-a30b-aa7cb4673deb", "value": "196608:UMcp6H9CKecYPe7tKEGtt1OFYsH0e3oJZYIfZDni9Fzeybkgcb:3c4H9C9W7tKEQ8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450390, "uuid": "afe53c94-096e-4ed3-a857-ec57a19af5f5", "value": 19719101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450390, "uuid": "c020ac78-1a36-49a4-a458-b2f07583d970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450390, "uuid": "4ef015cc-fc97-42af-9e79-bc050d822f2b", "value": "SecuriteInfo.com.Heur.18009.20421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a803d1-d0f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680396591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396591, "uuid": "5f807957-1c4a-457c-be21-82a93b4348e7", "comment": "Malware payload (TeamBot)", "value": "12aaaa275ed1642e9c773405c9d0d3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396591, "uuid": "4f3e2295-d07b-4a15-9410-1999134f46b3", "comment": "Malware payload (TeamBot)", "value": "e4bebf931d0de29d610fbe2b26748a6e456acf053ff5407019d8e13b0ee56e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396591, "uuid": "10525b24-81de-4e60-bdb6-899c3c59be5c", "comment": "Malware payload (TeamBot)", "value": "84579f8e8b74fcb1bfbad661da1a2b61fae05f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680396591, "uuid": "21c10b47-39a2-4ae2-9906-50ae6dd9faae", "comment": "Malware payload (TeamBot)", "value": "a97c01979ce638dd562d88eab9cfcc0407f59f708f65d61e78af08c17f6ce4b42b6541dac53929bf76e09b5bd20a3749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396591, "uuid": "ebe2591c-3d4a-4255-b803-8ead95f7d764", "value": "T17424CF3176D1C0B3C45BC9705864DAB46ABEB8319B6582CB37685B7F1E302E0963A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396591, "uuid": "81414c29-ae97-4017-b7e8-6e2b7309a8f6", "value": "724f7af50306908b18449bf42724cf5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396591, "uuid": "9d855b1f-cae8-45d1-b9ba-b01e2c3040b2", "value": "3072:C7QysOzyNth2lHiTfnd8lsPBI+1kqSOcAVbM3D2j5gW:Jp5h2QTfd0uS5gojW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680396591, "uuid": "afed6267-b92f-4baa-b99c-04d13f006787", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680396591, "uuid": "fed6c30c-b327-4092-9b6f-e37dfffce4d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680396591, "uuid": "f8b71cf0-ce88-472e-af07-9919137c9d7d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d459da49-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680422598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422598, "uuid": "e1e430bc-8b14-488b-ace9-8f2f5f59f823", "comment": "Malware payload (Amadey)", "value": "39a358122574af91292d2a34ca8695f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422598, "uuid": "c79dea87-bd62-46ab-ae61-90e360bd5b99", "comment": "Malware payload (Amadey)", "value": "e61bb7b21a12a6d375b1903955acf2bffd4572989a6677b59a8fa9e74b3f9550", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422598, "uuid": "679da765-84d6-4456-b4fc-4e0e4bc2a705", "comment": "Malware payload (Amadey)", "value": "235afaedeee4dd3c7ce4dda7d28293c92d49dab3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422598, "uuid": "1a2e1be4-c5db-4d8a-abb0-23a4eacdfb93", "comment": "Malware payload (Amadey)", "value": "5612c433b3e115f6d44cbb9ea29e2ae0b165c49073308a11a18c18f1f39b0bf30e6c089b1ff6a4c9901beed99637b722", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422598, "uuid": "fd948c0d-0dd9-4823-bf83-2f15a98cb69a", "value": "T12F252313BAED8033D97527702CF612C30B367CE1AD24875B7656A6291DB29D1B87332B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422598, "uuid": "3b809ed0-3536-4264-8b45-b3ddf22b47d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422598, "uuid": "0d441566-9a2e-40ee-bbda-c59b75c56591", "value": "12288:qMroy901lT78tQz7up8j8Ki6MvpYtN6t7DrC4GiFk8sfMeLA4yhzQbwbDzx:myHQzLj/Mvqwtm4GEk8KC4yhz5Xzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422598, "uuid": "6ac265ac-5c35-4c92-9980-5bda594f6d7e", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422598, "uuid": "fb43fb8d-87b0-4571-8c3c-cabaecfc69f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422598, "uuid": "c1be6999-1bee-4df3-9289-e5cd43cd2788", "value": "39a358122574af91292d2a34ca8695f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beba0fbf-d149-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1680435018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435018, "uuid": "82f820d0-33af-4bd6-acd1-20d72c6d8cb7", "comment": "Malware payload (Gh0stRAT)", "value": "133eb1dbef01ee6e57b7f6c8c65e3de0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435018, "uuid": "9762d852-a488-4017-a257-9b55a47e21fb", "comment": "Malware payload (Gh0stRAT)", "value": "e7266367dff0d4d6928ca09dcadff99afcb208bd9fa48a75964c427a332ac63d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435018, "uuid": "ae39d515-f6bf-4d12-939b-e0a3c53ed952", "comment": "Malware payload (Gh0stRAT)", "value": "cff4234d29dbee4c28680fb251e7fd0e5b443d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680435018, "uuid": "dcc63fc0-1992-4a08-85d6-0e26c301cd35", "comment": "Malware payload (Gh0stRAT)", "value": "be3f57fda6780a5f0178b5495f80e0e5f04fc4af7e19e2c3fa9bdd2e59a9bc28b2a46cefeab6c63c96f7175526151077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435018, "uuid": "6385217b-d6a5-4901-ba41-c4c7d5c2e009", "value": "T1BFA4AD1233E0C877D396B1B4C9C297F5A265AF011F2599C36FB1370E2D721ADAA32E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435018, "uuid": "7d4b9605-2e93-490c-93e3-6b9471159688", "value": "77eef4e097d1e4bdf8b3e7692e2593aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435018, "uuid": "903dff30-4407-43a1-8550-25a6708b77e4", "value": "12288:bkXOs/EQaS77z/t705Hux7xGTjCbqWd+YeMU:c/EQaS77TR05OxdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680435018, "uuid": "e3a770c0-ec92-454f-be18-18fea97d1fa3", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680435018, "uuid": "20822097-7a04-4971-9ffe-c5ef8bd19bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680435018, "uuid": "fd95a9be-729d-4649-801e-0be472188f20", "value": "133eb1dbef01ee6e57b7f6c8c65e3de0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b00a58f-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450420, "uuid": "725c6e9a-edd5-4faa-9adf-fa8c88a95779", "comment": "Malware payload", "value": "55dad0455048ba2c49bf016a5fe3e19b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450420, "uuid": "b8e9f247-2692-4b4e-a057-e24bac13d2f1", "comment": "Malware payload", "value": "e8257f70fe49d345c25e5b8ccd72320ee64363aa6e5c94fa1cb5abd8bb49d359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450420, "uuid": "d1644422-da32-41ba-b59a-3c808e64ab37", "comment": "Malware payload", "value": "32e8539d06bdeb95cd093a1d5d266cf98cdc687d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450420, "uuid": "5a7389ba-2915-45b5-9e09-d54cc5bbec37", "comment": "Malware payload", "value": "8f75fa9c0d1f79168510b62752090e180caf0356ce7e8866fd285f4a908bb73180a66c283f83f22ccb04be82699cd5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450420, "uuid": "cd35b61c-184a-458f-a3d2-997b2113e5a9", "value": "T11EB57C22B290C432D1635D38DC1B97F8A939BD116E2498477BE53E0DBF36B817836297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450420, "uuid": "e072a607-279a-45ee-9357-aa166e6f36c4", "value": "ebf28b3df00da45274333bd97f49e07e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450420, "uuid": "dc60a85c-8c78-4aad-a94f-5dec46600c4f", "value": "49152:CBeIqkdTIO4rNZfnEvT3BeIqkdF0Fn884:CBbqBzZVEjBbqzBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450420, "uuid": "158befb3-9112-47dd-9e62-12b166c85f40", "value": 2317364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450420, "uuid": "32b7edb4-93e9-47d1-92d5-b52e38251a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450420, "uuid": "9fc7ce11-7b99-4a05-b294-1668bbc1afcb", "value": "SecuriteInfo.com.Adware.Bho.3897.27714.7778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68933698-d115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680412539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412539, "uuid": "1dccf159-97d3-47b3-88b0-6a1b17b1345d", "comment": "Malware payload (Mirai)", "value": "191f21ca652f8e8045209b5dfa05abc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412539, "uuid": "d94ff020-860b-4f15-9909-f89f24a82e29", "comment": "Malware payload (Mirai)", "value": "e8691039771d38d13c7268d28eb606200badd3b528365caf9bd1109e79d6b644", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412539, "uuid": "89ca3960-7665-40ae-b410-7c136996ebb8", "comment": "Malware payload (Mirai)", "value": "f3d5ecb9d089e7841f9b5611f431f9e328a2cc62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412539, "uuid": "e9e4cedf-9936-4ea0-bde9-fd60a470fdf9", "comment": "Malware payload (Mirai)", "value": "eed8afe0cb97c58bb7fdfd1ca64fb9f58fa57dcdf8ad12b3db886fd3f7ea2c5226e56782aec6a4443a983487ca37a7fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412539, "uuid": "48bdb43b-dc88-4958-a6cb-f2251b5b1505", "value": "T18D82BE6064B9E8B0EA200575D7798F873BD312FCC0F870B5662240B85386A19F2BB5DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412539, "uuid": "250f756b-df63-4408-bc77-d75fcfaf5279", "value": "384:I7v2s2ep5DuPNrq33vukTIL0VoXjn9SoQCAA9BObl7SOgq28hymdGUop5h8w:bs7HSlrwmQIL0yJKr4qbs3Uozuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680412539, "uuid": "a993192c-e597-4f19-90b9-c51a236d71b4", "value": 18424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680412539, "uuid": "ab246412-87b1-4d8e-931d-477bd47aea3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412539, "uuid": "3d6a9fde-f7a6-4406-897d-37a86ca8159d", "value": "191f21ca652f8e8045209b5dfa05abc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fab699-d17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680456511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456511, "uuid": "7b12111f-b219-4965-aaea-3641ea50485d", "comment": "Malware payload (Mirai)", "value": "dbf58c5b5e4ae8b41a9e16b6ce1c6364", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456511, "uuid": "0b0bd38b-3fe7-4be7-a4a7-a9cb335f67a9", "comment": "Malware payload (Mirai)", "value": "e9593d28a5d1d27e6853c2e5e9b6859b6a38b9977bf6f0c9cfb5524e26cca17c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456511, "uuid": "b65c12c2-b2f5-410a-a495-4ae0656de56b", "comment": "Malware payload (Mirai)", "value": "a27f0afa1041c1606e34354b93c16444edbde223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680456511, "uuid": "cd4f413a-4bc6-4819-a2ba-48093f01b80f", "comment": "Malware payload (Mirai)", "value": "9665da919d30c57baa5a74cfa8dc7f2d1ad035bf59981d457ad09d70b3f056ee0b919d6f3d71d3e1a4aad4d075e64f75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456511, "uuid": "bed77053-fc37-46e5-8136-ccc4b973dbaa", "value": "T103233A91BCC19916C5D423BBFA6E41CC332563A8D1EF32079D222F517BDA92F0DAB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456511, "uuid": "dc116387-ee6e-4e81-b6a1-2435799a0a6e", "value": "768:mXU5fYgGsGZi97S5ZC5GNJ7wePIr+5t5lQTbQzFtw7mMVShrKK65/iT8DhheKTft:bfY/s97SfLr5ldzFK6M8h+/x1hRSoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680456511, "uuid": "ad5a3544-1225-43bb-8629-52c8eb026dd2", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680456511, "uuid": "79294dfb-ba6e-4443-a8c6-17b6dcab74a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680456511, "uuid": "2e9100bb-2068-4a50-aeff-d779a9f75857", "value": "dbf58c5b5e4ae8b41a9e16b6ce1c6364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e3db6e-d12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680422546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422546, "uuid": "ad4c8dee-d0e1-430a-9715-18c47fa301fa", "comment": "Malware payload (SnakeKeylogger)", "value": "02059dc7c9c64e54ddf584ec867daace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422546, "uuid": "cb92c8d9-0032-4ebc-8ce9-a54cb303ba20", "comment": "Malware payload (SnakeKeylogger)", "value": "e9fe41087ecb0d059624fd69ce267cca7bf10f38c96f3d5e1949ecbb2d48b623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422546, "uuid": "022072e7-e1ef-44ca-94f4-006ba9a7c4dc", "comment": "Malware payload (SnakeKeylogger)", "value": "50fcdf8892b156c33089c272471e2654d079acd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422546, "uuid": "2ddd1752-0b7b-4ff3-b572-e7f05e82e829", "comment": "Malware payload (SnakeKeylogger)", "value": "5a908289a7524a160d0995ad36744222dcd3fb3cf4514e3f39a9684a46ce26128521ddfa2ce1cbfab89a1ef1f8164534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422546, "uuid": "ed803bd8-b4d2-4079-a0dc-51b93ef760b6", "value": "T14E45AC4BB7B0A436F89E51BC063812CF5E31A253355CE2265F7B79448E9AEFBB1C8111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422546, "uuid": "a1ea2081-cc47-4ffa-b87d-163928281abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422546, "uuid": "18d06724-3592-45bd-848f-749a5c083ae0", "value": "24576:EtOPOyz1FaYjBaxGrpHW0nOW6u0/eMGUl12E4/Ctcu:EYPOyRFaYmGHZnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422546, "uuid": "05fdf75f-1e52-41a0-8e45-5272156df368", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422546, "uuid": "9b95fcd9-ba91-42ef-91cf-85450f504aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422546, "uuid": "3beabef2-68d9-4bae-9a0d-54a08b821778", "value": "02059dc7c9c64e54ddf584ec867daace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f61ef6-d195-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680467567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467567, "uuid": "7d97ca49-2f97-4e5d-8a5f-0e7c6f760f25", "comment": "Malware payload", "value": "134393cfc87759a8c6d32ee50988dabd", "object_relation": "md5", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467567, "uuid": "f28c009f-d85d-4c23-bf53-eb98739dd04c", "comment": "Malware payload", "value": "eabff018c3ebb3ac47878699565cf1efcbd66db0788914c5a5f7e4b8d0b3251b", "object_relation": "sha256", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467567, "uuid": "4d924504-3985-479c-87d7-7be4a54961d0", "comment": "Malware payload", "value": "8fd8494c1dca9e100b8f713757014cfb64c1cf83", "object_relation": "sha1", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680467567, "uuid": "b58385fe-733d-44ea-ac38-97f92388e47a", "comment": "Malware payload", "value": "08d63643f5e1aa5db64b9efdc6713db4ce499d4b3314df6f8cd1ca394482f833ecf7fa315cd72a0c175f6b1cba3db78e", "object_relation": "sha3-384", "Tag": [ { "name": "AsuncRAT", "colour": "#3BF756", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "runner", "colour": "#37EA1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467567, "uuid": "51371f98-0f66-422a-b38a-59eaea813e06", "value": "T17B13718C7A5076DFC86BC976CEA91C64AB60647B431FD303A45712E99A0C69BCF052F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467567, "uuid": "811354bf-a61d-42c4-8582-981206763c85", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467567, "uuid": "2c5dae11-afa7-41e4-b566-78cf1794cce3", "value": "768:OVjjYaXnvzcCffTcoiuWn2MHJBp1WYy4OzFu9Nl+fOu3q6YOy0M3z0OeQ:gj0aXv4CnTcoiu2v+fO/Oy0MXeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680467567, "uuid": "be8da577-1412-4b10-8361-39868536e0a5", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680467567, "uuid": "4820f0a8-f827-4034-a8c3-508a432c0c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680467567, "uuid": "56b61744-9b73-4035-9045-e1541f30adc6", "value": "NewPE2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cfab71-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450416, "uuid": "83232df8-bb3b-45a0-827b-9b0eca4a26ba", "comment": "Malware payload", "value": "9fa450fcb608c440d5a7b3e4159423cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450416, "uuid": "c35fa775-d69e-4cf4-bf24-fd976ca9270b", "comment": "Malware payload", "value": "eac03c03a6ec88b9e4b6f339fe2583e54fc6a109123dd6762c8f0c5c90c30d98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450416, "uuid": "a0d5de07-0122-4442-8ccb-2f66a641db51", "comment": "Malware payload", "value": "73a1667c59b52e6bfe91771bf3283ce01a0ff5e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450416, "uuid": "3681618c-431c-48db-9ebf-a83b336a88ad", "comment": "Malware payload", "value": "74894dcd073e3cbbec044e61369888b04c1162329774d3f340600a8440ed57b279724351a75fceedab03123db01b3411", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450416, "uuid": "45edee89-19be-46ce-8b6f-7dd2ccdd3e0a", "value": "T158A6AE1133E88A3AE2BF4B35A875911156FBF9225722DB0F758D162F1F727408E217A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450416, "uuid": "ef5b94a6-776c-4366-a699-c64086768107", "value": "196608:ott1OFYsH0e3oJZYIfZDni9Fzeybkgcb:K8H0e3oJZYEi9FCQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450416, "uuid": "5df2689e-c50b-4674-9db8-16736d9e7985", "value": 10322285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450416, "uuid": "b16b507c-21a9-4f1d-b7f3-500356960158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450416, "uuid": "7f195d5f-7c39-40c5-91cf-0e6562c9b377", "value": "SecuriteInfo.com.W32.KeyIso.A.gen.Eldorado.26803.13812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8743f3-d0ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680395473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395473, "uuid": "b578c14e-3620-4880-9b47-dd9f750abcb0", "comment": "Malware payload (TeamBot)", "value": "df71e5d06dc8903c1db15de11e84102b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395473, "uuid": "6b7d113a-754e-43a6-9418-2f183676fdbe", "comment": "Malware payload (TeamBot)", "value": "eda25afd305a4158d3b02d9ad03ec2d866cc9abb51f008dbbefa9fb7de800e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395473, "uuid": "17c75b34-0795-491c-963a-36b3477379c7", "comment": "Malware payload (TeamBot)", "value": "45fc85968f782d5357d322165941c580020838db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680395473, "uuid": "f1499ade-3991-4a09-8630-af0f76929773", "comment": "Malware payload (TeamBot)", "value": "1d227977ff78fcacdfbdbd902ad1c88a9429f79aeccb2c16ad3b2d18a188b088caa174935548c18cb6d220ad55e6a464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395473, "uuid": "7344ddfc-6f8d-4248-bf81-d4a6f8cf13dd", "value": "T15F644B4253E06871E5235A328E2FC2F43A1EBD52AF357E6E1A4BBA3F0974171D162F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395473, "uuid": "3b66803c-9772-4dff-ae61-29ae4ce6ca48", "value": "bea0621f64bda454c259fb9cfcc3b2f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395473, "uuid": "ac6983dc-a37d-4949-83d6-9bc4353d1417", "value": "3072:0OTNNhXHQ7Z+f2EYdMd0+YDSujHjYJMnepqGi8/8m0P2qBBId7vWYgOHcf:PNh3Y+fFEHjQOevI/W+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680395473, "uuid": "d6098c0d-935a-4690-a476-78ffb8602570", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680395473, "uuid": "5e276ab7-f1db-434a-92b4-d191775fafc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680395473, "uuid": "4abffaf0-c521-4dc3-bf01-0074a9bc46c2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c16af8-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450327, "uuid": "454eeac3-6e66-47a1-a571-6d4bb3609ff0", "comment": "Malware payload", "value": "636d8bdb934ab891f2b6ddfd38ad6372", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450327, "uuid": "f24d0c33-ea62-49cd-b809-4c1ff5512b29", "comment": "Malware payload", "value": "ee2140ed353d552f24324f4078f27678030216e049013129706bf65cd70726a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450327, "uuid": "60c6f62b-a0c3-406e-a098-05264df4604a", "comment": "Malware payload", "value": "092264af3412c94fe172a25a6634af56b880bc8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450327, "uuid": "764b8be6-17bc-4623-8150-d474f2e4aa5d", "comment": "Malware payload", "value": "d27f8ec4ecf21bdda8d4c4d8382c35db82a731362b6b01501b3b1eeaef1a9ca27c4a84ebb68780fa78eeb89a1fb99596", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450327, "uuid": "01f43591-5a28-4665-8b9e-5d89334c4f90", "value": "T1E1A51206F2D3C8BAD4780530488B9F96E952AC514D799ACFB6DEBB0F3F76150ED12122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450327, "uuid": "c525f70f-cb59-43b6-814c-fdd767d95909", "value": "d661a9f1f159e1bc3b24a586ed9208b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450327, "uuid": "dc0764cc-dce8-447c-b0a4-03493a4ade08", "value": "49152:6f/Nut9eG7yt82CkA2lV8XfAxdoATY5Jnti78qdyem:aav8825VVkfAd7Y5K8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450327, "uuid": "79558c64-95de-4098-87e5-22edfeca8bdc", "value": 2236720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450327, "uuid": "8b19ac03-5227-462a-9812-cf68408ec24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450327, "uuid": "9f044070-f0a9-4f6b-955b-7392ae6181d9", "value": "SecuriteInfo.com.not-a-virus.RiskTool.Win32.IMEStartup.12805.18410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e1499e-d115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680412585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412585, "uuid": "93b279c1-1694-448a-9ba6-e2fe9c33fd26", "comment": "Malware payload (Mirai)", "value": "e44db2aadaed445cc55b7304206e02b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412585, "uuid": "b50c0d5e-89c1-46e5-8ca4-fc2ad8433e12", "comment": "Malware payload (Mirai)", "value": "eed1bfb3d07d049285f2ab7e2ccb3035b525edb8a3fedd4e61c391cf4734071f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412585, "uuid": "7eaa52ae-a68c-4510-aa4d-4855bbdeba5c", "comment": "Malware payload (Mirai)", "value": "c340ac526d1413f867b36e5b62ffe535fb0fc7fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412585, "uuid": "52deb157-5439-4fc8-a8e0-2ea373b8f8ea", "comment": "Malware payload (Mirai)", "value": "d4d100674572bfa02cfd7d0371f518181933cb69ee5ca6973e511f09c57ba59f45568fad785f63f45f5e6d02770cce68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412585, "uuid": "f139a07d-0433-40af-812c-85bf132c1caa", "value": "T12AB38CEBF24702A0C86246F007CB4BED3E2323816F2785E77D6A657958791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412585, "uuid": "5afe5693-7981-4bf3-b344-aba745fde733", "value": "1536:BTAeK8s1NKYSpidMuXiIgUp2lWqg3Y/LWH:BTnwOYyMMuWUp2lWqg3Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680412585, "uuid": "7744899a-b745-486e-90ec-311b7ee17596", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680412585, "uuid": "d8fc7255-e684-43ba-b183-121f9d8e37c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412585, "uuid": "e42eb3ef-5beb-48dc-9b6f-3215a26c879f", "value": "e44db2aadaed445cc55b7304206e02b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba3e991-d128-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680420651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420651, "uuid": "d3d4808b-9524-4adf-9b19-dd21be5d351f", "comment": "Malware payload (CoinMiner)", "value": "86d0551f1f1fabe18d3932421b4b9b66", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420651, "uuid": "2120fe7a-57e5-4683-bfb4-955d64bd286c", "comment": "Malware payload (CoinMiner)", "value": "efaaa8ecbfb81f33bbfb791209f0e386756b6a5242428d178efda0ad93ac64bf", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420651, "uuid": "f07a78fa-f876-4446-a7f0-4ae519bba90a", "comment": "Malware payload (CoinMiner)", "value": "f0f5c37e09f0c7e4c39dcb5bf16c84fb4a6144a2", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680420651, "uuid": "007650f1-e69f-407b-9aa5-0f062088497e", "comment": "Malware payload (CoinMiner)", "value": "0eef406cfdc46d12de398974e4a2be74b38b50240277f509cd7b64730a3cb5a7372a217ef91fb5a36abc5651199cfdac", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420651, "uuid": "5550963e-a487-4632-b6b5-35ff46dac4d5", "value": "T1B2B6D0A69B29883DEF073A3560FBD395F4ECA8805C9EE1192509644E038E5FFDD0997C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420651, "uuid": "6919f971-48c7-4ca0-9393-91c781d3bacb", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420651, "uuid": "eb1aa8a0-bd72-40f2-97a9-a0dd71a43100", "value": "196608:aAZZ3n6/MaXqImepdc1GPzWQXfIvmdglbubFVLOjbhNr:aA336/MSmepWbQXfIvmdglbiEnhNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680420651, "uuid": "dab8d579-7255-40ec-8a5e-25ba01920a81", "value": 10469032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680420651, "uuid": "c4e8eed6-bf8e-4797-993a-6ab396acb2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680420651, "uuid": "77457dff-d665-4506-873e-e71678402841", "value": "86d0551f1f1fabe18d3932421b4b9b66.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba48060b-d16b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680449613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449613, "uuid": "b0c24857-6590-4d83-aa9d-a30f5f139df4", "comment": "Malware payload", "value": "c72d0a13d76f6cbb713922b5b48e2d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449613, "uuid": "48d2c452-f0a2-41df-b1fd-69c8c9203161", "comment": "Malware payload", "value": "f04f7c4388d063e19fdd1a7a9661c7e74294a5db335d4981cfda0abd7a158372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449613, "uuid": "f2bd35fb-fc47-44b9-a8a2-b9fb7abe22b7", "comment": "Malware payload", "value": "32ec79cddbcc637fff8bc9aeb730ceb3f249e6b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449613, "uuid": "7985c397-e3db-4272-9e88-e1d3639e67c0", "comment": "Malware payload", "value": "0c14173bb8421a704f434fcfa7c3e6803ae8e878dd2d02de6c18639a866af1c49d10ae926b22bd9abd57c40bcd226e59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449613, "uuid": "af51723e-7392-4470-9b00-0d80fd577e0f", "value": "T1E394AE0247E86870E53F57328F2EC2F8261EBC629F597F5E2679BA3F09340A1D522715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449613, "uuid": "cd5039c4-9fd4-46b0-bcea-6405473c9cc9", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449613, "uuid": "5f9873d5-f928-4d47-a11c-8e176307e61c", "value": "3072:BPGFHcVVF6fNgGCR4QinHZCdh+6qM3wG//xuFoqy1Ib7jYuVrrcaCNoe3dM3dNBb:pUHcLF6TL6/89MOY0CiRBC1qj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680449613, "uuid": "61f05cf0-5753-4f92-8050-f4504f61cf7c", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680449613, "uuid": "773d2bc4-1dc9-4579-9544-8a6233cf2326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449613, "uuid": "9160ab65-3795-4879-bc64-1ec798d87b1b", "value": "c72d0a13d76f6cbb713922b5b48e2d3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1c0a2f-d115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680412569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412569, "uuid": "4f5b7697-1d63-43c9-ae76-a1ff3cbf7d49", "comment": "Malware payload (Mirai)", "value": "9db9d50d51b68a10d04bd921f3e7d797", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412569, "uuid": "661a8cbc-b08c-4dc0-b444-8244d231d2eb", "comment": "Malware payload (Mirai)", "value": "f1472e320172cb3e6773f2a01058115ee609089845f0b55a75ed24f326280af6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412569, "uuid": "2766fd56-972d-4748-bdee-902a4f2d75fe", "comment": "Malware payload (Mirai)", "value": "35386f939d00850d2621cb265a3be4349d688953", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680412569, "uuid": "f0e60417-96c8-48db-be6a-82a29a0f90d5", "comment": "Malware payload (Mirai)", "value": "4a08fd826966f3f402711cd3e69aca6837e3471c830e9853260ddbadcdb579179b1d6527d972db788dfbcc321732e265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412569, "uuid": "4b2650a2-a914-4db2-9786-5fdbea988332", "value": "T1FE23F17A15623A02CA5460FEAAE0040776553BA5E1F73BF6928D5CDCF9EA9C712FC005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412569, "uuid": "89d08ebd-e31b-477d-83f2-d3a4f0e96fc1", "value": "768:WVtqm0GO3oPklQX4RVubtNimOzgrllko9q3UEL2uCW/A3+ZZHnhb:WV+GO4PkCkVM2mOzKsL2uCsA3qpn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680412569, "uuid": "93ce65d4-adba-42d1-9136-b9d802e4837e", "value": 46580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680412569, "uuid": "82047c2f-076e-43d0-ba35-b92015b0f99c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680412569, "uuid": "f8d1d9c8-e30b-4b01-bff0-84f8bc1e40bf", "value": "9db9d50d51b68a10d04bd921f3e7d797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db04b151-d136-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680426905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426905, "uuid": "0d76f560-f648-410f-88ba-db7d3ce51f2c", "comment": "Malware payload", "value": "b27c371967d3db0b36cba3db46b77cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426905, "uuid": "d4e0154d-b18d-4788-9c74-abe454e67e4f", "comment": "Malware payload", "value": "f24d6466374003c8dd783d19979b0364ac09322a4e24ce0a6361cf980a4425a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426905, "uuid": "2ff14fb5-af15-4849-8f61-ca6f9524fb29", "comment": "Malware payload", "value": "a6e844510107c303a54bb726e3bf0a690bb9826f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680426905, "uuid": "b750c274-1d6e-4bcf-bdd8-9c5cab25382c", "comment": "Malware payload", "value": "7347a2d35e3de04da5fffa7d4f03e70e777deb7d28fbfff3daee4e52b95c3727ab18faea2d8ac18d4ae7d43b108e6b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680426905, "uuid": "90e3ef0f-4511-4d9c-b7a8-1a59f8bffff2", "value": "T182A44B953A985C86F750C97840F2D3F761B8BCB08A164B0265E0FF3FBB35A953D89249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680426905, "uuid": "e4ac1486-ca90-4f81-bf22-ba3acca963f9", "value": "4fb1914d5ddbbd80791f2f249cf92e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680426905, "uuid": "0c92e287-ea97-4023-8158-fe0d162c1674", "value": "6144:h2WISICCiolzkKhOx08vF2EFCTwRTg/bl36VCiVW2x3IXl62dlw4TKa/v+zTapxU:ZIGomhhbYPKYcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680426905, "uuid": "c30a0a66-b032-4e84-9bd3-f8b1aa914134", "value": 456568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680426905, "uuid": "025d4d64-e0dc-4742-9505-b1171a1f1b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680426905, "uuid": "b567aa42-a93c-494d-9343-8aefc034b207", "value": "[720p] Fast_&_Furious_10_Vin_Diesel_Jason_Momoa_11bit.7CHan.x266.MRNA.MySiLU.HECV-PSB-YIGY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6eeb1f-d166-11ed-88f6-42010a9c006e", "comment": "Malware payload (000Stealer)", "timestamp": 1680447332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447332, "uuid": "1337c58d-bdfc-47ce-8474-f43a4f9dc10a", "comment": "Malware payload (000Stealer)", "value": "3fa1f5168ca91280bc0c33261f126abc", "object_relation": "md5", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447332, "uuid": "c687ff3b-a0a8-4dbf-bb12-bc71725f0174", "comment": "Malware payload (000Stealer)", "value": "f2630132e335882740e03419b0aeafd226a5e9e8f93d2bc235c6ba9a3217d950", "object_relation": "sha256", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447332, "uuid": "cfe2b016-9908-4a1c-8806-8ad918331ee9", "comment": "Malware payload (000Stealer)", "value": "ae3a6015c9a162b6a25de6f6e6e98c61a989c6ed", "object_relation": "sha1", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680447332, "uuid": "5bf54e49-6c53-41ec-9026-1f7f477f0d78", "comment": "Malware payload (000Stealer)", "value": "8b93a0e44e4a447bc2b6024660d6fc8ee70e92278f53c20e95ded483ecd0a67b0144bf1be421e09ccd8b0af95923d3e0", "object_relation": "sha3-384", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447332, "uuid": "381c0e07-2f19-4bed-8b28-7338b6541478", "value": "T11064945437A54CD9F1E6FA39EC2324C968F6B80D5836DA0C0E5C644F48F474ABC2BE66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447332, "uuid": "7d6d2bb3-1af1-44be-a6ab-32314e4ed7a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447332, "uuid": "44a30f29-1b77-4cf9-a024-0fdd9a67636c", "value": "3072:uCETJ6HF32Srzji4lgqBejZpZFcl3djRnYHfJ0SfeFcNjVsD+uSbqEzNU9l3Psai:uHJs32Of7irPfeWylf3PIEPxf8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680447332, "uuid": "f9889783-919b-4ce5-8dd2-bcd817f7fb0f", "value": 331464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680447332, "uuid": "69c07b75-36c7-4fc1-8f00-0f8dceca57f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680447332, "uuid": "6255a525-2cee-4e4f-bd64-4a2d3f3c51ca", "value": "3fa1f5168ca91280bc0c33261f126abc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4b2751-d16b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1680449697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449697, "uuid": "2a09a6a2-0e5d-4b6d-b56d-a5b7994b7522", "comment": "Malware payload (SystemBC)", "value": "0af5f12094b7f8d8dbb03213fcc87934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449697, "uuid": "c142360e-b145-4193-a0f5-7fdfa5b8e77c", "comment": "Malware payload (SystemBC)", "value": "f41e64e9944e9b0a7e77c55fb1f59a329798f85c2d84b940ecd5f1c0207003dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449697, "uuid": "201a0dca-d384-4438-8bd6-917f01a8d69b", "comment": "Malware payload (SystemBC)", "value": "4d681b0bf9abfef8338d7d07c745b9a871a6db46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680449697, "uuid": "3dca9966-e40e-4c79-9d13-f89c9a54d3ee", "comment": "Malware payload (SystemBC)", "value": "cdf82ad7fd455a7d95a285506ef587d34ac608e2e476cb613972902a3cfae38be0a3757f4a361102af6c36d32322311f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449697, "uuid": "1391ee09-7c66-4bb9-8976-c78b48e1662c", "value": "T1F744C0127291C472E95B05B94D19DBF46A3AB8705F618ECB27801BBE5E303D2CB7634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449697, "uuid": "5b053c1f-51be-4713-a79c-b7fbbd08eaaa", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449697, "uuid": "3ec7559c-6a11-4fa7-a9ef-937a4c6cc488", "value": "6144:ZSnRMzYaLeC9/Nvpj5xfdHfxcnUvw+TC0I:ERMUaqC9/Nv1bBfx0Z+G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680449697, "uuid": "0e664f47-34f6-48ac-aa3a-9f889e86cf91", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680449697, "uuid": "8a51e4e4-06ac-4b02-b2e8-f981fa826555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680449697, "uuid": "2a5e9203-cdd4-4712-b43e-03e93e8d8db8", "value": "0af5f12094b7f8d8dbb03213fcc87934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c0b565-d12b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680422193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422193, "uuid": "898a0153-0f49-498b-b328-ee6128c61eed", "comment": "Malware payload", "value": "90ae9ff67004d370c5c540ae10696a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422193, "uuid": "1f3ff0dc-0ab8-4ff6-890d-3dec50a44242", "comment": "Malware payload", "value": "f4e5d036ab88c2034b9bc132671294d2eabed5f6c93a2c21abd1efba788d6865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422193, "uuid": "1219b61d-0d35-4a2e-b62c-ce9f8c911891", "comment": "Malware payload", "value": "8574255964c795be519adb8a1413ac4f41965899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680422193, "uuid": "765db90f-9fc6-4c9f-94e5-e69289f48510", "comment": "Malware payload", "value": "bc4d3714189a5d240f4d74b1579926f51406d6ddd0332e39312b25d90fc8b470062337e7526e71a29902fcf248d202f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422193, "uuid": "dd856a97-5b7a-47e0-840f-3244e52d9a4f", "value": "T1233633036396143AFF3607354A2FC6F9364F36965E397FA669937A3F0A70121D061B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422193, "uuid": "f6413c8b-e372-4001-9bf9-92d93c05d3d7", "value": "cbd684b5c2d7ad7fbf4a9d5a3ed4fb3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422193, "uuid": "893d6022-3541-435c-8ae1-2b59a3548e7f", "value": "98304:jGOK4YoCkJ5VQE19CY6RSriHlLY2W/8xQuNmr3Ikn9BjplkX:fRYqJ5VlylFE5ypNg9BjplkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680422193, "uuid": "81ad8649-e6a0-446d-8c3f-8e514cbd4d7d", "value": 4939264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680422193, "uuid": "8c50510f-d81b-4d78-aee8-c4fc814a22f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680422193, "uuid": "5c767c3c-7dbd-4603-a03c-cc52636ce00c", "value": "90ae9ff67004d370c5c540ae10696a95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a084fc5-d19c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680470363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680470363, "uuid": "1b8f76b4-b485-4972-adf3-c5d1b16e4b21", "comment": "Malware payload", "value": "d76c13190558d20783fc1e7579122523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680470363, "uuid": "cf94ed9a-efc2-493a-a9a1-e272c74acf34", "comment": "Malware payload", "value": "f865eaf36d15356e81f043a8c94ea116aba70e9912f81679cc70a5b53bb595b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680470363, "uuid": "c99b1ecb-08c2-412a-8140-6832177ba372", "comment": "Malware payload", "value": "7a5eb6db945166ce4352cd9c2088dba98ef7aad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680470363, "uuid": "7629ee2d-d5ff-420c-b9b5-f9c8dace059e", "comment": "Malware payload", "value": "5f42b202695eb2c91a81ac7389f44eaefe8a95fe8363742330865e6fed82f872e21ef378143a49ded2832e30132a8d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680470363, "uuid": "3b6781d9-a4c2-4107-8ea3-9cde88faa54a", "value": "T14A748C6773E4EA3BD1FD173AE43206154BB0D447B602F38B9A6855F86D223868D523B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680470363, "uuid": "d387c664-7efb-4102-ab44-ea9962726f82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680470363, "uuid": "543cb47f-282b-46c3-8016-32e6d35362b1", "value": "6144:v2NHXf500MKMTjnB7wbCoRbxLKFnjES9q:ud501nVsRVLUnj9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680470363, "uuid": "781dd524-c42f-461b-8664-c497bf6e2c45", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680470363, "uuid": "16aeae8c-0028-47aa-964c-09f7f82a7993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680470363, "uuid": "99b4456e-b474-4900-890b-f5128618d20d", "value": "x822a5Je2oKa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27613ed8-d144-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680432616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432616, "uuid": "013750aa-3dd4-4e65-bc70-d306e4c68f93", "comment": "Malware payload (AgentTesla)", "value": "627d531f2361508ce6d650dfb74f50b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432616, "uuid": "69279a87-7155-4226-b0e6-669046124058", "comment": "Malware payload (AgentTesla)", "value": "fa1cb59a2e33d1b2256194f4741afc762ef819cf058614afd490f56e5e92bcd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432616, "uuid": "09c4c9b3-0aca-4a73-bc92-d798ba91c335", "comment": "Malware payload (AgentTesla)", "value": "74cdf31cf47ce5898fc6391bfdd1b8801bc2813f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680432616, "uuid": "5fb02715-6e97-4b7e-b645-0f72c82dd45b", "comment": "Malware payload (AgentTesla)", "value": "c7bfc1d4d7e3e303885421bedbaf9f950b185cfcc5fe213a3b7fedcbef64a26ef10bde2b8138f12dd083a261c1f0ae14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432616, "uuid": "a343c401-99ae-4af4-af96-3aa1cdf3088b", "value": "T142F47C3D197CD3A2D679D3778BA94C61F7ECA02BB721CD2A3CDE01894A42A4271C365D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432616, "uuid": "d6b42cc2-8214-4004-9046-fb886179b3a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432616, "uuid": "3bed8b04-4216-41a7-83db-9aec970fc133", "value": "12288:nUuXMbBzUnxUn7bNVVebMyywV42hhmihgMDdvqv96q6GmdEk9z:fXMbynWnlwVHh1hbdvq16qSmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680432616, "uuid": "b38f7894-4c8f-45be-bb74-b0e61572d1c4", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680432616, "uuid": "d76ce882-aed7-43db-9c22-eebf73a69a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680432616, "uuid": "6c606177-893a-4746-91f5-6fa04149967b", "value": "TT SWIFT COPY $37,000.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530a3d0f-d168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680448151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448151, "uuid": "34eff82e-4f9d-4479-9159-f2d2c069b93b", "comment": "Malware payload (Gafgyt)", "value": "5383e7186328059909a7d1231dde3534", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448151, "uuid": "b6acc5c5-11e8-4a8f-afc0-bd2f8d3dcf1d", "comment": "Malware payload (Gafgyt)", "value": "fadbd5bb4898910ab38768fce0aaa4f3523a5edc67db24b0203cbf6b3a236a52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448151, "uuid": "c6123cbe-4661-48a0-8132-7890a8ec2ce0", "comment": "Malware payload (Gafgyt)", "value": "0409b81a8e3b509e0bf1b4c359e037b1048664f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680448151, "uuid": "1201806d-11c6-4bb9-8934-66f2bd6080cb", "comment": "Malware payload (Gafgyt)", "value": "32d27861036c92304b57d6f90858a715dae62ee5f06a140167de065b9081572cfbbc63124d598bebc1d070baec4f8897", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448151, "uuid": "43a7c532-ee4f-4260-a669-eef5ab8a8c21", "value": "T128831903B71D0F43C0CB9DF02AEB27F18769B9E112A36181B51BAE905773AB92517F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448151, "uuid": "6026a28f-bb67-4960-aac4-f764c5b3fd99", "value": "1536:u3EDGHkknQo/bqZ/UrMACJCIfj18SyOhhj4T5hq5ALJU//J09mQmV6qDjjoflee:uUKHzncmMNJCIr18ShQ5hUALM/y9mQmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680448151, "uuid": "609c941b-926c-45e1-a777-5f4987c3aba1", "value": 88472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680448151, "uuid": "06d66101-b9e4-47f6-8641-95002a2348fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680448151, "uuid": "948ae4a2-d195-488c-a119-a1bb8fcc2446", "value": "5383e7186328059909a7d1231dde3534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adebe53-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450366, "uuid": "573f758a-d6ae-4429-a410-3edefcba1656", "comment": "Malware payload", "value": "b76b80c32f1213d50258fc7e506e8e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450366, "uuid": "2f049d26-b13d-4e31-b642-64624db2d54f", "comment": "Malware payload", "value": "fd82ce2be4a5729eb922e96c154d0116a937d58caf16ad52388be18d482117c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450366, "uuid": "89c3c127-a472-4ba5-8af8-78c63279505a", "comment": "Malware payload", "value": "d3c2e3e959c60b5643c74941a73deda56e3cd228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450366, "uuid": "9b6aca65-b6d4-44f2-9b80-2156dc7b9077", "comment": "Malware payload", "value": "d5d262ccb976755775370ced22363a75c23b04b81a369259a0cbc9f923f2eef293b62bafe5b3d2e6cc5f9242e3df52fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450366, "uuid": "9286dd6d-6fc4-4b02-ae4e-838854eb84ec", "value": "T11E74E60C5B85EF20E338917412AAA1649E195C878A324675F15CB02B6FFFA5B5C3393F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450366, "uuid": "38114350-b6a1-4133-88d4-f99404685962", "value": "15d5ce8268c726819df7f9fd77fa35b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450366, "uuid": "efaefcca-f2fe-449d-a0e9-eb0ec8f107cc", "value": "3072:IUW2SUq2lAWBsLcdzKEGongYW5cqdzATZ6RMsdSqb2tm:s2RqWKLwgYW53Q8Cqgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450366, "uuid": "356f2d4d-ad14-4385-8c5f-41fea4ad4bc0", "value": 370192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450366, "uuid": "540f332c-f307-47b9-addf-3f6a52ded418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450366, "uuid": "9cb81313-ff25-4054-85fc-483c8613b2d7", "value": "SecuriteInfo.com.Win32.Malware-gen.25490.3722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9325aac9-d0f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680397149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397149, "uuid": "2ef047f9-0cb9-46de-b04f-603d24fe3949", "comment": "Malware payload (Rhadamanthys)", "value": "0ff50a2908535351a560e42def77c509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397149, "uuid": "e427041d-a65e-4c8d-b7ca-a4ae8591a851", "comment": "Malware payload (Rhadamanthys)", "value": "feb5487ea80521645196d869335bbc829280c03bd83b5d9e6a0f0e1e23b1a1c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397149, "uuid": "2885374c-5af4-4361-a0b3-7ad52b85ee9a", "comment": "Malware payload (Rhadamanthys)", "value": "8fcfc9b45f17943657762c0ae1459f14e95e555e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680397149, "uuid": "61863612-e9e6-49a1-9c9a-8cb85ceb6d7a", "comment": "Malware payload (Rhadamanthys)", "value": "e620d6240cc949860aacbff95c7db07701b84f190c3356316b6d09a9a49a7c88dd681abc8509116f2b3134ba04769a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397149, "uuid": "56cbf4ac-a220-472b-8c56-e341055c2ad1", "value": "T110849E1286E86830E53E4B328F5EC3F4261EBC629F197F9B2679B93F05701B1D661709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397149, "uuid": "5155f9ce-b53f-4551-9c5c-75b474e17bdc", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397149, "uuid": "9ae0c28f-d77f-42f5-979a-3df0fb6f54f8", "value": "6144:/fRW2RboYqLaQxnICyfCcnl2hVmQXoat72BIwg:/JdJoYqLaQpITCuYhVtDS2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680397149, "uuid": "bd0c5d8c-7b61-4bce-93cf-ac18a62a73c4", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680397149, "uuid": "fbc4f877-bb8e-437e-a736-7f2bf330babb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680397149, "uuid": "b0abda38-bd67-4493-b7b2-4f710ce7a657", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dc0561-d16d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680450357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450357, "uuid": "055781e1-5935-41a2-b440-9507c76ed40e", "comment": "Malware payload", "value": "fbe0410ea47a997dc83de3e078497a46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450357, "uuid": "525b045d-e627-46a3-a847-6fa5d534f14e", "comment": "Malware payload", "value": "ff0dbe32a8abb0fe276c8931d071bae63a37699fd70a5b049c93c3ef5633888d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450357, "uuid": "10a69dfd-df47-46bb-a820-c5c39c7f83a4", "comment": "Malware payload", "value": "77ff89dd86e20872a103f4c441bedc8294346e76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680450357, "uuid": "d796451c-67e4-4b02-ba7d-bbc6f43f124a", "comment": "Malware payload", "value": "29ba9afe0416930b7bfce2603cb442f1e5d941e34bfaf37b078ba7ac97d686c8d7bb94ce3e1288f81e42a205111c7579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450357, "uuid": "13fe4906-ad86-411e-a358-60243b6e8c89", "value": "T154D42B1A73E4B010E5FE9E354B6B469849327C22F464D95E22A0BC3D6D75F42E8B132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450357, "uuid": "3d2ea54e-5669-4553-b486-6af2663b5170", "value": "b210ebe7f2de6e89a03686e9113f875c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450357, "uuid": "fdcc56bb-8c65-46ce-bda7-dbcedf560be3", "value": "6144:M+rHwdM67imryxTHlEhG7JFWzrbMi4vpnUepeup92zsfcRTqe+G8J:M+r7JlHlEg7JFWV4C1PDse+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680450357, "uuid": "828dbe44-367a-4216-99f1-daf87e0be9fa", "value": 642580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680450357, "uuid": "c4af582b-99e1-4e26-beda-aa47181cc736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680450357, "uuid": "dfc30c2c-3622-4df1-8a86-a73ded482134", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.1411.11681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }