{ "Event": { "published": true, "date": "2021-06-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-20", "timestamp": 1624233782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9c2934c3-c87b-4a9d-8050-eee4de05341d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae50b18b-d1d9-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624201842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201842, "uuid": "fc4da7af-cf89-4361-811e-ede9569df124", "comment": "Malware payload (CryptBot)", "value": "02ca933f5f777deefdb9924972d09a0d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201842, "uuid": "dee12147-1f15-4711-bc86-253f4cfbde4f", "comment": "Malware payload (CryptBot)", "value": "02b2395502a744108c7c09bafafb58af53016603294bdb780d667bb91c484363", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201842, "uuid": "8f7f1b97-d63d-4309-91d9-808e46b580ae", "comment": "Malware payload (CryptBot)", "value": "e2fb7bf6f36b4abb4f5ccfc6a3cdef02693f9cf3", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201842, "uuid": "cebdb971-332d-4195-ba84-19892d87b581", "comment": "Malware payload (CryptBot)", "value": "5326ecf9099c3960c0fbaa6f489178373915e3bda35c0c46bb4dc2b99d6be40d2ca2d336d6d8b5c253cbdb26a2695575", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201842, "uuid": "85289aa7-9893-4c91-88f8-0090301e0cfb", "value": "3BF4F100B650C035E5B362F856BAD369A52D3E70976488CB52D52BEF9B787E0EC31B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201842, "uuid": "6f373ab9-035f-4d65-9a70-ad3df1ca35aa", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201842, "uuid": "9535a9a0-8b43-4095-af9d-7e51a4357b46", "value": "12288:C6z8xGFihojV8qilzkJBkVT6Gssof6ISEug2ov/Uhm0lHkHXhwt5/rl:nGGFihoizEqVmMISfgVvABlE3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624201842, "uuid": "dc26e840-2dcc-44ef-8a48-db2b9a1f9e58", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624201842, "uuid": "9dcea967-4cfd-4176-a74c-bd62e2f09cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201842, "uuid": "3c383d70-fd38-46e2-b16c-815818e5a37e", "value": "02ca933f5f777deefdb9924972d09a0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7d4ee2-d180-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624163478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163478, "uuid": "ce1c8372-c842-4d7c-8938-63d9f9721b62", "comment": "Malware payload (AsyncRAT)", "value": "aa16b5a6c856065b71f4e07cd37d9240", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163478, "uuid": "08100019-eb8f-4442-8d35-6e6d6781d302", "comment": "Malware payload (AsyncRAT)", "value": "06417db53e9b090c7a07192dbb6203ce15c832c0928d73ebbc9c8ebff05320ff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163478, "uuid": "113328ee-7264-4ba1-8119-1c75bc86e597", "comment": "Malware payload (AsyncRAT)", "value": "1e1984ffb7b94566f51afb242897ec963588ef42", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163478, "uuid": "16bf6d3f-89ca-42f5-aff7-52e706f6723a", "comment": "Malware payload (AsyncRAT)", "value": "9f8e5ac17b1c8c58f0cbd755f87d563a8df0b4ec6ce4b8e25a7a7377b436128fcba86a25a23baa52aff6e58f51e6536a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163478, "uuid": "ddf654c6-5b27-4836-9acb-ed9c39ead5b0", "value": "88231B003BE8C12BF2BF5F7869F26105867AF2633603D65A1CC451975723FC69A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163478, "uuid": "339309b6-6b70-49ed-87a1-90423a04d140", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163478, "uuid": "9353095b-a997-40a6-9c63-63d8303667d1", "value": "768:YuIMdTsErkZTWU/APhmo2qbzbYZJYgbbb4n9jbdPIm1bjbWgX3iA1+Wm5MKNBDZc:YuIMdTsX22wYO9jmm1PbJXSARKDdex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624163478, "uuid": "199074a1-7eaf-480e-b2d6-5ed33e72d598", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624163478, "uuid": "62e3ea00-edf7-466b-ab87-47742383bfe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163478, "uuid": "551b4cf9-5081-431b-8e65-2d84883ead66", "value": "aa16b5a6c856065b71f4e07cd37d9240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408e914a-d192-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1624171164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171164, "uuid": "9322d683-8ac5-4393-9199-ac34b671252a", "comment": "Malware payload (TrickBot)", "value": "1f5033d76b72ff259bf0d7ab33725141", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171164, "uuid": "5b9feac2-d500-4a67-9357-fb2f3b5ed14e", "comment": "Malware payload (TrickBot)", "value": "083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171164, "uuid": "f229ab04-c065-4df8-8d68-805d0db8c0fe", "comment": "Malware payload (TrickBot)", "value": "a827a2e9e2072ae57420a22f469e7053de62ea97", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171164, "uuid": "c3ab87a5-58ca-4a6a-a458-13ce8f8e93dd", "comment": "Malware payload (TrickBot)", "value": "ad393634b58ad5b4c1939413569cd01599c193931135a2453dc21977ab059a79814a310cf51680ff77b9458e13ddaf1f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171164, "uuid": "3829763b-6a97-4f74-aeb9-4ff5bc5e6d37", "value": "E8E4F11332E4C179D2AF06314E766B79BAB5BD509F70C6AB07D0DF5E4A31A408D2932E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171164, "uuid": "b665e8bf-f01f-4ce2-b367-15687758b9f8", "value": "138b75389ce3822d86ad7f6cfbebc40d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171164, "uuid": "1d507f79-cb6c-4b66-bf4a-7042a04d30b0", "value": "12288:gtDlVPn5ZvJvxc3DmEAdLXcppE/XhtvWQqmEAdLXcppE/Xhtv:An5Z/E5kPhtvWQzE5kPhtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624171164, "uuid": "4f5b851f-9103-4b83-b573-bf406fc377e6", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624171164, "uuid": "87bbf752-3d10-431f-b4bd-bdb5cb0bd9e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171164, "uuid": "db0ef385-6d75-49df-a8b5-61b6fff19401", "value": "1f5033d76b72ff259bf0d7ab33725141.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f051849-d15d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624148425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148425, "uuid": "775ce0ce-6085-4637-acbb-b97714185cb7", "comment": "Malware payload (RedLineStealer)", "value": "36e91ffb46a40f8c0a5ea7ff35e9e503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148425, "uuid": "65e3da57-be1f-4785-8e1b-6b0a311cbe73", "comment": "Malware payload (RedLineStealer)", "value": "08cea47d6ea993f56f181574a1c9a3b1e97cf0c0e5ad628adcc3ab0e34c8c44d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148425, "uuid": "a02ceb8e-94e7-427e-b859-b81852350d9d", "comment": "Malware payload (RedLineStealer)", "value": "cd637c4cc79e202b4890a0f4b4ca25d76c265a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148425, "uuid": "8de8e701-aaf3-4080-95e4-a57f2c9ab9f8", "comment": "Malware payload (RedLineStealer)", "value": "35841fecb50a411ff9eaeb7622d92125759e3eee487994c8b8e6ea8b481a5794671b5d56acb753071f74e39fa07e7efa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148425, "uuid": "6de47aea-4ad9-425b-8e55-bf781a8f9df8", "value": "7B94BF00FA90C035F6F652F85AB6D3B9A92D3AB05B2450CF52D52AEE56347E0EC32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148425, "uuid": "5e06ee42-3de7-4bca-b85a-e598d6b721fc", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148425, "uuid": "9a64ecf9-c993-410a-8e2e-0b5f5898602f", "value": "12288:+AEmp8tlsxmdI3i1/UZrAvNgbGJLqsTl:iA8tlsxG/W8l8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148425, "uuid": "fc6db310-07b6-4ef6-82f2-736bd278eed7", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148425, "uuid": "10a962f4-6afd-4e0e-94f4-0d7f92f699c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148425, "uuid": "54fe6a06-3dd6-4929-92e8-ed5c266220f9", "value": "36e91ffb46a40f8c0a5ea7ff35e9e503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca90731a-d215-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624227659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624227659, "uuid": "2b90cd06-3d17-4802-9c73-7a359740c2d0", "comment": "Malware payload (RedLineStealer)", "value": "59fa543ac741c1bdae35959c2f594d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624227659, "uuid": "18b0f43f-d9c0-498c-a852-1702905c0940", "comment": "Malware payload (RedLineStealer)", "value": "0a2b7ec564796acc3d0785dc0d3d80d4f3e26e70ce32a6b1db19895cb03b32cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624227659, "uuid": "047e93ae-6e39-4fb1-9177-b7bb6dc2c061", "comment": "Malware payload (RedLineStealer)", "value": "c0442edb9a706662798dd2da31def02d5af9e071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624227659, "uuid": "1318ce0e-6049-4bd6-8f10-fc4cbc969b53", "comment": "Malware payload (RedLineStealer)", "value": "d3ffa1c696739ef8ce3ec0668d4a472a938b2f136acdcb1d44381980686911f5f0e6796b2fcde8be15965aaa668640f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624227659, "uuid": "e1eb6e35-65e2-4f76-a16e-58105169547b", "value": "1B94AE00EAD0C035F6F766F85A7593B8A52E3AB1672490CF52D52AEF1B247E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624227659, "uuid": "a68c5754-67af-4ae9-b2eb-21a538241b34", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624227659, "uuid": "3f5f3a8d-7337-4c53-b8ea-6a8dfd12e38b", "value": "6144:pdcEUIilHkcguDNSTEppwerb7Fi06T7g225uTYQCxt2dOWUHB8KriC:VU1lHkcgu5SAp7rfvQCxwOfql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624227659, "uuid": "4e6dcf25-1510-45a1-8823-b8962271bcb2", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624227659, "uuid": "8cac5aa3-a6e6-4aed-91c0-640b7ca5709b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624227659, "uuid": "09b82a50-a2a5-4a97-8604-71a58838c3b9", "value": "59fa543ac741c1bdae35959c2f594d1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8d387c-d19c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624175502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175502, "uuid": "4032f981-65dd-4563-8969-086bf45c0093", "comment": "Malware payload (AsyncRAT)", "value": "63c3888fe1c409c072655ba91af1d0a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175502, "uuid": "e3169b2b-ea7c-406e-b7ee-28ef8fd954a1", "comment": "Malware payload (AsyncRAT)", "value": "0d34de46f847f8e5d608e7416b65da9e2f9a7a9183986f24a40b4b242f044e2a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175502, "uuid": "8df17fd3-13a0-4602-866f-789dae8ed0b3", "comment": "Malware payload (AsyncRAT)", "value": "719f3cf43f07beb1f310cd70d5eed9dc34aa041d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175502, "uuid": "a6a810f4-7d3c-457e-a288-8e936538216f", "comment": "Malware payload (AsyncRAT)", "value": "2e730749d1808d828dce222b2fb9949cd5ce23ee9f7ff8c3eb0c5a1cbfc63adb7764bebffdb6c2cd472e0fd3d1542efe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175502, "uuid": "8db507bc-1a7c-4d4f-b93b-3421bc709480", "value": "B1518993A9A1094248B40C9C20693D94EA4C5310F113E2F9CD1FA272E5FCCBE09ADB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175502, "uuid": "457bbff6-44d5-42a0-afd5-a5490169eb83", "value": "24:IF8eOPWjN6ei4hdmbDGMipDS5fDsXQYDCOeFPD6YO0rZ:sNfdmbTipDS5fch2FP9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624175502, "uuid": "0b539d13-6330-4267-b584-a62b850634bf", "value": 2761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624175502, "uuid": "d62a2fd1-f478-4029-953e-107135845268", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175502, "uuid": "2619c3de-f44b-4c99-8e55-08b76f73b3ff", "value": "BCVCDD.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cf9de3-d1bd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624189797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624189797, "uuid": "4e1279ff-2786-4438-b7a8-7a7c8ae2f238", "comment": "Malware payload (RedLineStealer)", "value": "f91de207113931e0365fdad93847aed4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624189797, "uuid": "bf09e692-de24-47de-a178-cb1513b9dd07", "comment": "Malware payload (RedLineStealer)", "value": "0ddd58bc17333ab499fd360420a25dfe0d7838c9751b409a87dc2b49015305cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624189797, "uuid": "5fd78e68-a4d4-49e7-b4f1-a008a09a012e", "comment": "Malware payload (RedLineStealer)", "value": "2faeab2ace67ed20a77971f5bbb67d15bb90fdcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624189797, "uuid": "a8ce837d-ac33-476f-a77b-b064b7fe5790", "comment": "Malware payload (RedLineStealer)", "value": "f07c3b31e9ca58ef8290a05b0483f50758f4ad0e71cbd806778ef5dbea141d200b8d82d2a3dd4500cff262d866f3e45f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624189797, "uuid": "edb3db0e-b5fd-437c-a7c8-fdcfa295aed3", "value": "BF459A71376992E1C1E70070C19FBB1105656DB2C6E6C5A7F2883FA96704393EFA23B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624189797, "uuid": "1b3257d3-ae5b-4349-8de3-3138fc0c0ac3", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624189797, "uuid": "1670e5e0-7baf-4ce8-a1a4-e4824aff6187", "value": "24576:Sk70Trckqk4Pxbc2Fu8VtuBLb2prqAvoa5Qhef63bVoTpOslvR3uwe:SkQTAJk8xbhuatuBWVqW2hyUxoFHtReh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624189797, "uuid": "826ba365-f7b4-4532-a159-b897129a9d71", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624189797, "uuid": "1bb6454f-a276-4607-a322-416229962811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624189797, "uuid": "577ad5fc-15c5-41bc-b248-f043eadbf994", "value": "f91de207113931e0365fdad93847aed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a93086-d189-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624167582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167582, "uuid": "399b0edb-441d-4dab-97a7-f7768b482e2b", "comment": "Malware payload (Glupteba)", "value": "ea57c9a4177b1022ec4d053af865cbc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167582, "uuid": "15e0e18e-53cf-4899-b06f-c5e734bb5094", "comment": "Malware payload (Glupteba)", "value": "0e2bcbe99b84383cfa549598d998bddce096daa94e1eb6dfbfa66d3cf12cc1e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167582, "uuid": "5b1c0b11-2fe4-4900-a83e-0f1c4ded470f", "comment": "Malware payload (Glupteba)", "value": "7ec0f509955223f91ff3f225bfdc53e5ec56a6d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167582, "uuid": "69027591-90c4-413c-b7fd-3c5b5b3d40d4", "comment": "Malware payload (Glupteba)", "value": "b34586f2552ad7efb95e70800d3b2a4aeffb0a3aeac2db339f9e84803ac0dd7a3b9face9e1d59c850e394fa155aec693", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167582, "uuid": "a7c9c77c-f377-476c-bf6f-3c9f240faf9c", "value": "31263311F5708139E5E2A6FC58B9E23CA93C3E709F2415CB92E156E9DB207F09831B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167582, "uuid": "a6c2a35d-54a9-42d4-9fdc-12b0266dfe38", "value": "e621a9dda4bab203878bb79570221dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167582, "uuid": "af6ef167-77ad-4ef1-8cac-0085aef04371", "value": "98304:zCAdBEbQw8N1k4UvgFzDRLIvPJDh6GIJD7k5iIl7nTFrfspCYmQ4:/k58N1RJavmrJs5X7T9lXQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624167582, "uuid": "cff4cd51-1d2b-4895-afd7-a417c5c98513", "value": 4732456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624167582, "uuid": "3ee1f9f2-deaa-4a98-abfa-f55d467c55ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167582, "uuid": "9a014c67-83c1-4015-98c2-0c0211360720", "value": "ea57c9a4177b1022ec4d053af865cbc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b83900c-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157841, "uuid": "41c464ee-275f-4337-b794-2ba7d030ca09", "comment": "Malware payload (Mirai)", "value": "7d5b7ab203c2e4c1f6258a94dfe539be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157841, "uuid": "194e55da-33f0-4a6d-a05a-82d2eb44fa17", "comment": "Malware payload (Mirai)", "value": "1281aa496d5c220c20b2b12e82e759e312e60a37015e2ebcf761c4603c2dde46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157841, "uuid": "28b0abda-71df-46d6-8f91-d2416251717f", "comment": "Malware payload (Mirai)", "value": "402c625a4f81cdccf803c7415fc9a6aa151fac11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157841, "uuid": "a065d580-ae13-4aea-8d17-2cf0568fd865", "comment": "Malware payload (Mirai)", "value": "f24fb327a84fadd9256e94c2bbe1458d13d1e13a86a98fef70f128fd1bb38287286f7ee7be531d18fe0405b88173dc07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157841, "uuid": "952314ab-c218-4104-952c-572495002583", "value": "D5E2E123C34440A5C8A23E7BADAD3445A6BF38ADA3679AC6751495303BC3C394E7CF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157841, "uuid": "b281fa3e-5c3a-48f2-ba54-239545454d10", "value": "768:w8MJYBKfBJkYsfciey4fJq2Ny1gOCaS5u8KG3UmQ:GYYBxsWy0RN8grQUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157841, "uuid": "e3003621-4650-4fb9-bef0-6fdd63776558", "value": 34104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157841, "uuid": "0999d157-95e3-4af5-bf8f-6f077ac2e33f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157841, "uuid": "d064c44f-4e03-4bf4-8fac-af46f7196bc3", "value": "7d5b7ab203c2e4c1f6258a94dfe539be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f927b307-d219-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624229456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229456, "uuid": "e75c5f62-d035-4081-99d5-8c5a4f53de81", "comment": "Malware payload (RedLineStealer)", "value": "6ca6142c56a9258bb4d59db76e1b5138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229456, "uuid": "75ae4693-cfff-4d00-8fc7-2f38e409c578", "comment": "Malware payload (RedLineStealer)", "value": "12f7ffd93e0af380b2fe64c1477afcf876ae1449dcc197d71da381873bfbb439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229456, "uuid": "59138325-d2ff-47a6-8b0e-d1aefcfb90d2", "comment": "Malware payload (RedLineStealer)", "value": "d521ca13ba7336ed51e51547a27f21fb2cd00a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229456, "uuid": "cbdc0b5a-a178-43ea-838e-277a0b4fac4c", "comment": "Malware payload (RedLineStealer)", "value": "38784e73a64155ec84faee52897ad9508223ee8c7dba21ed3b72acca38485a34b1b69cb50d8ec28b6dbdd2406c19cbd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229456, "uuid": "54b19661-ee1d-489e-80b3-a63fa798d09a", "value": "E3F53300E5420144EA00D9B82E9F9F5EACF6868879E14EE7BF414F4CBE6DF729117C5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229456, "uuid": "bbd79801-918e-42a7-9d71-799b61dd3f2e", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229456, "uuid": "913a4bcc-beef-4b9b-8e97-fa6d679dfc94", "value": "98304:JT+fUk0P81DpLO4X0jHsr1Oj1jUZLEMBCo0IRRPfA:JT+fU5P8BpLhX0jMr1OjyLEMEo0AlfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624229456, "uuid": "38511221-622c-4373-a7e9-44b2c1d9d728", "value": 3450683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624229456, "uuid": "8d5e1ce3-4164-45e4-b59e-87d7796bc18d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229456, "uuid": "a0073fc2-3e6b-443a-aa90-44398c0195ba", "value": "6CA6142C56A9258BB4D59DB76E1B5138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f65a867-d209-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624222218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624222218, "uuid": "eddd29a1-2726-4937-8649-02d7ebcc40bf", "comment": "Malware payload (RaccoonStealer)", "value": "6654274fd3aed9024394ef8657461b9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624222218, "uuid": "9a7673ad-af5f-4365-84fb-46e64066dc6d", "comment": "Malware payload (RaccoonStealer)", "value": "130aab0a401cfce6e038d6d9f2bf1d94588a92c04c9b27a67f7a00c6a1413491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624222218, "uuid": "b76248bc-e5e0-46a3-a1f4-9a122860c290", "comment": "Malware payload (RaccoonStealer)", "value": "cc3941cbc1baac94c8e91d07756ee37ab4b7b9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624222218, "uuid": "7640e68f-c959-4a15-9036-5f1e8e4e6729", "comment": "Malware payload (RaccoonStealer)", "value": "08abf2dbd4302114d34fecaf7261dfe50327edb2f382ad83b129521ebcf0cef8184f24d78c4570b52a273c805fa6aadd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624222218, "uuid": "de7f0183-1b42-47fa-b0a1-117066d68365", "value": "F3769EE17A16B2CFD49F37789097CD82546C83F546204902ED6CB9FE7D66D82328AC78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624222218, "uuid": "a4a449b4-647c-4d41-aada-31e44fe67c49", "value": "58ca43c54c545fb000b546dccfb3c7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624222218, "uuid": "7727ce87-cd17-40fb-98d1-e788517af36e", "value": "98304:FVvza5ugzFecPsRnfBWA1aIyIkOlvrE3zea9X2PMTlTuDX4vJ61d07QVNaLWTCW2:FQ5t1i/39lMAoh6X07QVNaLWTCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624222218, "uuid": "9f6cece7-7a05-44b7-878c-6a13f3c8bf91", "value": 7730200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624222218, "uuid": "41c5d0a2-7d06-49e1-b36b-477278ca24d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624222218, "uuid": "adb26f33-f5e2-4b11-9364-05b5d5c7c844", "value": "6654274FD3AED9024394EF8657461B9D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e2bb16-d1f6-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624214129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624214129, "uuid": "5e9dbeba-7be1-4b6b-be99-6e0af3b7084f", "comment": "Malware payload (RaccoonStealer)", "value": "01f848f1bea5fee38c9b3ace82d48517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624214129, "uuid": "15df7ef3-b628-4d44-9b79-6ea9085c446f", "comment": "Malware payload (RaccoonStealer)", "value": "13333d8111107cce84e50c0264e4b3ffa7af34802de26de7d229ca86782db674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624214129, "uuid": "bfe00e2a-d91a-4fc8-a88d-2544f6c742c3", "comment": "Malware payload (RaccoonStealer)", "value": "bd35c42b99d9c5e4e136505030f3d8f62f33d04f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624214129, "uuid": "74dd830e-f96e-485b-8219-f2aadf60de46", "comment": "Malware payload (RaccoonStealer)", "value": "adf8cd6f6237ef0c3c5cfd23c06c0fb78b5e694b009a62efa94af93ff3c2057c577e916151ddd38f5b81ade5d1dd27ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624214129, "uuid": "e8a90eeb-4ee7-4685-847d-e67f0b6adcfe", "value": "60841212FAE0C173E5C685B08936D201683BBED5AF24428733E93B693E727C5563E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624214129, "uuid": "66f65397-1df1-4771-9396-dbfa56cd4dec", "value": "60fb65c5f46ca687f9973c28fb00f82e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624214129, "uuid": "d3c0d944-fc40-4515-917f-783168f7af2f", "value": "6144:T6zFIvdmSk5W4h19pTWyx4M3C1nBXCGrD1cK+fEinSpZZ7uIjUl6VdiMoMm38NYw:T6ksh1nTWyxn3qn1UxShjUl6VdiMoMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624214129, "uuid": "dbe02764-8bc9-4b15-9402-896a874a242d", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624214129, "uuid": "d4a8e6e8-7181-4bb0-88af-8e1ae24fe71a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624214129, "uuid": "5b16c112-6eb6-4030-8afd-d6a41b42c552", "value": "13333D8111107CCE84E50C0264E4B3FFA7AF34802DE26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ba0f94-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624176971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176971, "uuid": "3899dbf4-7ae6-45f7-9072-214f6b1380f8", "comment": "Malware payload (RemcosRAT)", "value": "6855e78fc405ab419cbe253874c74806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176971, "uuid": "82691265-50a1-4d93-8832-c3f73d85fed2", "comment": "Malware payload (RemcosRAT)", "value": "133a9234dee77f774077fd79e3edbdc22b9a8252a4e855fab33aeae974d2fa15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176971, "uuid": "f41fe7db-ef47-4791-ac51-e3884436068e", "comment": "Malware payload (RemcosRAT)", "value": "5b816745317f6cdd79ab2fd7373bc2c8e28529f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176971, "uuid": "2b5fdc91-9420-447c-b34e-f4326658de8d", "comment": "Malware payload (RemcosRAT)", "value": "aa25b3ecfe0e2b82f1c39e04a965a198959c60d20f870d904808a9b091ca9ffcb3523f192d3a1fb4800a1bda9fa50555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176971, "uuid": "84da2bd7-b16a-4fcc-9ffc-871202fce3fe", "value": "2605AF203BE95629F07BEF7955D43181C7FAF623A312D55E3CA502CF0762B81CA92636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176971, "uuid": "527ce49a-c8ea-4fc7-90be-631a478415a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176971, "uuid": "aa0f8a71-1090-4109-9fe9-a2d221355e57", "value": "12288:fWKKCPMaMCieFThlm4S4F3M9ym+E2zEDXwdUAwAxYC/oDGjkgXmdypWq7Y+xwsjx:f5XMaM1eF1WbuwDgHnY1CYWuEbf6JOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176971, "uuid": "01a9b843-f83f-4e70-b111-1c9e5c9fcad2", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176971, "uuid": "59df0957-e26c-4fcf-8b65-f5790bd63b9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176971, "uuid": "4044bfaa-1126-43da-ad18-68e158dbb460", "value": "6855e78fc405ab419cbe253874c74806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887482b7-d211-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624225831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225831, "uuid": "92bd834d-cdd2-4dc3-b6fa-eb9b35c2a0aa", "comment": "Malware payload (RaccoonStealer)", "value": "69574b885950801fb8803cb0b25f025f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225831, "uuid": "8d72c9a4-b085-4537-ab4c-9ac698565bb1", "comment": "Malware payload (RaccoonStealer)", "value": "137026a259166724d41d797fc3a5fd8ba40c30e9eab4e71db7ab8ad54747a77a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225831, "uuid": "079bc1b7-a366-4c59-883a-90645b5f3612", "comment": "Malware payload (RaccoonStealer)", "value": "e1d137c941812a93e19b45d6f725f368ef1b8de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225831, "uuid": "cdb130b0-2089-4742-b19b-1a4d3c546d97", "comment": "Malware payload (RaccoonStealer)", "value": "77adf1033243cf68432dc44b80845be0cef705984a750fd21991c08c3c5655c8894970e3d5fbb12ef53e9d87d689ac15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225831, "uuid": "79d52275-28b3-4589-8634-bfa6a5f8be05", "value": "2FC4E110A690C035F4F632F89ABA836D652D7AB09B2451CF62E516FA47385F4FC3172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225831, "uuid": "742fe08d-a8d1-49ef-933c-92122bd200d1", "value": "7b1dc6cbb65eee334207b62238bf5f24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225831, "uuid": "0a4efb97-2c67-4629-ab31-2429ad78de5a", "value": "12288:7MNDfyqDvW54ym8Bsz5KMswDEcdkEZpxOuJeAuTCV1:GftDv4s1KMsRVEZpgA91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225831, "uuid": "b9e79937-6455-468f-89ae-e56031e55714", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225831, "uuid": "d5022851-5165-44f1-9aca-1213684fab06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225831, "uuid": "8dd636de-ef61-44d8-8706-e97645d91110", "value": "69574B885950801FB8803CB0B25F025F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d662a68c-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624176999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176999, "uuid": "d25effff-2b5a-438b-8406-dade599b6896", "comment": "Malware payload", "value": "378923db2b9f3fc15b86f5e878f38d14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176999, "uuid": "e4df4bfd-dda6-49e6-aaef-40f969f2b7ab", "comment": "Malware payload", "value": "1423a334558a70b043c5d2f055ed2103cc5b31f2e8f6e70b79a5b0ca4c0616c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176999, "uuid": "1b7e48ab-2960-4538-9ba8-b6a6eeee944b", "comment": "Malware payload", "value": "0f6c2f37d045e70f25b85997e87c897380a40e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176999, "uuid": "1bd93efd-e057-4ab2-9eea-4000d0ae025d", "comment": "Malware payload", "value": "54119a2566f8c43c40bc4a35dd6dad1aad9df24be1c708ccef81c71f91836a828ac0458fd07446fcae15cd85f8178530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176999, "uuid": "2c2c52f8-648f-42eb-b512-f4cf6038a4f7", "value": "10E53353726E1243CBC9C8F888F779461B072557337C2EB811423E11F6A570F6AB769A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176999, "uuid": "68855ca5-8088-47f8-b25d-4a45ad79fc5c", "value": "98304:QbhaIUK+MXPKHfawHXOQTC6gVqAUqxmxlc9c5PM:QUIN+6KHfaqUVNfmQe5PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176999, "uuid": "977d2a2a-01a6-4bb4-a7da-152f40c9fdd8", "value": 3147732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176999, "uuid": "cc51f17f-dde1-4fe7-a1b9-00617066882c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176999, "uuid": "82fb3f38-7926-4d45-ba86-c81549e2e194", "value": "378923db2b9f3fc15b86f5e878f38d14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487aa56b-d1df-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624204248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204248, "uuid": "3c5adefb-7c78-42f1-8f23-e56da619ecbd", "comment": "Malware payload (RedLineStealer)", "value": "18499eaa223053517b1af7febe69c0b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204248, "uuid": "af3ebad3-4f74-4edb-a4bd-f3dca42236b7", "comment": "Malware payload (RedLineStealer)", "value": "1467dbcc4b504ab94baaa6bf9dbb59dbddc3ea61a86452b61760cf6f50417364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204248, "uuid": "622eda27-2163-48a5-aa8d-d70636d3fc69", "comment": "Malware payload (RedLineStealer)", "value": "a8c8de313cf2e6606cbc565c5fe135035a46b6d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204248, "uuid": "49218cdd-125d-414e-a1a4-52928a20184e", "comment": "Malware payload (RedLineStealer)", "value": "61c55fc9ca698bc02d8625c0fd31e41b858464e8376d7c49393f7bde6fb7384c06449afcc9ea8eba953ec7efc2818420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204248, "uuid": "0ea24ce5-d100-4f3f-9841-3290adf57871", "value": "C894BF10FA90C035E5F662F85ABAD3BDA52C39B1672490CB52D51AEE1B347E0EC31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204248, "uuid": "7129a9c6-b6fb-48c2-bf80-0a5926ac1b58", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204248, "uuid": "3bc8953e-1512-46c8-9f8d-6b148f0447cb", "value": "12288:utd/ecqEJkSTg92nlwQ6pLZ0GBTo7c5Ezl:oGcqEJFplL6v0mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624204248, "uuid": "677af24c-e34d-41cd-ab95-48dd9eeed8ea", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624204248, "uuid": "8daaa063-7838-43ed-99aa-46b3a9cb36a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204248, "uuid": "90ecd79c-6189-477a-b8e6-b059e73d10de", "value": "18499eaa223053517b1af7febe69c0b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c835f168-d1c5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624193296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193296, "uuid": "3c952018-2f96-44a1-b94e-72093f4ef610", "comment": "Malware payload (RedLineStealer)", "value": "371ed60f3ec8352131a21cdf6380cc95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193296, "uuid": "faf769bd-3c3e-46e7-87b7-ea8f5159dbd0", "comment": "Malware payload (RedLineStealer)", "value": "14bb337bfab1686103f252a2d7079863980237f1679164c3b519caadd3cca27a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193296, "uuid": "ee9ffa39-8cef-43c5-ab51-4abb4f809bc2", "comment": "Malware payload (RedLineStealer)", "value": "7d2ebb23b40026a310cd19933de14f1f31084d8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193296, "uuid": "8a9782c1-e86b-47d7-b6a8-214a13a3ec86", "comment": "Malware payload (RedLineStealer)", "value": "4fe589ca214c4ec4e8f06529d82511bd145937621cedab89f3ebdb88bc173a536be9059604bb3290bea17080594fd9d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193296, "uuid": "771b1925-2939-4ca3-815c-0431ca04bef3", "value": "0FC533EAF20DCCBAE44314B9F544D265410D99BEA0E520173F7ABE466CE030652BEFD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193296, "uuid": "b9d71239-7467-46f4-871e-6062456bf2dc", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193296, "uuid": "59de53f4-3d50-422f-ba96-f3d008685a6e", "value": "49152:7sH1Xb6u0OQ514WVvn6PN7MvL65LDG0Cniuqpehu+p5e/MAToBAS2hqz4Cfb6/K:Q1Xb251/v6V065LDYniAWNbJUbjEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624193296, "uuid": "91766b44-72a9-4177-be3c-772e3615b484", "value": 2564751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624193296, "uuid": "766c6984-2074-4cb1-9bb8-16576ca045a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193296, "uuid": "a96045a7-d980-4a20-b389-6ff27790e62a", "value": "371ed60f3ec8352131a21cdf6380cc95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58301e5-d186-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624166179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624166179, "uuid": "b0704b24-1055-43be-979e-185264d3063c", "comment": "Malware payload (BitRAT)", "value": "abbb4244329d47f498415c7038e9e5f6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624166179, "uuid": "0e4aec69-3ba9-47db-a36b-3fc6030d546a", "comment": "Malware payload (BitRAT)", "value": "14ea0d3828549bfd5d7d3733bc1e3495aa86b21333daeabd4d9408b53f707933", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624166179, "uuid": "64cdd7a9-8f87-4e52-a1b6-69e65a294950", "comment": "Malware payload (BitRAT)", "value": "ad3e5970806cf11640d946f9fd4d7c4ee966407a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624166179, "uuid": "ded8a40b-b3f2-47f6-ad09-0598c306df3a", "comment": "Malware payload (BitRAT)", "value": "f5d5cb4a98de2f0d560e4289e9512b432179817f62fecb213ffeb299b83899e513eae5d92fa4e1476b369b2eb0cd1069", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624166179, "uuid": "0b657156-7953-4ee3-b2a5-0552c004b6b8", "value": "62824C59F7D84D32F5B6CEB07AF045122E31FB12AD50DA5F289A40488A62B4139E5F3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624166179, "uuid": "45b58a69-ff30-4e42-ab91-fd827f916952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624166179, "uuid": "261f9b17-609f-4576-8ce3-16433b8f4a9f", "value": "384:2S1y+2DzaeQF/VNsg2+EXnXTXoXaXtXdz9Hd4qTdkMl6yhbb:2caieQTVNE3jYq9Jj5hbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624166179, "uuid": "5995c12f-9b15-4a44-89df-aec49c1ed037", "value": 18560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624166179, "uuid": "920b3a0a-80b3-4aec-a89b-28548aeac4d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624166179, "uuid": "9240138a-fd8d-4724-8ff8-c6e1b5a09e28", "value": "abbb4244329d47f498415c7038e9e5f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73025d8e-d1cc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624196159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196159, "uuid": "1d46e9f9-009d-4403-b853-fef027769df7", "comment": "Malware payload (RedLineStealer)", "value": "927d5e0e6b75ce13fe9119e54aae9d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196159, "uuid": "28941a94-14e5-47ac-ada4-ec840c65bd2a", "comment": "Malware payload (RedLineStealer)", "value": "174a7b9b585c981199040fc6d979026c843f976e7a9dfaba8bf2dbaba1a25339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196159, "uuid": "adeb91a3-5b82-4f10-bb1c-06ea816ecf10", "comment": "Malware payload (RedLineStealer)", "value": "986020fe5f8cc24d0d121d122faac86e3d6714e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196159, "uuid": "4ad4e2a2-5cba-47bc-a850-78cd458edbd2", "comment": "Malware payload (RedLineStealer)", "value": "f17727149d9c05695036d7c5abe4183538d1fcb5e674f8ea83218d66f4cd44872e57f217a0fb493044cccba0d9dbf857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196159, "uuid": "b6397c2e-4917-4856-a9a7-cfcaa0379f5e", "value": "1094BF10FA90C035F5F662F85AB6D3B9A52D3AB0972450CF52E52AEA17347E0EC32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196159, "uuid": "ef334416-789d-4999-9d98-ff86eb66ffbe", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196159, "uuid": "74456f63-6db4-4d74-9f10-9c051fc5dd47", "value": "12288:LCe/ecxEJ9STX92Plw1+Yk5me7N03Tjl:9GcxEJuew1+Yze7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624196159, "uuid": "2181099e-685f-439b-a13f-a079d63fd7d2", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624196159, "uuid": "05553fab-769b-4866-8bb5-8c07cbddd5aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196159, "uuid": "b2d381c9-6ef8-4f22-bd86-6f4fbcf4913b", "value": "927d5e0e6b75ce13fe9119e54aae9d7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e994ba-d19a-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624174738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174738, "uuid": "6bddf499-ab0f-420a-ae14-6d8bb7d52fae", "comment": "Malware payload (CobaltStrike)", "value": "59f0ec0adf69728a1cbf70b5837485ef", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174738, "uuid": "ca55cb11-9b11-420b-8e12-4cbcbd75cde6", "comment": "Malware payload (CobaltStrike)", "value": "18a44e52d98237aae86d2bc2050ccf4438514faf866812c1268d62356c19d6a9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174738, "uuid": "8380d9cf-a895-4ea3-8f99-bddfb2275753", "comment": "Malware payload (CobaltStrike)", "value": "c49a07cd01890c981933ba8f71ac4a739418c498", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174738, "uuid": "e241400d-2609-4582-8588-a820fc31ae57", "comment": "Malware payload (CobaltStrike)", "value": "c5d7c87cfe58b9cc6a9f4f5b9840f22b5f0d7347d7b41492b86bf93dd143451ca032b04a4fe5fba45727f8aa73251641", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174738, "uuid": "0af8dcc5-339d-44f7-b745-eb554083c0c1", "value": "DA62F60EEBA394FAC449D17491FF4731A4F9B93208B5992E32ACD3354F286D1973E906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174738, "uuid": "81d229ef-9f91-4597-85b0-1038f1ad6da0", "value": "18b8ca59e0dde52b50f46aacc686771a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174738, "uuid": "85d6b65a-7eb2-4165-817b-0ac61960c6dc", "value": "192:CxKnn9A3Qo/AF/mvVi9bPikGJOG0egoiY958b5TABxKA/N8:KIn9SQh8vVSKNJO5YxKA/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624174738, "uuid": "bf23d02d-0190-45a5-9535-8d65e5fc8190", "value": 15886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624174738, "uuid": "0002258b-959d-4c7e-aadc-ea3458f78172", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174738, "uuid": "10013b7a-2363-4bfe-8ccf-97d9ff141471", "value": "59f0ec0adf69728a1cbf70b5837485ef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42782157-d180-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624163436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163436, "uuid": "954f0532-05f9-4c36-951a-4d0ddba5c45d", "comment": "Malware payload (RedLineStealer)", "value": "4100893898de0b27d2e93028c4506dc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163436, "uuid": "a4b08643-950f-4e45-9b74-cc94e06b0a6f", "comment": "Malware payload (RedLineStealer)", "value": "1a4670f1209f533e82becd6e3515de61aa74a3836cb4aa491f2f1a803f21d9e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163436, "uuid": "949bbcb4-fbf0-4fb0-923c-646cad98455a", "comment": "Malware payload (RedLineStealer)", "value": "10c4c9815e2968dac6894e961516c6cc9916da61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163436, "uuid": "4b464c40-70a5-49f5-80b8-eba3620c476b", "comment": "Malware payload (RedLineStealer)", "value": "d4e6464835c5be4e4f3040471e09eef171f342d1d5a68507f33c355497c1f7fb7107c4a2250b3dc7b74e96c5b68ff87a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163436, "uuid": "218e2685-273f-422b-a8e9-a8b016bba53d", "value": "6E94BF11EA90C035F5F662F85AB6C3B8A52D7AB0972450CB62E51BEE57387E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163436, "uuid": "15062b21-a7bb-470a-a992-ba623007aa6d", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163436, "uuid": "b7591f1d-cd39-4ec3-8c96-c4d6840d84c0", "value": "6144:hSMoZYMqb8oxZ5S6SmlXJ8qsu4j4Xp1ACgTowMjg3nH3hUZKri:MZzqb8oxZ5SHmzsuKmVgTozjg3ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624163436, "uuid": "cd26b3c8-3aa2-4a67-a2ae-893bf973b981", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624163436, "uuid": "1f80573e-d6ef-4574-b56b-1be05371f303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163436, "uuid": "daad6004-1f8b-47b0-ad67-e5392f05bb1a", "value": "4100893898de0b27d2e93028c4506dc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd72c753-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225544, "uuid": "edb02726-37cd-4b6d-be92-42a6f0a7ab4f", "comment": "Malware payload", "value": "8062e1d5f4731bb42d19263f6e769ce2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225544, "uuid": "1e170227-8cc4-4a94-bf10-aa2e1cf54cf0", "comment": "Malware payload", "value": "1a9daa636d0a5a5b142fa85e0c4815f6b5a6c025e93880c6457f02e028183392", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225544, "uuid": "d4c51d92-da9b-478b-ae2d-a07a1af53b05", "comment": "Malware payload", "value": "ce80c19f440cc3e10e1eae356acd89eced61f00e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225544, "uuid": "e4d3389c-744d-4c97-9cf1-f4943034f5c3", "comment": "Malware payload", "value": "562aeefd407236ae68695bd308f46181de774b60fef7a8fa76165437e206f98b13b064517dfe11ab6cf2112ac9febf47", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225544, "uuid": "248a4d93-d531-4f53-b022-1d13b09ef60a", "value": "3554236FF49815D5C5830C36A6813EBB0E7BB85D1DED04FD325B8C8A9A7A0436058ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225544, "uuid": "89056d07-7872-466e-b833-1f7e983742ba", "value": "6144:l14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjK:lvIzBhNU+3WB4d66j9B2dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225544, "uuid": "7aaa9331-2415-4a5d-9637-c4751df54bbf", "value": 295098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225544, "uuid": "1b59d13f-6794-4060-8948-16a303701a6e", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225544, "uuid": "511ca208-58be-4b5c-a123-bcb44d8bffe1", "value": "\u5e03\u5c40\u201c\u6740\u732a\u76d8\u201d\u5751\u5bb3\u56fd\u5185\u8d4c\u5f92\u89c6\u9891\u66dd\u5149.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d719c5-d174-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1624158363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158363, "uuid": "ee9942b7-6697-4ecf-a4c7-3322b848e1e6", "comment": "Malware payload (QuasarRAT)", "value": "a6000dc2d7e32df066079f4a2ff91e35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158363, "uuid": "3d29c039-a054-417e-a1ae-54ed662738fc", "comment": "Malware payload (QuasarRAT)", "value": "1b7d7515f98891cf08164a7469bb9c9f3133e7834cfe99d55094594ca330e982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158363, "uuid": "7e9e792e-0e9a-4957-b3cd-91302efdc1e3", "comment": "Malware payload (QuasarRAT)", "value": "7fd9fabb206082c75a0719cadab7287097234aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158363, "uuid": "a9952e4f-b6fa-42d3-9788-a6352428a0d2", "comment": "Malware payload (QuasarRAT)", "value": "94769b226bc4541f472cd250294b30a5ca2697140efb3168b24548683ed3c48e2f134312d28ddd9da086dd0fbc001893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158363, "uuid": "d650d7ec-30c4-4709-9e76-b0419ac2b7bf", "value": "EA763375A6714A75E4236872C243D3F37632F7682F2A118EF1CE694C2D3734644BA2AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158363, "uuid": "cc89715a-8ba4-4384-8a23-32e94057a35a", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158363, "uuid": "8b51d23f-6b60-4f8e-bc09-370a9ce06694", "value": "98304:mAI+qSlex5u6+tLvHREJTSeEehw1F+cgyThOMYYYjyDAbsr9CjdiECMFKHq3/Iub:VtqieGeJmeDolVvwjoY0qMHLjixF7gzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624158363, "uuid": "32c01b47-9fb6-4aac-9f01-c944e25cb689", "value": 7717865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624158363, "uuid": "c0f10146-2b2b-4503-8648-cc0335eef2f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158363, "uuid": "d9487bfa-3edd-4eb2-b1ad-6866dfa59eb0", "value": "a6000dc2d7e32df066079f4a2ff91e35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c07113b-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225219, "uuid": "c1a64394-3e79-4501-94b9-c6099ee39a39", "comment": "Malware payload", "value": "3efdbddd282598591e6096caae8e10d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225219, "uuid": "43f96551-5c3c-44f6-b311-ba8e719f103d", "comment": "Malware payload", "value": "1cebb1153264ff7d706895a8a17411f4f037ee4854756ce90ee0506af73d5fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225219, "uuid": "65c34176-eeae-4546-b20e-360e9fa9032e", "comment": "Malware payload", "value": "a9c8f7ed926c13f14ca55331674639d89e198dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225219, "uuid": "a017f827-2357-448c-bf6a-a98396e36706", "comment": "Malware payload", "value": "c48c905cecf68f1e25c1594eccfe940bd7e218a7856495bcbe45db7acd94b243a399741914ff7d73af35446e497d84a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225219, "uuid": "e9aff272-e478-4b2f-b871-c549dd8cb0ce", "value": "DB946C42658A44B3FA269578097B37F9DF5A88EDC30045C25344FE4D8CB37ECBE2694A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225219, "uuid": "d2ad17a1-5189-4bfc-8a7e-e8104728f9a0", "value": "747eda1509b7cba75f10e99c1205fa63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225219, "uuid": "c479f459-3395-4119-b3f1-f14c0d6cfc94", "value": "1536:JHzjSCPkW+xEFHwTiqKS5vgaUSIh08q/2OJeAr3+qdkYQt2FvNmWeaLLLLLLLLLc:JHz2CPkH+FsiqvgaUN08S2802hN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225219, "uuid": "ed9bfafa-b094-460a-8af9-e88673cc1902", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225219, "uuid": "4e1df20c-4dec-4096-869b-00460b537fba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225219, "uuid": "f1df3b65-3de5-459f-8e20-13e694133132", "value": "\u4e2d\u56fd\u5973\u62fd\u7740\u5c0f\u6811\u6797\u5c31\u5730\u5f3a\u5978\u89c6\u9891\u66dd\u5149.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3860347-d16e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624155949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155949, "uuid": "f4938896-e193-4049-87f8-4e4c3d654c1f", "comment": "Malware payload", "value": "26a2014da76c70d223a918888a444e42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155949, "uuid": "56cd290b-5043-46b7-93b6-b86480dd6ea7", "comment": "Malware payload", "value": "22811245067eb0e6e0a6a0696a69a02679221e02e41193939699e6657be11f6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155949, "uuid": "bfaf085b-f9f0-4927-9c69-c5ecce764736", "comment": "Malware payload", "value": "c6aafb67d3aa0495fa32de8c3fe1fd256bfcb199", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155949, "uuid": "da66eb89-e67a-4f3a-913a-4c7de8d19f72", "comment": "Malware payload", "value": "890c7d651f11adb43a1a97023d557dcea75ccb879545d863286df0a7e48ea454d191b645e1fcb2dac63ad3fd0b1f678a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155949, "uuid": "babef6ff-7d65-4f2a-8cca-0819c63593ee", "value": "E6E4120372C3D831E0BA5B3151B0D2B19EBAED504FB4DEA76B585BA91D711C08D3BA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155949, "uuid": "3062cbfd-d6e2-44e9-98ec-12607ca934d0", "value": "a044253673528dd98a9dd008f2a6b058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155949, "uuid": "54e35909-dff4-4871-ad15-cb8935f03c76", "value": "12288:Umn1vBXNJl0P3ZbcCAjqH0d5g+qUH6wyZQMvvdgMiCgT:n1vJNJla39cGH0dG7sOlQCgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624155949, "uuid": "a0b7c111-4bdd-4539-a89b-10fc2d3e298d", "value": 696364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624155949, "uuid": "4938a923-96fb-4798-acce-a9ca57659d77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155949, "uuid": "1cd727fb-9e28-4084-96e1-b62251f335ba", "value": "26a2014da76c70d223a918888a444e42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb24867-d1d5-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624200205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200205, "uuid": "b448c71c-f2c4-42db-94f2-e11c87bd2176", "comment": "Malware payload (SnakeKeylogger)", "value": "d2562ba3cc578a7851ffcf98585aaa9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200205, "uuid": "b5c511ec-ef6e-46ef-9c54-d8711caf111d", "comment": "Malware payload (SnakeKeylogger)", "value": "2335bfea54b33abe93e21697e7d2ed09527fbcf9245d8ea2ca2d062c1a89a0a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200205, "uuid": "c233b895-6019-4bdb-9add-f24d198f7702", "comment": "Malware payload (SnakeKeylogger)", "value": "27100dd29d91f8d0e0aafcc9b93d184378478728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200205, "uuid": "d04e1e34-43cd-448f-988f-59115a064210", "comment": "Malware payload (SnakeKeylogger)", "value": "83005ca6fe4da610e6aee4b561ce8499fb7476eb23e210623fbf3acff6a8b4f1a846518e61328b4d7f8247258f5e9373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200205, "uuid": "838e135c-d19b-4444-9c86-748cd0b66ffb", "value": "80B4EF897660719FC467CE7A89A92C20A660A07B531FE343944726FDE94E6E7CF011F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200205, "uuid": "74730773-2c25-47d1-88e6-e9d431740803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200205, "uuid": "2f67c6cf-5aff-4dc5-909d-6d55d022ac4e", "value": "12288:M1TfscqaIAiw26p5inHAPDYlYztQZpEcGG0PpAtoSNlvWbuA2/aX3:8TE9X6p5iHcnZki4GSnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624200205, "uuid": "79c5adaf-5457-41d9-8825-a94ba88b10a9", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624200205, "uuid": "dd662241-36f2-4284-894c-e5a27627208f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200205, "uuid": "ec7201d0-d1c7-4f14-94ef-916d3419c110", "value": "SKGCM_Arabbank_Transfer_document2021doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6ecbc3-d191-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624171053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171053, "uuid": "c9482028-8cdd-4ddb-93ef-703dc6a89f41", "comment": "Malware payload (CobaltStrike)", "value": "3dd7eb4707c960948f24367ecd652971", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171053, "uuid": "40f75d31-0f15-4039-b045-de4bedad2bed", "comment": "Malware payload (CobaltStrike)", "value": "23537b7760c3db032fe5a8442a45d376a3ac9738445d0292c984e6b6ce5cf27b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171053, "uuid": "8e183a0b-b6c2-4a53-a053-a6fee59f70b2", "comment": "Malware payload (CobaltStrike)", "value": "f1a2a0074e9607b0a95df1177969ac7fa6f50b7e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171053, "uuid": "d3e4f7b2-b349-4577-9d7a-9cd4ae312896", "comment": "Malware payload (CobaltStrike)", "value": "f3c65a5050a9d60592726e18181d3e6ae59d032c9ce785c199a2fb4c8b7949e2a9f6fbcf59d4a6ad5e2b362f5985d453", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171053, "uuid": "1ed90f1f-1bf9-4381-a02b-3bebd2456a15", "value": "6C446D31A7A0C435F1F252B889B582BC692A7DE1EB3C50CF52C536EA56347E4AD3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171053, "uuid": "23c6a975-0492-428c-95d2-2525a3510027", "value": "9b623fb7c49314a3f750ca39cd5e64f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171053, "uuid": "9c4a66a1-818e-4ae1-80f2-138c99aeb448", "value": "3072:UjUwKh9VWs521vT3lyVgByGfy38udEI4zbbf+HXG0usD5yjMgtFtN+CLzt:UjUHZ921vT1yOdfyFd74zP+ktNtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624171053, "uuid": "fb1f1ff3-a989-4851-b64e-2a7bd978d260", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624171053, "uuid": "670f4885-2d2a-4961-b7c5-f1cc9adf7787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171053, "uuid": "e41827c5-e185-4851-aec6-3b8fac3d129b", "value": "3dd7eb4707c960948f24367ecd652971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e4b2c4-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180479, "uuid": "74cbbd53-9515-4b27-ad3c-5c9d15a7c0b6", "comment": "Malware payload (Mirai)", "value": "036887a1d8791c9c57d4b3785d27d455", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180479, "uuid": "34964b6e-999d-4f0a-bb51-443d92203d81", "comment": "Malware payload (Mirai)", "value": "2384bab5f85204e815df8415510f95c4f8a492a50e6708ed45974a700163fae4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180479, "uuid": "b5c1e9b9-1771-48fa-8e00-5c71408db896", "comment": "Malware payload (Mirai)", "value": "a28a0ae6caacc615bc660803cc6f40b81e2e541a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180479, "uuid": "38542604-3877-42c6-9225-d1b36e756156", "comment": "Malware payload (Mirai)", "value": "127428d42e0880967cac9c63f8b500c2e154fe489e80852735fff4e2b2f3c00ef0034a538ded4a7def671deeae012eea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180479, "uuid": "9946599d-ca52-4868-99c5-1dacac60c850", "value": "7223E100E7AA35F1CF504C3AADAB99856F263F7CA349721B205485DCB107146E9EEED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180479, "uuid": "0857e8e5-dfbc-4789-ac11-330b62f6c419", "value": "1536:vD3QY1EtA+sw/68+SDUAYlDzpDVDNl9aILU:1gV968+SDUAYlXpDFNlgILU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180479, "uuid": "5a42e179-622c-46fd-9054-fef09b6e9dcb", "value": 49920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180479, "uuid": "20b4fbe8-11dc-495a-ab25-71910265023d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180479, "uuid": "48ef9247-65ca-4da0-baf4-f9c88e424253", "value": "036887a1d8791c9c57d4b3785d27d455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d430031-d1e4-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624206323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206323, "uuid": "a47d4065-da70-473b-804e-d5490100f584", "comment": "Malware payload (RaccoonStealer)", "value": "2d72f495b24f6a0372488669d5374b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206323, "uuid": "5c483ff1-7c56-4fab-ab86-dbe1cb0264ea", "comment": "Malware payload (RaccoonStealer)", "value": "24a722ce99ba486cf511c6534f66b8e8c9e7f90836dbcbd46e608dc085657a1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206323, "uuid": "e482d9cb-c71e-4034-8c73-d084d7b9f0d8", "comment": "Malware payload (RaccoonStealer)", "value": "ee88bd82706c9ccebc011827fe86e041d28324c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206323, "uuid": "3393e292-0393-41e0-8800-289744a00b17", "comment": "Malware payload (RaccoonStealer)", "value": "2dbd1069fc91c5435ed8b4dc70edf7d648a657313145746a9466a0974cbcd24f90d58ab41c1eca19eed1ad6c01c802ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206323, "uuid": "ddde278b-9573-4a6a-a4cb-f4214c5ec1d1", "value": "324551027D4EA301D5E0193760FF292823E55DFA87B29A0F7F05FA6A14B63455CF1A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206323, "uuid": "8eefd0b9-2629-4f0f-889b-1bc53a4fa6ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206323, "uuid": "16490958-63cf-486e-8083-b442b7b883c3", "value": "12288:IW1LZVFsAJuud+3xEKwy9YoerYmSIH//Czwti7d9cP8Jpyt831R6nJ:R1mAJJYZweY/rYmSE/YBeP8bSeGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624206323, "uuid": "2e873991-cf5c-4b78-a583-8b62bebb8109", "value": 1270512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624206323, "uuid": "9714f9a0-c6b2-49f1-aa3c-eddd1bc2d0a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206323, "uuid": "312dc5f3-6041-4972-b5f0-eac03e5f06d1", "value": "2D72F495B24F6A0372488669D5374B85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a40648-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624176922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176922, "uuid": "760a9ac8-f4cf-45e4-98e8-113da6b8cff7", "comment": "Malware payload (ArkeiStealer)", "value": "2b7d693b5010840ddcde876eb9096ada", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176922, "uuid": "585f535f-1919-4fc2-86a0-1dbbba99cad9", "comment": "Malware payload (ArkeiStealer)", "value": "27b90eaec119dfd5e831a842b715c648e7b889aa973aec8485f7b83bda87c04c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176922, "uuid": "78af5ec0-29bb-4773-8687-23f275b04033", "comment": "Malware payload (ArkeiStealer)", "value": "025a6babb970bd00cff60201901f77be493860c4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176922, "uuid": "6b41e025-f9df-4a91-805a-34c7a8c84b97", "comment": "Malware payload (ArkeiStealer)", "value": "7974a615b52da9648da463468bf1a6aefac831b5c1c102180a16602819837bee4858777b3d6109ca13f0896c6b8bdde5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176922, "uuid": "d7a9b427-87ba-4b60-ba65-b15c411e3a64", "value": "58A55B1869BFD01960B3FE916EDCA8FBDADE55E3240D743B109153178B22B81DE8B439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176922, "uuid": "2b46664e-d452-4950-bacb-04b7dd2ea0fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176922, "uuid": "3bd6b77e-a2c4-45a9-8191-8ed2728edcad", "value": "24576:RSYZGYiIHhrClPEGbxJo79oJZZSyzwBOK3rcbuLkhFU+BLCg8+Q9FjhhJCGpnMIz:LCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176922, "uuid": "e84dc8f4-252c-4a2c-addc-27770245af49", "value": 2215936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176922, "uuid": "6b8a11f9-da01-404c-928c-bde4bc7c4a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176922, "uuid": "fde36d58-69e5-40a2-93d9-d395ca204f1d", "value": "2b7d693b5010840ddcde876eb9096ada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a72c0d8-d207-11eb-875b-42010a9c0053", "comment": "Malware payload (OrcusRAT)", "timestamp": 1624221351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221351, "uuid": "d0453bfe-85cd-4524-8fe0-9290acc23f5e", "comment": "Malware payload (OrcusRAT)", "value": "5aa7713fd72747a1eba1cd2186964478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221351, "uuid": "5ef4062d-0be7-4697-a493-de858528bfe7", "comment": "Malware payload (OrcusRAT)", "value": "28027fae1edf2324a8165c9f1a82273f958385c4947e8750a6bdcf29ec2e4906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221351, "uuid": "bff4b66c-da75-4583-bc37-e94495d993a9", "comment": "Malware payload (OrcusRAT)", "value": "26dc8e8926e6e3a4d3983d2a0321d4f3b9fc1c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221351, "uuid": "9118372d-089e-4014-9865-c748ad21da19", "comment": "Malware payload (OrcusRAT)", "value": "6f7ec5b3b31fabd5c42788fedeb14ae491a0141c616310d2d1448b9249817b21c7843b582a33f6596a44d11232809fd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221351, "uuid": "b05f3b16-4846-423e-a7f1-4ef5ee232960", "value": "BA15BF013BACBD06C1BE7678B7771AC90FB8E9066052FB4F085861AD1D9B701BE1536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221351, "uuid": "d97b1fca-798d-4355-8dd6-ef058b41d0a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221351, "uuid": "d995cc8e-b1ab-4289-bbb8-a66a015d0978", "value": "24576:Ghf4MROxnFD3Iw8XlrrcI0AilFEvxHPSWooJ:GSMiJkrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624221351, "uuid": "a0eddd46-9c8d-4b51-aafe-433786171e86", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624221351, "uuid": "9465dc84-dff4-43e5-baa2-71059013d95a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221351, "uuid": "b60651a6-1eef-4df7-9daa-91ae2786fb3b", "value": "5AA7713FD72747A1EBA1CD2186964478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dab622-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225471, "uuid": "8a911ad6-6f1c-424b-9353-0d2d2d190e4b", "comment": "Malware payload", "value": "6c2209564f34c31036cadbeef9acb7c2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225471, "uuid": "02c33753-6210-4c9e-8a40-bbb83feaa1cb", "comment": "Malware payload", "value": "29966289cf9e248c29cc976fe76daaccce7d6fbb3b6903ebc3e4f9a0d63a7bd2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225471, "uuid": "0343521b-f7f8-4d78-98d4-e7a44ddc506e", "comment": "Malware payload", "value": "3e71cab53cf46218e56fa7558a1497f575d75d0a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225471, "uuid": "552efc8f-4271-41fb-b9fd-6a98005d0973", "comment": "Malware payload", "value": "20566a578056de337054597f05bd434f1b86a0be7453b41ff04925255890ede7ed3bfc606c6d700e1df0dc799841ab76", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225471, "uuid": "f0a09e16-f52d-4395-a4ae-de6635f77df3", "value": "4154236FF49815D5C5830C36A6813EBB0E7BB85D1DED04FD325B8CCA9A7A0436058A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225471, "uuid": "85a88992-4344-41fa-bad4-8eb1d10b0119", "value": "6144:H14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjd:HvIzBhNU+3WB4d66j9B2ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225471, "uuid": "962c0353-3f8c-4267-85d1-6e18b84ce421", "value": 295106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225471, "uuid": "d2b62d9d-5314-4d9e-907a-08bdf808fc42", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225471, "uuid": "54153666-759f-4b13-9e3b-4799a5db1206", "value": "\u66dd\u5149\u83f2\u5f8b\u5bbe\u6613\u5f69\u516c\u53f8\u5973\u8d22\u52a1\u88ab\u8f6e\u5978\u81f4\u6b7b\u89c6\u9891\u6d41\u51fa.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d9a03e-d17d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624162239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162239, "uuid": "d5172103-c9a6-4ff8-b525-46a6049bdece", "comment": "Malware payload (RedLineStealer)", "value": "e9f895ecb9d504e8a5f81ca56c1c0461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162239, "uuid": "a45f92a7-14fa-4f80-82ea-b0697de16e7f", "comment": "Malware payload (RedLineStealer)", "value": "2f6576f6687bd9fa5d8a86389b03b564d3d82f6c3c63ccd64df6f460dc4dec65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162239, "uuid": "8b319ff2-87df-4b6d-8999-0cfd23eabcbd", "comment": "Malware payload (RedLineStealer)", "value": "94b9b634125593aa9abfc38ffac480330689b46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162239, "uuid": "fb4f04a9-0620-462c-a2e3-1eff5b6fcb39", "comment": "Malware payload (RedLineStealer)", "value": "efe2b954c9feae6335dc65fa6932e93d16da4fc5f2a67a6491ee6a01e46c584546c9f2af319489bc9c0e09a4ef07ea1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162239, "uuid": "fb5faefb-5308-4b35-a94b-702c7e1e2fcc", "value": "6B94CF10F690C035F5F662F85A7AD378A52C3AB05B2151CF62E52AFE1A387E0AD31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162239, "uuid": "85f6b228-7e7b-418e-846f-3f8b417633ca", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162239, "uuid": "3aed2fc4-f8eb-4add-a09e-ecad6617bcd9", "value": "12288:PD8sMXsci9KY2SdVr0rTD3MnDiGbe2cfp6u8nl0J:7MXscDYBX9iGbe2Xvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624162239, "uuid": "e980c8e8-6fec-450b-97a6-7b8b52c1d391", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624162239, "uuid": "1e64a179-5481-48d7-a006-c76caa5ff718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162239, "uuid": "66e92669-6307-4720-88d9-119b8ceb347c", "value": "e9f895ecb9d504e8a5f81ca56c1c0461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc54271-d175-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624158949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158949, "uuid": "71e20680-ab09-4bc2-87ba-960db6ef8e09", "comment": "Malware payload (RaccoonStealer)", "value": "a7529e9c6cd5174667f86b391bfbe9d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158949, "uuid": "f4ada3ca-633f-4b3a-9b37-a8138e240b11", "comment": "Malware payload (RaccoonStealer)", "value": "30b7b720ba1630d9824263b22c33e2096a6075cea04ec5bad6f4dddee6fe5daf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158949, "uuid": "96f31f90-706f-4748-bafe-dade0d2896b5", "comment": "Malware payload (RaccoonStealer)", "value": "ac17e62b16c78ba3ac53e6837f5ec6a84704eb96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158949, "uuid": "8287f1e0-0ec0-4c92-859b-b0b33349a139", "comment": "Malware payload (RaccoonStealer)", "value": "cc3a8fa422089a8a8daca3220515d40a520c68c26bff56d7a0574611a9dc3bdc921b12d234b092b13d3ff039c52a759a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158949, "uuid": "c82e1ed0-94c1-46e2-9c48-ae382176e149", "value": "D6C4F110A790C039F4F632F859BBA368AA3D7AB05B6850CF52D51BEA47346F4BC31257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158949, "uuid": "f9fb6009-96ab-498b-b660-d0fad1134f5f", "value": "5a83c85aa267887d843723cf1c481c4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158949, "uuid": "722c5b5b-69ab-471f-a990-6f2756bfba5a", "value": "12288:1s6FAqufC96U6qLQKkMCsjf7VueBz6of0tmnz+ctf:lAquxDhS+Fts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624158949, "uuid": "f1602948-37f6-4997-9023-234a27ffcf42", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624158949, "uuid": "84b1b989-ccd3-46e8-81d4-bb0913267147", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158949, "uuid": "c4cbb568-47b0-4f64-98ac-91fdba1926ea", "value": "a7529e9c6cd5174667f86b391bfbe9d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d482ade9-d207-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624221663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221663, "uuid": "48d38284-7ede-4696-ad75-696777414965", "comment": "Malware payload (AgentTesla)", "value": "7c4194af8b96aba768004cf02dc66ff2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221663, "uuid": "f473fec5-4ea1-4073-b0e8-7390286c9b26", "comment": "Malware payload (AgentTesla)", "value": "33a82cfa5ef0f113bfa98be28c2a3d8637423f8e22be91179ee36a907ef808ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221663, "uuid": "62283224-7064-45e4-877b-fddabd4a6adc", "comment": "Malware payload (AgentTesla)", "value": "0316176e546e300c41ab967ed0b671aa843e5298", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221663, "uuid": "f6e4631c-880b-4b25-a556-041bd39a8b4b", "comment": "Malware payload (AgentTesla)", "value": "943ea0a5f9bf8504b955cb389bf4e27d74bce306ef095299fc99024456e4894033e913261f57aea4d012e566e53f2c35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221663, "uuid": "0bfa0adb-2f00-4a75-8061-76837426cbfa", "value": "5415E0243EEA9129F177EF754AD47597CA7EFA733B02D80E2491038B0A13E41DE9153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221663, "uuid": "2b84df54-9c27-40b5-a203-2c2d2bd31509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221663, "uuid": "7a65af8e-3419-4e33-b816-b2d5524bde96", "value": "12288:JFehlm4S4F3M9ykYlDxvgcw6Uc85v8+C/0a607C2L8kJRdPtsthhtg/2hppp7ETF:JEW9Yl5Yc85JC8V45Vqhw/2hppKZpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624221663, "uuid": "75ac36eb-974a-4af6-b353-6f715ee09708", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624221663, "uuid": "d587e5b2-9e82-447d-85cc-b50d4ccfe36e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221663, "uuid": "d114dd93-cde0-402d-a240-a9d651bbc9f6", "value": "AWB & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b2e1af-d15e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624148733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148733, "uuid": "94cec96b-a77a-4533-afa6-c34619a2af22", "comment": "Malware payload (RedLineStealer)", "value": "cf08ffa2e973cb217a8450118504db3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148733, "uuid": "85c995b0-2cfb-4841-b214-2801d7f906b6", "comment": "Malware payload (RedLineStealer)", "value": "34b19ae69f81f4e9a112373b8554dc1158433c3faaa6629840f4e0575226b46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148733, "uuid": "43e38fac-844e-4e32-814f-6d46bc563e1e", "comment": "Malware payload (RedLineStealer)", "value": "cdd42c08abe0b524ec9997c3394930250a35dc73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148733, "uuid": "23bb329b-e3df-41b6-8a8e-4648de195109", "comment": "Malware payload (RedLineStealer)", "value": "2a003c8340005d33b5410bf910b0bda1d5fff121c87bcacbc6c5f5599f3351a8675accc232226c77329e2f43183ec545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148733, "uuid": "ff40d2f7-1492-4497-a8cb-01a249aecd00", "value": "3194AF10EA90C035F6F762F85A76D3B9A92D3AB0572450CF52E52AEE1A347E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148733, "uuid": "36877360-7253-4c30-9b36-3fc3449170ec", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148733, "uuid": "dfe8bc51-0a18-45ec-a621-107dbfa3c164", "value": "12288:ArBmZ8U8cxDd/HyfVPqIKMipsURerrUthZfl:Qw8U8cx8SIKMiiXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148733, "uuid": "26305aa6-18ba-4279-ae4b-ee206054bac0", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148733, "uuid": "f87e1a3c-1f7b-44e6-bb4c-cf29ad7a329e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148733, "uuid": "8480d11e-2165-4927-a164-598fa74884b9", "value": "cf08ffa2e973cb217a8450118504db3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76166013-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624176837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176837, "uuid": "759608dd-152b-4cab-a74c-4a5270c73b38", "comment": "Malware payload (RedLineStealer)", "value": "9f130f3dfaf4a2bc37a955a7eae490ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176837, "uuid": "997b3eb3-5aa9-4951-8c6d-25c54a54df18", "comment": "Malware payload (RedLineStealer)", "value": "34fe6f40d44353171b22566f8e032da61450adcff2a4f64432f75c50c2fa48fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176837, "uuid": "48a6245e-dc34-4058-8d78-2bc5e4c8daa0", "comment": "Malware payload (RedLineStealer)", "value": "0bd97fee9da2cb4cc57b206fc1dd73984bb0a5a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176837, "uuid": "67b84033-4178-4e1c-9c94-88889ca44f06", "comment": "Malware payload (RedLineStealer)", "value": "c625744dc3c5bbb274a7bb2d9bf00480204d52c2b656d42ea44fe09f26e8f2678ac92416d997e249515ed9b3fe6be0c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176837, "uuid": "0a72abd3-697e-4ce8-a1b8-3357c277253f", "value": "A3459A70377983E2D1EB5430C08EBB5546612CB2C6E6D1A7F6943F994B00393DFAA3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176837, "uuid": "44a3e910-9495-4ae5-a397-bc9f17de79ac", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176837, "uuid": "95e031d5-38e1-4054-8356-12c4330edf52", "value": "24576:/k70Trc8e7G69gTQ4FUes1KhdADIXmFacr0sSqYXESzfKFcSl3qAEJJ/Xk:/kQTA8e7GxQL50ZaaI0ssUSzfK53qzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176837, "uuid": "18f539a6-6afc-4848-b2e5-8c4eeabd0dea", "value": 1268224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176837, "uuid": "969a3a0e-8a7b-4049-aa5a-4abb5fd7298f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176837, "uuid": "66580e64-90c5-40b2-a19d-b019704c3416", "value": "9f130f3dfaf4a2bc37a955a7eae490ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf77f3f0-d192-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624171377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171377, "uuid": "49bc15fa-7bb5-4588-95af-eeb396cce19f", "comment": "Malware payload (CobaltStrike)", "value": "18004edb6c9d25cee30980ae1b8505a9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171377, "uuid": "1cf0dccf-7fdf-4810-b2bd-40a21cc77b0b", "comment": "Malware payload (CobaltStrike)", "value": "36b2bd45095adfece653a5490021b3d803b7268153c6f6a5b7391905d02e4d80", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171377, "uuid": "9d959049-a5de-4a23-92f9-c92cc3ae85ef", "comment": "Malware payload (CobaltStrike)", "value": "fec63f6fc09de463dfc6a07820882953795f1b8b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171377, "uuid": "e742dfaf-83ee-4224-b664-36a8fca6ba30", "comment": "Malware payload (CobaltStrike)", "value": "261c063a81be80b9e63c2b2a80d191e0bacdb52048807a4fa31f96db06afc55a0da2463efa28b2af82b890ab26f7b21e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171377, "uuid": "cb5c9c96-ae32-4470-bdf0-a4f649cba606", "value": "2CA26BD6FBA58839C7C941B979C8AE210DBD703016A3443677839B4CD59C1A3BE79B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171377, "uuid": "56843c10-adb4-4227-8167-8b47fb777b01", "value": "0bd0953d0c9330e23d1d23b3ea55cac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171377, "uuid": "f1c9a45b-46a0-4a42-85a4-d0370d1ca790", "value": "384:I3o45iJ7XcsNrTh4niqeMIAX181m101q1H9UfON9SOSzt1ODxW:I445qzcsVMBeMIE181m101qZ+foSOKtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624171377, "uuid": "f1102364-51d3-405a-8db0-d3e775a06958", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624171377, "uuid": "2eed9fcd-9ce3-4fec-9c17-5744eab04c5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171377, "uuid": "e3eb75ac-f209-410c-bad2-b8ba59a3a853", "value": "18004edb6c9d25cee30980ae1b8505a9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd546a64-d19e-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624176635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176635, "uuid": "6211b4b1-7f44-4b20-ba4f-b6a4e34f81e3", "comment": "Malware payload (Smoke Loader)", "value": "62ddd6a52cc36031af700fe0b2f58e79", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176635, "uuid": "38746496-76c9-43e1-88fd-c156d0770e72", "comment": "Malware payload (Smoke Loader)", "value": "372e3f20168cb6280781e04db5b47a84c3496bde190343f4cb54a7e80c4a0c6e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176635, "uuid": "62e4e9ef-4fa2-416a-8d0e-bf63fa17bb6b", "comment": "Malware payload (Smoke Loader)", "value": "96a5d909d78ae554a7c4a5963510976edb6904ee", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176635, "uuid": "3516da1e-4515-46a0-8615-729c664c7ed6", "comment": "Malware payload (Smoke Loader)", "value": "ab97af896fa398507085ff8541ceaf6353b80fb1cffd9965d6c91b1a79cbc905257bd021390d93a54e6232da9bfa9da2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176635, "uuid": "e9b7ff54-31eb-4d54-8bf1-22a6502e98c4", "value": "0E649E00AAA0C035F7B662FC59BA936D652D7DB05B2490CB52E52BEE5B343E0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176635, "uuid": "63f7d7ff-ef6d-40c7-a51e-7a3092e0c437", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176635, "uuid": "16654f2f-2a23-4dac-99b0-369241f1ed5d", "value": "6144:z22oLY9ZJdv0HfudlNkXn23CVX+klvNhhuJSdgJKri:ILyZjv0HfudlqDVX3vNhoQol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176635, "uuid": "461057ac-b434-495b-b564-238c62f6dc68", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176635, "uuid": "f24204ce-02f1-4f30-9097-16fb8f3ae037", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176635, "uuid": "41003109-2af0-4515-a222-672eb364b2c9", "value": "62ddd6a52cc36031af700fe0b2f58e79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4498fc64-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180190, "uuid": "ee26c116-7d82-404b-a997-d8bdaabb8c8b", "comment": "Malware payload (Mirai)", "value": "6955d7627873dcf1ff2d2e496cd9e9cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180190, "uuid": "e454a73b-a393-402d-926e-c8dc3d4a9722", "comment": "Malware payload (Mirai)", "value": "390eecfb3f8d903742ac6ef78831f21e1bd0af0d9e21de881b24b39acac4c977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180190, "uuid": "fd1602fe-3795-4d94-93c7-4ab19ba15e32", "comment": "Malware payload (Mirai)", "value": "9bba7f61aae3fa797dc4cc280611d89e4e7ea625", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180190, "uuid": "c7180069-dfeb-48e8-bab4-dc217619db86", "comment": "Malware payload (Mirai)", "value": "b12eda0f8368ed2a346ed4452da97d1569a5af7fe14e7b216d36ee8e1e1ce0e86b82dad01b4dfc06f42ea0ff1ef5c3de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180190, "uuid": "09cd38c4-edcf-4f47-8509-495e96310498", "value": "5513F15296109DA1DCB21B32EE1DB943322241FDD2F754203A90CA94BBA579C17F3FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180190, "uuid": "ffbd8c11-f537-483a-96ed-bf0dc2ae5e2d", "value": "768:7TjeUUoZQIRfInJ1rQsLeX5EAGOSkDi2sJLyXJHydMTt5vIAlvvPmzs3UozE:7ttfs/9MZiLyMKvvPmezE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180190, "uuid": "6a76a055-4c1f-4f7b-a365-dbbd9c0b40bd", "value": 44304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180190, "uuid": "1ce6a6e3-1a57-4fe5-a57c-76b4cb081e62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180190, "uuid": "f56a01e3-ddce-4591-ae9f-dbf570a06371", "value": "6955d7627873dcf1ff2d2e496cd9e9cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef72557f-d20f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225144, "uuid": "232c9086-60e8-4f48-aa4e-6c2f6ceeb48c", "comment": "Malware payload", "value": "afd9d0d862719febeb16fee0e47249a2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225144, "uuid": "2abaa9f7-7879-4839-85fd-6883095be7f3", "comment": "Malware payload", "value": "3ac37b91fea4891e8f5e0edb5a33c7f503eb08eed65da35aba0a79ed4b2c2629", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225144, "uuid": "d934f49f-6ef6-4682-8ae9-667e066fea83", "comment": "Malware payload", "value": "229b98e80ee455470fdeab405b7e4d30c79bfd45", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225144, "uuid": "6a787829-524d-40b5-b719-03a07e88cc94", "comment": "Malware payload", "value": "2297f7863958d74acb017669c0cab103bb34de954c815c8b182f9ff98864be79f56ab06a253aa892ac2a4cfeb4087c6b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225144, "uuid": "067b68ed-0dbb-4039-8968-c10ce8fd79c5", "value": "2F54236FF49815D5C5830C36A6813EBB0E7BB85D1DED04FD325B8CCA9A7A0436058A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225144, "uuid": "0696a7bb-5e88-4750-ba2f-aeaa194bf816", "value": "6144:p14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjd:pvIzBhNU+3WB4d66j9B2dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225144, "uuid": "f9b533d3-b73e-4b6c-90c8-733827b26f02", "value": 295114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225144, "uuid": "d2f6252c-1272-4fc3-b146-c18f29a8b996", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225144, "uuid": "8f4f61ab-b6e7-4825-9285-9ab57162c4ca", "value": "\u201c\u6740\u732a\u76d8\u201d\u5982\u4f55\u69a8\u5c3d\u5355\u8eab\u5973\u6027\uff1f\u53ea\u8981\u8fd96\u6b65\u5c31\u591f\u4e86.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e557092-d15d-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624148450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148450, "uuid": "453d4aa5-e0c4-4c04-80b9-bb1aa806dcc5", "comment": "Malware payload (RaccoonStealer)", "value": "48efa0aacf4fc77df43bca3e2ec24a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148450, "uuid": "73d9832d-dce8-4ae2-bbc3-595f3eb4eab4", "comment": "Malware payload (RaccoonStealer)", "value": "3d528b742ada6b08740dd5413b53471fadd61ca065332bd768904603bd640fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148450, "uuid": "5534e357-bbfb-4491-a85e-7781f665d0ba", "comment": "Malware payload (RaccoonStealer)", "value": "338fc6db167a42bc0709c4dcec4d6e2258c91bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148450, "uuid": "0c613935-0be5-4bcf-9b7f-82ec3703deee", "comment": "Malware payload (RaccoonStealer)", "value": "fd5cacb7e9081f83615e066407fbf2a45916b83a72adb9702f2b642c2c51bbcbbc4edc7a48d3f3451374ea41243a7ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148450, "uuid": "7b879ff3-48ce-497a-8c02-3a09ebb2f20c", "value": "5255C023A2D14437D2B32A349C7B92945835BFCC3925988E6BE42F4C9F357A13B7215B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148450, "uuid": "b94e99f6-70b9-4567-96de-1c3d7d784029", "value": "d9cd4126463a23f234a6ba2e4c47e4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148450, "uuid": "0284a9a9-2381-40c5-9566-27841e5311b3", "value": "24576:EHkMS5g/oIj/VBpzXFq9v1acwAyXIrt2go5pvxM+Yy5X1IVeY27:EESoIj91+tyA1r3o5ZxNX1IVeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148450, "uuid": "665d0c3a-d23c-49b9-af76-edc583349238", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148450, "uuid": "22c7b1c6-6f21-45ef-80e2-5bd9633d8a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148450, "uuid": "66173c91-b41f-43bd-b101-ae961dc807ca", "value": "48efa0aacf4fc77df43bca3e2ec24a83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5362fa-d19e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624176581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176581, "uuid": "809023db-bd5f-4a1a-9ab6-1c9ff2db8776", "comment": "Malware payload (RedLineStealer)", "value": "204312b9e407d9589fbff53a705f895a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176581, "uuid": "514e2fba-da7f-4e7d-82c8-a6a16a395781", "comment": "Malware payload (RedLineStealer)", "value": "3e503d31e990d9452c5f5ee146e7f83f46df6b034563f8a6d10959de7b43ae78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176581, "uuid": "62813e20-cccc-4506-a153-956dc09d63dd", "comment": "Malware payload (RedLineStealer)", "value": "c69ecc39f6fd989989f9ee2875578905e903ac4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176581, "uuid": "03ed1cb9-3003-4602-950d-ad503789e8ad", "comment": "Malware payload (RedLineStealer)", "value": "eb3a931f7bd0dbd64d9cf78e210aa72802fc9d29d20db27e709a1320ef745ed12582628bf742636400704acb5bde7180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176581, "uuid": "a5a06783-54b4-4824-a981-a88ca0097bb3", "value": "27E4F120B652C035F5B662F81AB6C3BDA52D3DB09B6850CB52E41AEE5B347E4EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176581, "uuid": "13d57d81-50a1-446b-abbc-76d5c8bf9262", "value": "cef982a39394466fe74a88f9214df2fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176581, "uuid": "64539a68-1ddf-41e0-b60d-85d5308ef2d0", "value": "12288:VShsEJoGrNn1hSMlhgdgfhe72QEmpzHWwReCKiUmJqsk1Qt7nd6hAdYblu3l:8TJoGrNDqgf2bzeCKDJOoMYs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176581, "uuid": "6cf286e7-100e-4640-a824-b70476379cbc", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176581, "uuid": "20c44228-d6d2-46fa-bccf-11b199c94308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176581, "uuid": "b79cef9c-2ae9-41f2-9bf4-05a8d9d30455", "value": "204312b9e407d9589fbff53a705f895a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354a8a42-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157831, "uuid": "e95b337e-22e3-44bc-b418-913f467f9b8a", "comment": "Malware payload (Mirai)", "value": "2eb034345bdcea9b76c233709eb0bc10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157831, "uuid": "b6fc20a3-4bec-4a39-ac21-b3ba0b1e80c6", "comment": "Malware payload (Mirai)", "value": "3ffe5c6653b4231e4f6d3a4b98cf592a7edecce89dee8097e13163d35332b07e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157831, "uuid": "b2ec1dca-4c29-496c-915a-ab303ed4df6d", "comment": "Malware payload (Mirai)", "value": "923eb33abdd9b030a00482a15080975a9d0ce941", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157831, "uuid": "68901d72-95bd-49f0-901a-8918352275a1", "comment": "Malware payload (Mirai)", "value": "feca1a05ab31099215576e826082b4b951bc71f5aa45d45d32d76fee33ddc66187db58f474886c8e837722d8a7294b11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157831, "uuid": "354a39c8-776d-40e3-9783-dbaa43cdaef0", "value": "D94302576E4714BEF1B68E36FA0D8302AF896EACD1BE79528351118C1720C4ECB7858F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157831, "uuid": "ee1c66d9-cbb2-4413-80d3-7cc0977cd4fb", "value": "1536:3vQyEB9XoKsXqUG7d9X/ufyS2nO3Y5c4aZb9W:3vMBlo7p+JrnaYsFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157831, "uuid": "1503afc4-30ad-4977-af55-8289557e3930", "value": 59012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157831, "uuid": "044c4cf0-09db-46c5-9f1c-c5f9fd4fe0fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157831, "uuid": "7b11a74d-bd61-46d8-8c7d-9de67f6b17e0", "value": "2eb034345bdcea9b76c233709eb0bc10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f24558-d1e4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624206356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206356, "uuid": "f0e2edb0-38b3-4c70-ae65-b1fb7f54c3c2", "comment": "Malware payload (AgentTesla)", "value": "011ae7c062109041359a68059758b004", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206356, "uuid": "78fa546e-fbbd-41d6-8991-6e4dd94a2f81", "comment": "Malware payload (AgentTesla)", "value": "4121b53175e74dddb4cdce06b699ce06dcf6c62b610060ef2dd9796751a067b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206356, "uuid": "0ffc687c-2464-41b0-9b6a-5059746fbb1f", "comment": "Malware payload (AgentTesla)", "value": "679a905e7eb30105e8e272d32463393802794f47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206356, "uuid": "e5d8c087-a09a-4bb7-b85e-9f4f5c10cc82", "comment": "Malware payload (AgentTesla)", "value": "550671d483a87d2721f905690784b70e45bae3015d83ae0e6bd997828322fd0bd3980d16fcc6f7981beef138c810832f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206356, "uuid": "a6de57df-5689-4dcd-b953-91b1ef6ec796", "value": "B604074977F4490AF9BE6B3248714C496370E4925923EB0D4FC284A96F33780CD9BBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206356, "uuid": "387ad919-7cf0-4f10-9b1b-5b02dcd576f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206356, "uuid": "0424cab1-20ff-4c99-b537-2dff7e4ec23f", "value": "3072:1Y1BdhUDNdkH+LGP34ovKerVUzeeDXbwa21D59ua/aHyvZRVd2iP:1Y1/hULxbwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624206356, "uuid": "849b117b-6e84-4685-80ed-d47618b5e31a", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624206356, "uuid": "328d2a81-21c7-479d-9224-bd8345c11d56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206356, "uuid": "5934e482-9444-436c-bf68-85aeba036244", "value": "011AE7C062109041359A68059758B004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bcf0fe-d17c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624161668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161668, "uuid": "95879fd9-5bfd-4caa-9a2e-07901b09a268", "comment": "Malware payload (RedLineStealer)", "value": "a90df7ee45ddec733fd428e0e34e20b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161668, "uuid": "d2dae202-c052-4575-a383-ec49970fa0eb", "comment": "Malware payload (RedLineStealer)", "value": "416759a2c6d7a277aaea4f313f09ab1ff34538ec80edc749ab062f6051454ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161668, "uuid": "9bbbe26a-6e52-4049-ae9a-2496267bf00e", "comment": "Malware payload (RedLineStealer)", "value": "947b74b57f10f3b5c34339669ed11e1aa40d08a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161668, "uuid": "f0320646-e0b1-4bcf-bfab-4b3719330df8", "comment": "Malware payload (RedLineStealer)", "value": "f216496e1de2ddd8243adbe63bd2ce911c744da3a4da2812a6ff599be42244ecd622ecccd20ca0bc5f689cfff92be336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161668, "uuid": "70c349a6-382e-4f04-b5bc-6d6350dbb2e8", "value": "3184452864BFC01984E3EEA12DDCA8FBD99A65E3640D743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161668, "uuid": "396af97e-6cda-402d-a753-641f0c8f2e70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161668, "uuid": "ae7dec86-c93b-40a6-afc6-7820d912e2f6", "value": "6144:UIualvergT2LZ9wc9f2dW0JjV11qjYBDCXvqYIwyZ3g9qmq+:UHalveET2LZuc9fyW0JjV11sYBDAvqYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624161668, "uuid": "4fcd01fa-e87e-4f6d-8ab5-cc5c1bb5c8e2", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624161668, "uuid": "54e090ab-4e85-4c26-a360-a8ed950b0724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161668, "uuid": "b367188f-b336-4dc9-a8a8-1849ed67d97b", "value": "a90df7ee45ddec733fd428e0e34e20b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461b7e90-d1ed-11eb-875b-42010a9c0053", "comment": "Malware payload (Neurevt)", "timestamp": 1624210257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210257, "uuid": "bfef244e-2845-431a-89f8-75ff45a8399e", "comment": "Malware payload (Neurevt)", "value": "2717ee99c8d55f10db1eff0239cc5cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210257, "uuid": "3b4775ac-3e5a-477a-98d2-51709faea076", "comment": "Malware payload (Neurevt)", "value": "41a882c91afa2a845ca6a72b2508d910a12e6371fd853bbd136298cdf40e643b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210257, "uuid": "8adc047f-57b0-4ae3-aa8a-a4e6f0c73898", "comment": "Malware payload (Neurevt)", "value": "1493a65f2264e498bf8401141c192fc32afc9a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210257, "uuid": "5e0164fd-11df-4f42-87ee-ab31b6634d8d", "comment": "Malware payload (Neurevt)", "value": "9263587451952166cd15592e38c22ebcdb93fe307cfcbc7d0951e0c3068d38702e4f18b6b7439470414c1c0a044072dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210257, "uuid": "46c610a5-c091-4119-82e7-d4bee396cca4", "value": "AF948D14F540C258D1B34A307CD5EA602C62BEB15A267EC73360736B993126EBE3B767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210257, "uuid": "b2c68d53-d7ac-46ad-990b-bd590d8c68ae", "value": "635a1b24f29ac20618e895d965cb4114", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210257, "uuid": "2ca3b610-5a48-4e0f-85df-d3840a45138e", "value": "6144:kR75N4aH4S+6PpXyIaqBxgjQL5Q9/YnuZQQiRTJyyxLg:01aaH4S+6PRyzq7aQm9/YnGitJysE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624210257, "uuid": "c14ed0aa-6840-46da-889d-e9535941ec6a", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624210257, "uuid": "f64a5e9a-83dc-4b9a-bb0a-61e25c5afb0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210257, "uuid": "85f55089-6d7c-42e3-85d0-eed938836600", "value": "41A882C91AFA2A845CA6A72B2508D910A12E6371FD853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9d735a-d1a3-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624178455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178455, "uuid": "b9aee4e6-d179-4a36-8757-c145f98455ce", "comment": "Malware payload (NanoCore)", "value": "0adf6b230a5601fc87c2e7dacff386cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178455, "uuid": "deb31dfc-5d8d-4c13-b39c-614b435084be", "comment": "Malware payload (NanoCore)", "value": "437c9421ae36bc19198438f86b86a39de0d207449abef097eb9656743823c256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178455, "uuid": "a1e8a586-d98d-4179-87e9-9171b20f6c3d", "comment": "Malware payload (NanoCore)", "value": "e1eb3b1b8e2d7045d124268baf6c42cc099a3986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178455, "uuid": "8b450667-c9c6-44ae-8a82-eee4ecefa206", "comment": "Malware payload (NanoCore)", "value": "a0d1064fe75dd1e52d6dca87ed88d5d50f403ca1f1f458a89b8c5189655f8491b936c380ef7c51b2df83c7eab606511d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178455, "uuid": "e76dc4fc-5d7b-4b0d-b74e-483512315e1f", "value": "9F35F17493044E6BD3BD277CC0012EC886F8F7A22591EECD7CE410D6A5E6B25EFA1169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178455, "uuid": "c5d2b500-5756-485f-a780-cf6132b90477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178455, "uuid": "ed5f4de9-c22f-4f5f-a186-778a1cac354b", "value": "24576:LfgM96nIGX/Vj07KfLzmM9Htp05hwSjOV1S4MtZn9Yq:EM6T/V0UHs5KSj81I/nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624178455, "uuid": "c4bd82fc-9431-4fbc-bebd-356043d1648e", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624178455, "uuid": "e9d3c7b9-90e8-4b45-8e44-e50ff7706c24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178455, "uuid": "2cb636a1-6c6a-421f-bedb-52d9a3189272", "value": "0adf6b230a5601fc87c2e7dacff386cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f5f903-d180-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1624163601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163601, "uuid": "9b5de8ab-ae9f-4bc1-9ad5-0921013dab89", "comment": "Malware payload (DiamondFox)", "value": "fd4160bc3c35b4eaed8c02abd8e2f505", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163601, "uuid": "efe22242-7836-4266-a30d-b25c06c6165e", "comment": "Malware payload (DiamondFox)", "value": "46836190326258f65c9dbc1930b01e9d3de04996a1a2c79e39a36c281d79fe0a", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163601, "uuid": "0a933701-89d4-437f-a045-5aa2cff502b3", "comment": "Malware payload (DiamondFox)", "value": "3c7bcdc27da78c813548a6465d59d00c4dc75bba", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163601, "uuid": "4c89b90b-e9d1-4d24-ae43-14e06b5dba6a", "comment": "Malware payload (DiamondFox)", "value": "145865f1386935146164d62b71f971c30d3be5dcd7856dd5df46378af43b83d03d4aaa309e1bcb2d9457a6e191e0307b", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163601, "uuid": "e0b4213c-3a20-49e3-b163-994369fed9e0", "value": "58058D20B182E1B1E4A100F5396DBF66246D7D3807709AEBB3C83F6D597D1C15A32F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163601, "uuid": "8b6f5771-d73e-46f6-9212-44fda4f83c44", "value": "146d9834dca937c5740063d6c887d411", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163601, "uuid": "58f704a6-d4fa-4d04-a61c-53dd320df2a6", "value": "24576:i77o8t0b5e8dzMdQG/6dfwun9elTFl64D:1jdgdR/+IunmTvxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624163601, "uuid": "00f68f51-7ffc-4840-a1c5-515fcfcb2c8d", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624163601, "uuid": "7557f5f0-5983-486f-929e-7e8d418fd4b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163601, "uuid": "0d6a408e-a926-4f2a-bcf7-4d90bad11bb3", "value": "arnatic_6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13d8f3b-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624158038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158038, "uuid": "7dae593f-65f0-4cb8-bc4b-85f9cfb37039", "comment": "Malware payload (RedLineStealer)", "value": "a8ee4cf73b31a95e6cfbf5482fd2b04e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158038, "uuid": "aa137468-0717-4032-af5a-abd04d160932", "comment": "Malware payload (RedLineStealer)", "value": "470b1fe6e325f38614ee00061e8a9905ea3be433502a474cb2682c2aab6fa05d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158038, "uuid": "fc194489-c851-4217-8d52-46e2c88462a6", "comment": "Malware payload (RedLineStealer)", "value": "ea460c16f4701f5244c3800d69113da57b4a845d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158038, "uuid": "7eddc952-61b5-4af9-b098-3138dabf506a", "comment": "Malware payload (RedLineStealer)", "value": "4ab01c9007d4af3a65e8c4d1f1ff4934c42102bab28981ee8485051ab6eb660aa3699254ad4e953488388d85089b8f20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158038, "uuid": "99f5ab01-e7f9-4450-93fa-5e66e355f63d", "value": "0694BE10FA90C035E6F662F85A7AD3B9A93D3A70572050CF52E51AEE5A387E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158038, "uuid": "b8de1d86-aadc-46d2-8813-e4d542e4dfb3", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158038, "uuid": "1059fb65-d2b9-43df-a55f-52df6ba4e8af", "value": "12288:gO2mp8tzsx1dC3i4jG8Fp+tIkbebN8S7z8Twfl:cA8tzsxqhgjCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624158038, "uuid": "cbc0db9e-d4e7-446b-96e0-935f8c2de953", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624158038, "uuid": "0d43d957-2c17-4d6c-b266-e476e1fbf385", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158038, "uuid": "b3565c18-ce6c-48cf-b5fb-444e18892252", "value": "a8ee4cf73b31a95e6cfbf5482fd2b04e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404c831b-d199-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624174170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174170, "uuid": "4715068b-5d45-410f-a33b-c989f6aac63a", "comment": "Malware payload (CobaltStrike)", "value": "1ed3039c09cfac8bd651d48fcfb4847c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174170, "uuid": "a5585a08-eff4-463e-b171-11e292cf107d", "comment": "Malware payload (CobaltStrike)", "value": "4726664a1167df53e184eaf298ce91c539a5c0ad60297706caf8eee472d26455", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174170, "uuid": "c1148024-4dd8-46f2-87c3-f8c8b4304ada", "comment": "Malware payload (CobaltStrike)", "value": "4dc94c5adbf2814605af54e0a72d42bb64cdcb1e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174170, "uuid": "da86e80b-52b4-4f82-8396-c5d7007c2ba1", "comment": "Malware payload (CobaltStrike)", "value": "6c47c3c167a9b54e192008963586d5af1c803d2276d9cee8b242c43d685c1ec34b9e73a8a8a20b5099604f3a914b31b2", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174170, "uuid": "30a96107-6bc7-47f1-b9bd-72b1933997bc", "value": "F72422D0AB57DC7BF488B834A6818062BD8EBEE5F5DA46CE244DF78A053279154F0C1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174170, "uuid": "3572406a-8d05-4bd1-8f50-b6b6d76ac07d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174170, "uuid": "87050521-02eb-4491-bb07-246c6e77c44e", "value": "768:DS/regJ+Yr9MgbM6MFuT3WnhObkAApLu3oiIDNzeJku9vx/SF5Mbd0oC3d4OoxnH:2/regJ+Yr9knkbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624174170, "uuid": "b147b4ed-d273-4c33-9532-605135b342d8", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624174170, "uuid": "7e7d95a2-8afe-44f6-9dc0-c5292ad6c1d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174170, "uuid": "8d827c7b-e0a0-48e9-9b6c-50ed6918c21e", "value": "1ed3039c09cfac8bd651d48fcfb4847c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb233f6-d15d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624148421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148421, "uuid": "a6748461-e16d-431e-b8fb-76a4c86f941a", "comment": "Malware payload (RedLineStealer)", "value": "0af92037a49331001375d9d62b57f952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148421, "uuid": "32f0cab8-a81c-437d-baf0-91fc3999b7f5", "comment": "Malware payload (RedLineStealer)", "value": "4746fa9dcfb09792d1151daf8a13ff1c522f1ee9d28b0c977e882009e039498f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148421, "uuid": "51961b04-cf0c-4934-8f02-761052d3420d", "comment": "Malware payload (RedLineStealer)", "value": "73ecb5052a6fb85f0ef216ab74f3cf2d181a3859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148421, "uuid": "ec8fa40e-f949-4857-9259-8aff6ddff67f", "comment": "Malware payload (RedLineStealer)", "value": "4d9b9d866d3f5494dcf392b2e29729103801aebff5e69490a53fc7f3921bf3339c6638fc757c22ec27be4a95b3333cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148421, "uuid": "417308bb-987f-4c66-b552-0a507cadd749", "value": "3384BF10FB90C035F5F612F84A7A93B9A53C7AB19764A0CF62E51AEE56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148421, "uuid": "2cf7ac1a-28e7-437d-a5d3-f535e29562b0", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148421, "uuid": "db94c3d7-c489-4862-9d45-1939977d2e0a", "value": "6144:ZwnLQLB7cllymbKZFh9UGQABblluQZ8FbBeAVGlTpYLD87:KQLB7cXymQvyGEQWvvy9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148421, "uuid": "316424c0-fde7-4a10-a889-6d69515168f1", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148421, "uuid": "ff4943c8-5ffd-4076-b602-0995d08cfbd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148421, "uuid": "2eec422c-ede7-44ad-82e6-9c93e9bb4963", "value": "0af92037a49331001375d9d62b57f952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5688f3df-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180220, "uuid": "9a66dfa1-eafc-4a60-b037-4b8518d7a0f2", "comment": "Malware payload (Mirai)", "value": "f74143abce0b3cc23b2fa6ade8c0f2ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180220, "uuid": "10152eed-ed23-417f-8eb7-9305524662da", "comment": "Malware payload (Mirai)", "value": "4af2649e3aa8d37518f9f4b1e53e14d552cb13650061bc1cd333c4d00f270ce1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180220, "uuid": "c22e5f7d-8ca7-4e1c-9453-109e14e311fd", "comment": "Malware payload (Mirai)", "value": "51ab7e1d8d3a2b629f29bfb04878272e555a2c03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180220, "uuid": "2d421569-543d-4a51-a913-fb2ceaa9e8bd", "comment": "Malware payload (Mirai)", "value": "c717dbc3768b3a1e7afb4392c036ed5c2f2277f08217e530f543a2593f52de2031fe1ee77bb88a4fb00822c79e8be9e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180220, "uuid": "f97136df-dae0-4373-8dda-515d5a6cc34a", "value": "156302789916BE34BAD37832BC9745C197590EE8DBBC4A76502E29BC1C318B051F928B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180220, "uuid": "a3edeed0-9dce-4064-8a40-f346f29db1b8", "value": "1536:VgWKK0K26mVuQYO1M3iHQmTJmOOxGWZpHvq80LtqOD9kdWfFc:ViK2hIyMATOxG6OLt9D9kdqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180220, "uuid": "592dc919-3f7c-4a59-97af-a8c25480690b", "value": 72600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180220, "uuid": "c596a9a4-1220-4e1a-9b71-21d0323fa879", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180220, "uuid": "316761c3-95ac-4e56-b1b7-f46433511ef4", "value": "f74143abce0b3cc23b2fa6ade8c0f2ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0622909-d198-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624174009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174009, "uuid": "dfce1797-479c-4821-9726-6b1dba66c31e", "comment": "Malware payload", "value": "caf57d99885af6e6cd0e2e6f4e991cc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174009, "uuid": "3ed511dd-a446-4ebb-b6c6-fa2d82d459c2", "comment": "Malware payload", "value": "4e1b1d348b5d643308cbefc595c7e3761d79928a45c4b6b9c937d380d135b1c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174009, "uuid": "b490c9b7-c726-4c84-98e3-05536002767a", "comment": "Malware payload", "value": "a85aac65ea7927b9b787207fcfcbeb357a4fce85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174009, "uuid": "92b225ee-65dd-4f81-89af-8532a594c472", "comment": "Malware payload", "value": "c136430c9bb5309568d08d2a6ff86c83a75854c9ec74bb482c8cbb6f6018e938c58ee1db24b194caeed64b91979abc20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174009, "uuid": "76615074-9989-41d4-9ae0-2c4c38bf7e5e", "value": "96256B59A103C5F1D9272AB84C2A56A8D4EA7C333B34CC4A26B47A4D7AFF2903D1DD47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174009, "uuid": "d0e9018f-96f1-4c8b-a1c4-8c305147b86e", "value": "a08047ed05d96265100ca97553e90f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174009, "uuid": "c7937725-e714-4ea9-9ac2-72193d6973a0", "value": "12288:qKWXw4bc1NhDVFvci6VXI7ikDOHFR6ly2WGTZt6TqX0uNb+T0HXX+jBnnXLVgKRs:q5XYfDjAVrk6FIl5ZtGq/XQB/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624174009, "uuid": "9c724b26-93b0-4b81-bec0-4a8810f4bcf3", "value": 984704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624174009, "uuid": "fb06884a-088e-4756-9a32-a32d810b3d6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174009, "uuid": "8307ca04-6fd8-414f-938d-91e46312aa62", "value": "Orden de compra No 2413613955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd328ffc-d1c6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624193734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193734, "uuid": "09c0f2ec-2fc7-4523-b020-c5d613157591", "comment": "Malware payload (RedLineStealer)", "value": "49fab59b03d00ca382dda8035a58652f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193734, "uuid": "899f3769-0f53-44b4-9a0f-792043acd61e", "comment": "Malware payload (RedLineStealer)", "value": "4f3a351455832dca36b70f79c591d224fd52865d5b7b47cab749e8791044d625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193734, "uuid": "ae8ce63f-3897-450d-a771-e933deca00b5", "comment": "Malware payload (RedLineStealer)", "value": "1c62eeecdad2e3f6d034e2f285f5e940c1b9f74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193734, "uuid": "1d2ea855-ee29-4ead-b27c-5beead3ea06d", "comment": "Malware payload (RedLineStealer)", "value": "48498c89a241e03e1f9cf6c657cc9b9932a66a9c94a8ce4a4426d5ce4708b342bf584df003916d956851dd2a3be47e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193734, "uuid": "29283593-0471-48bf-8c20-43dba29d8278", "value": "6594BF10EA90C035F5F652F85ABAD3B8A52D3AB05724A0CF52D55BEA1B347E0EC31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193734, "uuid": "663523cf-3705-45c1-89f5-1e16503d4e6d", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193734, "uuid": "91e8ea8a-c3b5-4995-9784-e6098fb716e3", "value": "12288:189/ec7EJPSTx92Gvmmfbk2xCA9hfoc5NkpLbnJLl:WGc7EJ8TBw0Upx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624193734, "uuid": "b2bd35f2-f387-4059-b587-4d255665f849", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624193734, "uuid": "bff506a7-b9b9-4b07-8d29-788294d2de7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193734, "uuid": "ae14e6d7-9826-4104-83c2-08fe91084140", "value": "49fab59b03d00ca382dda8035a58652f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3af0cf4-d192-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624171330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171330, "uuid": "b3b87b7c-5dd1-4852-ae34-dc3d793b11a5", "comment": "Malware payload (CobaltStrike)", "value": "d142a4792297359c9c000d671abaac2b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171330, "uuid": "78c7a092-deb2-46ef-a255-5de19f32ce32", "comment": "Malware payload (CobaltStrike)", "value": "4fd51972afad0f2b202359f4ff7626055f77d1f05eacb01b994035fffe88af5d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171330, "uuid": "97243373-17b9-47e9-8960-2027541a16b1", "comment": "Malware payload (CobaltStrike)", "value": "9c5855a03ca328ec09a9ff3f16ea5bd7604b9afe", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171330, "uuid": "dba4ec46-1f3a-4b27-977b-87b09876f4d1", "comment": "Malware payload (CobaltStrike)", "value": "957c90a3be82c9a8d1b41feef6110830d260d7f1ab4a9e15688fa053e4beae24137e89245b1d9093c28b3fe7f1968741", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171330, "uuid": "2a485bdb-dfd8-45e9-b33e-e601d7fc62c2", "value": "CD72302569EA502DE573EFB13EE875D6DEEAB7733405255B1085030B8D12F80DE42A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171330, "uuid": "64790ffb-e3b8-4f6d-b7f5-cc10f3c639ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171330, "uuid": "d4ba742b-18d3-4edd-b9b1-7802b9392e36", "value": "384:LYfKlWytNko+SRJajuV6BKFCzaWvjMfyZoAkYDistHWI:LYfjcNTajuVcKZsZncI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624171330, "uuid": "443afd5f-2059-4c50-9add-900370e9d848", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624171330, "uuid": "dd508fb1-59ed-4ef2-a452-b992cbc113c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171330, "uuid": "14059729-204c-47cf-ae39-92ab11d3c776", "value": "d142a4792297359c9c000d671abaac2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ceec51-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225283, "uuid": "fb20bdef-c1a8-473a-88e5-dd1b5ddb77f8", "comment": "Malware payload", "value": "b374d6e04a7e59416b88ee44a4552588", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225283, "uuid": "86382914-5a45-4211-a83f-0d10395a174a", "comment": "Malware payload", "value": "4fe17bc93b8d54e767bf41fdcf05565aa09bd61ae0054379ca82c2a3e91164a6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225283, "uuid": "51cde04b-f911-4521-a060-8dfed82f36c6", "comment": "Malware payload", "value": "c96ca13a3f228ec2b8d9e63abbd3e49e9780904b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225283, "uuid": "3e2be44a-703a-4e61-a35e-959bb213cb7f", "comment": "Malware payload", "value": "a9126dfeb55f3e1181bda6beeb99e81aacda284d74f17ba54865b89a195712385c33bc3544ac1193d9e4753af6fbc5b3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225283, "uuid": "3f0fe83d-8306-449d-9228-a2eefd83102b", "value": "3A54236FF49815D5C5830C36A6813EBB0E3BB85D5DED04FD325B8CCA9A7A0436058A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225283, "uuid": "793ae610-c9b8-4684-8fd7-22149dffa4c2", "value": "6144:R14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjI:RvIzBhNU+3WB4d66j9B2dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225283, "uuid": "fc3ca04d-f11a-40f5-8b06-5c83b9bcb67e", "value": 295106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225283, "uuid": "7b6f7d33-fdbf-4317-97ee-ee27bb233fb3", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225283, "uuid": "3fcea675-6f5e-4fbb-b57f-446b539dd134", "value": "\u5982\u4f55\u628a\u4f1a\u5458\u5fc3\u7518\u60c5\u613f\u7684\u5e26\u6b7b\uff01\u5bfc\u5e08\u5fc5\u770b\uff01.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34aadef-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624158096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158096, "uuid": "ae57829e-5526-4c80-8e8a-b86d02c7e1eb", "comment": "Malware payload (Mirai)", "value": "0ae724dd1cc566d77d5abe90196463e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158096, "uuid": "7a9f326c-0cfd-4caa-b17d-ce28340e0ccb", "comment": "Malware payload (Mirai)", "value": "503f0cd87c5c2b2edd8a25785583b29c70a03d31841be35ab3a8ba9e72b3a425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158096, "uuid": "a1fb671a-1a42-4be9-83c2-287e60e6cdee", "comment": "Malware payload (Mirai)", "value": "0a74490b5b98275105f4d2410086fe9ef649a8bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624158096, "uuid": "692c172a-1eff-44cf-aafb-184fc6dba171", "comment": "Malware payload (Mirai)", "value": "3a4910559a6961d9d3a2ba9fc289bc415c8258cadeeee89e36acbc70eb801d95a87341027b7e207161570fd862b29606", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158096, "uuid": "23e5ace2-4746-4f79-b28a-8d15661a52bc", "value": "C403F1B12E552172B320AC77F86E824FF25DAEFC62E07115017A0AAC3E6F44997F4658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158096, "uuid": "436b6a5a-cbbc-42eb-af38-ddb91d863d5c", "value": "768:cae8Vef5jygd5OQc2dUR5Yst9myFR2ghGX2THq3UIsE:cae8VIJygd5xcasNY+4EoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624158096, "uuid": "34720594-14c9-4904-869d-98d99c2f400d", "value": 38920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624158096, "uuid": "af2afff9-7030-483f-96fd-ba6e3ad0ae7d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624158096, "uuid": "8d91899c-d872-4450-880a-c6cc6fe8c868", "value": "0ae724dd1cc566d77d5abe90196463e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de4cd65-d161-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624150168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624150168, "uuid": "7b9c25e6-3a10-4590-b181-adfc2a61eaad", "comment": "Malware payload (RedLineStealer)", "value": "2c62e6a6ea9929bfab155e2195b418fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624150168, "uuid": "bd6d3cd6-957b-477c-8768-b5c8ceac622e", "comment": "Malware payload (RedLineStealer)", "value": "50575798954fd5dff1f376d1597a3d0ff52f51789c5ae98b48957590b540bcce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624150168, "uuid": "4d1cb2ff-4aa4-4881-bb8d-48726722d07d", "comment": "Malware payload (RedLineStealer)", "value": "6e8fdb8bdd8cba8111c8668512a24a04173c00e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624150168, "uuid": "0390fb41-bb19-42dc-8131-7a5a363aa308", "comment": "Malware payload (RedLineStealer)", "value": "050b0c8d6236c9c74d1af7ff6083f26a0665bede8710b67db9a26e23f8fa41fd4fc0dcde3c52249f80c3dd2b090aadf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624150168, "uuid": "68692e4e-852f-4fc6-bff4-5444a31f2dde", "value": "40D53350F35DED48F21102B1A8BDC275253655A5A30D4E3B381ABD22FDD23B510EEEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624150168, "uuid": "71ae09c6-44b4-4467-9107-ef4cf903159a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624150168, "uuid": "c5960483-ee16-4704-9789-0cd8b07599de", "value": "49152:dx8iKSQJtuXyBFKA5XiatfcrGblN/V+2U8YpLPqk/20xKLPHGT3KNzp:dx8iWLLrdiiDRNtYL926+PmbKNzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624150168, "uuid": "a831b25b-e9cd-4cb0-8cf8-651dcaaa474d", "value": 2802320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624150168, "uuid": "eef993f7-9722-4b23-b561-7378c6137c89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624150168, "uuid": "d9440cbd-bbd4-41f8-8527-e028c4445931", "value": "2c62e6a6ea9929bfab155e2195b418fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b9df57-d220-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624232424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232424, "uuid": "47558fa1-7d41-4074-b588-356491a07d68", "comment": "Malware payload (RaccoonStealer)", "value": "8c9b46d8c682557e142bf5e96b70709a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232424, "uuid": "611523bc-9c4c-41a9-ab0a-769b65b387d4", "comment": "Malware payload (RaccoonStealer)", "value": "5146dcf82d334df70b5d75763f4625af0694934aa667e9faaadfad02c56c85a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232424, "uuid": "24d1db49-3750-41df-98e3-92fb49618cf8", "comment": "Malware payload (RaccoonStealer)", "value": "84f206e3f782a58c122be02dc107210ac894e6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232424, "uuid": "ee36eaa7-4716-4814-87fa-2ece6b2f96f8", "comment": "Malware payload (RaccoonStealer)", "value": "b990ef3ecd91682f1447f3caad61dd58441fd324a94ee75068b27da92aaeec6f00f515ece5c429ccf01c9e5b71c14adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232424, "uuid": "f96beef8-36a6-43e2-a6e4-cc98a36ddef0", "value": "B04529303FB863D6E07AEAA145ABB447C9ED61FA250DC8CD5C5007C557326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232424, "uuid": "46ee940d-f728-4df7-8b29-8cfcd9db1113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232424, "uuid": "5e798a0d-0e5c-4237-9328-aa24f325c470", "value": "24576:3s0YQCWrvyQbD2o7z/bVJvlP2t1AQWldhIOku/gNyM6Zy:3s0YQCQbD2o7P1G1AQAdhIOku/gV6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624232424, "uuid": "e51fc72c-3e6f-4404-8edf-c04042bcfab8", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624232424, "uuid": "d8677e01-ee18-436f-88a3-79a00705070b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232424, "uuid": "ab25631c-2469-4e9e-9fe2-37ec206a94f8", "value": "8c9b46d8c682557e142bf5e96b70709a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf1cb7e-d180-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624163613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163613, "uuid": "22471ff9-e111-4261-8b51-b461265fc9b8", "comment": "Malware payload", "value": "21442458bec8dd39678ba8a34e5a790b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163613, "uuid": "8a67e347-9f66-4c39-bced-2767585e319e", "comment": "Malware payload", "value": "524c474c488d2f672ec0394a8b2357a72490ea10015b8d3f81df6172d23f4fb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163613, "uuid": "25d8e32f-f8b2-418b-86db-fe2dc1445548", "comment": "Malware payload", "value": "1cde405516bfd31a390bf86c0c0b7023b7a44603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163613, "uuid": "9c64cd4a-7998-46a1-9f36-e996df9dbac5", "comment": "Malware payload", "value": "50f6c6ad8fd5b9d347164363bada20c9b2c3835d8337da19882d5f3d9496168e43ffd9f2c2307eeb7d86f90ad97fe4a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163613, "uuid": "61c92fa8-a991-4957-91e4-974a2cf8936c", "value": "ED542369101FBAD4D9FB117769EA324722E64D8C5ED82622B393CC26C19204E761DB3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163613, "uuid": "b28e6dbd-cc21-4d79-acfe-5eb68f2dce69", "value": "51819a15c774f82b926ee8620d39f121", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163613, "uuid": "66d08624-c10c-43f9-a9bb-d49ff1e1728d", "value": "6144:2CqbkrMCqbFE9VFvRrEQWjinXABNBuWYC2cFDdo:24rQBEZ5MiXAFuWYhc5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624163613, "uuid": "22fa20b0-9fa5-4bef-a53c-f6a354773134", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624163613, "uuid": "cb3ab703-2cff-4764-b867-200138ea66e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163613, "uuid": "e56b318e-9f1c-44d1-bd01-7334dc7f92bf", "value": "setup_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b587febe-d15e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624149026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149026, "uuid": "af4e5075-e41f-4e0e-ab4f-61aa24478e6e", "comment": "Malware payload (RedLineStealer)", "value": "ceb123517ebdca84545a4f02b7d06494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149026, "uuid": "b989adf3-a0b8-4058-acd6-ab1daea3366c", "comment": "Malware payload (RedLineStealer)", "value": "52a7015460b20cb4f86a6f7ef86278e389a5be0992895c7cd337824237005db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149026, "uuid": "c4131796-b914-4cdf-a456-af573157fba5", "comment": "Malware payload (RedLineStealer)", "value": "ec428aa3dc1e74776bbda4566924faef7524c4c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149026, "uuid": "b7798822-89b6-40f7-9553-0523a5ccd665", "comment": "Malware payload (RedLineStealer)", "value": "ddb59340138ce00f9ca41b9330945582a1cb290e401e0a62869766d9558bcc5e16c8a1a89eeded52ea47efed1ba1638d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149026, "uuid": "bacf5020-4fce-45db-998f-48d0fdd910e9", "value": "CF84AE10FB90C035F5F312F85A7A93B8A52D7AB1A76090CF52E52AEE56346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149026, "uuid": "c20fd746-20cf-4e9d-bfe3-6e6e7476dcb5", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149026, "uuid": "e75a5e66-b06c-4853-aead-c522c1d09a39", "value": "6144:3wnrQLBLcl2ymbKAFhIdS884fV7pgx0HmLbvVxa5IVIpFn:gQLBLcYympvB88S7pgx0HmLjVxa5Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624149026, "uuid": "bc471e00-5bce-411c-9283-729db6da4f51", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624149026, "uuid": "e81d06e3-a736-4947-a441-867d51f8bf4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149026, "uuid": "77d79813-4fdb-4b39-a103-769a669c951e", "value": "ceb123517ebdca84545a4f02b7d06494.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26176c04-d217-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624228243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228243, "uuid": "401bb3f1-d9de-4102-bf8b-9497a8d3f25b", "comment": "Malware payload (CryptBot)", "value": "58e5562209d50978efd614dd040ef4ca", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228243, "uuid": "cceeb56e-3c63-4961-94ec-3a2b8b4ee738", "comment": "Malware payload (CryptBot)", "value": "530656ad87a4e5c0f07998323ebca34348af7c7a2e585196f2d0c73580832e36", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228243, "uuid": "cd30dd79-78df-4e45-ac08-8f5c602dc1c5", "comment": "Malware payload (CryptBot)", "value": "d225a1f15ac4f8b96be737b3905f050fc2dc3a31", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228243, "uuid": "54892458-8016-4ac8-a9b2-4530f6aa0d85", "comment": "Malware payload (CryptBot)", "value": "bb2e9ba981a4c9534b2a887fc898e6358da9b444dd60fb6fc472f57e8bc81c97bebe4ae30168eba4d63298840aa43195", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228243, "uuid": "2d73078b-6d15-4958-9387-5e9b90f4aad6", "value": "E4F4F100A750C035F5B762F816B6936CA93D3EB19B3454CF62E51BEA5B747E0AC31B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228243, "uuid": "1b9a401a-986a-4889-ab65-c733316babd9", "value": "110e60b2b75791801e1d228265739b22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228243, "uuid": "56af3b39-5fe9-4ed6-a579-57a68887a53e", "value": "12288:UDUi0OJq6SiVG6nMTr4wUMHmKz3S+0FSjzy5mjfy3okiDc8N2f3JFAnjlqUl:ptOJq6SDlUMHDB6Sy5WUycHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624228243, "uuid": "4d5d5bba-8a14-496d-b684-ec9d7aadb2b6", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624228243, "uuid": "34f79ed5-bc02-44c1-af51-63f83548542f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228243, "uuid": "e768dc71-d1db-4222-89f2-cdf1557eb290", "value": "58e5562209d50978efd614dd040ef4ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2309baba-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157800, "uuid": "3a23b4ce-6a9b-4640-8463-9ef778851779", "comment": "Malware payload (Mirai)", "value": "423b6174c91a26e0eb23d8bb23ca668d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157800, "uuid": "5825db31-142c-428d-988f-202c10e9f248", "comment": "Malware payload (Mirai)", "value": "5319783836f1c648e153e5a995378f4097c31e4150d0c1b716ae89b39130ae59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157800, "uuid": "f28cb6fa-551d-4624-bce3-a520822bab5b", "comment": "Malware payload (Mirai)", "value": "54f0f19649da2a32cb660c3dbcfde171d32e6a80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157800, "uuid": "3fc6699b-3a00-4913-a70b-08aa9b3190d7", "comment": "Malware payload (Mirai)", "value": "65a103b928ea303f1cfdc8df3f16202d326c3d4604135240c0458e79b6e8410fe9fa7a2c98ae1c24aa63b4a69122f637", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157800, "uuid": "170f8969-64e3-4a21-9d2a-222913eeba15", "value": "D173AE72C8646DE0C258063879E9CD381723F6055623AEF59E558BE6240BDFCF50E3B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157800, "uuid": "3b2cbf1b-fee2-451e-a6e5-df8680949aa2", "value": "1536:V/5j6RAcTaNwt/+ZcYMPDFbYPOqbubefuxkoixTJxCpCETq:VBjIZTm6+vCDSPtiNkoATJxCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157800, "uuid": "eef6c093-2f83-4966-8f61-d0f34a013bc0", "value": 75064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157800, "uuid": "9f5f9f6d-3842-43ed-b176-f443c814a399", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157800, "uuid": "a9bda1e9-63f2-49d0-ba7d-9c77a7fe1a10", "value": "423b6174c91a26e0eb23d8bb23ca668d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfb82b5-d18a-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624167935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167935, "uuid": "a6b11699-8814-4ee9-af65-d121d2dc458c", "comment": "Malware payload (CryptBot)", "value": "acedfae9cd75516840b39a63dacf56fe", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167935, "uuid": "6b433844-b302-40d1-b0a7-32c251e9b020", "comment": "Malware payload (CryptBot)", "value": "538a92c3c9e3f3ee0704bde1009188520dc54a840f3a97832dc5b9f8de2545b0", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167935, "uuid": "2c358ac1-2804-4b7e-aad4-f8104800a243", "comment": "Malware payload (CryptBot)", "value": "165bcd5f3552d1dc20f5f80e702de0a3c449236e", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624167935, "uuid": "e55d243d-a8ad-4f94-a433-95cb88d60f30", "comment": "Malware payload (CryptBot)", "value": "8b545710f75c772fccfc26fb2113d1c0bdef4ff3012fa2eee943706fd346f9c3b3a9173986db7516fb0c2cecef136bc5", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167935, "uuid": "dc43f257-52d9-4d7b-ac85-c179d519215d", "value": "9C84AE00A7E0C035F5B762F85A7963B5953E7AB16F38D0CB12DA1AEA46746E0EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167935, "uuid": "b805e459-5469-43f9-9161-016fc10d3542", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167935, "uuid": "d3c7598b-668e-4d12-b269-df6686710f02", "value": "6144:v4ymLwbiBIDiK6NnycsCUk31eY+ZIhw4nn5nfTXA:v4ymLwsIDjknycq6cYHhTn5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624167935, "uuid": "eab11b32-6e3d-4ea5-8af0-27a900fd0cef", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624167935, "uuid": "477f4a26-20b8-4fdb-be52-a96a3ee24aa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624167935, "uuid": "34adac34-2d8f-41c1-b9e0-a9ccfd8c4b77", "value": "acedfae9cd75516840b39a63dacf56fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ef563b-d163-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624151247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624151247, "uuid": "e3c0e261-a881-42b5-91e9-dc240a9da383", "comment": "Malware payload (ArkeiStealer)", "value": "a29374f894a68cee6063cabb69b41199", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624151247, "uuid": "3ece1f61-b11e-44c0-a3c7-c0b9d2295753", "comment": "Malware payload (ArkeiStealer)", "value": "53a00aad6040922a947d5034e296d464726e0bde07a1439341f097af00e17881", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624151247, "uuid": "0bb2863f-84b5-4822-a192-4814c8286038", "comment": "Malware payload (ArkeiStealer)", "value": "49a41165ad3891aa0d017d0b175717b6c0424a4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624151247, "uuid": "fa7f3925-2740-4649-ab88-033ba4b895ed", "comment": "Malware payload (ArkeiStealer)", "value": "a06179c9bbe1c365b18a5bb092404e0cbb7a62474fbb4ad7872561c7f0f07f1bc9c9763b785125b537dc55f2e5259346", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624151247, "uuid": "5e585c97-95d2-408d-b3dc-49dd10ea88ef", "value": "E355122436D6D80BC2755B34D6CBE13027BCBA533B039B1B315A539D25A17E0AD42BEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624151247, "uuid": "7068e0e8-8c06-40a1-bbf5-5c4055324fa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624151247, "uuid": "c34289a4-f9a4-4e0c-bf70-61db2788d1c5", "value": "24576:1zNH+HCbzZFlDGKzFMGV5SgDRnkF1lMORI9F+J+B541fJFWwVJmWiI7m1QjW:nH+iBbDFxV5SgWMOREF+JC41xFWwVJm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624151247, "uuid": "b42c7e40-481d-422f-b1d2-9d2f3dfe301a", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624151247, "uuid": "33cb8f54-ec28-48eb-908c-3e13bdd62443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624151247, "uuid": "ec3d7bc4-d6a9-469b-b87a-f3e0e7192811", "value": "a29374f894a68cee6063cabb69b41199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175fa23e-d16e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624155633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155633, "uuid": "2c761fa1-19fa-4b58-8e75-b422dea9d877", "comment": "Malware payload (RedLineStealer)", "value": "a13ba9faf86a4fe3025a1cdc35841bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155633, "uuid": "a789117f-98d8-4582-8d2c-55a512995bc6", "comment": "Malware payload (RedLineStealer)", "value": "5446c74d8c521df57dc5075110c82e17b06062fe894f611ae7970a763e988ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155633, "uuid": "85c86714-92e9-43ed-8528-0db07dd33f90", "comment": "Malware payload (RedLineStealer)", "value": "c98db8c8cdc7d41374163d26d04c92a347107858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155633, "uuid": "40cc1829-43c9-4f33-ad3b-b007504f1c22", "comment": "Malware payload (RedLineStealer)", "value": "bdb914dfd4c0bc1039baab07a2dab455a570af42e2c0202d51bc981ba1a4339da6cc8581898e63f095ff862f2234a730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155633, "uuid": "d8a4f7e5-68ba-47e3-b1a3-5f1ddb284540", "value": "B694BF10FA91C035F6F662F85ABAC3B9A93D3AB0572450CB52D51AEE5A347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155633, "uuid": "f231c181-5519-42bf-825c-6527f2c7f797", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155633, "uuid": "ab165166-8649-46ac-8c4a-99489ca656a8", "value": "6144:t65IwYEmp8tKsxWdY3pHk9AP3xmcoWFPQfxsA9YAe2TkA9Hw3h7Kri:zwzmp8tKsxWdY3i9AP3xsqgP9OgVw7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624155633, "uuid": "48bae673-a708-4f77-bcc8-c3b2efa46e49", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624155633, "uuid": "9eb23832-3559-414f-ac45-06a7b66ad91b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155633, "uuid": "961dba32-3d62-41e8-8f07-7f9ebcee93c7", "value": "a13ba9faf86a4fe3025a1cdc35841bfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74479ba3-d1cc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624196161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196161, "uuid": "3222933f-6e02-4c9f-986b-9f3cefe16c98", "comment": "Malware payload (RedLineStealer)", "value": "5bace722d9a9bc21645aa088b877cbc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196161, "uuid": "a1c43eef-8971-41ec-8649-cb015734e862", "comment": "Malware payload (RedLineStealer)", "value": "5640e973edefbcd5f30f0be1c1f4af39b138a70437c578bebb09bb790f3564ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196161, "uuid": "93e51811-9c04-4287-8550-66cc4eb22b83", "comment": "Malware payload (RedLineStealer)", "value": "118ee5ef8950875826634e784a97c60a4b6e611c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624196161, "uuid": "7fe05e84-8845-4094-943a-2ec69bef68b9", "comment": "Malware payload (RedLineStealer)", "value": "4aeb4444a2a3008fe583a0c4ca607b918cb7d96aed99269eae891779a746fae0e4e348115b0768cd3444c96caf9cc343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196161, "uuid": "f8289192-11f6-4717-8daa-52cbab68d668", "value": "7094AF00EA90C035F5F762F85A76D3B9A52D3AB1972450CB52E62BEB1B347E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196161, "uuid": "ad94424e-8f3d-4ea7-a621-e6e5e61fb1f2", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196161, "uuid": "dea91ec2-1802-49df-b1f3-1b96e3a70819", "value": "6144:5Us3DIv/ecAEJKSjP291HgvdScz/R8LbV0v5yfCq8HLlnKri:9D0/ecAEJKST292vd7zR0bI5yfCTNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624196161, "uuid": "ba153544-e1e9-49f0-9626-21ad3a24f133", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624196161, "uuid": "e586be0e-4d53-49e6-8aa9-1016147393d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624196161, "uuid": "52c15eeb-6611-4439-95b5-b752a14cda9c", "value": "5bace722d9a9bc21645aa088b877cbc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a55e4ba-d1a3-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624178428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178428, "uuid": "7a7032c2-4d9d-41f0-96cb-4e911888ad42", "comment": "Malware payload (DCRat)", "value": "b9605949d8c673f09d2b7a21d29a7d53", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178428, "uuid": "1f030177-7761-4dec-82d6-55ca2c7c661f", "comment": "Malware payload (DCRat)", "value": "56ea71902459aeec2444e8a6f5b1122428425f605ad30c5adab33adc6b0fbd9c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178428, "uuid": "9388effb-9aa8-421c-97bd-b1ca482884fa", "comment": "Malware payload (DCRat)", "value": "bc46289d6dfce191b29889c7c97b43bba031254b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624178428, "uuid": "4095e31a-811d-4e6f-b550-74f25b4d90f5", "comment": "Malware payload (DCRat)", "value": "ed6d44b5240b0fb2ddeb4cd7a97e20e33256bbc4468e4be808af40c0172625d647242e1f7fffab65c97039911727ff2e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178428, "uuid": "65d97a22-53c9-4272-8719-478d13769890", "value": "04256C123644E921C0691637D5EF45144BBCED00B762DA2BBE9E37ACE9613B37D0D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178428, "uuid": "a9a60920-ad27-443f-a08b-f99d02d0e2df", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178428, "uuid": "1e6b580e-4141-4a34-8019-36d47621723f", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4Rb8Z9tp1dnN8aZTh97/coj7BDFvPjp/oqnx:U2G/nvxW3Ww0t8b/1dnN/L737xo+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624178428, "uuid": "1886f3d9-78a2-4d9f-8286-e7f0aa6dbfc2", "value": 1051369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624178428, "uuid": "5d547af6-346c-4059-9326-64e5c1e35902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624178428, "uuid": "130f6e9a-787e-466c-81b9-02ac013f9d95", "value": "B9605949D8C673F09D2B7A21D29A7D53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b2d37c-d1d2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624198736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198736, "uuid": "a1f84e04-c30f-472a-aaa5-af0fb0ffcb73", "comment": "Malware payload", "value": "f54b956607d0370e0ad3084242712bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198736, "uuid": "6a39f2df-4294-4c41-bb9c-98740938c440", "comment": "Malware payload", "value": "59926e3453980c8bf4cfb466d00770fad47f05cd9c9e2a1ec7a25da16b38ebed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198736, "uuid": "88653e25-ba7b-4c42-8cf0-a7b660b4db03", "comment": "Malware payload", "value": "13593a9382790bbcd6ecfd6549a0b05b22c8facf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198736, "uuid": "c59692cf-dacc-418e-b723-fda1b3924bd6", "comment": "Malware payload", "value": "6d3f9442bf73af86279fd324e19138e8750bf99dd70fc4b4e804ec02dcfc6a30c9a3c9294be7664657931ee176571830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198736, "uuid": "e7d9c32b-789a-4408-b755-42b6b95ec3e8", "value": "97E4AD85E99491A4DC69AB346A76CC314227BEFE6934E41C24DE3E673FFB2C34021467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198736, "uuid": "17218d98-a16b-460b-9da2-b4d28248a001", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198736, "uuid": "78cec859-b8d6-46fe-894c-211d945b116b", "value": "12288:Y+xhTVW5o3hNItPdVJy3yo1+NQ2ESwRP7r9r/+pppppppppppppppppppppppppz:B7TV/NItdOyowdwR1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624198736, "uuid": "8d02f5d5-8e1c-41ee-b45b-2e203375faea", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624198736, "uuid": "1dee8bf7-e6e2-49d8-81ff-d1cdfd47d37a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198736, "uuid": "d249b021-05b5-4083-9334-d8613bde8a6c", "value": "xZezXtb9N6sKgxm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71525b7d-d1b3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624185419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624185419, "uuid": "2a8d2860-bf13-4ffb-84c2-ff2364112f7f", "comment": "Malware payload", "value": "fdc66cdabd46bc3b26aba4e59943726b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624185419, "uuid": "b3118e4e-f1ac-4ead-8418-f8ce972e70c9", "comment": "Malware payload", "value": "5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624185419, "uuid": "a19bacb3-0c3f-481e-bcf6-3827864d2104", "comment": "Malware payload", "value": "c341002cc5f9214cc8fd71e633efef673267d1fd", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624185419, "uuid": "74455563-9913-49fd-9f88-0d127aade9f6", "comment": "Malware payload", "value": "b0b6297828ba97e90a04050c577da3fe67a293eba5a30f52f37dfebafb530eaaef4e9e141f82f698a1dd6ac2ad6fe89a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624185419, "uuid": "18de1268-9e69-4bde-a93e-036ede0637c2", "value": "EEE35C0733A470F9D0A3D63888929A43E7B67C790771978F57A4526A1F332D1AE3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624185419, "uuid": "eca2d37d-70ac-4058-9558-b111996f2fb7", "value": "d1329d33ccefdb6f3b5616753e87390a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624185419, "uuid": "cc875646-1d51-4710-a254-624a8761ecd7", "value": "3072:QdIi6g2P8Tqen3Z4RaVwO7KlQcF2sWx+HqXVwOTZt:QdIG2kT9Z4w68MF02BOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624185419, "uuid": "b5bcd04d-3c57-41b0-b22c-eb036354412c", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624185419, "uuid": "86697e79-1e3d-4f5c-8d2e-15b09ea1a0ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624185419, "uuid": "b0fb347e-e7ea-4454-873f-abbc1d9e3088", "value": "5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46b07e5-d19e-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1624176566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176566, "uuid": "50780e83-cf50-410b-9084-5ac51ecc762d", "comment": "Malware payload (TeamBot)", "value": "c3aa574cda9a8f4e3aa0eee683b8a420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176566, "uuid": "5e8f696e-5034-454c-98af-244cc01c9aca", "comment": "Malware payload (TeamBot)", "value": "5eaeccb4395702847b45ea5f3270ea5cc52533aef00eb5c69fd05f56fdc27556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176566, "uuid": "ef363463-071d-46c0-8a29-e4ca73106ee4", "comment": "Malware payload (TeamBot)", "value": "c7b93b55d6fd2bb8a82bf7e1e4b311d44a71b2c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176566, "uuid": "8aa139d7-f77f-4ede-9169-599c294bbdcb", "comment": "Malware payload (TeamBot)", "value": "08ddfc10ab106facb59cfbe91bdf85464b0af2c72ab8135944fb335a2ea36002d72893f24745cee9252507b5c86833de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176566, "uuid": "feb9ab18-878f-4a3c-90c3-4c8ea049506a", "value": "D1050100BA90C031F1E726F8567693ADAA2E3DB15B6451CB52D56AFF1738BE0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176566, "uuid": "4d1981df-1f5c-4ed7-be83-d942fcc8087b", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176566, "uuid": "ce741265-1025-48f5-b54a-6b1905d25b18", "value": "12288:3rHoZHmOUmtzTJ2cAADxC66s2dy4pNZnzb03MgIULYlCLK5OstP604KPehdUSYZz:zWHmOUE9AA9Crs2943bIFlBEQVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176566, "uuid": "f220198b-7d5f-4caf-9771-b27773a651d4", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176566, "uuid": "44cf930c-00ae-4417-b528-e1e145d477d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176566, "uuid": "0890b849-cf5d-4800-b373-de9a61c1e402", "value": "c3aa574cda9a8f4e3aa0eee683b8a420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951b003a-d172-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157562, "uuid": "16442efc-0de1-448a-a8e8-3563bf2ee457", "comment": "Malware payload (Mirai)", "value": "75fcba7a5f7c0d3aef16db5f1a31940e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157562, "uuid": "53953a00-8c95-4cad-8a85-634842396280", "comment": "Malware payload (Mirai)", "value": "5f2be0b99aa2968505415118be63c0eb99c1ca3c4a15df18a454566dcc3404cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157562, "uuid": "3265701a-2894-4b8a-8920-35b5bb80c665", "comment": "Malware payload (Mirai)", "value": "33c78bf0bb041d780eb8868d8e74093f467a46d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157562, "uuid": "7c96f9ff-3a2a-4f92-803a-0000db2512df", "comment": "Malware payload (Mirai)", "value": "038a13bcdac2445e4c41fd9b1479ee5ba2aeb756202fb796f19bc3ddbc153de5ddb9f4c483bfdf6f4f48048614ac83b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157562, "uuid": "b22b8620-ef57-4385-86fd-4d38713ad402", "value": "2BF2E0CDAC882D86C84D9DBE52DECA245A18B4D27647A3C0631C5CC097D654B3BCECBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157562, "uuid": "c6456a63-cf29-49ed-ad41-78732d7c04b2", "value": "768:khzYqR2SJ34gM86ixBUqij68YF5QlgeOwE0SQQ2WMO:kh3XVM86ixBUrq5QlgRwEFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157562, "uuid": "8ff025f4-ef37-45eb-9d04-fffb74ec5367", "value": 36988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157562, "uuid": "d01132ff-2ae5-490a-9b17-9e268d728df6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157562, "uuid": "c8a90d11-0e69-4da7-b55d-1585433d1e68", "value": "75fcba7a5f7c0d3aef16db5f1a31940e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49032465-d1e6-11eb-875b-42010a9c0053", "comment": "Malware payload (RevengeRAT)", "timestamp": 1624207256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207256, "uuid": "2e712ae8-e79f-44b8-b008-9225a70f1ead", "comment": "Malware payload (RevengeRAT)", "value": "385b9916d255f7b6e411e39f6cab3623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207256, "uuid": "19159735-297a-4238-bb6d-0af7c8744ac3", "comment": "Malware payload (RevengeRAT)", "value": "5f5dd9783ee79a7097f47c023015c07c76d5b9e5562362fa54cc28b2f7d1744a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207256, "uuid": "2d8d5f63-7166-405b-b459-a616c2de8655", "comment": "Malware payload (RevengeRAT)", "value": "9891f98372ad8b7f85abc5e9399726496dbe203a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207256, "uuid": "f89eab70-2111-4cdc-9eb9-009da378a749", "comment": "Malware payload (RevengeRAT)", "value": "40698d271a91cf11bdd97601de4cb34706f203dd11654ecea28d66c9898e200b7928ab04b0d96a54753f0710d30c9f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207256, "uuid": "820cbb46-165a-4ecb-a81b-ff7739753028", "value": "419412184F9107C5C9C64AB0133E2FDB49795F7A8077C1E6ACA53C459B2DAE3A053FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207256, "uuid": "eabf4f34-6a92-41d9-919b-052f0da158e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207256, "uuid": "c696bbfe-8cd0-42ff-93ec-aa2d13e17ed2", "value": "6144:zNWsBCNCmud0HvgL/A4S2XxSib7An0X6YmHs3+GNA6SAzn6Piz:zCM0M/P7xSw7AnkNFdmAj6Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624207256, "uuid": "224dae46-64c7-4012-bf35-c6add509ebfd", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624207256, "uuid": "20ca52c3-aac6-472f-b6bf-70727754d8fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207256, "uuid": "cfbbd372-0805-4104-9587-603697f2230a", "value": "385B9916D255F7B6E411E39F6CAB3623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967c0291-d1fa-11eb-875b-42010a9c0053", "comment": "Malware payload (OrcusRAT)", "timestamp": 1624215976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624215976, "uuid": "324ee002-a2e8-4328-981a-6361e37f492b", "comment": "Malware payload (OrcusRAT)", "value": "3d6471a712e6f52085e15a2f4a1ef8d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624215976, "uuid": "c6d5e562-2782-4304-8fc5-881af202f52c", "comment": "Malware payload (OrcusRAT)", "value": "5fe03c646fcc7a7b912b2266fe54c645f203d22bfae171bf5f089e9934711dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624215976, "uuid": "72889567-a873-4aae-8644-ab470a2349d0", "comment": "Malware payload (OrcusRAT)", "value": "3bb0124e5192ae02e1bb3355a42b56ca69106698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624215976, "uuid": "4c7240f3-305b-4e73-af66-cb77fdd661a5", "comment": "Malware payload (OrcusRAT)", "value": "e402433ffe8fef61b80544440861cf238494219040aaae143bc65f8ecc294f8213408b5d9877ee5fbde550275513b224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624215976, "uuid": "3fa9419a-48d2-42df-8fc3-26ede65d1623", "value": "9225BF013BACAD06C1BE6678A673DAF50BB4EC065052FB4A08D46DAF3D9B701BD11367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624215976, "uuid": "56717da4-3f16-4131-8ed4-fabac719ce26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624215976, "uuid": "6452b04e-f3a9-4831-b0fd-de3ce101c841", "value": "24576:Rj54MROxnFD32w8XlrrcI0AilFEvxHPiooj:RyMiJWrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624215976, "uuid": "18e14fe5-5286-43d9-a58b-5bc40a0624f5", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624215976, "uuid": "65966d8d-fa97-494d-a216-5ca01430d1fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624215976, "uuid": "d643825b-21fb-4777-a98a-5c97fa1d37ae", "value": "3D6471A712E6F52085E15A2F4A1EF8D5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f30e9e-d180-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624163653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163653, "uuid": "651842af-438c-4e6e-9422-cfc278c48a02", "comment": "Malware payload", "value": "455e72195f5de1d79b8d74611112be63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163653, "uuid": "683387df-90cd-4210-86e9-6f26203acc04", "comment": "Malware payload", "value": "6150118a43ac634f753fefa6047b59d9c508b07970d4247c006a8895f959babf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163653, "uuid": "7a90707d-63f4-4e11-b77f-01e0ea2e50b8", "comment": "Malware payload", "value": "6e0b776a1c540f341445dac1b4f606e4c656d95e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163653, "uuid": "d0596a6a-b9fd-4b96-9b4a-c5242ecbc5c6", "comment": "Malware payload", "value": "55f28eab0cf0a1efe367cae5eaaf949f73b2bb1b2fa97c5dc3f595bbf2aebedf778051a5339fb9ebf5d3f00c2d65cbe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163653, "uuid": "9dad9529-4325-4df1-8b88-f6853c5c9783", "value": "FBE5EC898215A147861F1EE4A3CCB7BF88D720314B2D9FA505C87F8179E06BD9C6B39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163653, "uuid": "5b4cb5e0-19e1-4c32-8a2f-ad1e6bddcd47", "value": "0ea92d5be811b0e674c3d7385c4e3824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163653, "uuid": "9cbdda27-468e-41f1-859a-64765b754061", "value": "24576:4sCm5sUyPNJGfxPEXTPzRsb9oh75zHsx8DLxjZpGy6PGHU/1d6rZjTbsxU:RCm510AcLzPskAeSOLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624163653, "uuid": "9326dea8-54c0-4de1-8b9c-db5422b12c88", "value": 3080704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624163653, "uuid": "2b322243-617a-4aeb-8ba9-312afb490173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163653, "uuid": "2f3bd1f9-0822-4aab-a5e8-ad1e6ad94ff3", "value": "CIPTyx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39adcad-d185-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624165827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165827, "uuid": "509060a4-b322-407d-aabe-99d091375bac", "comment": "Malware payload (RedLineStealer)", "value": "9c412e8acb005ef450c190deee4dccd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165827, "uuid": "dd666cb7-7904-4305-acbb-44dad8d176fe", "comment": "Malware payload (RedLineStealer)", "value": "61d60c1fdab9751355ce7906702e272d2ad284d518178a136e1647d1349bcc95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165827, "uuid": "71b64bf7-2b2f-4895-809e-671fecdf92ed", "comment": "Malware payload (RedLineStealer)", "value": "be6018d93fda5ab0f49c5d7d5d51f6786a7a94e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165827, "uuid": "1a03256d-b014-42f4-b6a4-140ff74ef25f", "comment": "Malware payload (RedLineStealer)", "value": "2740958f3943b6eb87d1c5981188afba785ec5781630a2032e97bff4be01a628bcb3ecd7d153dec945e317d30a47bb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165827, "uuid": "37e473d0-1c96-4572-bd27-8ecaac98f6a6", "value": "3894BF10FA90C035E5F762F85A7AD3BCA52D3AB0972450CB52E52AEE5A347E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165827, "uuid": "cb919f87-4f10-4e7d-ba8c-c499158ed2be", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165827, "uuid": "eb37f577-ea5b-48ea-81ca-064efa9783bf", "value": "6144:aSCoYYTqb8TxZjS6HmlXJlsr+5sYo7yRUeNuRfhXi7vnHeHq4FxqKri:1Ysqb8TxZjSSmzhbgTeNccvn63ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624165827, "uuid": "c8d79ee9-7438-42aa-b21e-b887a3e6ffb2", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624165827, "uuid": "6fe71bb8-244d-4542-95aa-887b874fce0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165827, "uuid": "bc98f464-1363-4855-b450-cd24ffb7dc1a", "value": "9c412e8acb005ef450c190deee4dccd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a668c52-d1eb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624209432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209432, "uuid": "f0b39a15-16e7-416f-ad15-53d9ed3774e0", "comment": "Malware payload", "value": "86a3403d7a9b5a70b5ab1074e6faea47", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209432, "uuid": "b7b92721-f5b4-4084-8a0f-cd1a3d96e484", "comment": "Malware payload", "value": "61e49ea8ac3572e344c27742a2d53266df15266d0163470bbb56e5cd7ad78a4b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209432, "uuid": "4330bafa-f775-4193-bb82-5ae3273a57f6", "comment": "Malware payload", "value": "eed67e0b464ff00aa14e9122d618bf063f2156e5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209432, "uuid": "febbf4e9-3757-4d1d-97a7-09502d2e1cd9", "comment": "Malware payload", "value": "c1ba67891735028144e5ebd67452789aa430ae53cfad2a9a82080d147c8373f9b5993abb1d8d3a0c6a9e8224fa87dae3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624209432, "uuid": "47b226fe-61ed-446d-b28b-6d60a3ba5a10", "value": "63863386FBC4CA11DB1B46BF1BA531C3AB184712D0DAE57FC2446A9022F2C875B95C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624209432, "uuid": "2cffbc87-b85f-4322-af82-a7fab3bbe237", "value": "196608:LKWKndNMyQI4/FVjt/NMC1NC3lDWx0RiQdyjynFAL9z:OWKdNMyQfNVjMzWabyj40z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624209432, "uuid": "361b2dfb-6141-455b-97f6-785c27a4da74", "value": 8023811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624209432, "uuid": "6ec21bd5-a5ee-4b02-b79e-1a73fc9e4309", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624209432, "uuid": "c1a463ee-6c2e-4774-9eb6-918f7937f6ab", "value": "Player.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f405f151-d185-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624165881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165881, "uuid": "01cdd348-fed7-4e28-a1b8-56f5928144cd", "comment": "Malware payload (Formbook)", "value": "6b6d7ad58821060703a378ebfba5f182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165881, "uuid": "de8a45b0-4d55-4972-a7c4-3a876b091754", "comment": "Malware payload (Formbook)", "value": "627a04d8c996dd089b215283dcbca862df324f676d143ffc64dba5cd9754bedf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165881, "uuid": "ccc3e47c-1b36-49f0-b867-2e338b249b98", "comment": "Malware payload (Formbook)", "value": "a204c89984c9fdd115a94b4571b90c6290acbf19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165881, "uuid": "43f3e9b3-b45e-4d03-a50c-098ebc5a5241", "comment": "Malware payload (Formbook)", "value": "21ef4fb8aaa33fa5dc3cd49042ce8d366c1b62afbd72d595aa29af6a774f848a6b5894cf2c046730bf332a5a878b7b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165881, "uuid": "a7f8a01d-3d91-40f8-8290-30f7941096cc", "value": "F5F49F203AD95729F17BEF7956D0308587FAF623A312D95E3CA502CB0652F81CED2636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165881, "uuid": "0b183a4e-dfee-4d3b-8e4e-f076ed015fc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165881, "uuid": "ca2456c9-9d6c-43f9-bc4a-503612ba53b1", "value": "12288:QcVkw/b2Fdhlm4S4F3M9yh+E2VQrO3/vkEYFGtuVgJCyfB0GsyUG:QcaK2FTW0uVQrO3EXGtJ5Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624165881, "uuid": "56a8efc6-6d73-4640-8b4b-a5270e435c93", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624165881, "uuid": "9b8fabe0-674f-4c41-9be0-3c2faa2227d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165881, "uuid": "bec59178-7114-4293-b978-79fbc4892d53", "value": "FORM_C__.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefde814-d18c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624168826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624168826, "uuid": "cdd6eb8a-d17c-4565-9144-3acbe39e0ff7", "comment": "Malware payload (Mirai)", "value": "b9d8ea958d556220c3ab426a8f39060e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624168826, "uuid": "17c56b9c-5f1c-4d42-9042-73bf912a6733", "comment": "Malware payload (Mirai)", "value": "64b37727a80163250617d0f0ad12b19bfd48f89f9bd00fe583e1d2f58fa7c319", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624168826, "uuid": "24c6ba36-f10a-4e6d-8606-0b756a8bec4a", "comment": "Malware payload (Mirai)", "value": "f4860480ad5d843355127ed3365531d610dbd1aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624168826, "uuid": "37278b15-e7e6-4a6e-b4b2-98e8f4e67632", "comment": "Malware payload (Mirai)", "value": "5140198635f515ca5d124f1f61e8db3578b98b3bfa698d215a998520f6f1dc1702b33a5756fb528563e8ee34742597db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624168826, "uuid": "7dc80905-250b-4a18-98c8-12f3eeceb11e", "value": "C664F1CAEA01AD7AF9CA47B9696B0B0973F1CBD8D3C3B140E224C6543DAD2459B645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624168826, "uuid": "d7191a92-8ba4-4876-a5db-8206233c549d", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cocqwPa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZnczqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624168826, "uuid": "8e94b173-4fb5-4ae4-a370-91fd51439a97", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624168826, "uuid": "cf07bc50-b962-4e9d-9aec-bfd5f340a364", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624168826, "uuid": "8b45e512-db5d-46ba-865e-8403837a7dc3", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fa117e-d1a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624179952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179952, "uuid": "fd6f87f2-5843-4450-9347-c23b769702fc", "comment": "Malware payload (Mirai)", "value": "e2c689e53064a6503915bfe8b178e10b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179952, "uuid": "de25f5ba-d4b0-4794-8d3b-92b8702ae90c", "comment": "Malware payload (Mirai)", "value": "64f17c4e57cc54962568e4031fc4a6887ec533f323c2da0e9cf6db6fe338cb14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179952, "uuid": "819acb35-7bdc-47c7-9be8-ebae3e370e1d", "comment": "Malware payload (Mirai)", "value": "1a5b89eba02e20a711d88da5988d99e223abaeee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179952, "uuid": "b5442384-f084-4fef-8e11-f16f22d2cfdd", "comment": "Malware payload (Mirai)", "value": "db83f3eeba4ca373b9feec66702f27f4a44113c8226c4f7f37ae2e805bc0a93416efe6f703b238ae9a4cddbda3c5606f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624179952, "uuid": "539ba402-d055-4a3c-8ae8-a5f1a81c5708", "value": "AA23E17D3A0082BDE914C77E12E74BF955309962FC12D80BBD8C92D77CA80A52457FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624179952, "uuid": "b0878c74-2cbd-46ca-be24-e937dc09b5f1", "value": "768:GKdzjVwpp0lO6dKPnw65idPVwmjmGFjtFAqTSyelpCRfbJgGlzDpbuR1Ja:GKdzjKpp4vdKPw3VrRPmyEyfRVJu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624179952, "uuid": "fac66cc4-c74a-4a36-8dc5-128d8238abcd", "value": 47832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624179952, "uuid": "a1221227-2b56-4677-8ddb-5cf54ea578b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624179952, "uuid": "a9a93c55-e748-4e54-99e9-9588dfad56cc", "value": "e2c689e53064a6503915bfe8b178e10b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e279f7-d17d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624162205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162205, "uuid": "9e953ccd-85fa-4c36-abd8-54c7c02fbb05", "comment": "Malware payload (RedLineStealer)", "value": "a5076245d573c4477d75f8e767a24ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162205, "uuid": "df2d8a84-9412-4c84-b037-ec7a1f60809b", "comment": "Malware payload (RedLineStealer)", "value": "64fa359ee0cc2f6724acd29a0ea27bb086922d80c8d2aa385c03db890d5e8bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162205, "uuid": "4c0673e5-1346-4972-b0e8-10528bc11521", "comment": "Malware payload (RedLineStealer)", "value": "594f65adb484ad2d9fea7eba058b4f03dd6feabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162205, "uuid": "2ec13e58-8dcc-4cc2-809f-10268919e184", "comment": "Malware payload (RedLineStealer)", "value": "c6188d9cb898843ecda1e8ba265add7ff0c68a7b8b3b56f873451683d7d6033802d3b4581d893de3f82c2636c040f78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162205, "uuid": "5f87aa60-feda-4a63-b837-6dadc5405c10", "value": "3235E051BEC184F3E1A220B151F6AB365D7A653147109AD3D3C46AF54A203F0AF3B7AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162205, "uuid": "0cb6aa33-70d0-42cc-9c2f-19499386958f", "value": "1dd9e0c90802c146c30db4b322f2aa9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162205, "uuid": "5827be7b-ddb7-4d1c-8055-2349efbc5f2c", "value": "24576:RJeo26y1eqAyY6fNC1TUSzEPBzTWf7xblPzW:D92NC1TUSQzalb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624162205, "uuid": "8e00c3f8-1963-45df-bb0e-cef7e760679a", "value": 1087328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624162205, "uuid": "8362fd64-f243-4fd7-89b5-e9b35d011ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162205, "uuid": "ad256b09-0a5e-4590-8556-8143b4192bc6", "value": "a5076245d573c4477d75f8e767a24ddc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95558d66-d1bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624188915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188915, "uuid": "98ab9718-4c3e-4258-81da-df3a8c644f7b", "comment": "Malware payload", "value": "4e221beeb038ac78ebf37da8163692f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188915, "uuid": "57070ec7-23ed-4c0f-8bb8-f1a0995981a6", "comment": "Malware payload", "value": "68190452249948af984b462552abe41785cc7acdac0c3800c3ce9e9674c416da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188915, "uuid": "6561b5f4-4be1-4b8c-a2d2-d58783020158", "comment": "Malware payload", "value": "61ab81b9f4f18779d99b8f14446cccd51e503bb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188915, "uuid": "4618d03c-f0b1-44cf-a849-7e21902bafad", "comment": "Malware payload", "value": "e1cb18524341130bb01ec4adc121aa70ba26144ac8507f1c27458a6aca74f9decf1dca6b2a9258ac225bc31d3d8018ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624188915, "uuid": "9a0407ad-069b-4393-a5d3-f06b113b30db", "value": "6CE1AE633F108E67D304CB32CC3316E9006760E367764386E5A8AD5976A3643B268DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624188915, "uuid": "dd6102f7-b8d2-469b-a9c0-b4e9ff4ea59a", "value": "192:GTDKumPYGrduNHxh44aLeavphiCy7JqE8t98U9gTwG:8HmPI44aL9Rhi57wbt98hTwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624188915, "uuid": "998f99f0-05f5-4cc3-b108-517b115f93fa", "value": 7256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624188915, "uuid": "01f77b8e-28a5-4a86-81e2-3a843e9e58e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624188915, "uuid": "6c7b6281-9f9a-42b9-8dd7-ea290ebb4656", "value": "SecuriteInfo.com.ELF.Mirai-BHTTrj.6319.2803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c5de98-d19c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624175528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175528, "uuid": "68c09c9f-2b05-48db-b362-0d1215089b41", "comment": "Malware payload (AsyncRAT)", "value": "c3824275871aa671a8f505a8e1c238d0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175528, "uuid": "95558589-defd-4240-9cb0-5691a59a41de", "comment": "Malware payload (AsyncRAT)", "value": "68c76a98ba3ea1b1f240773b442cb00579dcd722084ec5f8b728e417c4a66835", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175528, "uuid": "c012a59f-fd0b-4484-ba76-190257c40cda", "comment": "Malware payload (AsyncRAT)", "value": "3bcd145ace63b33ef199b60c3c5a5724251277d9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175528, "uuid": "e27d52ff-dae4-47b3-bd7d-fa6935762bb6", "comment": "Malware payload (AsyncRAT)", "value": "42b24b3cadefec5e0fe902968297150d222e786e4e566aa489846d50ad172ba7ea798d486b4f2971e8e584e1d8ecb4a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175528, "uuid": "4d0eeb8d-a71e-44a8-8a21-22ea590b0e2f", "value": "4501496B4C208CD18675616D54A1B93AB39671E0BC555B69CF24C16380F769053DE70E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175528, "uuid": "a8199cd3-a175-4e74-806a-ea95199ee991", "value": "12:XJ2FXuaeqCrPRXaMRzdiH3TMTQCyRK0qGxzsXRJEnnaxda+JIMdCdKE:IFeaVCTRXay8XTM0RK0qSzQdh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624175528, "uuid": "72221aa4-aac9-445b-ac9e-f299c4cd1a43", "value": 691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624175528, "uuid": "9ee23361-78a6-4188-b4d8-ec663a78c95a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175528, "uuid": "eaa4a7c0-64c1-4ccd-8f36-ffae829aa51a", "value": "#BIll-ID#232325.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914b2258-d16f-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624156267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156267, "uuid": "b47dd3c9-2f51-4891-bb39-537f985c1f13", "comment": "Malware payload (RaccoonStealer)", "value": "a58b3e10ac4df0f36d36b7572b2fbd68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156267, "uuid": "0b0be65f-8b24-4f97-96ee-1e1c13ad64e7", "comment": "Malware payload (RaccoonStealer)", "value": "6cbdf9b7e12a7a43a809caf6750a896454c4d81212fc4444e11e2acd9f3b78ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156267, "uuid": "bc480dc7-be79-4726-8479-7e09fd218c99", "comment": "Malware payload (RaccoonStealer)", "value": "046f370bb5abdaf3045251ae48a87b37c52ed5a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156267, "uuid": "44ab9884-b314-43c9-a063-413a7651b8bc", "comment": "Malware payload (RaccoonStealer)", "value": "d979a3e35940bae59efd6ba40a9b0bc789e2b38340d48246bf13cd9baa687be90f1336d2185b2e4890288bcc7f53b874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156267, "uuid": "56d92d7b-e69b-4b1f-8a28-8ab982aea111", "value": "D0B4E11066A0D038F0B772F4597A53A9B93E7EB0AB2895CF52CA16EE56345F0DC30367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156267, "uuid": "2fa26757-2543-4840-ab23-26031f6fefb9", "value": "b0d3854c557fd79a46b820c312bd2709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156267, "uuid": "36162ec2-5a48-4332-a629-4e8da424883b", "value": "12288:yDgUpzDsywB4WJ1EzgYE1elWnP1S44NzsyM:igUtNunEzgF1esnrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624156267, "uuid": "f1927285-a97f-48ff-a9b7-3e454b48e393", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624156267, "uuid": "bd7e392c-2f76-4434-8008-d60c446ef271", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156267, "uuid": "8003790c-535c-4021-a950-770f0019a840", "value": "a58b3e10ac4df0f36d36b7572b2fbd68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed33108b-d185-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624165870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165870, "uuid": "db5a7a58-deb1-4422-8119-9312fd11dfd4", "comment": "Malware payload (Formbook)", "value": "59581ee9a2cb18982b8513df1669b049", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165870, "uuid": "53deb086-d403-44b7-8be9-cddf7c455281", "comment": "Malware payload (Formbook)", "value": "7049b87105bf668fa5eb1eaaa0000b7957fd939752841504aed80ce9ab1a4324", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165870, "uuid": "ad55da71-65b0-44ae-b99b-4f58d719872b", "comment": "Malware payload (Formbook)", "value": "68c28201a38c580fff712a8eddc1defae3466a63", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165870, "uuid": "97f33a2d-67c1-4dd2-9310-9f2b4f9a7b9b", "comment": "Malware payload (Formbook)", "value": "b23834f58634bacb25a24717ad198ec0c21859c6be8c8a36739baf5b4156ba4005c3719e63930cf5e5c0ae674dec18e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165870, "uuid": "14ee0000-c8b5-49ee-a9d2-1d993275ab05", "value": "94559F203AD95729F17BAF7956D0308587FAF623A312D95E3CA902CB0752F81CED2536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165870, "uuid": "54589297-57dc-4546-a10e-0bb17c1bcfc5", "value": "12288:lcVkw/b2Fdhlm4S4F3M9yh+E2VQrO3/vkEYFGtuVgJCyfB0GsyUG:lcaK2FTW0uVQrO3EXGtJ5Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624165870, "uuid": "4f7a94a5-0a65-4fe0-8562-22a983d0e1b3", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624165870, "uuid": "d98769da-edf1-48f9-9c06-688897c79d84", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165870, "uuid": "e27dd47d-c453-4184-a347-fe02a50ae30b", "value": "FORM C-06192021.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba5a79f-d207-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624221621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221621, "uuid": "59d47626-ef2a-46d1-a38a-b0a97ee6417d", "comment": "Malware payload (RaccoonStealer)", "value": "624290bf755777cb42a83443b8580916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221621, "uuid": "4ff24828-a684-492a-bdcf-01e76bda8178", "comment": "Malware payload (RaccoonStealer)", "value": "70f2ed4c1b72485f588dfa0465242b10735ca5579b9d10d66043113b3dee4e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221621, "uuid": "2cc384d0-484e-445e-ad4e-d4efad704150", "comment": "Malware payload (RaccoonStealer)", "value": "b2d5377293c55997d0132468d2dc01c32307d055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221621, "uuid": "00e5d6f5-0f52-404b-9b70-5207045abe43", "comment": "Malware payload (RaccoonStealer)", "value": "d368d63910a21cd036018e4546139796636acd10ba8178ff672cb15c65dbf96d28417624bd60f79ff3af30f69b1fffbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221621, "uuid": "65895be8-1421-4cfd-81ec-859fd0140f43", "value": "8CC4E100AB90C038E5F632F8597A536CBA2D3AB15B3850CB62D567EA47346F0BD31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221621, "uuid": "4689b817-6415-4c33-a056-5d6e481d5677", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221621, "uuid": "395fa114-2e9a-4dcf-9c3d-59081b6f3389", "value": "12288:kA40HhmlCybmMWF9JFzv7H2EFzqBSxT2K2ZeL9kOJVtBa8DXUM:/HhmrUv/7H262StgZeRkSBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624221621, "uuid": "63fbe20d-6a87-456a-b3c8-1dd58db97f2c", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624221621, "uuid": "b63ba0d0-edce-422b-9e71-ecc7d2aa5717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221621, "uuid": "fafcc96d-bebb-456f-96c7-456e0f204129", "value": "624290BF755777CB42A83443B8580916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fba36b8-d1ed-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624210220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210220, "uuid": "a8d3690d-a659-419f-8385-0785c7a2387a", "comment": "Malware payload (RaccoonStealer)", "value": "327caa0e0bbaa62deae08f92fb82318e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210220, "uuid": "12d27329-11ce-4c1e-942e-cdaa45cf1399", "comment": "Malware payload (RaccoonStealer)", "value": "73842595c824b3ed06e5e975c9fb247012ea58dba4facc6c1ecb1c7608b30032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210220, "uuid": "e31dfed9-7c51-4f16-a7be-2fe8b7a8710a", "comment": "Malware payload (RaccoonStealer)", "value": "87f62ea3871f7751c097a429d6533e1bdef7d0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624210220, "uuid": "1577a04f-d7fb-445b-8922-883f082b2e7c", "comment": "Malware payload (RaccoonStealer)", "value": "d2c436e42affda32d647c35127977381526834efe608f0f55e29f31e5568f305e9ec9599f76b9c21322eff35a09b5be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210220, "uuid": "2857963c-5da4-4c55-9651-8bff5b882785", "value": "05767CE1B90AB7DFD19F16799417DD43E53D03FC4B100922ECADB87AAD62E853285C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210220, "uuid": "a00bd20d-f4a6-4c82-9d48-2a4478dbe3aa", "value": "58ca43c54c545fb000b546dccfb3c7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210220, "uuid": "3dcc5182-cb0d-469e-aae7-eafb5aace93f", "value": "98304:qG+k/8jC9gnjuGjOUIarmWSFscnCdhaKp7Ps9ATNR/JB0uIqqYjIzw9nm:cegjuMEDfFxKDEuNY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624210220, "uuid": "604813c7-e742-44fd-98be-fd8e1465c193", "value": 7520792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624210220, "uuid": "d57088fe-d162-43bb-b408-d7490fac802b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624210220, "uuid": "c5570b71-d5f6-46be-b729-4f8309c2dc94", "value": "73842595C824B3ED06E5E975C9FB247012EA58DBA4FAC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403e2277-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157849, "uuid": "f1cd063b-13c2-41b6-b027-948c10f43b31", "comment": "Malware payload (Mirai)", "value": "5509543733820e312eb28d2ea30c1560", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157849, "uuid": "a009dce1-bf88-40e8-bd50-0ebc056bec79", "comment": "Malware payload (Mirai)", "value": "74dc2fe397371272a66dec98e801c66cb314e733f5205f5d7cc112697ba29eae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157849, "uuid": "e1d56f8a-e1ce-44d1-badc-81db8df0663a", "comment": "Malware payload (Mirai)", "value": "8add1b70f1580aa287cfd9d6c695597c9d40ee0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157849, "uuid": "3e0eac8d-cc80-4b8e-8fb2-999c7e0665cd", "comment": "Malware payload (Mirai)", "value": "a53e769c970e18a9d77ff35af33ffd0834b86670e42d00467afc91d5ce01daac5161c34386c33522b9de21fb64b31952", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157849, "uuid": "2becc610-8c89-471f-82c3-170aaaf45e77", "value": "F6E2E066E0852CD0DEFFDE370D390ED07FD08A427F978AC05581B7B2A522A15567ACD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157849, "uuid": "c621c97e-8e31-4c95-bbd6-d4028d69b626", "value": "768:pSqtvRwNH1VSY1Nxcu3EJOSQDMHMHROr0Xw3inMBODiUYNA4uVcqgw0RTWXq:+zSuNyuUpNsSfBONYe4u+qgw01WXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157849, "uuid": "96ddb3b0-50c2-433b-9a99-c78d2e4e8069", "value": 32860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157849, "uuid": "5761f20f-1f9b-4184-9938-50af5638c569", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157849, "uuid": "9edd4b36-b319-4c7d-b986-ea4af948ac25", "value": "5509543733820e312eb28d2ea30c1560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f3c324-d199-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624174090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174090, "uuid": "4d941ae0-3757-4a9a-82c8-ec36846e5668", "comment": "Malware payload (CobaltStrike)", "value": "038200f2f866cbb184cedda02a2ada52", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174090, "uuid": "54cb9f71-9f99-4cdb-893a-00e7b11ada6b", "comment": "Malware payload (CobaltStrike)", "value": "74f4d0602e6f4937099657fb75a62dddd16cf9e2c87d2964e5e60a9227a5cc68", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174090, "uuid": "0f53a2b1-3fa9-4440-a869-03fcf3aa04d5", "comment": "Malware payload (CobaltStrike)", "value": "5381eccbea74f53cc461cd6eafe7022be90c85f0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174090, "uuid": "25e3a00a-5953-45c9-a0ed-d3f9032d675d", "comment": "Malware payload (CobaltStrike)", "value": "469d338aa33738dd0ae46ef427f1e3ba4d9a60386f14165f8d56e492f05f52590814daedf11494c8aade78e482b49c7c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174090, "uuid": "49ce98f7-a748-421e-8578-93c3292f692f", "value": "A1224B07FB968973DBD40FBD603BA018C772BB602F20A39337BB95E4C666541E46641B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174090, "uuid": "bca684c9-12ac-4fe8-8884-f64ede336d01", "value": "6f55a8ec4237cd79703eb0a6df57c846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174090, "uuid": "4924beaf-dae2-4a3b-9ad5-de30a9516fae", "value": "192:x4yxDFAV9XBdlxt5sHXJmigDo3C++Q0xYNMC7E5pz6yfku5:SyXoXBdZ5s3JmigDdDe7bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624174090, "uuid": "4ec7f406-3f8a-4763-b60b-afa32965bf25", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624174090, "uuid": "b06c9df6-3e35-4383-9af9-827c0ca17dd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174090, "uuid": "434d538d-bd71-421e-9aae-a19562605053", "value": "038200f2f866cbb184cedda02a2ada52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeac100e-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180475, "uuid": "cc257ee9-be77-40a9-938b-2399295e8c97", "comment": "Malware payload (Mirai)", "value": "de1d19020150170c1d9eef9ed2409de1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180475, "uuid": "9edfe772-8788-4675-b14f-b5aaa3e1bac3", "comment": "Malware payload (Mirai)", "value": "75250e2f405822cd9f21216cb133bb72f1df2394ecd0b3fa7199997d06bb55df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180475, "uuid": "13eb520b-96ac-47df-b656-4e1ef11d093c", "comment": "Malware payload (Mirai)", "value": "c52684724c618952574aa2a2088f23a5acb3c269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180475, "uuid": "26dfd269-d64f-4934-bbc0-d3e76184203a", "comment": "Malware payload (Mirai)", "value": "f05328944cdd8170dc2cc09bf4907ccfbbd4d93a364790f933a3ed2594c82f37bfa3ea5b56ee14abb1e920174240b2ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180475, "uuid": "b5f573d9-0759-4c90-9b9b-b17b8bdac9c4", "value": "3FB35BC3BC61DFBEF84DA7F684130A06F130E2505AE91A33F6126897BD610D57866EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180475, "uuid": "af55870f-af04-43e9-b2de-a67339c6c852", "value": "3072:9EOQ3vSCnniGJPZ1PTWb3geyagHgj4DHEMTeySD:9qhnhf1PTUyabj4rDPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180475, "uuid": "127a17ce-e3b8-49fb-88c6-a5f3fa157294", "value": 117404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180475, "uuid": "506399ef-d0ad-4586-bc02-0a0b915165d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180475, "uuid": "b91925d6-e5da-4938-9302-71d17cab4336", "value": "de1d19020150170c1d9eef9ed2409de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec8204c-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225412, "uuid": "3f396202-340b-4221-aa97-3495365084cc", "comment": "Malware payload", "value": "aa27a5dde2212f53ebe1080371d44aca", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225412, "uuid": "907d2fbf-0888-4d65-9d55-a8e14b6a431c", "comment": "Malware payload", "value": "7532ed7d1be8bb32bf47cb9cf4a585b70d2be27f46bff955a878ade20a5d7465", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225412, "uuid": "37209000-1cc2-4167-8da3-01e7bd2ddd94", "comment": "Malware payload", "value": "9fea779c37b6c1683403bf933a47064d145a5d1b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225412, "uuid": "d29fd8f6-880a-4b97-90cf-9500be9741ba", "comment": "Malware payload", "value": "790a3f21095f718ea28f7bc57afde12df6d2ef60e8eb5db182e5b8695190643129a0175e7b262f3bff9215c50ec7ee13", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225412, "uuid": "131aff32-9dd1-41c9-955b-d04b5654f517", "value": "9C54236FF49815D5C5830C36A6813EBB0E7BB85D1DED04FD325B8C8A9A7A0436058A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225412, "uuid": "48cc452a-bcf6-4472-a7a0-d56228b2e32a", "value": "6144:T14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjQ:TvIzBhNU+3WB4d66j9B2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225412, "uuid": "341aafa3-e0ab-49ea-9733-13bf2be68ff3", "value": 295106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225412, "uuid": "98aac1b2-7c92-4893-a4f4-e4dbb3e4ca0e", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225412, "uuid": "16cf91dc-c26b-43e1-b5b2-cbff34223542", "value": "\u83f2\u5f8b\u5bbe\u4ece\u4e8b\u535a\u5f69\u884c\u4e1a\u79d8\u8bc0\u8bdd\u672fJPG\uff08\u538b\u7f29\u7248\uff09.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268d548c-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1624176704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176704, "uuid": "7d90dd80-833e-4ff2-9782-af957a699a92", "comment": "Malware payload (AveMariaRAT)", "value": "6ecc124da5dc1cba847442d24ddeffb9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176704, "uuid": "adc1c456-918d-4dd4-8e99-825887338837", "comment": "Malware payload (AveMariaRAT)", "value": "77814febf110acb4e26acd375ffcea6cfeeb1916968bad7d306392418a75aea6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176704, "uuid": "10f2d8c7-1634-42fd-bd2f-1c1bc53a9dbb", "comment": "Malware payload (AveMariaRAT)", "value": "47a9e02c316695033785696a40d05ab25c5a4639", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176704, "uuid": "f04f6bc9-debd-41b6-aa3e-d31186ba47a3", "comment": "Malware payload (AveMariaRAT)", "value": "2760c45bcd614b70bf2657b9ac9ef34fd36e6c1bc8be1d4b2159355409fe03d376a1027bb9885565fd84e88a2cf2d7ab", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176704, "uuid": "6f23b89f-d1ca-4451-b886-f788ecf90bda", "value": "C7B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176704, "uuid": "e718be4c-02b2-437b-9d6f-edd6b59c11de", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176704, "uuid": "64e11968-dab3-4ef7-8b3c-60cf58fbc501", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01J:K1VmhaH8EFvW+0OVE0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176704, "uuid": "2a216dad-e20e-4784-96a3-8949946fb23f", "value": 111340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176704, "uuid": "6a7ccb38-0d6d-4afa-be09-7a6569e5fc79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176704, "uuid": "0e8e9130-5fcb-449b-98fe-8ef234dfef12", "value": "6ecc124da5dc1cba847442d24ddeffb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f562679b-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180487, "uuid": "7053d273-611e-4610-8f17-212589ff7ca7", "comment": "Malware payload (Mirai)", "value": "a498cb5a1bb1568dfdca1001bf29a0c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180487, "uuid": "53b62f9e-c657-4712-8b39-ff79451de863", "comment": "Malware payload (Mirai)", "value": "79acf92490dbcc074cd8c7eb005c659f3afbed529921b547c7642a7a8ef2156c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180487, "uuid": "2c674f87-7c93-4ea3-b688-8ebc4c32640d", "comment": "Malware payload (Mirai)", "value": "d32f0901bff2f92ffc5cb2b52ee5bcce0a544257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180487, "uuid": "f82a365b-5202-4b9a-a1ad-b852a796ca09", "comment": "Malware payload (Mirai)", "value": "0f6038924dd02f5decb94a055e4842c6cd43bf1e627cf5c6d506b5aa0602419255fbea76635972eb7ec100b7cfb8a0de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180487, "uuid": "894a8aef-02a1-488d-b3aa-11d1e0046862", "value": "C5230235590DBE36F1105831B8D5D75A21C20E9CD4A177BF2A2108BAEFDD0896EBC4DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180487, "uuid": "ba9b19fe-d78b-49f5-a1ab-7481369bb52f", "value": "768:5Ieruz9CsjQ/7w9cxJDDvxxDXmfzCmKFMJQw0fEW00T6k/DwnUThjlp2s3UozE:NruJCsjQD8OxxDXAzCpxw2T6ksnUTbpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180487, "uuid": "4bbb14db-4640-4b44-8dc6-0ce105dfc40f", "value": 45772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180487, "uuid": "46187c9c-5cac-42e2-b3ea-0cc60a0e100e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180487, "uuid": "98ba9918-8449-400d-8a19-85ee1cce6654", "value": "a498cb5a1bb1568dfdca1001bf29a0c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2dc9f3-d18d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624169140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624169140, "uuid": "ac6d5c65-e0c2-4468-9b12-aa0a004fb62e", "comment": "Malware payload (RedLineStealer)", "value": "4cd8abd4814bea12ed951baa0dce87c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624169140, "uuid": "fe959615-6dc7-425d-a406-1d618cc4a8f9", "comment": "Malware payload (RedLineStealer)", "value": "7a21ca897703eab2808479f8d59212cb320f3efda31bb4f66602c75f547cb385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624169140, "uuid": "9499a1d8-2371-4e1d-96a8-6d4ef6422542", "comment": "Malware payload (RedLineStealer)", "value": "2b26b7a677517cfcd665fed7b7978624c2b050aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624169140, "uuid": "7294f1d8-6de8-4824-9c2a-18de35214b6b", "comment": "Malware payload (RedLineStealer)", "value": "6568103bdbd16ac1aea4eac46efd6373435d885000ea817a03c51a3d118c753e42782a34c329b7a584beadc65e3fc358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624169140, "uuid": "4f2b2aad-2a99-4645-bb89-4020cdd7c916", "value": "C494BF10FA90C035E5F662F85ABAD3B9A53D3AB0972490CB62D51AEE57347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624169140, "uuid": "adac70f8-35b4-4a22-bb79-3cbd8e60d7f2", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624169140, "uuid": "23ff4610-ada5-48d4-aa59-527a79119bdf", "value": "12288:Kocqb8DxZQSHmzlgqdjK7k/kErapKKCIlZ:2i8DxZACI/KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624169140, "uuid": "918143f5-bec1-4778-8a63-daaa7fc12a22", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624169140, "uuid": "8f4c97e2-f213-46a0-90f6-71acf29fba07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624169140, "uuid": "92cd3163-6b19-40df-9aba-1217713d6087", "value": "4cd8abd4814bea12ed951baa0dce87c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f401949-d1c2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624191939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191939, "uuid": "530085cc-4418-40e1-9c6d-4055a725110f", "comment": "Malware payload (RedLineStealer)", "value": "e33a93cf17515a6455a15a20134871f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191939, "uuid": "1992926c-ab98-4af6-8644-3e38e8fa1c9b", "comment": "Malware payload (RedLineStealer)", "value": "7c2a8ef56f05752557f848c93dc04a94138ca1022f5701d34f42a02b8c83520c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191939, "uuid": "c73f7bbe-efc4-460f-b792-c265edee5a3b", "comment": "Malware payload (RedLineStealer)", "value": "6c033ee46a1950b0bc27b75dfc02c4d3e9883447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191939, "uuid": "61fbd7ac-6253-4505-8406-50f9b56cdf2c", "comment": "Malware payload (RedLineStealer)", "value": "4ce2b0e9b03def328e937159375536593c721fdd4e7451b5aa5318cbb64e0758b0810b3f9418971e06bf761d82eca63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624191939, "uuid": "82ceb0a7-d278-4bbf-abd4-89df287970f6", "value": "CC34C06BB36CDA15E7FD4935BA71012947F0EA8B6402EB8B8DC1B4DF2E62BC125045F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624191939, "uuid": "da04d392-5a32-4382-90b1-1553e1dca612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624191939, "uuid": "8a414ab4-8159-4c1f-a055-9f15753ef966", "value": "3072:TO/JR38Z+nfJealKYU/+++++++++++++++++++++v49iyHPHyy3daRYJCs33yTV2:T2sKyuI3yTVn3LRvO+d6f7bUtuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624191939, "uuid": "a8d464b5-86ad-45e9-ba9b-fc6906963f53", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624191939, "uuid": "fe4876e4-de44-4705-8cff-39a8cebb056e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624191939, "uuid": "d8af4f88-4598-4059-861c-bfe7d0791264", "value": "e33a93cf17515a6455a15a20134871f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c5a689-d19c-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624175687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175687, "uuid": "73654494-ff4f-42f5-8ca8-45a542fa8fbf", "comment": "Malware payload (SnakeKeylogger)", "value": "64bdce55d3318e4294055d873f1741c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175687, "uuid": "368ff2f7-e17f-45d9-a718-b1e46f49cc87", "comment": "Malware payload (SnakeKeylogger)", "value": "7d589e38568ed522cd280ee2628cbafa359d65d45cc517277983ccb1c1b32f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175687, "uuid": "b127c674-f9ef-4d91-af8d-ee0a29019402", "comment": "Malware payload (SnakeKeylogger)", "value": "e36ba27206a698291d1d70278820afe50932070f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175687, "uuid": "9f2318bd-f539-4f90-a1a1-e8629f396bc1", "comment": "Malware payload (SnakeKeylogger)", "value": "5f38bcf2b7207c621364aa0b6b5aa6dbd6c3de06244476c1367e5f8cf59622ee52f9fb45ae9df02274782c442089a65d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175687, "uuid": "41f3308b-b2c4-4566-bb2f-6f2383ae4b9e", "value": "A174F1243AF98029E07ADFBC55E63662DABDF6633A0BF658454601CA17D3BD0CC815B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175687, "uuid": "499a461a-68b4-496b-8483-fbda9f708633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175687, "uuid": "967edaf9-0fe0-4a4d-b11d-28b168793478", "value": "6144:nv62qYL9o8vDdNMfQu6Z70n+SrGXqtGfYBfs0kLXm6qu83n3TWq:neErdN6x+56toGs0kLWDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624175687, "uuid": "33a80776-6968-4737-a5f6-656fcc334d2a", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624175687, "uuid": "c1015d6c-76b0-4312-b31c-dba5d84056f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175687, "uuid": "9716977d-cce3-48b7-9d60-af2fc965c82f", "value": "ScanOrder.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3a7fb5-d192-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624171126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171126, "uuid": "78c567ab-4a16-4506-986e-37f8a25c290e", "comment": "Malware payload (RemcosRAT)", "value": "f9073e9d0327d9e6f6cc68a086ce6f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171126, "uuid": "025b6557-82f6-4288-a872-cf55f899497b", "comment": "Malware payload (RemcosRAT)", "value": "7df259f7873239aee108522c3efd6fca233db83a268a3c9fad4766994c5a029d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171126, "uuid": "4c266bbd-e82a-45e3-9f13-e7659fc19088", "comment": "Malware payload (RemcosRAT)", "value": "0f13b5e3cb61b9960dc0717f59967bafa7ce1dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171126, "uuid": "f5a85020-f9d3-488f-ba2a-3e621540a2d5", "comment": "Malware payload (RemcosRAT)", "value": "a859a6eb915e98e9c6274621cbdf630198049af74ba93bd6929faf6ea56ce415eaaaf4ab1ad867f82af7281471154861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171126, "uuid": "6020d615-2518-4c0a-a0f9-d829768fd50d", "value": "D1E46D0DAA0148B3ED632AF95D0BB695505FBF803A98EC4E7BF839457A7C785741C08B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171126, "uuid": "5c6a6485-1e29-4a61-84ba-84290b9fc653", "value": "c71d480d2366fb95d3f3cb43f743204b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171126, "uuid": "069e5906-924f-413f-946d-f589b8336b28", "value": "12288:IaszhyKpd14urE8YDEYhBOmey+8QjqX0uNb+T0HXX+jBnnXLVgKR37:IaslBV4urE8Y3hBr+9jq/XQB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624171126, "uuid": "7cad6fc0-f60d-4211-b9a7-165c2468d4b2", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624171126, "uuid": "b881a935-f616-4c73-b766-a8cb900dfe86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171126, "uuid": "6250d3df-4c64-4585-a8bb-5ff4dd15fcf0", "value": "NUEVO PEDIDO11092924567,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c0ba05-d19e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624176617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176617, "uuid": "485156bb-da7a-4a78-b380-69f63bdce4c3", "comment": "Malware payload", "value": "d0a450955b5c37142aa1fca3f2631a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176617, "uuid": "4dd43b77-1791-4914-8f65-09ec80d71a13", "comment": "Malware payload", "value": "7e0e41753d443d82da40eba933548b31ce5417559c1d159976322d6ed3050df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176617, "uuid": "25b7a107-f58e-481f-bb8f-2dd6dc88bc54", "comment": "Malware payload", "value": "b177c6597e5fab0f19913ee54c521ef5055a6981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176617, "uuid": "2ea00702-f214-428e-b18c-60080134701a", "comment": "Malware payload", "value": "3286cd33d5312fdb1b359122811bf3e32f298f649c1a0f840b048ba62fd89b9d269b07e09e7192c1542b49f5f47c460e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176617, "uuid": "21eac702-1cf3-441e-a9b6-97e5e45f01a9", "value": "5A66335539F086BEE1610030ACF63D85B335DD184EB4E5632B2D163F9F7C9893A3A52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176617, "uuid": "902c8373-6ca7-4fc5-8cda-b545cc7c28a4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176617, "uuid": "84711ab9-937f-402d-8f0e-3627397f2d56", "value": "98304:b1OBSfk8bUKAB/mHhqUQ5MJmtGBRUMXMyZHG+r8wSKcwqMhBSFa:b1OBMk8FAfNmXxBZmbx9wqMKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176617, "uuid": "46268a34-0c8a-4dbf-979e-171221d1ab35", "value": 6518984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176617, "uuid": "b6a2ce59-0321-41a1-a96d-59cf3c7b329d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176617, "uuid": "a538003b-6b81-44a0-9998-9d59ab76c76a", "value": "d0a450955b5c37142aa1fca3f2631a77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845ab0ce-d1f3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624212939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624212939, "uuid": "156f86bc-b06f-4aed-b290-d16224016be7", "comment": "Malware payload (RedLineStealer)", "value": "b85a50ab8331eb4f1088c926902bc8b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624212939, "uuid": "79a44f8c-ed06-4b69-b653-a8713a1fc9b1", "comment": "Malware payload (RedLineStealer)", "value": "7f375d7a2e62835d9436ee95f499da5cdcbf03b3be43bbcdb2cb674f0b834690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624212939, "uuid": "27fba12f-10bb-4c35-b6e3-84d2fa53b2dd", "comment": "Malware payload (RedLineStealer)", "value": "7052e7dcf2623d3f87cb57312c1a6128637bcbe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624212939, "uuid": "d1275164-0cda-450c-b5ca-a9ff0692f226", "comment": "Malware payload (RedLineStealer)", "value": "a028aade78cb8db71933650f325d6a5cb194e063e93c481c257632b7d9e2f769b910026fd87aec8740148e86bd6afc86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624212939, "uuid": "024a45fa-7aad-487a-8a9e-96c0b9c3d049", "value": "3594BE10FA90C035F5F666FC1AB9D3B8AA2D7AB1572490CB52D526EE1A347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624212939, "uuid": "a73b1d74-7898-4bb0-979b-4a36f895a714", "value": "f9171e3fceb6d8c6fb81cb999790f0d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624212939, "uuid": "e7578b68-5d4d-4c5c-a06e-cb7251de32fd", "value": "12288:5kUOgE+y5S9fvXhZLoXajo15LtlLW3l4J:4gE+yG6ajo1ZGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624212939, "uuid": "3f834abc-9b40-445d-bf43-a2caf0b0bb26", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624212939, "uuid": "91a42b4f-9fcc-4b74-8b89-c9e7b431d64a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624212939, "uuid": "e6db02a9-019e-4743-a105-a869ff0bbe4e", "value": "b85a50ab8331eb4f1088c926902bc8b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9568e5d-d19e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624176574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176574, "uuid": "96b670cb-ce0d-4be2-9b2e-657dcff14b4d", "comment": "Malware payload (AgentTesla)", "value": "a0174d0ce23bdc10aac6a50ab7540412", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176574, "uuid": "5a32ec98-7f5a-43ef-9197-16fe15186487", "comment": "Malware payload (AgentTesla)", "value": "7fb990250eb44087277f87e8365a30dcdebba19c2c4c4c89287630ff329af399", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176574, "uuid": "25d756f1-8e86-4b5f-8e49-4123877745f4", "comment": "Malware payload (AgentTesla)", "value": "5316795ad1ff00e6db5b0d9f4b598f81d02a55c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176574, "uuid": "324f8000-53a3-438a-9a86-8f3d33e56c69", "comment": "Malware payload (AgentTesla)", "value": "03beec286586f43f1801cb71f353890128e6ceab0f74fe6328753d18b19332b0e0170d6d829a45389a676bf6bbf5fcaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176574, "uuid": "44f9d311-a9b6-4c67-888d-cd61c3be7fb7", "value": "A8E417C43132AA4EDFE24B3A65304BB15D103F36179FADBE71E23B98563D951EA0016E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176574, "uuid": "1994468e-f76c-495e-b830-65f3ff17125b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176574, "uuid": "0d1e4171-3ed9-471c-8f87-e39187702abc", "value": "12288:uGN9waLJZseooocCdOAodFbXIlwKZyh73cHAbmqh:uGL5LseoNceOBslwQyOqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176574, "uuid": "35647df9-5b2f-4cf7-9b0f-b9a8dd4f5e58", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176574, "uuid": "a5f4e372-4c19-4b24-9a20-d09d3c7ea615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176574, "uuid": "2095d5ac-1c6a-4ff1-864b-469d45169b14", "value": "a0174d0ce23bdc10aac6a50ab7540412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ceaa24-d1e7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624207839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207839, "uuid": "2548b948-5800-401a-b320-671c24acc29a", "comment": "Malware payload (RedLineStealer)", "value": "8acd03609f88c3afb945ee66494ee4b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207839, "uuid": "281f1ab7-1c81-48ea-b290-927481d287bc", "comment": "Malware payload (RedLineStealer)", "value": "8053673f8d7f73fb01366e07c15d542c52120d7bad3d30f2e1279e4d97481228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207839, "uuid": "b6808f26-5a65-4153-b6a1-bedbea56885a", "comment": "Malware payload (RedLineStealer)", "value": "65215f87ab691add24cdb25f293b9fe04b2c38c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624207839, "uuid": "8b71f20d-5489-440e-9797-f7a805908a78", "comment": "Malware payload (RedLineStealer)", "value": "bb751936bcf974aef11f4ceab1bcf7bb63865ef6d4badefe07e54326260e048d9da01b5c97fe0e3f765a3599a145acbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207839, "uuid": "2def48a1-1691-4ddc-a3f3-ede890df56a6", "value": "AC94BF10FB90C035F5F662F85A79D3B9A52D3AB05724A0CB62D56BEA1B347E0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207839, "uuid": "cb461fc7-3e23-4e77-ac89-85ccf51eac9b", "value": "f9171e3fceb6d8c6fb81cb999790f0d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207839, "uuid": "d35fc307-ae8c-43be-ad4f-a7f43859d5e3", "value": "6144:hH5RuInIgK+y7SDfW9+nVM+9lUgFZBpSI76N0Dlwr3kV+/ZE6DmrGKri4J:xu6IgK+y7SjfzvlmIbJwTr/ZTnl4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624207839, "uuid": "a4bddfc7-cc4d-405d-b356-4192a173ece4", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624207839, "uuid": "7ae8c4aa-2033-4c4a-9335-b493d25f1974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624207839, "uuid": "465e42df-c68b-476c-86fd-27ffe2eae80c", "value": "8acd03609f88c3afb945ee66494ee4b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b714f8f-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157814, "uuid": "d70ed944-b972-49fc-9ade-27f1cbe5a67e", "comment": "Malware payload (Mirai)", "value": "fce37219d9ab1675474e45a93861b55e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157814, "uuid": "f95c7568-7bb8-4e83-92f6-a20e9908556a", "comment": "Malware payload (Mirai)", "value": "809e35b97d4416b50d01536c0a446e0f49d38f74fd3fe3d6397d83bbcc0c82e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157814, "uuid": "a07d5a8a-0cb7-4f01-9971-a127953ecd8f", "comment": "Malware payload (Mirai)", "value": "a6c634abe5f5ffd833b12b844c2e13040e028560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157814, "uuid": "ef4b1b31-dea4-4c50-8b06-f9b6d80786f9", "comment": "Malware payload (Mirai)", "value": "a655e15d3873cfbbd215f77395afaacbf0fd61041063e977e82df314fc56741971a10817a39d49f57ec40e8766608b14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157814, "uuid": "80a86f8e-8fd9-4a57-8618-8dc254c0db8f", "value": "E8F2E1AAE5434794D78F00B98DEB39849840F7DAC4B8D4F379DA76477C6AF47088C681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157814, "uuid": "1fdf6b29-5ab5-4a8d-aa92-e0ee2b7d11dd", "value": "768:0yfjom95T4dArUSst4MKliLe3GKvZipqAGaHynbcuyD7Ufyqh:0ob9xEUDgr7ccSnouy8qqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157814, "uuid": "f5fac131-cb46-4c48-a12f-0719d808855e", "value": 35688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157814, "uuid": "0e464695-eb9f-4ebd-bb83-c581b4ef9da5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157814, "uuid": "bb6de86a-0a91-418e-a1cd-a9d15a367c9a", "value": "fce37219d9ab1675474e45a93861b55e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb80bd8-d15d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624148448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148448, "uuid": "e3546e55-92ef-405e-b41e-d6d2bb7fbeda", "comment": "Malware payload (Loki)", "value": "50927aa0cc8bbc3b41c84998b6d500c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148448, "uuid": "049505da-a94b-4acf-bba0-8e26caf17e1c", "comment": "Malware payload (Loki)", "value": "80b5c587184821cdbab152fac30a7c898e19f75cdf2f9ed0d471535a3acf94a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148448, "uuid": "6796b206-39ef-4453-bbc7-0d7f0f95ac85", "comment": "Malware payload (Loki)", "value": "fff4b27d3cbd3acfd17f1b648ebc33bdcfeacc4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148448, "uuid": "e7cb17c5-120a-45d9-8b57-8f2fa0f79323", "comment": "Malware payload (Loki)", "value": "6331d16ac3f48a475a8558dbd73597abce048e9fc22619ff694edd356786381bd1a582982ae82fc309d0701d23e0f2cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148448, "uuid": "9d4bc9ac-6d35-435b-bf87-d94a9e6c99e9", "value": "0B257C1036D89A19F17BBBF499A4244197F9BE53F602C54D38B1328E0973B43CD96A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148448, "uuid": "294c42eb-6898-4632-a80f-cb0c0a206e6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148448, "uuid": "25964579-abc3-4a31-ac61-5f2110c0a181", "value": "12288:gfn19krO/Rushlm4S4F3M9yEhDZVg7Hli7vCC7UwNqEGIWhN9S3r0NV0dos:S9kriRxWjU7HmCC7UwNqf9SE0dos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148448, "uuid": "6f5f78a0-01d9-40c6-9cd9-8827692e163b", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148448, "uuid": "7599a513-83f5-4225-8e12-b6e194d78ba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148448, "uuid": "2ce9e7ea-6ffd-4cd7-a509-d3325892222f", "value": "QATAR 2022 STADIUM PROJECT ONGOING PR0JECT.e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00131626-d221-11eb-875b-42010a9c0053", "comment": "Malware payload (NetSupport)", "timestamp": 1624232474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232474, "uuid": "5e865ba6-e700-4341-a6b7-ab9e13bc9869", "comment": "Malware payload (NetSupport)", "value": "8043262173c3e29f33c566c80f0da3b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232474, "uuid": "20c63ace-e7cf-4a4c-bb8f-62f70e591e20", "comment": "Malware payload (NetSupport)", "value": "80b6f4260035bf83f8cafbc80b8da3263d8ed022c96509aeaa6e4a0016c6eb42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232474, "uuid": "ac4fb0d8-3ab2-42f0-90c7-d829015db6dc", "comment": "Malware payload (NetSupport)", "value": "5a6f13e5d492e43ab316ba87ddd33763c51ba874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232474, "uuid": "e4813a35-01a6-4302-bc55-8867445b18cb", "comment": "Malware payload (NetSupport)", "value": "567e65ebfb35a0f6288c149ccca010397a09ab099124249f865c71cff6a1c42691f2010be91f98856d6bec728943361c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232474, "uuid": "c9dacca0-7ed3-4c8a-9521-bae5e151f535", "value": "2713C05BA5C19DF7D592023117B3E73AF7BAC6C842610A170FA42F7A3E21583C91A7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232474, "uuid": "b714b662-3e2b-4fdc-99cb-de0700f3c201", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232474, "uuid": "967b340c-700d-40c3-9611-17f5b63bf5ee", "value": "768:KHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJbCSrgVkqIzq2ba0LP:KpgpHzb9dZVX9fHMvG0D3XJbCSr+kqID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624232474, "uuid": "a71fc1a6-11b6-47e3-9d38-303c208eb38c", "value": 44774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624232474, "uuid": "a021ca71-c122-4a71-9d8f-bd93585c994b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232474, "uuid": "6211f9f8-65e4-4ae8-96f5-8e29f4355b2e", "value": "8043262173C3E29F33C566C80F0DA3B7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fc5e9f-d1fc-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624216866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216866, "uuid": "e8767af1-8a17-4550-917a-026536508e31", "comment": "Malware payload (AsyncRAT)", "value": "40611a3c5415b7c9220ae63408c02d9a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216866, "uuid": "b9f107ad-94db-4672-8d46-4b86bf3326b5", "comment": "Malware payload (AsyncRAT)", "value": "8346802296fc33b77a434c410fee9e054ce3f670a74907d603a521128465b90b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216866, "uuid": "76a5e07b-227b-4f7c-94c9-44b4a6b11246", "comment": "Malware payload (AsyncRAT)", "value": "210678585c82d7a60e7887ff66db1c93866c332f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216866, "uuid": "de1b20ae-0b0f-4d32-a801-fdc0a0898d08", "comment": "Malware payload (AsyncRAT)", "value": "5b11901991c03a4d6a745085c6c01a3960c7ef9c914a4c4606b3ecfdeb66df95a1ad7e1466f84863f40411534271c61c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216866, "uuid": "954fd2d7-746d-42b1-92dc-8ce136a9779f", "value": "1484DFB077F5A0F2E15335727880336837FAF22D4B1445E7A758260ABC259C2A6BD5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216866, "uuid": "42f10542-2400-4fdb-9ccf-641e25f37de1", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216866, "uuid": "5dae609d-e605-40cc-b6b5-455b15252147", "value": "12288:b5393whFOBbMfJhYmyM9nd64Bw3V54qYE:b53uhFPcMNdzB25h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624216866, "uuid": "852b15a4-d42e-4c3a-9970-68e79eb3622f", "value": 394850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624216866, "uuid": "67e58d34-64ea-473f-835a-8b81c476d170", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216866, "uuid": "813bcc55-5f05-4e23-aac7-943d4f118ff7", "value": "40611A3C5415B7C9220AE63408C02D9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95938fed-d221-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624232725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232725, "uuid": "f98d31bd-939b-484a-abea-31994b9e6844", "comment": "Malware payload (RaccoonStealer)", "value": "81c1e35c6881abcbc98d714a719b35df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232725, "uuid": "3531c3df-4a53-4e66-807e-4c345918602c", "comment": "Malware payload (RaccoonStealer)", "value": "839844cd03415c7ae12a412f2e8f9a6365f87731534a351ea67bfdc6dd36f590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232725, "uuid": "e2b7ebfd-6afe-4cc6-90cc-5ef33b2e19a5", "comment": "Malware payload (RaccoonStealer)", "value": "51a8e02f88f1d6479cfe00a37f65535edaf9786a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624232725, "uuid": "05b07303-4b73-4904-bb5c-bcc17f8ecb68", "comment": "Malware payload (RaccoonStealer)", "value": "b4b3e728663d7d256deb71ddef62227c19c51e012065c6ab310fd32284a989a9067d75f625be8c51b801dc219640d0af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232725, "uuid": "6a3384bb-f425-4e10-bd55-594a7006bad3", "value": "B5C4E15536E4BEDBD769063294B712B02B34DC7FAA41E70B21501A2F1CE3BD12C1EA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232725, "uuid": "8a522ac6-a879-487a-a362-01da123c8df0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232725, "uuid": "4c14b2b3-869b-4db9-be22-9b3233e8f129", "value": "12288:tjBokhbhKzLGr35oJkoZLKI9t6rCPUh/F/:tvBhK/SJ0KIXkCPUhN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624232725, "uuid": "8f72596a-8969-472d-9940-95b2fb368ea5", "value": 566944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624232725, "uuid": "01434acd-8267-4a3a-8a2c-1306de2e6c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624232725, "uuid": "2b780ec4-59eb-4fd6-ac41-45c7d1a87856", "value": "839844cd03415c7ae12a412f2e8f9a6365f87731534a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51d6227-d207-11eb-875b-42010a9c0053", "comment": "Malware payload (OrcusRAT)", "timestamp": 1624221664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221664, "uuid": "ee8a0f8e-27ec-4b69-87b0-7274a8a347af", "comment": "Malware payload (OrcusRAT)", "value": "60f75f3f9255307c65a56ad10d14c79c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221664, "uuid": "d9219b8b-4d7b-4dd5-a3b2-e372bac0790d", "comment": "Malware payload (OrcusRAT)", "value": "83ee132d4ae14e9a0963af00c2a937d70da63d696bfbbcbc4e1b5d976beeb4a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221664, "uuid": "a4e585ff-b7a6-483b-8d05-296eb8d98d84", "comment": "Malware payload (OrcusRAT)", "value": "8eea51686ab6f338b13011adc4ccd724238daac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624221664, "uuid": "ebd38840-2ae7-4f7f-8cf5-ed00590f17a0", "comment": "Malware payload (OrcusRAT)", "value": "4a39669a58aec3950ae2c77bd0a98682de9a6ff8d8b037ac936d30d2bdf8edc055efd31e620025e4afc46dba4ccf2f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221664, "uuid": "564fce55-4e29-4bb2-9958-8508013480de", "value": "4B15BF113BACBD06C1BE7678B7771AC90FB8E8066052FB4F085861AD1D9B701BE16367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221664, "uuid": "34a0677d-5559-4e97-ba06-48231e2e2222", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221664, "uuid": "c67b0111-545c-4662-9a70-b2c98c8b23aa", "value": "24576:Ehf4MROxnFD3Iw8XlrrcI0AilFEvxHPxKooJ:ESMiJkrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624221664, "uuid": "b017090f-1955-4d30-aa44-ed32a38b4d57", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624221664, "uuid": "e7c769cd-c01e-4965-9b23-0bc8ae975b44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624221664, "uuid": "07f495d2-47ca-4b95-8ff0-bed07c45fccf", "value": "60F75F3F9255307C65A56AD10D14C79C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff16715-d15b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624147540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147540, "uuid": "88bc19c0-0ace-4110-b84e-b49420b92fa3", "comment": "Malware payload (Loki)", "value": "0c1a9c5200dd6ad9e9adc3d2b23810fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147540, "uuid": "ce9970f7-9c40-4994-81d3-19fb69c12d63", "comment": "Malware payload (Loki)", "value": "8487616e993913211f1c1d1888b24697f40132eed17e4f5ca2bf44b0edf036b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147540, "uuid": "326febd1-e585-41ad-9596-da517116b2f4", "comment": "Malware payload (Loki)", "value": "0396a39963056871619728cbbfd7f517a6247af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147540, "uuid": "d2242dab-2411-4702-bcfa-4e253c72eaee", "comment": "Malware payload (Loki)", "value": "ba3d28401724a645de2427db3f465f9afd4f3d660d86d9232d97f6490aa10954c6deab6fd5508706e6456d4c6ae1056e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147540, "uuid": "d1f0fb77-0698-4bed-ae08-6204629ecad7", "value": "F0257D103AD89A1AF17B7BF498A4204197F9BE53F702D54D38B1728E0973B43CD9662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147540, "uuid": "125abf6e-3b7e-4ff2-8619-61be67d57918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147540, "uuid": "6fb4db3a-d160-4f82-84ab-9303505712d3", "value": "24576:5GgUrIQ95XZxWDXlRYa9BmLWBjqR9X0doH:5BQ95pyXlRX9QWZq7X0do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624147540, "uuid": "84ec0703-a6da-4694-bc84-0b5752a1e267", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624147540, "uuid": "b7abdae1-6f1a-48e9-8469-cdfd8b85b3e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147540, "uuid": "8067dacc-16d5-4315-b9e9-14dbfe0370ca", "value": "RFQCei20062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb3d0f4-d172-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157548, "uuid": "205ffcea-f483-4175-9ac3-a3d9e154b18a", "comment": "Malware payload (Mirai)", "value": "c8748dd73169e942b8803c6c70ec2de3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157548, "uuid": "843d7d31-01a4-411a-8db5-ac636f4df381", "comment": "Malware payload (Mirai)", "value": "869ed8a87f5a42245163946c76028d6a1415e56a11fda5188e83a806ed107010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157548, "uuid": "0f348a85-bb35-42bb-b0f6-299b1d448249", "comment": "Malware payload (Mirai)", "value": "d8f786dd5fa4e665b49544cb8a5a25241d0737aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157548, "uuid": "ca129e3d-d754-4025-a708-17e6930b90b3", "comment": "Malware payload (Mirai)", "value": "fc14b5e37faa248d16954dddd49b3fee9a46bc8a14d3c981995c122ccccbe33df8a39f25a3034085ffa52aaa4a9d5dbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157548, "uuid": "51ddfba3-ac75-498e-b2a5-597bbf7bad83", "value": "05837B21B93A2E27C0E4B07E02F78321B2E1634E24B8DA5D7D720F5EFF156A02567576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157548, "uuid": "13d4ae98-28b7-43b7-9237-7353370a47bf", "value": "1536:bUsaBm8SLTfP1Tp1fgqNNtsHDlK6apoVoEAi6uFclSKrG:+m5fxfx6j06poEAi68CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157548, "uuid": "23798976-1944-48bf-892e-39913e312673", "value": 84104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157548, "uuid": "a92343d6-96b9-47c2-84f4-379caf21f4b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157548, "uuid": "6f4f20c4-d217-4d3b-b95f-b522f8adbffc", "value": "c8748dd73169e942b8803c6c70ec2de3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4441a0-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225384, "uuid": "7600a5e5-3fbd-429d-95db-9f22f28d2a1c", "comment": "Malware payload", "value": "2e5789d634c0943773a6b321beb5325c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225384, "uuid": "c459ec43-6a55-4947-ae20-b0fee3faf90c", "comment": "Malware payload", "value": "86e16072d28fe35eb599b4ae58fb85d8019ca82f2fffe418c943604921d2fe46", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225384, "uuid": "d824dd07-188d-47e8-93f3-86ff40acf394", "comment": "Malware payload", "value": "5e3a822d5de56f7679f5c0d0ad54e648052a916c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225384, "uuid": "1a13147f-f4fb-425e-9283-b12ca2f3646b", "comment": "Malware payload", "value": "69704011fadd543ea40e7a329baadb858f6a78d9d163bf35b59350d69124f97f5a21537e2516c9980bd301b82e3d7761", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225384, "uuid": "00950c44-b033-4367-bd4a-079de0beda09", "value": "7264239932D94585A2280AA7AFCCD83D8C9F19E5F83C477B1B8728C2945C754DCCA8DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225384, "uuid": "01235d86-3d16-4995-8904-f7a4419759c3", "value": "6144:XWjmVafNXSqlepwUqIuEkWnuiiW1vCOuzZ4CZP4sEH:XwF/lauXWnuijVHuvyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225384, "uuid": "d61e4394-ae34-40c0-a88a-571d37cc676a", "value": 332912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225384, "uuid": "66d8f09f-7266-45ca-bc30-cf2e2f36694c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225384, "uuid": "d686de5d-4e58-40a6-badf-18dc46c0fd94", "value": "\u897f\u6e2f\u60ca\u73b0\u65e0\u5934\u4e2d\u56fd\u7c4d\u5973\u5c38\uff0c\u60e8\u4e0d\u5fcd\u7779.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d24572-d16c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624155033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155033, "uuid": "8ce93ffc-13a3-43ca-b52e-dd1ee3c2ddda", "comment": "Malware payload (RedLineStealer)", "value": "a29be9e688d14557bb2c8d1bab72071a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155033, "uuid": "e9903a21-af69-48dd-8ff0-67dfa86ce122", "comment": "Malware payload (RedLineStealer)", "value": "885c540ea597bed7e1d4b8fd3670bc66e821368ba0df789c53a5fd2cb96ed33f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155033, "uuid": "00d14698-d3fb-45e0-bd50-503cb2eb47f1", "comment": "Malware payload (RedLineStealer)", "value": "4f839d5d4bd6f098abe8f5bc64db2542b0e40798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155033, "uuid": "255368d1-ad62-4ca5-a504-932e89844986", "comment": "Malware payload (RedLineStealer)", "value": "59c8b264ca73460cf552df47ac7b1e11d5df31a7bf32a54a1730c01dbde997461f6916968a6aaab2c0baf52e60ad1902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155033, "uuid": "af938589-a162-4e09-8143-4fe53b41a6c1", "value": "3B0633607AD7C1F2E5001030E5107AE6E4FAD7890AF559D76BA8CA0E0F3CD729265A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155033, "uuid": "88b4f36c-b270-4f73-830d-26b07cafde27", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155033, "uuid": "d111b2e2-2b04-49d4-8ee9-90ce583f5526", "value": "98304:xeAjQVzoqa0ivM1QlevQuyDDYCvLUBsKIvE4:xeAQVzRa3M1QlekZLUCK+E4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624155033, "uuid": "9d4a1c38-f3e3-4356-bf6d-77b2384d25e9", "value": 3789029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624155033, "uuid": "081d1b17-f4c4-4d97-8d02-a25608daa4f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155033, "uuid": "e18332b3-93cb-4b90-a431-18b1a9a4764b", "value": "a29be9e688d14557bb2c8d1bab72071a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e68704-d1d4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624199760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199760, "uuid": "d0193f7e-d688-466b-9d68-940bd9b94dde", "comment": "Malware payload (RedLineStealer)", "value": "279b5a30597f6c1ff3032dd9e30595ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199760, "uuid": "0cea3e84-8648-4c29-93ce-8d4bd682e093", "comment": "Malware payload (RedLineStealer)", "value": "8b2688a17acd38a07626c0c1ad5927b0c72ea64689e682dab445b80072c10a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199760, "uuid": "8db5af7c-277d-45fc-82f5-14a0a4c296c9", "comment": "Malware payload (RedLineStealer)", "value": "0f4339af6f38d9958c4865165a60837b09340a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199760, "uuid": "c850b7b9-5f2f-400c-a049-eb2ba4216466", "comment": "Malware payload (RedLineStealer)", "value": "7190256434d296cbca02834cd58e8e11f966a8e10c765ef1405211289ddb5510cd8c61ef2f9a7b66a5ac1edb514361cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199760, "uuid": "8282c8ea-0002-40ba-b8ca-9e6787f135be", "value": "FE94BF10FA90C035E5F762F85A7AD3B9A52D3AA0972490CB52E51BEE5B347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199760, "uuid": "3c706b81-1ff3-4c71-b93b-9c6316b12538", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199760, "uuid": "95e11dac-a7a8-4dc1-8237-3b0c2ca3dc60", "value": "6144:oUJ3MIv/ecrEJ/SjPh91HgsCLClS0VuDOkJ5BnvhSuV3GAcI4Hng/YDKri:TM0/ecrEJ/STh92ZgQ59hzZGAc5vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624199760, "uuid": "4f0a340a-3397-49c4-a4a6-21d4f0578307", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624199760, "uuid": "52241ee4-1f1f-4c5e-97c1-3ecfe6c93a2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199760, "uuid": "4dd1b8c1-b3e2-4da4-af01-61bdd3f8abcf", "value": "279b5a30597f6c1ff3032dd9e30595ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518f5b90-d16e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624155730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155730, "uuid": "cdf1e825-315e-4369-9bfe-52f85aa5c9fb", "comment": "Malware payload", "value": "41c69a7f93fbe7edc44fd1b09795fa67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155730, "uuid": "78279d6b-958c-4a57-95f1-14dd56af4094", "comment": "Malware payload", "value": "8b720f6963165f9aca1600e2e3efb04a7162014d0d738fb7f8b9872019f49bd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155730, "uuid": "4edd6c9d-c361-4c7b-9882-07a4c80eb543", "comment": "Malware payload", "value": "f09309b52d2a067585266ec57a58817b3fc0c9df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624155730, "uuid": "5da58289-8b9f-40a1-a8d4-fa35b6411959", "comment": "Malware payload", "value": "791b774bddab503cce1b6ef1fe8f2187f286264bee418b41bd46b1317b7eda5340e9dca9b11b64a68020cd80889df381", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155730, "uuid": "5b6f7da5-6b90-48d4-a3d2-4cf3615cd977", "value": "DCE4120372C3D831E0BA5B3151B0D2719EBAED504FB4DEA76B585BA91D711C08D3BA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155730, "uuid": "825d286a-a23d-46db-800a-ff8d57849745", "value": "a044253673528dd98a9dd008f2a6b058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155730, "uuid": "274410e2-569c-4306-9fc5-efa1b253fb34", "value": "12288:Umn1vBXNJl0P3ZbcCAjqH0d5i+qUH6wyZQMvvdgMiCiT:n1vJNJla39cGH0dg7sOlQCiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624155730, "uuid": "086020a6-b248-4912-bb5d-2d45f4ab8455", "value": 696364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624155730, "uuid": "e31554ad-2bea-4cdc-83f6-9cbb6d4ea137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624155730, "uuid": "d18b75de-3ce8-492b-a568-0f3bc7ad1e1c", "value": "41c69a7f93fbe7edc44fd1b09795fa67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc252af-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624176880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176880, "uuid": "970fc660-e394-4100-9c2f-0eaed9a3cb37", "comment": "Malware payload", "value": "5ba09cc8a6fef69449bbcf06fff1ca33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176880, "uuid": "64b10366-2df2-474b-b911-db500cf7e545", "comment": "Malware payload", "value": "8e0ba93dc7ebbfd1178c1334922dc59f9e2e4a915c43281f10b225774873141e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176880, "uuid": "2464f49f-e2c3-426c-9dab-9a61d8976f75", "comment": "Malware payload", "value": "08182a748f52b751ed7e0d9fed86a625a4e8392f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176880, "uuid": "c77d2d79-5cfc-477b-985a-caa76f156ac0", "comment": "Malware payload", "value": "22c470f9f788d857403e32e682ed355f4118e27e96fec2ecdb109473377c0b61de46db17bf94b2b5b14422e8d35e7c66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176880, "uuid": "edacbef3-e005-443c-8afd-5a2343e66c20", "value": "DEF36C10EA03C035D89A61F846AED77DF62D3E71434C35C793E66AF6A7682E1AC3105B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176880, "uuid": "fcbb5b0a-b96a-4209-b1dd-9a36b1c86917", "value": "3072:JHSB0TFz6xXk80lDGmIfZnmHnIPxQwZQCBK38X2xTQ:JHZFz6NoGbZnmHmew7Qns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176880, "uuid": "fa63aad7-5fdf-4468-b802-f864dd60d596", "value": 158790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176880, "uuid": "2e2df2a9-07f9-4a48-a331-8620e365bf62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176880, "uuid": "882d60e6-d723-4c59-848e-5f1c494f407f", "value": "5ba09cc8a6fef69449bbcf06fff1ca33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a80cf2-d1aa-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624181755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181755, "uuid": "a3cf7257-e6cc-4d8f-8997-172a172d738e", "comment": "Malware payload (BitRAT)", "value": "c50bc2313eaa275d4293293d83705751", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181755, "uuid": "a7315067-52ae-4439-b23f-052a8eafe954", "comment": "Malware payload (BitRAT)", "value": "8e3c9001f9377d8c55aabd93e84e71e5b0eaa73bf783e880ef70476b442348b7", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181755, "uuid": "13081089-8611-4741-a6fc-2fa5a53780f0", "comment": "Malware payload (BitRAT)", "value": "34767b07934098788f11026855a8d0bc1abf3e73", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181755, "uuid": "5a0e773b-bc98-43c6-aa75-d8c81df01f22", "comment": "Malware payload (BitRAT)", "value": "3a818b6db0f97238bbd0e89f792657cc7c7f121e92dada6256ea709ec69c6ac647f26067dc0a305dad6cc3808a380d90", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181755, "uuid": "4438a953-38ca-46bc-9d39-7ff2aa01469a", "value": "2A838C01B2A96B6AD7B827FB2474512167F2709F68A1F31C4EC660EA6F73F014681F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181755, "uuid": "e2e4d45e-91aa-4b78-b25f-35f6acc49beb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181755, "uuid": "eea796b0-546f-45ac-a53d-4b81a0786b81", "value": "1536:rx6RLzqfcr+W9yrotsXFRxzuLb0Fu7OtUBm2tAEgeOZD:rx4r+laig7OtU42rXGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624181755, "uuid": "dabe7b1b-688e-4724-82df-2f3c045398c0", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624181755, "uuid": "754586a6-ed22-4b58-9b78-c72187936668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181755, "uuid": "e4b76f91-dd00-44de-be86-8407a417021e", "value": "c50bc2313eaa275d4293293d83705751.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3884dd98-d172-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624157406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157406, "uuid": "3315ef69-1634-4ef9-aebc-02a545b5b903", "comment": "Malware payload (RedLineStealer)", "value": "a65c057ce64857391918ce8d449a158d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157406, "uuid": "2fcf3354-88db-4d4a-926e-392dbadf466b", "comment": "Malware payload (RedLineStealer)", "value": "8f4001fd561fb0462d88c09f3be2c8cfc6810118c79066e1ec6956d43e18c643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157406, "uuid": "1e9325fa-15e4-4d29-b800-9055790776a0", "comment": "Malware payload (RedLineStealer)", "value": "0d12b7bf1f2037509f5c0302534f08c42f406ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157406, "uuid": "0f0b8b3e-0928-431c-9674-1dffa52c7cd9", "comment": "Malware payload (RedLineStealer)", "value": "6b7deba10cf1359009c5a1f1a3e9042a1ad9637bd675f17c520879c69a22023d532bcc82514f4c4b13b4bc34ee683d40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157406, "uuid": "9f63c472-1d58-44f8-bbde-fbba14089648", "value": "6384AE10FA50C039F5F612F85ABA93B8A52D7AB0572850CF62E51AEE47346F1EC32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157406, "uuid": "51703370-e353-42ec-9ddf-fbbe2948858b", "value": "866e8b0fa01ec6fd81db7579c1be52ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157406, "uuid": "4342fb11-5b55-4246-8e9f-b2663809b09a", "value": "6144:AUIBsCpuw3Adg9X0S5jPrLwBE8Sfh6UWDvfqySZTr9HrKafV6JCE:mBDpuwwdg9X0yPz15sfqySRR2SV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157406, "uuid": "8bdf01dd-7ae2-4f3f-9c93-75cb7dfac5ce", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157406, "uuid": "94d29764-1da2-4b88-9fe4-dff08393f842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157406, "uuid": "e1ad40ce-500d-4175-b132-765a2f7953d5", "value": "a65c057ce64857391918ce8d449a158d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992860bb-d172-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157569, "uuid": "b27d65cf-530a-4b25-a9df-b02b653665e5", "comment": "Malware payload (Mirai)", "value": "48213615f9f2d28bb297d290bb724c00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157569, "uuid": "d2d895a8-3100-4bc5-8ee6-d92d06e35b99", "comment": "Malware payload (Mirai)", "value": "9108777b9b73f9382602ea8ab92b9c7d04aefad401d6430279ec66afe965832e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157569, "uuid": "e9abeba2-0541-4007-96fc-cdf16cec3363", "comment": "Malware payload (Mirai)", "value": "df72e01f6b160b7cdb2bcbf4d2ac9eea174478e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157569, "uuid": "7eae37fe-4fba-4df6-bbf3-27bc6b857007", "comment": "Malware payload (Mirai)", "value": "53047d7bfc143f1dd326a13a0ea494550e95d5c6f2aa7e08c7219e203dea689f7d6dbe9c6ecbdaea110e99e1a1d79761", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157569, "uuid": "9e9efeda-97a9-42fa-ab5b-5d940e8122e1", "value": "44F2E1784A8519B0D4B3D4F5118873B079250FD5D7F68C432A41ADE6BBE7028B8DEDE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157569, "uuid": "16df9747-9776-4ba4-afe7-9e09c8e8c5fa", "value": "768:UygINWpi40cU4ccd9O84DHKkbgjpTERTOOhkwHENc/JgGlzDpUYsP:U1if4ccdVYHfj5h7kKVqYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157569, "uuid": "966fe76f-aa2c-4efc-808b-8d4b2668566b", "value": 35664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157569, "uuid": "a4d580fd-66ba-465b-8f3f-5b39ee25d81d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157569, "uuid": "e6c04c04-1193-4b23-b100-edc64978d6f7", "value": "48213615f9f2d28bb297d290bb724c00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f120740f-d15b-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624147838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147838, "uuid": "c9050b6f-3b9b-495a-a951-84dcdbfa8b5a", "comment": "Malware payload (BitRAT)", "value": "42a4edc5b094d1e0ae4b36d82ae13f1f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147838, "uuid": "a284d5bc-f98d-479c-a006-422a402e3fbb", "comment": "Malware payload (BitRAT)", "value": "929ea8cb5bdef95c8f6b1b7f98ce1a27565fb40af90be41cc4aa70044f53ea31", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147838, "uuid": "1df03223-fb6e-4c31-9dc9-ae013a22d401", "comment": "Malware payload (BitRAT)", "value": "b5f677e585f6263779e35579d803d299f7ce7948", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147838, "uuid": "3a3abc75-2b52-4694-b80d-f37d061cc1c6", "comment": "Malware payload (BitRAT)", "value": "93a621e4bc6d0036c786534306f08817bf3251915920d663a179276d261a519aca1e82cb877d9f97542bc00cf2357fa7", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147838, "uuid": "e33c2507-2f34-44f0-9680-8916f844527d", "value": "04A5124073FA1B6AF5B987F009A5A14013FA3E2B592DF2484DC371DF29B5F854642BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147838, "uuid": "a51461e2-b50a-4601-b4d8-cc31e21171db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147838, "uuid": "b2cbf727-b35c-4ccc-adfb-61acf7032c62", "value": "49152:MeXTOqI0Tnf5QZwfAvwm4nhNcjElIYKwXMF09Yj1Tm/:7XTOh0TnBnoYm4hNcjElIY1M+Wj1Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624147838, "uuid": "26c11c2a-f589-4c4e-a757-3ba26c36a1fe", "value": 2211328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624147838, "uuid": "3757bebc-2b46-43b0-9993-09da462e828a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147838, "uuid": "91cbdca2-ad21-4ba0-b49d-7b54e8120115", "value": "Application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501bec97-d180-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624163459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163459, "uuid": "9050ff78-93e1-45ca-bcf4-4305bb4045e9", "comment": "Malware payload (DCRat)", "value": "aa017e9d36fa355de3106bc59b1aff53", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163459, "uuid": "32a5265e-0689-4533-a234-b8e40fbad3d4", "comment": "Malware payload (DCRat)", "value": "93fdcdd418324a8e47021c639488c68db00649b3d7d986a3221ffc19b974bc6a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163459, "uuid": "b2d61db8-6ea1-46a3-872e-582ffcadfe42", "comment": "Malware payload (DCRat)", "value": "f0b010c08604ecff35e1645add5142ffe3728490", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163459, "uuid": "4dca2da0-2df6-48ba-8905-58c7ca76e721", "comment": "Malware payload (DCRat)", "value": "ae2e0e20203835ccd7d3fa9978e6f5ab3766fd26dab0dd382a75cc09e81adbc5ae851b703d4fe05b048293644730097f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163459, "uuid": "92cd8e46-ff73-4281-ac52-8eb169011085", "value": "E5F43A223A48CD11E0A9173BD9DFA5244FBCED00B6A2D7167E9FB3AC64513636D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163459, "uuid": "0c8e2432-f712-4c0f-aea7-663ae7a380be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163459, "uuid": "6f97ee64-b5df-46f6-b16f-7383e28e57a1", "value": "6144:+rkXmQkFjAD+kIbZzqi98Mqvb/NRIjd5Iujhjm0cYrqin332K+xGRSP7zQ+B09aS:qkXnglba7fRMo7zQ7y1aOLqe836qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624163459, "uuid": "06a7d60e-a31e-48ff-8a3e-5b8808b661cd", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624163459, "uuid": "1de9e4b7-fe99-411c-a7ea-64464cf5061f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163459, "uuid": "163b00fe-8098-478c-b91b-facec92299b9", "value": "aa017e9d36fa355de3106bc59b1aff53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d47e46f-d1d8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624201250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201250, "uuid": "ffc0a71b-23d8-47e4-a892-25a05009fdb3", "comment": "Malware payload (RedLineStealer)", "value": "9c60ec4c199b312c49251a5a6236c7da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201250, "uuid": "38d1f6b9-97ba-42ac-975f-2f911d5cd974", "comment": "Malware payload (RedLineStealer)", "value": "943a5aaae1f59db65a42b291b72935600d67a8b1e8b223a52428777b08bd635a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201250, "uuid": "7cd2cecd-bc97-4b84-9d78-2aaf664a7e29", "comment": "Malware payload (RedLineStealer)", "value": "f6ab11a2a4d0ced63a1af3f19f46ccebf6582a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624201250, "uuid": "e991fe63-1673-4264-9087-4ea38971108a", "comment": "Malware payload (RedLineStealer)", "value": "00286aaa3a4f51f85a0cbd2be79c49db1b1b2579a85df4a8ba0f9e2a5d500480c7a468ef1f62f2cb20e46d3da783326d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201250, "uuid": "c7728b86-5adc-4d6b-9952-ac96d1282f8f", "value": "2B94BF10FA90C035F5F762F95A7AD3B8A92D3AB0572450CB52E52AEF16387E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201250, "uuid": "3439b1bd-3fbc-4564-bee0-459b7d51a85f", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201250, "uuid": "4d967e9f-a2a3-4b04-8fe7-038e006d97ce", "value": "6144:qU23MIi/ec6EJ0SjPw91Hgb0yiDQzLTBBjHrlJr0d2ri3UxiHEIpKri:kMN/ec6EJ0STw92DvPBBj4qi3U4fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624201250, "uuid": "b7e8ae50-54e9-4422-b4d2-a2857f9a042e", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624201250, "uuid": "b9f4476d-49b1-4b61-b3ec-6f03f548dc7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624201250, "uuid": "0b68e7d8-6d93-412f-a0b8-1d0f98acdbd2", "value": "9c60ec4c199b312c49251a5a6236c7da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e783b967-d19e-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624176598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176598, "uuid": "3d0c36d9-c881-4f9d-933e-e707b403ac46", "comment": "Malware payload (CobaltStrike)", "value": "d89c813bf46d01f144a20592d371f0cc", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176598, "uuid": "0551cfa6-3844-4ce4-ada9-2a1359a97a50", "comment": "Malware payload (CobaltStrike)", "value": "984265f2a1df743a585b3ed1aa138080dbc0e27c66d2472d10a66c916739556c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176598, "uuid": "752abfee-f1ee-4b52-95c7-3f6aeedbbc9d", "comment": "Malware payload (CobaltStrike)", "value": "7ad8ba14cb10c493c3dfb8d37779a86345572d38", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176598, "uuid": "2db927d8-a551-4999-95f2-c6798c59a3fe", "comment": "Malware payload (CobaltStrike)", "value": "3d5b364a6774bb0cf57d35d6a4f2d87e56958abf7aa94ae921312213eeecb62a5812e1f1f02d511eeb8a56c12104292f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176598, "uuid": "06135ff9-458b-4ba3-ab81-ac9095aba2f5", "value": "C9F5336300567AAEF2825DB4070BF8E48D053A735FA4B9345C17DAB414339E6E6FD12B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176598, "uuid": "c86fc461-fa9a-461f-a8e5-dcc3fbe00f8c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176598, "uuid": "50ee7593-44dd-4cd8-ad9e-f7258bfe0b54", "value": "98304:T1yVjqcy7Vr5Xvdy3FBtCNG7Kmvh6BD1HRx2ZrCluDWtmf:ZyiTXY3mpmbpDYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176598, "uuid": "5def37c6-5fe5-48ff-a071-2794b9fe0b79", "value": 3477504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176598, "uuid": "c7e6f5b9-29a8-4c40-aee4-adcf9260cc66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176598, "uuid": "1c0f3c71-17b6-40dc-bee8-e06f91cecf3f", "value": "d89c813bf46d01f144a20592d371f0cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eced910a-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180472, "uuid": "536ec9f1-4ac8-41ee-96ca-552957c27c57", "comment": "Malware payload (Mirai)", "value": "c07362a9c47dc89d6bb136144f2186da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180472, "uuid": "283fbcd9-159d-4ee5-9ca1-27d914070191", "comment": "Malware payload (Mirai)", "value": "9d11235892c39724222dd21ab0a6865e7404a0c6aa30f263f84fb2c8659f1e1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180472, "uuid": "c833a12f-da1c-4531-81f0-8e8034c7f06f", "comment": "Malware payload (Mirai)", "value": "6f0e218ee445d724fe24350b6f52088fb08e0ddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180472, "uuid": "679a4f05-7bff-4e1b-a84d-041adf21824b", "comment": "Malware payload (Mirai)", "value": "83e40557aa3ecaee50566069faa14b81a795e438a5fc391761cd8ce12d3014024a8f0ccc09e58db7a344be023f5b7633", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180472, "uuid": "a0cfe0b3-8923-477e-82f8-7a3d57b9dc67", "value": "D503F198E1B78A59ED7F02B0A8EDBE0FF661A27581F10176E6DCB1009B14F2D3435359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180472, "uuid": "02afe168-b527-4e88-9c5f-884e213fc161", "value": "768:OmEqJMPSeUUdp7CpH4VuEbtb40Wj9hcmsZghwrnbcuyD7UHQRjc:REjPSeVdCZ4Lb140Wj9hcminouy8HyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180472, "uuid": "2042b47e-1f17-4683-b7cb-053d9d19350e", "value": 38964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180472, "uuid": "7371a5be-814f-4889-a1d9-ffb405b2862c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180472, "uuid": "a1a006a1-5d67-4bdf-9cbd-890df3259f50", "value": "c07362a9c47dc89d6bb136144f2186da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ae5947-d198-11eb-875b-42010a9c0053", "comment": "Malware payload (HiveRat)", "timestamp": 1624173753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173753, "uuid": "cd26078c-1340-49a9-83dc-f0f3ac8012ec", "comment": "Malware payload (HiveRat)", "value": "744caddbbe8882685d201821c7bf3157", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173753, "uuid": "cd15687f-f325-4b36-8d5e-05ffc533e4a3", "comment": "Malware payload (HiveRat)", "value": "9dd4a95031cc128d8ca15aa0daba60ae2f897e56483eb70bc7859cebcdd60cda", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173753, "uuid": "2258d500-85c0-4e49-8fb9-4603bd7de7b3", "comment": "Malware payload (HiveRat)", "value": "1f51cfb1f71fdaa4a3b3ab0a5f38e484bb2965c9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173753, "uuid": "f97d0e31-55c1-4537-94ba-12eb6f70863f", "comment": "Malware payload (HiveRat)", "value": "54f487124f1093ea900ef8d62f08d0a1dc6a2393d3dd9bce201c0a181a432fa08ad57cb63ad47baa9b02a65549b5f457", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173753, "uuid": "39f33e2d-a412-49c2-8671-9d2f06eb8051", "value": "4B86335A16C73AF4D1C6D85EE4084B9F44E02587BA4B5080ADD02EE322DD7FB9ED386D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173753, "uuid": "12bd6fe3-7554-45a5-8a48-b31b24ed01cc", "value": "196608:6n3t28+tDL9lO/5K89XGQabjAGYB4+85wEkvwp/SCO81EGp7G:eM2jpGQmm4+8KvwmOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624173753, "uuid": "e0288b1a-1b52-4845-a5f8-fe705fb61381", "value": 8531386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624173753, "uuid": "3d4afcac-24a7-483f-9994-fc9389f8958c", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173753, "uuid": "01c52695-79b3-4a5c-bfbe-e0e77e8bc637", "value": "Console Sniffer Cracked.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53053ef6-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180214, "uuid": "278a94e5-f17f-4974-9b1e-c2993b072c7c", "comment": "Malware payload (Mirai)", "value": "e6d3192b1fb80729809546cb9a3ed61f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180214, "uuid": "1727fc25-beec-48d7-a971-a5813aeeeb8d", "comment": "Malware payload (Mirai)", "value": "9f432375a6c3d44c35a186f33652920168f5023548ef70afcc60534d3a6a02c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180214, "uuid": "eef21fd4-d6a3-412a-a6ec-5695b422146d", "comment": "Malware payload (Mirai)", "value": "822ae86f7c1cba0db17e05a84ab534c7c2e4d4b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180214, "uuid": "cfe8aab7-2e22-41ab-baa0-3943df251edc", "comment": "Malware payload (Mirai)", "value": "e025ab04f80b91a37e2b169c98c9f669fe31bd1c47093caf97ef154dabfa1766d378a613c831d7a564a5f7c1380cd111", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180214, "uuid": "7d122d24-08fe-4921-a93f-3dbc7aa98278", "value": "CD03F153C4A89D91C4DE703509BFEA8BC968C113A8991CE3DB882137D8F1E112539E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180214, "uuid": "0d888482-c13e-49bf-bcfe-f1ac9b0c7d54", "value": "768:PlKg86NnWvixTXwDoQ9V3qzVUtznsf0lKMl5gtR9IYy/vVYKMoJ0aWCb7evpnbc+:Psg8yci+Do6VkOtzsf0lpl5gZIj/vVLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180214, "uuid": "3150c53e-b331-4118-b8d3-5f241e4bf4a1", "value": 37772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180214, "uuid": "75bd8d3f-1190-41c2-942f-1166a940730d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180214, "uuid": "81a0957c-16ba-4d15-975d-dcdd08af6bc0", "value": "e6d3192b1fb80729809546cb9a3ed61f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0da9ad1-d1d7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624200961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200961, "uuid": "aa23aac2-3269-4327-ac5a-55a49d7587cf", "comment": "Malware payload (RedLineStealer)", "value": "e8ef168dfd054aafc9ae4a4f1a8d778a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200961, "uuid": "b29cacea-e065-4a6c-b586-f7f378139ff9", "comment": "Malware payload (RedLineStealer)", "value": "9f44d1063b17846d40238623a53370c0ada300e72603a213ba2130532fb0f011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200961, "uuid": "9102ca2b-0e62-4dcb-a21b-d43d19a283ed", "comment": "Malware payload (RedLineStealer)", "value": "e6eba07d340c6f0bfbc5218d8ca8e2dcc36293ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200961, "uuid": "6b9f0486-cbc0-466f-b796-0e24be76464a", "comment": "Malware payload (RedLineStealer)", "value": "1f9feeff3a90d5d8301352ad6273ccdf7fe83730ff275e0428bd2c1b28a04d5736b5d89a019d8471abbde65ed2e9d88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200961, "uuid": "e5ebd44e-86a4-4cd0-8ca7-6c6631294b1d", "value": "8C94BF00EB90C035F5F662F95AB9D3B8A52D3AB0A72450CB53E52AEA17347E1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200961, "uuid": "6dc29bff-bce0-4883-9b0f-8549c3caea7e", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200961, "uuid": "fc94a5cf-889c-43d0-8fe0-39674948abbe", "value": "12288:gcd/ecqEJkSTR92Bq8VYKALGxnG50BgZ5l:VGcqEJFkpVYFAnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624200961, "uuid": "5229bd37-1fea-4c71-adad-802adbdc07ff", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624200961, "uuid": "779fbba3-e169-4605-959e-ddc99cb173dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200961, "uuid": "9d0f7430-cb84-4788-b3ff-bdeec87a3722", "value": "e8ef168dfd054aafc9ae4a4f1a8d778a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb6cdec-d20b-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624223130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624223130, "uuid": "8ad4f87a-82bf-4dea-9a51-b929b8ed1e9a", "comment": "Malware payload (RaccoonStealer)", "value": "5fb915dee9e5da7bfa4b4d833bfefb9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624223130, "uuid": "3e7faddf-3c9d-4bd5-9ac4-4fe9057e003a", "comment": "Malware payload (RaccoonStealer)", "value": "9fe5d38a3eaacddf0cfbfcdbb0d84c8399a510872b53610638087f4d9553ac82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624223130, "uuid": "099fe782-7e42-40b9-be50-f88c3b3a8dd7", "comment": "Malware payload (RaccoonStealer)", "value": "abb3d10ef1c3e9bacb09c5e8370c10bd672d6706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624223130, "uuid": "9f62e21a-127c-423a-97c3-adfaab6a7fe1", "comment": "Malware payload (RaccoonStealer)", "value": "1fa581b0562de4bd3ed351d3c9b55b8559261b57c296deb53317d7b43ee153a9d134ecaffa9f27f20793c7b5f1ac350f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624223130, "uuid": "3aa427ef-8879-4bb9-87e6-949a1165ec85", "value": "7135D067A2C1D437D2B32E348CBB52A898357BCC3D15988A5AD83F089F367513B7215B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624223130, "uuid": "71fafae4-4502-4cd9-99af-0869d36ca6a8", "value": "8c3d2ce9c0756d959c7aa1c81b93d3a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624223130, "uuid": "8c188930-e152-408e-94ef-2040fc587f1b", "value": "24576:HscqzDohX1lerJEvajg6tX0nubt2ANw4bSw+LArvILX:H4YhQJECYubV9+LArvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624223130, "uuid": "ab58062d-47cb-4d2f-9732-14457834c50e", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624223130, "uuid": "939fbe66-aed7-4df7-ac78-547c654457c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624223130, "uuid": "29bc4b70-c801-4ef8-a5a0-37c24a786f64", "value": "5FB915DEE9E5DA7BFA4B4D833BFEFB9E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89339c8-d193-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624171848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171848, "uuid": "bb80ae3b-3251-41d7-bb40-9e4c92ee8514", "comment": "Malware payload (RaccoonStealer)", "value": "ae9a8eb8ef1651b2755505e4e43dfa50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171848, "uuid": "f7f0a646-bff4-4d83-810f-34e7612bb3a9", "comment": "Malware payload (RaccoonStealer)", "value": "a03d39f88a72a06a83839429cd99a5fbed10d9c6e25d83291cbf34e66ddc4890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171848, "uuid": "9ee7b30a-c5aa-4880-b7bc-48115f135f85", "comment": "Malware payload (RaccoonStealer)", "value": "db49296886d3ab515a1fa3a7dc3fb57c98968a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171848, "uuid": "97358358-5b6a-4664-8ed5-43a2b187ee4f", "comment": "Malware payload (RaccoonStealer)", "value": "a2b99f4716e0def87bf6b8be81b16ddf6d82b01b587af9375c4c01e2e943d6dbe38ebd45e55e4da795e9417b40761a75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171848, "uuid": "bc05ac02-9251-48ac-9fd1-6ea1c2caa2e2", "value": "BCC4D000A7A0C039F0B732F8997A8369A56D7AF06B3C90CF62D116EA47749F4AC71757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171848, "uuid": "0c338dfa-d0af-49b1-bc8e-5693979eeb6f", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171848, "uuid": "4a83a721-219e-4c76-b7c9-d93f1aac1145", "value": "12288:MTQEQLtT1zhBs4Wxgy1Qeggypbj8AxO1PotAcffEFYDNj+GjM:MiTA4WxgIQ3gCbjNO1P8ffEOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624171848, "uuid": "092de512-775b-4905-b6d3-f08f4ffb42e9", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624171848, "uuid": "c94c9d26-5ee1-488f-813e-abb5a125d627", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171848, "uuid": "591c2e99-4d2d-40df-89b2-802d279d8933", "value": "ae9a8eb8ef1651b2755505e4e43dfa50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f74a81-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225456, "uuid": "6d685db5-4765-4cf4-a95f-66214d9b4770", "comment": "Malware payload", "value": "a3cd2cbe1a2e6b73c6e2d4f34bc7fc57", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225456, "uuid": "797aef8a-017a-440a-88ec-0507edf3a5ae", "comment": "Malware payload", "value": "a08f18c6a34c167bf5ea4fe4fe3d2e0f92911e5b0b20aeefd08410c1ef9f72ec", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225456, "uuid": "fd8971fb-fbdc-48e9-9fcd-7372d452956b", "comment": "Malware payload", "value": "62fbfc02162a1831209408db72b4a4e23e40e190", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225456, "uuid": "903c6e08-79ee-400c-b1ae-aa585311ac47", "comment": "Malware payload", "value": "d26bb061ea2e8b40b5ab3250111a9c020813deb82e2512b31f5ba3d31174c51b88c836a2c9a368a40f966a839435ed96", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225456, "uuid": "43bdf7e3-d927-45ec-b87a-886f5950a688", "value": "0D64239931D94585A2280AA7BFCCE83D889F19E1F83C477B1B8728C2945C754DCCA8DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225456, "uuid": "e1ebc908-b967-40fd-8538-e8c9e9c7b7fc", "value": "6144:TWjmVafNXSqlepwUqIuEkWnuiiW1vCOuzZ4CZP4sEH:zwF/lauXWnuijVHuvyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225456, "uuid": "0a1dbed1-6d96-4847-9ad3-689db486b2d3", "value": 332954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225456, "uuid": "20c0bfbe-c400-4ef1-baf3-00a93c03bcb1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225456, "uuid": "869c189e-ff93-4867-bee4-08854fb35f91", "value": "\u66dd\u5149\u83f2\u5f8b\u5bbe\u6613\u5f69\u516c\u53f8\u5973\u8d22\u52a1\u88ab\u8f6e\u5978\u81f4\u6b7b\u89c6\u9891\u6d41\u51fa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d77cb3-d17e-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624162586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162586, "uuid": "209b25f4-68ee-4c42-bace-b8fbe7a4a32f", "comment": "Malware payload (RaccoonStealer)", "value": "a98682fe987630554c7d8aac792e1b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162586, "uuid": "fa905100-ff88-4066-94a9-13f0291163bb", "comment": "Malware payload (RaccoonStealer)", "value": "a22ce71be55494c6df6acc23d6d90152d8a2f5f57a3b79d1d2347f71c43ff28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162586, "uuid": "e42405eb-6161-4bf9-b8f0-f608c1614757", "comment": "Malware payload (RaccoonStealer)", "value": "f460ff77d4958dbb73aac5b9b43d4dc838ef7bac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624162586, "uuid": "9b74dff4-0b0b-49f9-89f8-a54b9901c5bd", "comment": "Malware payload (RaccoonStealer)", "value": "a8e402d423307d8fd44a5e156ec392e4b9141ff68269e24f4a8992056aa7e0427c210f970fb89a74f2f3a67c798ceb3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162586, "uuid": "3eea5cfc-5bf8-40dd-a023-4f6b8cf04fdf", "value": "CFC4E100AB50C039F5F631F859BA9368AA2E7AB05B3450CB62D55BED4734AF4BD31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162586, "uuid": "9279489f-7345-459b-bff0-570d358b46b4", "value": "5bc76f4349f7f0afe0c88e229f50d37f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162586, "uuid": "78a565fb-1014-4b59-9fe9-441e7361c234", "value": "12288:FF/VZ+aTCnyf+lOypnvabpisc4MSs9MToRRvEC3o1/z:tZ+a6l3nyrcdAoLEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624162586, "uuid": "87b9a6d1-481e-42dc-a453-8d6079e08809", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624162586, "uuid": "a1a7742c-a7a3-4fac-9945-0e1fa9c7ece8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624162586, "uuid": "64278dad-f638-429a-86ac-29da7b135d2f", "value": "a98682fe987630554c7d8aac792e1b6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc5c3ae-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624176689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176689, "uuid": "f6916bfa-e434-4ddf-bcd2-dbc80bd33cd1", "comment": "Malware payload (CryptBot)", "value": "44c7aaaf39377cfa7a550093f0224f68", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176689, "uuid": "d054c186-8b37-409f-94fe-522216e01416", "comment": "Malware payload (CryptBot)", "value": "a2ed4456865129f69ed876a3262526d1193bc881708d46d86be1528f23c1b749", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176689, "uuid": "29f52a7a-a7f9-4b9c-b676-4b7b4aa0af63", "comment": "Malware payload (CryptBot)", "value": "e7f7d4a5714724c53c60d514fd3a79135a984869", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176689, "uuid": "fb4dcf3e-34e7-45c3-aabf-fbdf5d3b8cc9", "comment": "Malware payload (CryptBot)", "value": "d5fb059e967a9b86a82f6f163df669223c7ca764839c17ce18234965bf8131f12b88f28e20eec10a37b0be64798f293f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176689, "uuid": "b29d01aa-acd5-480a-89ec-7dcc07d8ddcc", "value": "38F4F110B6808036F1B762F85675D368A92D3EB1973850CF52E967EE57787E0AC32B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176689, "uuid": "3e94fa6a-07e6-4934-ac8d-3334edbd6e23", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176689, "uuid": "47f7b20e-58e7-46e5-94ef-d5d91e915465", "value": "12288:nnjFMmdTtv11ampQ7XrH+frvckENKmvrtLjERnNRZk2zhZCpi9W8vBXBLhG+aA/l:jemdTtA7XrrkPoR2HZTtvvBBLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176689, "uuid": "77857d0a-cdcf-4210-94ff-5de155e1e428", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176689, "uuid": "961a078a-a319-4c8e-9ad0-3801b1cee8e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176689, "uuid": "e38a0b45-1a02-4cd0-929c-1b0b07e4a1be", "value": "44c7aaaf39377cfa7a550093f0224f68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73efa4e4-d198-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624173827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173827, "uuid": "677ff09c-5b9b-4a42-8cfc-3f4146398bfb", "comment": "Malware payload (NanoCore)", "value": "61d8ca5f3ec331a08c9032840b99eb5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173827, "uuid": "9c31cd0a-3b15-4b5e-9c50-134d266a72bf", "comment": "Malware payload (NanoCore)", "value": "a342e3327fc258c1634ffd9e27f0635bd2dc8aeada903d2cac0c5e1ab2e00811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173827, "uuid": "9a929f22-ade2-4ce1-b09a-09cde4615fba", "comment": "Malware payload (NanoCore)", "value": "dc73d785c3e899a58a5616239e89d3fd3d49bb93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173827, "uuid": "fdcad5cb-b41e-4161-bcd5-776563cff425", "comment": "Malware payload (NanoCore)", "value": "4a2e1458b12727b1ae1e353122712634de8012b50157170e08106ffad50125ce5538baad0ef0975f2c7f9d18f57c7f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173827, "uuid": "592fe252-a413-42c7-acab-7f5a54981f88", "value": "6986334E26CA75F4C0CBC47AD404479E04E02987B65790816DD02BEB52EA7FA9ED386F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173827, "uuid": "aababa76-b451-4b40-8aae-f0e8fc850340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173827, "uuid": "7842f97a-ffed-4fec-9cea-5eb525f005eb", "value": "196608:ZqD6pzTpQLf6OYIwLZxdTM2GAGcFb8NPwp6jyqoqf0Pb1pur:KMvzLdTL9b8Ndjy5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624173827, "uuid": "c9f3e944-f67d-43ff-a5e9-55ca9a7e7a22", "value": 8257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624173827, "uuid": "420957ba-5ef0-40d6-8ce1-2080854ac700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173827, "uuid": "8fc724d6-c071-426c-a615-de42dbd1a374", "value": "ConsoleSniffer v4.1 installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1631a3e5-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1624176676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176676, "uuid": "c7b2eb71-f911-4fdd-b1c2-8d4cd8cf3774", "comment": "Malware payload (DanaBot)", "value": "f6e2f1287fab29ad084e0115b084c25a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176676, "uuid": "890ec9e6-7ad8-446a-bfdf-f139c0cd74d5", "comment": "Malware payload (DanaBot)", "value": "a35a4b8c7fe3d0282fddf831fdec65a894ae0f9f0266f6824689d9770ddf5458", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176676, "uuid": "a040ee13-28ee-48ad-8ffe-1f38f0f69a94", "comment": "Malware payload (DanaBot)", "value": "0c41bf32af82ef7747beaacd60a992fbecc280e6", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176676, "uuid": "e8fb7208-b555-462c-a06e-7ad19918f0b1", "comment": "Malware payload (DanaBot)", "value": "9242cebe7cfcf77ca65f62f7cbd789cd705f57d872a4951e4117a71d1893aef042c0249ae1a178a12f859d2e2e824465", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176676, "uuid": "73e30cf4-bd84-488d-9e8c-349327741045", "value": "F6351200B6A0D031F5B7A2FC55A697ACAB2D3AB0972454CB62D126EE57747F0EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176676, "uuid": "8943753d-9957-4759-89b6-cca3d7e52dbb", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176676, "uuid": "aaf9b1a5-c812-4343-bed9-2960c7c9bb62", "value": "24576:gBrc+OQvbx+QsuSZFMeWz0ugNsOqdsordUDTTdyY4cOzh31+AYgf:1+Xx+IaFMe9ugtoehX4cC3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176676, "uuid": "82be09d6-ae9d-4865-bbb6-479a70f4d13e", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176676, "uuid": "53cefce5-43ac-4a76-b64d-8b3ab5eb4d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176676, "uuid": "d14d1c85-5013-4c8b-b44d-5eb226e583d2", "value": "f6e2f1287fab29ad084e0115b084c25a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c283fe07-d1d1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624198440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198440, "uuid": "6de90b59-8c9c-4bbb-be7f-91a75a4ed0d9", "comment": "Malware payload", "value": "45c1a82445a6ece7f4633ba2ccaaa906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198440, "uuid": "61b2265b-b868-4125-ae21-78497d4913e1", "comment": "Malware payload", "value": "a404718bcedb5af3ba359ec90d90dfda908f82f4335ff628abf08bc25cdae1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198440, "uuid": "48b753b4-7c96-4582-9370-c02de3f2ca54", "comment": "Malware payload", "value": "6a4a7b80a31f8393ce865b972c2a46a01dd9edd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624198440, "uuid": "d31ab509-6f06-41f1-a237-7595a3066bae", "comment": "Malware payload", "value": "754c507f3e02166220f838ec646339578818532a0a7a676ad25af47fd2fa9f28c5984fd53e4b581c92fe2b93389aa27f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198440, "uuid": "7efd52d1-e141-48f7-a697-ae804f25887c", "value": "FA34123775E2A6E7F46A0B741E7B9629E276E708402276470B70DF3E59A0DC2D7062C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198440, "uuid": "81240050-f513-4cb0-af98-99d886f85cf4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198440, "uuid": "25b533a4-4df2-46d3-a2ec-848ea85c2c15", "value": "6144:wBlL/AMC78OcCqrAlRfwectpNNYMhvWxglUFxoqkUqdPDaX:CuyCqrURfmNNYYWeleoPDt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624198440, "uuid": "ffc48865-3b3f-4065-872f-aea037adc69f", "value": 253107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624198440, "uuid": "1362b736-a0ca-4b7f-a428-21aeb7da9c91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624198440, "uuid": "5210dac1-19e4-4fc5-9af1-0edee399e944", "value": "Scan-Copy001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b416d665-d15e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624149024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149024, "uuid": "94608416-26f2-4877-aa25-45e90b0d6e7a", "comment": "Malware payload (RedLineStealer)", "value": "c4998cd3dfbd8570f9932a615cc52223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149024, "uuid": "cf194126-fd24-40c6-ab44-5fa0bafab90c", "comment": "Malware payload (RedLineStealer)", "value": "a444615df94534254fb1276063ebbd5de4dc40597feff4dfdb512273211edad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149024, "uuid": "c2aa90ff-a1e6-42b5-8404-9348184ade14", "comment": "Malware payload (RedLineStealer)", "value": "c680e4d0b5495348f3939e948158bf129dbc8ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149024, "uuid": "7d34f643-99a4-42ab-8036-c553f1caf082", "comment": "Malware payload (RedLineStealer)", "value": "2736dd8d65c9414dbac2a2084010a292887065e04f3e2f9decf0be184f72bd525958095847ef0f61d74b643608fc9446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149024, "uuid": "046e7686-f495-4a70-adf2-1f5364591209", "value": "4684BF10FB90C035F5F612F84A7AA3B9A52D7AB1976490CF52E51AEE17346E0EC32707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149024, "uuid": "51b5b2eb-ea9f-4bfd-9b1d-a16894d94828", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149024, "uuid": "2619681a-2f54-4186-a8f7-d8f6acec85be", "value": "6144:twnLQLBQclnymbKrFhVI9ZgrzcrwjeCuCZdAdKqpG9I/:2QLBQc1ymivVI9ZgnOwDA0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624149024, "uuid": "ec92e57f-69dd-41a0-bbed-09f6b22bda80", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624149024, "uuid": "5bb81056-4fef-4206-be28-b29bc7ab3f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149024, "uuid": "643a0816-81e2-4023-93e3-d2d6d1dca0e0", "value": "c4998cd3dfbd8570f9932a615cc52223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5f0ff6-d217-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624228278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228278, "uuid": "90a3785e-c95b-4eae-be3f-fb6aad8a39a1", "comment": "Malware payload (DCRat)", "value": "787f845b904fd7fc0f36f5ccab9691c0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228278, "uuid": "90d58e8b-5e46-4a06-841e-f8e3e5104881", "comment": "Malware payload (DCRat)", "value": "a7629346a7228cd9b9d1db57a2d25c12c87506db851f43dd99fcb5e8f0e520ec", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228278, "uuid": "1e886422-007c-4cd6-bf76-14d0134dd2ae", "comment": "Malware payload (DCRat)", "value": "d25cd2bf2986862d7c4d5923a144b5c6d11690ac", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624228278, "uuid": "fecb2ad8-1f88-4e50-b7cc-3963dceb3373", "comment": "Malware payload (DCRat)", "value": "f467c563597f11829f15f5f4c90428f1b2f20259ed177c8d46c7a5b55026ded403a441b6afd46f9996fcd6750ca0d97f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228278, "uuid": "4c082dfd-fa40-4ef4-b4fc-98edf84b677d", "value": "9B7559027A46DE12C069263BC9EF846807BCBD413B66DB1A7EAB375D64113E31D0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228278, "uuid": "fd79f2e6-3c45-43fa-9467-648a20664858", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228278, "uuid": "82178777-135f-4ee7-afbe-b9300b59346d", "value": "24576:U2G/nvxW3Ww0tpwcL3W+fU/huXXEnr9rMDgol64sdU2Pa8hEPRPu56uXkvGb/q+4:UbA30pVXEDolcimXk+54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624228278, "uuid": "0e06c04f-c029-4c80-aa4a-0c59e922b49e", "value": 1597153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624228278, "uuid": "6874f3a4-610d-4a8b-b6ee-4c9ce636dad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624228278, "uuid": "46aace09-a9e4-402f-9fa2-e0a300c4ffe1", "value": "787F845B904FD7FC0F36F5CCAB9691C0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb5c00f-d1ae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624183242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183242, "uuid": "07dfbbb4-2903-4f68-8f07-aab1e3f256b6", "comment": "Malware payload", "value": "cdd29a9f88ac302858658bfcf29b14a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183242, "uuid": "c0ae9eee-d5ba-42fb-9fad-39dff58bff82", "comment": "Malware payload", "value": "a8462511b26ae21f7dda93bff42922da216999802637ab2b945b73b152f0b749", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183242, "uuid": "b277ee83-2a0d-4f20-baf6-94f46098b1e1", "comment": "Malware payload", "value": "34ef54f9f535560d01b16b6b1f638e5a8efc791a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183242, "uuid": "99ca8920-37ab-4ed3-896d-0c89606b4e22", "comment": "Malware payload", "value": "e967d396e149fdeb8a83c99e06760660d88af19b4047cb0038fee2cbd0d68a7671821e501e577fc7a6414653c576bdc1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624183242, "uuid": "8190a969-13c0-4816-931e-ff3bf8c6a25d", "value": "DB6402CBEB62ACAFEC464BB015570B1A77F8D5D9D3C6A640B36885443CBE341A7502C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624183242, "uuid": "ec73879f-667b-4467-8ddb-744c14ee0094", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co25POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZncXPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624183242, "uuid": "2066458a-e867-4079-8577-21bd979af943", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624183242, "uuid": "9c00a9f0-90e5-4313-9b66-82c71e27a5b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624183242, "uuid": "528ac9db-6103-4202-a505-5635ce559857", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb53fdb-d19b-11eb-875b-42010a9c0053", "comment": "Malware payload (OrcusRAT)", "timestamp": 1624175135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175135, "uuid": "f5234b8b-2f2e-447e-9946-47f5fc3e69d6", "comment": "Malware payload (OrcusRAT)", "value": "b0cf795d97001e8a553ba87a5329e64b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175135, "uuid": "34ec8572-9f3c-486d-94b6-e64b98e4a9ce", "comment": "Malware payload (OrcusRAT)", "value": "a9fa22afed5974be369a0de5a4423a8aec9e81d427682c16692e3fc2a2aa11bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175135, "uuid": "325f0e34-2e35-40bd-97cc-3b1b8f859600", "comment": "Malware payload (OrcusRAT)", "value": "661850fb0a944f00f4907d4ebfa755843786c565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624175135, "uuid": "274993d9-759b-4e2d-a17f-505c9f90c15a", "comment": "Malware payload (OrcusRAT)", "value": "6cee4ea1f885746915daa361c9a8ac318cdd0afed9090f581427bb877ff828b28789b3374c752ea550db415f24bb2723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175135, "uuid": "e0d8b465-1438-4d73-9ad5-6d8c3d1188e2", "value": "1605E1007FEC9E0AC2EE7679B4B31CC54774EC47A596EB8E589464EE28AF311D034297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175135, "uuid": "6cb80616-cae2-484f-aecf-e75cc0435843", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175135, "uuid": "5fa4bbc3-4660-4cfc-b913-70b543f32e7d", "value": "24576:ApS04YNEMuExDiU6E5R9s8xY/2l/dot1Ibt+r0:AL4auS+UjfU2TorIbt+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624175135, "uuid": "2f8939eb-ed25-4a5b-b7ab-5c84af893937", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624175135, "uuid": "b6fa65bd-e05b-49fd-84f1-012110807abb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624175135, "uuid": "51bb1467-dafa-43c1-83e2-9e36e9dd4938", "value": "b0cf795d97001e8a553ba87a5329e64b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301b6376-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1624176720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176720, "uuid": "dc896d0d-20d2-45de-a199-07a05dc545fd", "comment": "Malware payload (DanaBot)", "value": "dfde72c9dcc318caad3e880ec186f010", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176720, "uuid": "3c880f11-bbc6-4b7a-bd1a-f22eb585c3d2", "comment": "Malware payload (DanaBot)", "value": "aa6206082575919b3b0ea11c5430082a8b6b2251ca4d4aeedfe663ca250fdafb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176720, "uuid": "ea1cb94f-e306-446c-b854-120f493104a7", "comment": "Malware payload (DanaBot)", "value": "642beb25cbc0ef367f87884e5bf8d77860279dcd", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176720, "uuid": "716ec40e-69f4-47f2-bf97-f02528ecd6be", "comment": "Malware payload (DanaBot)", "value": "6b1ce562ced7e8ba34e42ff1c7387051585f74456f622d014ee5d5d60bc95f4d3ead9428cff507c0d24c6222e37547b0", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176720, "uuid": "034541ff-dd95-4ea5-b8e7-875bc4f3078d", "value": "CC351210B6E1C031E5F762F85672936DB62D3EB1972414CB63D52AEA97287F0AC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176720, "uuid": "07d9b578-1a62-494d-ab9d-e541f915cd85", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176720, "uuid": "3df28da8-1cfb-4515-b6e9-d3ff1a90ac8f", "value": "24576:5Brc+UQvc8QIFYtTpIzlLjSdKYz2YFmB7ADfOiIHku9:E+v38TpsRjS7zdW7ADfJIHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176720, "uuid": "cbc0f243-8b2d-49ea-8c82-3a5c6d0d477d", "value": 1154048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176720, "uuid": "e14d6237-c510-43a2-972d-1c656da80beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176720, "uuid": "b94df13f-18df-4c5f-982e-23f333881504", "value": "dfde72c9dcc318caad3e880ec186f010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9ee686-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225301, "uuid": "98b65786-b179-43ca-952e-0d3594bf46f3", "comment": "Malware payload", "value": "60c61f94712e8aa7cd5a888f18e2c88f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225301, "uuid": "002a1fe4-487c-43cb-91fb-a200335e9ed6", "comment": "Malware payload", "value": "afa039970dda1afcdacd878f5fd125dd6ed37b80e8d7cbe37ec91871f4ab8eb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225301, "uuid": "3cadd443-9ef2-4ffe-b500-2d374f321130", "comment": "Malware payload", "value": "51c3ed0a988eb07298abc17a6c983acc4dbee87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225301, "uuid": "3370aebe-911b-4f91-941d-04e8a1cb83e8", "comment": "Malware payload", "value": "ab1284b6d0fbf7c2e1abab1baf8f320acee1e83a05995165b8e5b438be6b0c31c7b859968b929bc48bbd1025ba7fde2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225301, "uuid": "e9fd63ca-ee46-4b7e-830b-aca32189195e", "value": "85A428A18A458563E60556B488BBDFB13B101CA9D70248839B90FECF78736FCFF26546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225301, "uuid": "309385b2-4ade-4f62-b5b3-8da67e77b292", "value": "747eda1509b7cba75f10e99c1205fa63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225301, "uuid": "81420b9e-149f-4240-b092-f1488959a374", "value": "3072:9Hz2CPkH+FsiqvgaUN08S2802hNaG/yav:9T2CPkpT7E2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225301, "uuid": "5a44fade-0ca3-47e5-8f82-66e8f60cdaf9", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225301, "uuid": "5b2c5c39-8cdc-4fa2-8083-0d25f9fb6986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225301, "uuid": "61ed53d5-cc77-492a-9ccb-47b328e6d24a", "value": "\u5c0f\u4f19\u201c\u50bb\u5230\u201d\u88ab\u9a9737\u4e07\u672a\u5bdf\u89c9\uff0c\u9a97\u5b50\u90fd\u4e0d\u597d\u610f\u601d\u4e86.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31604e4f-d219-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624229120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229120, "uuid": "ce57424f-baee-4232-9bb0-811f67c10978", "comment": "Malware payload (RaccoonStealer)", "value": "84352a722935cb115706cce06d952adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229120, "uuid": "26c748db-f91f-4d48-9e30-446cf3c36b00", "comment": "Malware payload (RaccoonStealer)", "value": "b066989014bb1fa69020b9615b5d8074818ac1315eb541ff9e6a2711f0d5d7cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229120, "uuid": "3f7553b7-24b4-4006-8b66-af7cdcfb0d7a", "comment": "Malware payload (RaccoonStealer)", "value": "68a49229dad70a1bc06db45747e4760c67440feb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624229120, "uuid": "9e36225c-30dd-4111-bd57-ce0cc75d0e16", "comment": "Malware payload (RaccoonStealer)", "value": "2be135608eb0461e375a48b6632e993d31fbeeb0b41c0efe3f37b5da5a0a5c8e6dcabb1db420e31b2754030ff766e47f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229120, "uuid": "145d7d15-b5f8-46c1-b2cf-0a41aeb4bd51", "value": "BEB4015B33841EDBDAED947A90E693B00BB4AD725781D34F3194125F0EA379E2407B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229120, "uuid": "106f75df-503f-47e6-bc5f-dc8745295fcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229120, "uuid": "f1d0f0a4-81cc-4299-8d06-2892c7304487", "value": "12288:o7oW1LZVFsAJuud+3xEKV81zd6yCPwh/Oc8:U1mAJJYZV81d5CPwhGc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624229120, "uuid": "130d1124-b4da-4247-8b7b-f32775f54e54", "value": 541408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624229120, "uuid": "b3823547-1800-44aa-aeb9-319651b6ce91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624229120, "uuid": "a1d070b0-85f8-489c-9ca9-8a0a0b34edd3", "value": "84352A722935CB115706CCE06D952ADF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31d869f-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180483, "uuid": "12ab3707-f684-4d96-982a-05c5281ef0eb", "comment": "Malware payload (Mirai)", "value": "24547a617a3a4b240518c87310e896a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180483, "uuid": "341ce4e3-609b-4311-90a1-e3b5978b29fc", "comment": "Malware payload (Mirai)", "value": "b0758fffb839f5b2da762d8f014efab7b907fc5aff6e433d8f4bfd3b166030b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180483, "uuid": "bdd24e13-4666-48b3-9282-5741f74b94ad", "comment": "Malware payload (Mirai)", "value": "e73b802191453a3405c0352c051c070263c2e9f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180483, "uuid": "b277183d-916b-48c2-9eed-56c00c13590b", "comment": "Malware payload (Mirai)", "value": "773eb2e5e28a4dc19ad56ac22b22e0d18a76a5b865271781ecb1b54a80741bf687ab2e549ad4fa3feb2a52ea3b67c61c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180483, "uuid": "de80dfaa-ff81-48d1-94d1-75b1495fdf9f", "value": "75A37C238DB61E96EB0925F0B0E0E936E31BE80071FE1D77D95486A87503DCEB4993E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180483, "uuid": "7222694b-0e28-4414-9b37-5fd4fb6c4abd", "value": "1536:Rr9fMCK2OQO4zyrsS3J1nCNzyTd4mBAGOdnkSoCnpeYlK9/GjJPREWbzTmP:Z9RfOrsS55iyTd4YGkSor98K8zTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180483, "uuid": "0158c283-95fb-4dc9-8146-a8d911b9067e", "value": 103212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180483, "uuid": "47360c3c-0447-4f2f-9f50-07428fa034d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180483, "uuid": "769952fe-2d4d-4eaf-9bd0-9517ba2bc314", "value": "24547a617a3a4b240518c87310e896a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10c919e-d190-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624170467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170467, "uuid": "ac793d00-0902-47e4-a975-9e483d256b45", "comment": "Malware payload (ArkeiStealer)", "value": "93a9015edc62b53c12a3e3c9ca7e17f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170467, "uuid": "85a592ba-1715-4d37-8274-473616a2c065", "comment": "Malware payload (ArkeiStealer)", "value": "b0bf944eb3f2f6706a87e98b89a862ac20501beda28e8805116190f51bb56133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170467, "uuid": "05b2d8db-2d7c-44a0-a2b1-b018924b8c03", "comment": "Malware payload (ArkeiStealer)", "value": "5102f1f1a500a4089ccf6188a76fe664ec810870", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170467, "uuid": "8e3d6091-397a-44c8-9717-655ee862a4ee", "comment": "Malware payload (ArkeiStealer)", "value": "d6cf235c9d8070b05924a9997c5840135d88de8a6740d6dbad841273c1ec8087059a82b4eefa5abca3584d6d9728876f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170467, "uuid": "05652483-10dd-4765-9b2a-31dfcf4ffe75", "value": "0FD4E110B791C035F9B312F866B9937D692D7A706B6891CF62E55AEE47386E0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170467, "uuid": "9713a498-7a8f-41d1-8e62-b98c0742db68", "value": "ffdf4960b3ba42007c02996e1e5ea748", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170467, "uuid": "e488637d-ce5e-410d-bfb3-5b344f381311", "value": "12288:B8PvBj4YmXesgFfaORIKEol9I0614rzUoxYbAahDDLm3AQK+HGO0ixs+7yo8:w4YmXcCx1k1xWX3L8/hcixt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624170467, "uuid": "68936d8a-17d2-4c4e-8dd8-d0ac1f7d02e4", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624170467, "uuid": "80d6e0f5-6d2b-4667-b2c1-3244acc4cf8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170467, "uuid": "5c600ef2-d267-49a2-8402-1513ddb12503", "value": "93a9015edc62b53c12a3e3c9ca7e17f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c450604a-d17c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624161936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161936, "uuid": "132a7693-af54-4d77-8079-ab1c5bd0d3d7", "comment": "Malware payload (RedLineStealer)", "value": "44dfbe2753a445bcace9ee6b8b8d4d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161936, "uuid": "e68c5183-33f8-4f6e-a1f9-9b7b6afc273f", "comment": "Malware payload (RedLineStealer)", "value": "b179dc4d0cc27c7eccec5251bc10e6845fdbe835ab434d3d38fc9b12fc16a144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161936, "uuid": "e06e66b6-4231-46d9-8027-56a441a42008", "comment": "Malware payload (RedLineStealer)", "value": "43cc7463a8fc97ece71bdc8abf6bba54755fa00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624161936, "uuid": "2f4ac791-da3a-4221-a603-e6538c790f96", "comment": "Malware payload (RedLineStealer)", "value": "0a86ce0503c512ca7e381f85a12fcc2e2eec3a7c9a3b31200d4d1a3f3f90292aa38d5c1f1b9309b703d18db872879111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161936, "uuid": "71dff6de-c3c5-423b-9846-efc8039e673d", "value": "9794BF00F690C035F6F662F8467AD3B8A52C3EB05B2191CF52D52AEE56387E4AD32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161936, "uuid": "6c8ef8e9-ea68-401e-932f-f6685f7d6ede", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161936, "uuid": "4f262564-34fe-4f4d-8648-0f7f171a22ce", "value": "12288:NiV/MMsc99KYbSdWTIZjXLSmhBxOIUiHvNU4PuJl0J:6MMsc+YuUTIUmhBZUi1zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624161936, "uuid": "d1749b05-fcdb-4d80-b365-0dea0cd94c46", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624161936, "uuid": "bf1efc05-ccdf-45c1-9777-aefcd3668852", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624161936, "uuid": "9b92a140-6fcb-465b-8879-759cc9d16bf0", "value": "44dfbe2753a445bcace9ee6b8b8d4d5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886cda95-d172-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157541, "uuid": "903664d6-0ad9-4039-89c7-eb3dbd8a0006", "comment": "Malware payload (Mirai)", "value": "67fbf9658708b525f70b205fb12b7f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157541, "uuid": "18c431a5-b800-4d83-9a8b-240dec077249", "comment": "Malware payload (Mirai)", "value": "b1990bf02fe68cc9bd80660c712a0cae1daa0234df678b160343bd9e4d247f82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157541, "uuid": "8061c289-0c27-4d8e-b3ab-22ca6e621bc2", "comment": "Malware payload (Mirai)", "value": "65b789cffca3fbcc70733357e609102876ba0fa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157541, "uuid": "df3c35c7-acc2-419a-b3e6-ad8e3457bae9", "comment": "Malware payload (Mirai)", "value": "d1c33a930ef4fb83e5dd5e7eeb44d837d2a76bec6bbb7653023042d4fe021684dc1930c6adf679bf41bddd30df2bff63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157541, "uuid": "a75763bb-8f43-4dec-b556-90583b80c494", "value": "399308B81996B77CE9F21079F44310D628620A1C3B9CD1E379C3947AFFB4B087169E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157541, "uuid": "f2fb12dd-406d-4698-a401-5ef9cf921ffb", "value": "1536:ZiKPOJZ1KXi6CXMgbgfDOl1sl0a1/WworOCqW7Gwq:4KGJZ1WP9RDOl1sz1/WZbn7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157541, "uuid": "646db53c-07b8-4d4f-a225-52192380ac5d", "value": 91588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157541, "uuid": "cb160cb3-19eb-4553-85a7-9330f3b3d627", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157541, "uuid": "17001a2e-8deb-45b3-90d4-f0284adb6a68", "value": "67fbf9658708b525f70b205fb12b7f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e755f5b-d15b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624147538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147538, "uuid": "62118001-8fb7-40a7-893f-be739e30aeb3", "comment": "Malware payload (RedLineStealer)", "value": "75d96de7bbdc8919b3d71d2b6e897f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147538, "uuid": "acdc5ae9-20af-4c9c-a236-54a09f573d37", "comment": "Malware payload (RedLineStealer)", "value": "b31e9c182ff32b66da3cfdcabfcce77a6999db9469dee4481d48fee9fe27110e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147538, "uuid": "bec333ee-52d1-4d62-b411-3c59b984cf3f", "comment": "Malware payload (RedLineStealer)", "value": "e87fa02a385d1e5211ed035c1e038377e84fbcc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147538, "uuid": "8038dc4d-be8f-429f-a48f-e7edffb2249a", "comment": "Malware payload (RedLineStealer)", "value": "1e476a9e12742c9e4761cba4f13d9f87dffcd220ff0b77c2249c0a34c35f95929104b584ae15de8ca977e974c9914a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147538, "uuid": "bead5304-e325-4935-ad65-d56c2b6dbe3c", "value": "3D84BF10FB90C034F5F212F85A7A97B9A52D7AB1976490CF62D12AED17346E1EC32B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147538, "uuid": "202f1ee9-07f2-4138-a5e6-86d5d3c66800", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147538, "uuid": "c5941a6d-940a-4b22-af7b-08a3f566ee4a", "value": "6144:KwX7ALIdcl2yGsKgFR6AcTaAXM4yV4F9ZXp9rMBWNeMHSv75NlR5:FALIdcYyGw/6Aw/GuZXp9gBWQMyzDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624147538, "uuid": "64cdbc0b-6831-4ade-ad36-97b683e16862", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624147538, "uuid": "4a90bbb6-7baf-4369-bdb7-6b352c0f98e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147538, "uuid": "55d8a12c-95e6-4b19-88ab-3df91b863fba", "value": "Tipped2021-06-1918-26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac704a15-d15c-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624148152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148152, "uuid": "324080b4-ebf8-4f14-b6dc-cbb13c3b8c30", "comment": "Malware payload (BitRAT)", "value": "d06afa58f651202f6cb4bf95116c6764", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148152, "uuid": "d51fbb24-908d-4305-a18f-c16ed59a9850", "comment": "Malware payload (BitRAT)", "value": "b3d6d97ed4c74d16ab89046ee019d874b8cc1a8ca257e132b3d2cbd146a48545", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148152, "uuid": "0a4ca878-c5f9-40b3-bdee-6e1175438acd", "comment": "Malware payload (BitRAT)", "value": "dac894b8b7633884a8845d4ba47a1251a5d321d2", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148152, "uuid": "825f9f58-69cc-41c0-b118-04daff574387", "comment": "Malware payload (BitRAT)", "value": "ef502eefd56f962cbf6bd2afbe769f0575d347b0e24947e2807e631596b3987d8a75b38987cbb26ddd45bc1487bfcff6", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148152, "uuid": "9dd3892d-fb3d-49f0-a967-f88e2db6e915", "value": "70D45B9ED640D472E43719BCC8471AD6992F7E923968CC4E26F438863E753D83A2D0DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148152, "uuid": "35a2c2cd-7c8a-4596-b4ad-f289302888bb", "value": "12e0303b936150224b271f0921466f9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148152, "uuid": "c4f19835-c912-4ac2-8013-0bbcf43f1490", "value": "12288:EbaXTbvGMghaqcGvwn6PcqX0uNb+T0HXX+jBnnXLVgKR39LnG:EmXWwIdcq/XQB97G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148152, "uuid": "9b7cdb17-1e57-4dd4-bde6-23efb28d2e02", "value": 629088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148152, "uuid": "5289c665-e12e-4527-bba1-5bd90f7967d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148152, "uuid": "ef5ac2bf-9f4d-48f5-946a-43b801bd34bb", "value": "VdhjvtojyanvmhhausevskadryroaerseqSigned.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ad7dc8-d21e-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624231520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624231520, "uuid": "ed48cfe5-1986-4854-9d11-ddca0f443367", "comment": "Malware payload (RaccoonStealer)", "value": "9042f3b864a63f18f0017c9ed1bdba24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624231520, "uuid": "f2ad0fe0-6f10-4deb-bfce-b10a7fea200b", "comment": "Malware payload (RaccoonStealer)", "value": "b4ae66ae60bce1d66bf3359720c2be58cb944b9c47cba4a06defb6f3ebc58347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624231520, "uuid": "34f5b238-4683-4acf-9e1b-41af49e702ff", "comment": "Malware payload (RaccoonStealer)", "value": "c684bfaf5e5c8f3837953cfcb91493c106aae8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624231520, "uuid": "39f97430-80aa-4175-8e73-434c73b2814f", "comment": "Malware payload (RaccoonStealer)", "value": "b255461c4ca76726ed990bd7ff2e310285d068cd593fe9d810bddc49ac0253aaddef08955c7c9cdf6c48b167b41e0860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624231520, "uuid": "c4e010d0-30a1-41d5-8eb6-e736155f81c4", "value": "A6D4E000A7A0C035F0F636F455BAA379A92A79B06B7850CFA2D51BEE52246F0FD31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624231520, "uuid": "fbd8db67-93d6-49e7-8523-ff05937f005d", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624231520, "uuid": "e78afe95-e8cd-4f92-9e0c-a0863ab75acf", "value": "12288:/giomlSxUMikuRGPidfS2+oYRV0sBdZaqwFvKT4LcxN:YmSYGKa27ahprwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624231520, "uuid": "04855860-87b1-4fe9-acd5-69bba9ec0652", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624231520, "uuid": "014a3509-7740-4292-ada5-6906bd2faa71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624231520, "uuid": "72c7b058-a12e-48a0-a09a-5cf7f28ab9da", "value": "9042F3B864A63F18F0017C9ED1BDBA24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b876b369-d1e0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624204866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204866, "uuid": "57e0602c-5568-4cfc-a41e-77d23a656ccb", "comment": "Malware payload (RedLineStealer)", "value": "d01c7fa9abcdf73cc713d98605e3e6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204866, "uuid": "dad77ae5-7dfb-4713-82b5-df2624fb9ebe", "comment": "Malware payload (RedLineStealer)", "value": "b51650964996055c6a49021c2fd329dadc0aff26cff182c6946164ac4960fda3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204866, "uuid": "1c1b9f08-529b-4b4d-9408-6a6c9d32b9d3", "comment": "Malware payload (RedLineStealer)", "value": "9cf44e493e1c5ddc991ecd662435cf581a61503f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204866, "uuid": "5fde9c21-c6ae-47ab-997b-b5fc2f385e52", "comment": "Malware payload (RedLineStealer)", "value": "417520152f7b6b1e08fd5c8c88f34577fc571effacb00f5026123df033765e86b69a0e09b21fa4deb6f6fe6e70c5e19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204866, "uuid": "77909d4b-f2b7-4aa6-9ca8-5b748d0262d6", "value": "8494BF10FB90C035F5F762F85A79D3B9A52D3AA0672450CB52D52AEE5A387E0EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204866, "uuid": "71c7be5b-1ce5-4da5-9871-d514d4f2e67c", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204866, "uuid": "897611cd-37c1-4b89-9244-53007a1b5a99", "value": "12288:mSzScX4RwSWvaJS4VnjQERw+llFgBIpn2nl4J:WcX4RAfwnE3+lA6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624204866, "uuid": "6a78530b-049a-47c5-9eb7-faf5587b1f9b", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624204866, "uuid": "6d889432-58b2-4c26-a957-6179f67c09c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204866, "uuid": "d16d1fee-c024-4704-8d6f-ffecedd7e002", "value": "d01c7fa9abcdf73cc713d98605e3e6cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbedc650-d1fb-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624216522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216522, "uuid": "b70faa06-e904-44c4-9abf-f6a3770e45ea", "comment": "Malware payload (RaccoonStealer)", "value": "424299361f5f5ad7e853861a1dcc2d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216522, "uuid": "79517701-1764-48fb-a6bc-3d6b1e45fb10", "comment": "Malware payload (RaccoonStealer)", "value": "b59195060021de6f6aeb4daf33d5f63b8a4fe254c474aa86a12aaffbaa747cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216522, "uuid": "d6a39ce3-f61c-4300-a29c-e4fc84ba6049", "comment": "Malware payload (RaccoonStealer)", "value": "9457b1ecc5aec184a42343aa66f1bd0364e45b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624216522, "uuid": "3de809e6-64dc-4bd5-ad98-097109b86019", "comment": "Malware payload (RaccoonStealer)", "value": "6ea8e995d5b87bed35ef7f3604b5147b0cbc39eb345ef9245b26d3501dd8d9ceb553e56cdf8d9ef98a10ef3de8911a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216522, "uuid": "cd28ab88-983f-4b3f-9c1b-7cb988f8738a", "value": "B2C4D000BA90C039F5F632F859BA9369B9297AB0572454CF62E516EE87346F0FD31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216522, "uuid": "d5a6fc88-cdeb-43f8-b0d5-ad0a4cfb4af6", "value": "2eafeef859f65494b1ac6742c31dc4b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216522, "uuid": "f4bd200a-23bc-4840-9b30-35d6f6a10440", "value": "12288:aGhtv42jggrNlQ9nMN7vEOLb3EOdW/RBa/jEekAo+e77Akk:bvrjJlQ9nMNzEYb9S7j4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624216522, "uuid": "c27a4c30-ce6e-4104-936a-5cc33fbabfb1", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624216522, "uuid": "5a06ebf4-2c15-4da6-9ad8-0aca55781d94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624216522, "uuid": "4a87dfc6-170c-4372-961a-fd28175fbb55", "value": "424299361F5F5AD7E853861A1DCC2D6C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9187ecc5-d172-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157556, "uuid": "819a873b-ec6e-4467-ada7-d2f8f60a9763", "comment": "Malware payload (Mirai)", "value": "06fea3d23a80ad99d5b126350a0f20ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157556, "uuid": "867c673f-0e86-43e7-85dc-2b4532f4b6fa", "comment": "Malware payload (Mirai)", "value": "b82bd9fd60618a35fbdcf8796e6407af6a54fcadce055cc9c1621581ab127796", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157556, "uuid": "ccbb6555-ddd7-43a6-9835-8dcad450154c", "comment": "Malware payload (Mirai)", "value": "c1cdd7805721c8c22d7d064d1b37e18fe9cc7dcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157556, "uuid": "64e23fb2-2666-47a3-b426-42b8acf4496f", "comment": "Malware payload (Mirai)", "value": "fc59d1f414ac7f5f351fcac849eb0fcee04dc586a5607f83a718b0dd4ed9c13be12c094ffb8dd0bfc30e24dbc77006e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157556, "uuid": "d062efc0-ac68-4ac8-bee7-f0d9341f3ccc", "value": "11E2D0421AD59AC5C425003AED6FDD0978D4331FF5A8A97B7FD850BB8A9AF3B1234087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157556, "uuid": "9919c742-fa12-4d73-86c6-15cdf25c0867", "value": "768:6K4G3VqOUP7EEO3D7kfZL0in2LcUSMqiYTor7CJPnbcuyD7Uiyq0:wCqDjq3khL0in2LfSWYTor0Pnouy8Zq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157556, "uuid": "e636a7b6-a004-411d-9bed-cec63e1ba1e5", "value": 33680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157556, "uuid": "e18fd278-f7de-4763-ae27-0e15f5bec235", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157556, "uuid": "23a9ce22-3539-45aa-b7e4-cd75e62c7486", "value": "06fea3d23a80ad99d5b126350a0f20ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65527c57-d1d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624197854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197854, "uuid": "1181dc80-6f94-4988-8a68-66d6612bd8a5", "comment": "Malware payload", "value": "e01f4ef489111632bad36cf50a31de59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197854, "uuid": "70bc9f31-2dbc-4bb1-ad78-c00b4139b33f", "comment": "Malware payload", "value": "b8902f524b2bbefb37fe0215cc36f8e022e29059cdb0a68a592326fb522066a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197854, "uuid": "e9c4c989-f951-4188-bdbf-14b8876941ed", "comment": "Malware payload", "value": "958d0b6d6b171e85c1ca96728aeb5c186feff22c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197854, "uuid": "8756de13-ac7b-4808-b57b-cb582401a291", "comment": "Malware payload", "value": "b06af1845bc28c9c35b7d4552bdf5dbcd8db7491c63bfcb86023659e752d354a1d92bb4759db34e5eb98d88c15ac5009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197854, "uuid": "73648fc4-37ad-462a-a402-6a815e02a02f", "value": "12C4C04B2895C41EE0F4BFB06CF5A1431A36FCAA2225D18F98D7BE5D5FB23804AC1579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197854, "uuid": "d1b53c4b-b709-43a5-9317-6cad0f7aa02f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197854, "uuid": "93a03137-ffd2-4b23-86ab-980833825b2c", "value": "12288:0iVp6K6rHMrUxHpZqUYYSEap70pRaGTMVBAV4mf:Zn6KKH+iHp8UhapCUGAVBAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624197854, "uuid": "bffb065c-10f3-43dd-b88d-8b4759909cbf", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624197854, "uuid": "b1ea9dab-23eb-4cbd-8e08-d7816260ba83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197854, "uuid": "4f57be3b-3329-4cfc-992e-a49a1e587516", "value": "quote#2793 almaco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59f6959-d1cf-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624197560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197560, "uuid": "1f88f6c7-ce40-435b-b272-10e33645bcce", "comment": "Malware payload (NanoCore)", "value": "142e1f1618c33e5a63cdeeca99f7e1e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197560, "uuid": "5e4df316-254b-4139-bab5-b5476604e50e", "comment": "Malware payload (NanoCore)", "value": "b8abcc5499d5612a6e42f5c0b1c72e288ea6cbb3a8ddeb1d122f0275a82e4b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197560, "uuid": "27049793-dc83-4109-ad1c-81d05d645955", "comment": "Malware payload (NanoCore)", "value": "4527df56299f3750ab240b242ac3f187d74ed4cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197560, "uuid": "581b9a75-2484-49d9-aecb-f7b6091ce0b6", "comment": "Malware payload (NanoCore)", "value": "20c2e319713ad64558d829a6e1d05daa6800940dfe5b5e0cc659e00e531eae31ca4f2bdf3f190acbe65b84f74c3d8640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197560, "uuid": "9cf00957-da4f-40ab-8755-8d93f30fcb54", "value": "82C4E08A7760759FC867D9368A692C20EA207177570FE743A04725EDEA4E2DACF050F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197560, "uuid": "47354a1b-b08f-4624-8c08-75ce6afb91ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197560, "uuid": "4dcac967-3443-468d-8052-72f0110f665b", "value": "12288:Ra+lyhJK/MqbfxrHRNkZIHWeRpihafcj+RbVFNEu1DOEJcS7:Rn0K/MAxrnpPihaEjS0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624197560, "uuid": "2f0a9bfc-7fde-44ea-95dd-3e85ac90515d", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624197560, "uuid": "cc1c88c8-5bd8-4b71-a5f5-2afb182932d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197560, "uuid": "fea0ed1a-c3e0-4663-8134-44d9521683dd", "value": "REMITTANCE DETAILES..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33533532-d192-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624171142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171142, "uuid": "86658e97-bea7-40e0-b952-0bc95761cc15", "comment": "Malware payload", "value": "134acaedb1d9ec907997116d7857de72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171142, "uuid": "3ab1bf61-c25d-4491-a383-aa157473799e", "comment": "Malware payload", "value": "bc06c918fab5afbb61d15611dedadbc9012cf9e4979e9d3f261a9046c306bb87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171142, "uuid": "db3b4edf-8dcb-4f1e-84b1-11ac7ffda54f", "comment": "Malware payload", "value": "b8481df36361cfbf71af10f1cd1d81dc4ece252c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624171142, "uuid": "2d99cdcc-d872-4113-9ccb-9a8f5b96569c", "comment": "Malware payload", "value": "1705b6bdf9e4e86f732055ee0872754a6d08613116404811deabf5059699dd55b702d39d58bf1ebab1ad991a7f9cfb8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171142, "uuid": "aad904e0-910d-4a74-928f-5df328b8f058", "value": "2FB623992244735CC41AC0749033ED89F1F6231E1FD9DAA9B2E7FED077A6821E902F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171142, "uuid": "9fbeefe4-e01d-421b-9352-c283bea11b94", "value": "e6f0fe50e6797ff5bcd8e357b2797f01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171142, "uuid": "eefe448d-0ccb-4422-b04c-59ffac3cbb18", "value": "196608:r21bpx31dLMdnAcRVA92zwuW/fbzBFkFb8bIMatmmlBzffGa6OAdYR5DZs92:rKT1dc3A92zwu2z8b8sMatlhOtO7Rk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624171142, "uuid": "f85eaca1-8544-460e-9ddc-af80e75e54c2", "value": 10724864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624171142, "uuid": "35a10176-48ac-4dd9-9e20-15b6ca1a177b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624171142, "uuid": "95d98612-ef99-4900-a59a-231a5b635acd", "value": "134acaedb1d9ec907997116d7857de72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d422ff-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180197, "uuid": "d8272e66-f702-47b7-8abc-c3ed0f4497b9", "comment": "Malware payload (Mirai)", "value": "53dd2069e76c22a779aa25262f8c9b1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180197, "uuid": "aec17865-26c5-45e1-92b9-ee92f3bc9020", "comment": "Malware payload (Mirai)", "value": "bd2884ea33ed143848eda8438d7a05c46893fcefd798b7b7b5ce9834d9741543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180197, "uuid": "ff8cfedc-be7a-4335-b757-0e7e1e97f460", "comment": "Malware payload (Mirai)", "value": "c0b1ac757412059f597d458812e0e08619230829", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180197, "uuid": "f0c4a9bd-a873-47b5-b66e-ad654208a93d", "comment": "Malware payload (Mirai)", "value": "01d9ac3f9eae55831ccbfeae2192554848b365b9e3446ef9aa1073bc4b854c5b1f5eabd12e80880199b2fe159955f336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180197, "uuid": "906881c2-83ec-44f5-898c-9ba1b499518b", "value": "57C36E23A9B30917D6D871BAA1E75330F0E6A34930FC4B1FFDA30D997B24B4931562A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180197, "uuid": "b416a88f-a874-4688-b6b8-1bc2cffa80e3", "value": "3072:q7DzQihA7IC/zgtdssy6P4wu9BNd47h1WZwTpS:WPQihszgtdssyk4HP4C0pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180197, "uuid": "c50d722d-4b6d-4157-8baa-c4a7a755bb6c", "value": 127808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180197, "uuid": "bd10c861-6d5a-4e14-b364-d9a96e460bb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180197, "uuid": "e3c62d3e-e661-4c55-b768-34d6fd54b50e", "value": "53dd2069e76c22a779aa25262f8c9b1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc947ba8-d1e4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624206644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206644, "uuid": "9d432f00-f27a-4790-a30f-3b9db3679862", "comment": "Malware payload (RedLineStealer)", "value": "172f0e84c19ed26ad000fa7c5e0273f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206644, "uuid": "ef0329f7-b84b-4d53-9f3d-e7cd000247ee", "comment": "Malware payload (RedLineStealer)", "value": "bd60511c7b930911ed7edb22ca6bae15995f00b2ecdfd009322a04f5c82a851d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206644, "uuid": "087bed35-5562-4618-a44c-284387a9883b", "comment": "Malware payload (RedLineStealer)", "value": "6ae12172b3d01a9b1d080135711f9254075fa672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624206644, "uuid": "6d6279ac-55ce-4b48-8624-7a6633843523", "comment": "Malware payload (RedLineStealer)", "value": "8c6ac4f08566369ab83d37e8fa5a9d5d4fdbf511a7209459acb5682cca47ef50fc8e149155e983016a6976e7998f584b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206644, "uuid": "e94459be-4615-4c9a-8354-737876e4e2cf", "value": "5526334129EA84F1F3716F3198F26BDD08385971E5E41E28A277EE0E7C20587EC95B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206644, "uuid": "daae47a4-4f8b-48a6-a48d-02cac9fd48fe", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206644, "uuid": "b811eb0d-df8a-4edb-be7d-5a60ebb55f5c", "value": "98304:6IoGyWvhjqQdmtU9su3K0m8n6s3nwE68zGn8ivuV2PHqX/8hILmt:6I6Wvhj3jyppCzG8ivRKXEY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624206644, "uuid": "2e75c731-92d6-4d1e-9288-3f39775d9296", "value": 4585683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624206644, "uuid": "3836ea03-7808-47a1-a8dc-f0f69c396a8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624206644, "uuid": "14ce0ace-d56b-4999-8bde-889d6fcb3189", "value": "172F0E84C19ED26AD000FA7C5E0273F3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6554388-d198-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624173912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173912, "uuid": "a2bf6ad8-794c-40fd-8038-5f777ee46696", "comment": "Malware payload (CobaltStrike)", "value": "4fe720ed4820dd5633730c9176790149", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173912, "uuid": "163cfc51-2372-4693-92c2-dc8e726c1667", "comment": "Malware payload (CobaltStrike)", "value": "be106bc807b68d8d2bea83f7fbd526675f127b2f234d6c31e2932bb5a5d1aa34", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173912, "uuid": "9822f5ee-0d68-4338-9da7-87b3218ba2cb", "comment": "Malware payload (CobaltStrike)", "value": "8460b507c7a50d8df75375ae5f9c79e4efd2913b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173912, "uuid": "ef24d665-1ac9-4ca1-952f-9b7dba1240aa", "comment": "Malware payload (CobaltStrike)", "value": "cfef24d5893174b2d22338316d4eb2dd3fb361813b6ecd19d9f53e4332b9ead3c5f074cc8181e3976add33db2d55705c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173912, "uuid": "7ccffe66-7489-49e0-ad83-57d826f2f1f2", "value": "3C743936BA95C0B5D0DD45F0691DAA69842C6E3927708CEBE3C07D2F6DF60805BA1F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173912, "uuid": "99026386-3b67-48a2-9851-d13f93b0f538", "value": "a4295032178dc2932a89d12d68456a8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173912, "uuid": "5a5c83a1-cfca-4a92-a38d-a671b660e246", "value": "6144:LsADrhYOTEA4mdmYLZ7EDDM4+IrXunfO07WT+tYixugtH+m14M9MfQ:HHeEO0aeYFv/M9MfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624173912, "uuid": "2dfec433-9142-459f-92df-2020d6a623aa", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624173912, "uuid": "118ffb0f-962e-4392-9a3f-299071c2d11a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173912, "uuid": "d30751d9-2a61-4bef-9337-57daf6b9f7f4", "value": "4fe720ed4820dd5633730c9176790149.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763b18cf-d1bb-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624188863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188863, "uuid": "60122736-9f83-4a11-949b-476886b22798", "comment": "Malware payload (Glupteba)", "value": "802dd842bcc934b9f1a01bafe7f19d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188863, "uuid": "f86253bf-fbc2-44c1-85a6-f6b5049071f8", "comment": "Malware payload (Glupteba)", "value": "bf348bb3548e36fc86c7cd916f08be6f2b6e870ba20475e9aa660bf81cccb525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188863, "uuid": "78ed0235-5a84-4200-bda2-013ddcc77425", "comment": "Malware payload (Glupteba)", "value": "b73f69a5411f487e8c285f6bf0e429a58052559e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624188863, "uuid": "bce711da-c0cc-4f37-90cf-442ec8fdd87d", "comment": "Malware payload (Glupteba)", "value": "63db0d44533ef9c5b87e14c60c46c9a5d45a9ef286a8ecb4346ce47bba26646b7dd5fb063df157e944aa323d0a815443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624188863, "uuid": "779be555-09f2-429e-a368-f4977e1595ad", "value": "D8263310B651C030F97665F85A76A329261C7E70AB6045CFA3DA2BEDC2343E9E93135F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624188863, "uuid": "77021f68-401b-4254-ada8-c262bdd0de31", "value": "cef982a39394466fe74a88f9214df2fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624188863, "uuid": "da8a2105-7a67-44bd-afa2-73b7212a8796", "value": "98304:DyrUT/98B0gqDfJZ7WgaFUd0Qs5heIaLLqs35WvyitrIJc:2rUTV3gqz3WDFUkyLLqscv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624188863, "uuid": "1fe2a82a-31ba-4b63-8e3d-97034818061e", "value": 4724224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624188863, "uuid": "0cde1eeb-8fb4-44db-8187-0dcc31d530e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624188863, "uuid": "3317660f-5bd7-4d28-a513-37b1af2266de", "value": "SecuriteInfo.com.Trojan.Rootkit.22046.28365.29797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc74db9-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180204, "uuid": "762c4111-9f5e-47dc-a2c4-df48be79569a", "comment": "Malware payload (Mirai)", "value": "34f3daa411b2ecf994c6d70e892aa70e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180204, "uuid": "f912476a-cd24-4330-afcb-c92d469eacbc", "comment": "Malware payload (Mirai)", "value": "bfb376d5673b6dc1869561a5fe9f6cf80141ffd551886bf850d4eac6314a9fe3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180204, "uuid": "0b246607-e794-4db2-bd27-82cf33b0720a", "comment": "Malware payload (Mirai)", "value": "0106339c64895c31ffa3bd639c02ffe750485a04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180204, "uuid": "94ecf272-d0c6-456c-a0ed-5993c00e1781", "comment": "Malware payload (Mirai)", "value": "7947e5ec8d7d410506c4854ae147e4474d0199638895748c236f447c771d8a64ffcfe2b36e56d02fa45e3bdf8389c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180204, "uuid": "0c0a99dd-7966-440b-a31a-a5a4835f9944", "value": "3F03F14591BA4347E91A01791C3FB1397BECB8478468DAE2DAD0303A4F15BAE337CE61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180204, "uuid": "36f4eacc-e77f-4e7a-9ec8-adeb0dd3239f", "value": "768:W4wrjfdRvsuO6E8gKaQ0jPqLXAzZMa3/WRPRKbxHmANGEPDnlXRG9HNUP0nbcuyn:UfIuO6E8g50A1MwuCFH1N5DlXR+H/no9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180204, "uuid": "e6af32c9-5782-4f21-8f4b-3ec8092d07f9", "value": 39112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180204, "uuid": "efcb01af-65e9-4b46-b9d6-fd6576362300", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180204, "uuid": "fcdffc99-14e6-4d49-996e-8d5ea1c06f5d", "value": "34f3daa411b2ecf994c6d70e892aa70e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a8dee3-d185-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624165535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165535, "uuid": "f76fac48-73ae-4364-bb98-166116ef8bc9", "comment": "Malware payload (RedLineStealer)", "value": "94e20c96a49718b4a54b01eaf3238298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165535, "uuid": "403cc7e9-dd26-4395-b2e8-b2969e6588aa", "comment": "Malware payload (RedLineStealer)", "value": "c18201d5085a9c4cc08e1c96d0b38288a1e6cce1aaa153c0437fd6cb4998f569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165535, "uuid": "58466744-d28a-4510-98d1-ce7eff44f9a5", "comment": "Malware payload (RedLineStealer)", "value": "d975ccbc28f4daf7a5356c98ead1aa25ba84c265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165535, "uuid": "d93a0a10-4210-4866-bc8d-b9d8598994f9", "comment": "Malware payload (RedLineStealer)", "value": "459696e8ad52e99a3b94b5292746e3f0653b33368c0ce305bed351de8a04b68af7ce47c2c2797a29a6ce776da4f382c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165535, "uuid": "23ac8cae-8fb5-4624-8a9c-aa06a3eff843", "value": "2D94BF10FA90C035F5F662F95A75C3B9A52D3EB0672450CB52E52BEE1A387E0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165535, "uuid": "c39e0724-7dfd-465d-9339-442788048971", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165535, "uuid": "bb7bb9b7-8210-4fd5-8420-f02c4115ed5c", "value": "6144:SSSoXY+qb86xZzS6smlXJ+ov+fZS1R8HZHrN2QWMoU3AHYUyXKri:NXlqb86xZzSNmzfv+4fEQPUEEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624165535, "uuid": "c935f1f5-f0bf-4a30-835c-a2ca28f93b97", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624165535, "uuid": "c7be88ee-f9f5-4603-bba7-951a4d5f644a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165535, "uuid": "55e819e9-52aa-45ca-8618-e933447f05ad", "value": "94e20c96a49718b4a54b01eaf3238298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e18e40-d1df-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624204246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204246, "uuid": "a594e078-2ef3-4a0b-95c4-aca741dd539c", "comment": "Malware payload (RedLineStealer)", "value": "30fc3904a2fc79242a9634d4dbe50bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204246, "uuid": "15adb82d-6e47-4ea0-9a37-30920e5cecad", "comment": "Malware payload (RedLineStealer)", "value": "c23f9b87f69c4c561c432d39f95b9bb2af758507aef497945bae73847dae31a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204246, "uuid": "4bf29ee3-5448-4864-8dbb-363dedfc58fb", "comment": "Malware payload (RedLineStealer)", "value": "33534792ea803fe9bc4a477e103351cc0186c433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624204246, "uuid": "7329da25-7441-41d8-a5cb-d67f990b60e6", "comment": "Malware payload (RedLineStealer)", "value": "1d741f1020af470a610600ea81feac97e35780dd8c541e5c1f492b21d6cd86fbf9a886c7fd74835206441ee3f3b70181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204246, "uuid": "3ec74378-832d-4c3f-97aa-b1dcfa86e778", "value": "B594BE00FA90C031F5F662F95A76D3BCA52D3AA0972451CB62E56AEE5B347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204246, "uuid": "2a4fc8f7-bc77-4980-8fa2-befc802f6acb", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204246, "uuid": "24335405-17d9-4809-9cae-b1be24fb8df2", "value": "6144:kUj3tIt/ec1EJ5SjPL91HggrH07JuLk/n6Gr9lcBDEUoWYHfh0nKri:ttC/ec1EJ5STL92+6uwn62zUoLql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624204246, "uuid": "1e62c719-ac05-48a3-8239-a5fd402158a1", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624204246, "uuid": "59e3ffcd-2a7d-4b4b-9e7c-d61d42894225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624204246, "uuid": "4b6d7846-e899-4e1c-a704-3d7ea511897c", "value": "30fc3904a2fc79242a9634d4dbe50bac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456a7791-d1f4-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624213263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624213263, "uuid": "043955d7-53a9-4bdb-a0bf-09ff13e34163", "comment": "Malware payload (NanoCore)", "value": "263030a0e4c9046d78e1fb06660ddc7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624213263, "uuid": "31af39a5-77d9-4d87-89d6-07f54c3a3d45", "comment": "Malware payload (NanoCore)", "value": "c3e47807f3e8eca79930d5be045389e36ad44650ab618d234ce986949a5b2eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624213263, "uuid": "eff9459a-3ab4-4c3e-b3ad-33f56c8fa94c", "comment": "Malware payload (NanoCore)", "value": "16fdbff235fc5b3ca76cdb54d5de0588c3a7cd0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624213263, "uuid": "a87d269d-2298-442a-a6d2-0c067ebbceb4", "comment": "Malware payload (NanoCore)", "value": "4ea7b32f2c2a5bcec87047676721e5913a474ae5f77868e8fc32fde3170b1f887cccb713422db1a6fea027201766db7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624213263, "uuid": "df8912ae-e500-46e7-92f8-f194e6e97364", "value": "43C4022677A8067EE1CE917A602602928B79C2E7A8C3F3DE5CD416B7CF167D40A170D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624213263, "uuid": "6524c139-2922-4c8f-9cb3-f9f100512683", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624213263, "uuid": "d2c73385-b098-4f6d-84be-78319abc914d", "value": "12288:CLV6BtpmkRGZJ+wY17GJuFbX3jdXHLfgjPEsUBaBRB3:gApfRGZJfRuFPdXrfgjPHU8B73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624213263, "uuid": "ba4cfb0e-8543-46e8-b192-74a10b3d780f", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624213263, "uuid": "774ca9b6-ef61-470c-bf16-96bb8bdb0e9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624213263, "uuid": "fa9f5317-54fa-4c80-8f29-cf084fe96861", "value": "C3E47807F3E8ECA79930D5BE045389E36AD44650AB618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079a7c73-d185-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624165485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165485, "uuid": "652a1b4f-1115-4383-ad24-630de3df2dd1", "comment": "Malware payload", "value": "9603eb6733e7398b29922e18d8802889", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165485, "uuid": "44e6cfa1-966e-4a72-9ffb-73d28511b5f9", "comment": "Malware payload", "value": "c48d58c3e1c9b1279fbda4ba0e5a6bec21b80510a9495d0fe5790a4370938f50", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165485, "uuid": "c250ec4f-25db-427f-8652-f987e7fa6b65", "comment": "Malware payload", "value": "6ddeeb3bde3ed822baec9619662b8f911f1b50ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624165485, "uuid": "5dc84f99-bed5-43c4-881a-3fdb11a8e234", "comment": "Malware payload", "value": "5ba82fd4aa892836386bf0f9640d3ec71dc4c9c56f1768d76035a479d0773c03abfdb0b1aef462a0efc6e28cfa20b9db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165485, "uuid": "c955ddb8-18b8-4607-8111-d33355b1b497", "value": "2D63029A8C7A8D5DDF174DBF068B4D274DFA92E8F9C03A6843A224C41BA955FA40D708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165485, "uuid": "fd07d699-24cf-4f65-8472-985319917ce8", "value": "1536:EWTXdmu/5k063Y98cJHZGHddLBZFjcpBf+bLuiTkGesN42NlQbI:/TNVO/QJHZcfFj4rwLQGTNO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624165485, "uuid": "897e51e2-9ec3-4282-818a-b35a1a793675", "value": 68012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624165485, "uuid": "18a54cd6-cea2-4988-aefd-a2ef30dcce17", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624165485, "uuid": "a05e8006-63c3-45a2-a4f5-84165c8cff40", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05813666-d15e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624148731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148731, "uuid": "3adb85ed-c015-42d8-9030-a037a787f238", "comment": "Malware payload (RedLineStealer)", "value": "69371031959bc0d429d756aa4bc7c212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148731, "uuid": "00317b8d-aea2-4ad4-8c12-42d83ea6d3c6", "comment": "Malware payload (RedLineStealer)", "value": "c7120f356e253afa2ac665d0f4e7b9787b6c13f17890880cbeafea8effa13e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148731, "uuid": "5ffaa101-7c10-4ee6-a250-ebf70f23b355", "comment": "Malware payload (RedLineStealer)", "value": "a67937c3137d12103b2ed300f07d495a1a8a7c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148731, "uuid": "8f2aacfd-2dc2-46bd-ba49-26835cf76754", "comment": "Malware payload (RedLineStealer)", "value": "50dd51f0d888559ebf83192464e5ceaba4b737f00461e3a7aea8a92301788bfe7754c5e3b954e39b9f5504370691a965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148731, "uuid": "6f563584-29b0-403b-904e-15808b8a1a8a", "value": "F584BF10FAD0C035F5F612F85A7AD3B9A52D7AB19720A0CF52E51AEE5A346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148731, "uuid": "debb1e8e-2560-4d9d-b070-3478ffd30ef5", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148731, "uuid": "9fd6aee1-88d7-4927-aa8d-d1c83bc9ecf2", "value": "6144:kwnrQLBkclTymbK/FhlRWpdLJtGOQIJryiiF9bBBJVCwmsr:3QLBkchymWvXWXJtGKJErfLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148731, "uuid": "b4ff7392-987d-4dcb-b7b7-5d663dbf90d5", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148731, "uuid": "e6e1d82b-64f2-4156-b474-75915d44e0b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148731, "uuid": "3bc4d7a5-7a16-43e8-90b7-81d70b2b5a7d", "value": "69371031959bc0d429d756aa4bc7c212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edda8c89-d1d6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624200660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200660, "uuid": "eb53f89a-10cc-40e5-8412-7ec6ee9da61f", "comment": "Malware payload (RedLineStealer)", "value": "7e7eb03602721b5f2b66e8686c100b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200660, "uuid": "c85f06e2-e88f-4351-8ce9-26a6ab95dad2", "comment": "Malware payload (RedLineStealer)", "value": "c78be8ddaf315b1bc485e6d7fc87d468331cb25f8f7e50b66b6ed7158e57ff27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200660, "uuid": "8cfa6102-44af-4fdc-b71c-76200025a32a", "comment": "Malware payload (RedLineStealer)", "value": "13036f6097c5bbdb177420add13e07a227505214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624200660, "uuid": "a6614bf7-025e-462f-9564-422a22c79153", "comment": "Malware payload (RedLineStealer)", "value": "286f09dd0aebb152d3000afdd52a68aa53c928faf32ca5d527b6674026943c0756d875b7d117e4347a7e7c6cabc6dd83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200660, "uuid": "f4aebc5c-1b0c-451a-8b31-77bed8f0b194", "value": "2E94BF10FB90C035F5F662F85ABAD3B9A52D3AB0572450CB52E52BDA1B347E0AC31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200660, "uuid": "c0660038-4c1a-4f7d-a384-31ef57e73a28", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200660, "uuid": "dcbaf089-bcb4-48fe-b92c-89d373ed7917", "value": "12288:htC/ecqEJkSTg925K0hfGGgiktNimKXl:uGcqEJFHpGXim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624200660, "uuid": "d47527df-ab23-4ee4-8009-7bef8d3822a2", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624200660, "uuid": "7e524639-264a-41e0-a511-d8b9b449685d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624200660, "uuid": "0776bbd5-00a0-4512-9c89-063084348ed9", "value": "7e7eb03602721b5f2b66e8686c100b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2489413a-d160-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624149642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149642, "uuid": "77c199ae-b125-45a3-91a5-f2131d1f7b3e", "comment": "Malware payload (RedLineStealer)", "value": "4edeef5936e1ad8029a4c7bcda353b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149642, "uuid": "92e3fed2-eae8-4c85-8923-5e4df6a5748b", "comment": "Malware payload (RedLineStealer)", "value": "c871ff224642effcf8e9bcfcf7474f37a25a5b5eefe85b1ea6d849b7a1fadd92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149642, "uuid": "8eda9a2b-e12e-4054-8ead-334c5d50e229", "comment": "Malware payload (RedLineStealer)", "value": "79a22afc3c4034a771f99b0b023e39e8a57c0f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624149642, "uuid": "fa4826ef-63e2-417a-9697-d8cdc1ce668e", "comment": "Malware payload (RedLineStealer)", "value": "90c393d5a5813cb720e5899e0e23a16bc30ed0858bef2272c2f84ce2b29b27e392c8a0a0f357d21860d137f69c39c3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149642, "uuid": "8d3a8ea7-59c5-4e80-addd-06d3be7e82cf", "value": "D994BF10EA90C035F6F662F85A76C3B8A92D3EB0572491CB52D52AFE5A347E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149642, "uuid": "e6e58acc-9385-4415-bd60-c30b58283806", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149642, "uuid": "34884428-d3b7-4135-847f-ebe238907377", "value": "12288:+Rjmp8tasxmdI3iCvKPRuhZt39+bTU8Adl:WA8tasx9CuhD39qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624149642, "uuid": "1f4c1caa-243c-4c9a-a6cf-0507d06a997e", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624149642, "uuid": "2e593d53-b305-421a-9821-7b29059f6a02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624149642, "uuid": "07df6385-7848-4102-84f2-d753156fda4c", "value": "4edeef5936e1ad8029a4c7bcda353b99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8db9e1-d15d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624148419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148419, "uuid": "120b0e0e-8b42-4bba-90d8-e557138e8610", "comment": "Malware payload (RedLineStealer)", "value": "08a282ffc8d9137e06d1a4e54fbddff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148419, "uuid": "9980834e-1e60-4b50-a3fe-832915e4776d", "comment": "Malware payload (RedLineStealer)", "value": "c884cdcc0863dea6afa6f6481e2f45d21b4d8d10a46f9cc94742b0c7d87fb382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148419, "uuid": "cbcc349b-f213-459e-a3ed-26a776616278", "comment": "Malware payload (RedLineStealer)", "value": "610780c9c7d032b8467358f7fccbfde52b679d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148419, "uuid": "10597962-0e18-41f6-b7ea-b1268c2faadb", "comment": "Malware payload (RedLineStealer)", "value": "7a167b8fd565ca18505672fad70431329a168c1a9469d1338e91e26fb35bc62de3223d222809d9ec7cbff83464cb52cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148419, "uuid": "a165ad27-ea43-497c-bc1b-70e8ec669f93", "value": "FA84BF10FA90C035F5F612F85A7AD3B9A93C7AB1972090CF52E51AEE56346E0EC32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148419, "uuid": "3dde0288-beab-4d9f-bb41-ae2c0c6f8822", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148419, "uuid": "cb53ee91-2d6e-43e0-94cc-cac38aa8568c", "value": "6144:awXvALITclVyGsKpFRKKzikcIQbVtU6V/12x6fDzmYSNJlNoMUH:hALITcnyG5/KuOIWV7B1667zmHj/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148419, "uuid": "57755b96-f1c0-4143-86a0-b2b4df96f15e", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148419, "uuid": "07a36edf-255d-425b-849a-c9439553a6f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148419, "uuid": "d499e378-d665-4eae-9bc0-c160a166ac2d", "value": "08a282ffc8d9137e06d1a4e54fbddff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b315493a-d1ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624197126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197126, "uuid": "27cc96f1-b70e-4115-a167-21feb407bd73", "comment": "Malware payload", "value": "15e5fecbcc6e848e610796873bd5c4ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197126, "uuid": "bf91de9c-6aa3-48d1-a11b-e105be1fca73", "comment": "Malware payload", "value": "c89268050365d5778f216fdde8cb450efbf8be9f7642019cf9c13b252183225e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197126, "uuid": "7bbfddf1-e3d9-4371-b920-10393f5f2e18", "comment": "Malware payload", "value": "92788f21f9335cfaef613cd40c74118aa2283b6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624197126, "uuid": "e1751a7c-4d56-427a-8ae9-5c43775a8b78", "comment": "Malware payload", "value": "1cb89203678c8f6ebe02adb6c0da812eba744fcc9541c3a15ff4beee55ac92cb80acad76dad22b2a07d4da5d4609babe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197126, "uuid": "bd3300a8-3aff-45f4-bc3c-d6af67bf5a4f", "value": "88F48D2027E95719F13BAF7546D47445EBFAFA13B712D55D3CA001CB0A22E42CEA2B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197126, "uuid": "f752421a-8495-4fe0-899b-f5ff666d005b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197126, "uuid": "5b155a27-937f-4242-b778-63102b4fcf62", "value": "12288:vhktghlm4S4F3M9yiLPw5mT+BRCUBfF7eypbXNfWShujuhrdulUYw:JkaWXbwMT+nCUVkMXNWuhpulUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624197126, "uuid": "2a73daeb-47ba-40fe-a324-4f9aa1d0ad17", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624197126, "uuid": "34a3cee9-ad04-47e4-be15-e0b44d4daeab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624197126, "uuid": "06f5d2a6-d5a0-4806-b9b6-559935c208e2", "value": "RFQ-HMKAC57230621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee44cd4-d199-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624174248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174248, "uuid": "11bc068d-44be-42ec-9913-75d8d27dfdca", "comment": "Malware payload (CobaltStrike)", "value": "4da9eff3a95a5a313218c1a0a4055647", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174248, "uuid": "eaa2c18b-fa07-417a-9d6a-39cddccead5f", "comment": "Malware payload (CobaltStrike)", "value": "cb18432353e218676537e6fca6ab87c1ec57e356933eb8b6a4e012d1d6aaba63", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174248, "uuid": "0d45d302-4361-458b-ab26-808b2184313e", "comment": "Malware payload (CobaltStrike)", "value": "1786a744cc2c04c085bd0ddee3981d0d8d2f9e63", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174248, "uuid": "a3cf27e4-01f8-4e5a-9906-92a3f47b9dce", "comment": "Malware payload (CobaltStrike)", "value": "33a750abdbc0bb909621e422eb9e0c87dcf41d202f25cb2b1416423cf1d3d785b3bbebe56e93b9b9f387b8156527eb49", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174248, "uuid": "43b3a5f8-a1ce-4966-890b-e6927f2df860", "value": "5C23750197AAAE92D2D178F98097B7ED47766B1D0D3B80FCCE867C48E83A94348395D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174248, "uuid": "b2f3e34d-47ee-4bea-b001-c9c419c32365", "value": "6355eedadf57c4a4eacc2aa5084a60c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174248, "uuid": "bb190c31-0aa3-4175-966a-d42d7a3f9618", "value": "768:LCmaxqSsdl96nFQlr192Lq4KPgfqzwAvwUnj4:2mJS29uFQlr/2LpKeAvwu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624174248, "uuid": "96401e50-df04-4427-bbba-2fce6edf159c", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624174248, "uuid": "7f758f31-a54d-4ebf-9911-85f64e28e82c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174248, "uuid": "d2752128-3303-4445-b2c5-3881a9b75d75", "value": "4da9eff3a95a5a313218c1a0a4055647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8c88db-d199-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624174353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174353, "uuid": "150bf2b2-768a-4e54-bde3-c6fc96f9214d", "comment": "Malware payload (CobaltStrike)", "value": "6e5a6c3d1d66ba6b8a66e023edb10ae1", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174353, "uuid": "894871cb-4387-4e69-b315-c138a57efe9c", "comment": "Malware payload (CobaltStrike)", "value": "cb8742e6f31e36de917770705487add71a2e536580df52185dee4863a888431e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174353, "uuid": "da4172f0-e323-4747-b635-2fc92d998aa7", "comment": "Malware payload (CobaltStrike)", "value": "fb3e9639dbcc4c89f946ed41acf0a9b16b184e1f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624174353, "uuid": "89247f54-5aa8-4092-b6a1-fa4ee4972041", "comment": "Malware payload (CobaltStrike)", "value": "e1c5b5a4a15762469e4939b6092b188f747e9c8bcffb49d25026b5d250a89e7d07e86febc95cd5bdd76a94358ab1ab44", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174353, "uuid": "aebfc29b-073b-4608-8fae-bd20086a875d", "value": "2A743936BA95C0B5D0DD85F0691DAA59842C6E3927708CEBE3C07D2F6DF60805BA1F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174353, "uuid": "c76406c8-b572-4765-8aa2-9b5dc3331e95", "value": "a4295032178dc2932a89d12d68456a8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174353, "uuid": "d2a9fb9b-3a25-4938-ab1f-f8657bd72f8b", "value": "6144:isADrhYOTEA4mdmYLZ7EDDM4+IrXunfO07WT+tYixu8H+m14M9MfQ:GHeEO0aeYF5/M9MfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624174353, "uuid": "7d9ee5bd-a5bc-487d-b03e-b9e2f50ef2bf", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624174353, "uuid": "efc0a4e1-3089-42b5-8072-5b856d87c963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624174353, "uuid": "941ac25f-6f21-4b2e-8158-2309f11bbd09", "value": "6e5a6c3d1d66ba6b8a66e023edb10ae1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958c6789-d17f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624163146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163146, "uuid": "97a99696-42cf-4b5a-a828-6a9c7f0dd572", "comment": "Malware payload (RedLineStealer)", "value": "83f23f70f491f560cb7ca6c7e1968bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163146, "uuid": "9825d1ca-a775-4479-aba1-5971b52c17da", "comment": "Malware payload (RedLineStealer)", "value": "cde7084c17ca106515461de845219bf5b4ae55b373d53b4402587cb199fa1c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163146, "uuid": "0a47dee1-e618-4cbe-bcfc-dbbb1dba69d1", "comment": "Malware payload (RedLineStealer)", "value": "460fe8f0e907c4056c5867f978160c27813815fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624163146, "uuid": "30dfeee8-c2c5-4b27-95c3-75673701b5de", "comment": "Malware payload (RedLineStealer)", "value": "6edc311ca8bacf1931b3c6a22ab8076fffc357d3ce5b670399e63f29a8df858d66180f852faa38465140f9703d783ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163146, "uuid": "44045b38-ceda-4d13-8034-3958201fc799", "value": "9F94BF00FA90C035E5F762F85A79D3BDA52D3EB0A72450CB52E56AEE1A247E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163146, "uuid": "e3b12c78-80c5-4d53-8dee-cccab8e622ce", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163146, "uuid": "f25e333a-b80e-43a9-b34a-1d1df34b111d", "value": "6144:FSSoXY+qb86xZzS63mlXJKNO3oTwxGhNWPJNNZp6B76OHDl2QKri:GXlqb86xZzSimzKNixG3ebp6B7JoQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624163146, "uuid": "2a0cedc1-0daa-4a58-b451-9ed07de9cc23", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624163146, "uuid": "3f35bef8-9392-4042-9898-b5a11ac8c4fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624163146, "uuid": "5f1b5f27-05ac-4c4a-85cd-30215100a899", "value": "83f23f70f491f560cb7ca6c7e1968bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8b3572-d1e1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624205139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624205139, "uuid": "61c4e7fb-ac8e-450a-a1ef-f72fe12ed83b", "comment": "Malware payload (RedLineStealer)", "value": "4c92298aa16b8a271d648573c595de0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624205139, "uuid": "124a2b9e-ad66-450c-9b5c-250e3a1a01c0", "comment": "Malware payload (RedLineStealer)", "value": "cf70963a45cf340071f0cfedf91dbfebda72e5f4b62a4544faaa715184093a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624205139, "uuid": "e01fb131-716e-41f9-9730-8201990e3899", "comment": "Malware payload (RedLineStealer)", "value": "68c1993c20f8b6d60f2c98ed56fe41b93a2b2eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624205139, "uuid": "b38d0ce0-5df5-4e29-9364-1ef44fa9700e", "comment": "Malware payload (RedLineStealer)", "value": "92432111b406ef41dab9501b82682dab04cad23ec782a06c79927b192f7206c35cc3760139d1b8dfa95fe35caeb00c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624205139, "uuid": "2105be02-8d43-43df-96b5-ebf15eef92bf", "value": "2594BF00FA90C035F5F652F95AB6D3B9A52D3AB0A72490CB52D52AEE5B347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624205139, "uuid": "0e1e9eea-9cb6-41d3-a6b6-666d8c592328", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624205139, "uuid": "da842777-5c25-43d7-9e1b-7519a19550a0", "value": "12288:M8FUcx4RySWIaJsB1CFeNMPdwCZcfl4J:ucx4RaKZi++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624205139, "uuid": "42820473-7a62-402e-b425-7e32c432609b", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624205139, "uuid": "a3ae8954-476f-4048-aa88-1b80dbaf022a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624205139, "uuid": "76b35bb1-0bba-45ea-a104-a78e4078af08", "value": "4c92298aa16b8a271d648573c595de0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b00d0c4-d1c8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624194347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624194347, "uuid": "397008f1-65cf-48e9-bf70-98d13b10431c", "comment": "Malware payload (RedLineStealer)", "value": "5d364cc05579b95333d40284ac986dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624194347, "uuid": "e6337e74-2687-4a89-813c-77cdb91ad44d", "comment": "Malware payload (RedLineStealer)", "value": "cfe433c467a23f36cb4e717de1c07028b9d0b2d81f06a982d75581fb900701d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624194347, "uuid": "3cd72c02-26a5-4caa-ba58-cafe884be2ce", "comment": "Malware payload (RedLineStealer)", "value": "75e1cab6804a4535b5ec3e9f4cfa05683cf6a2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624194347, "uuid": "0e849862-a94e-4db5-ab8c-381888696441", "comment": "Malware payload (RedLineStealer)", "value": "60dc561750496482982d5e0a66f7a76936b6401ed0724f0d13d60687a4e76842e6cc6aba6164fdf2ae38fcab31873f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624194347, "uuid": "5a6720c9-75cf-4f5b-adc7-c69d7f91e213", "value": "8C94BF01EA90C035F5F762F95A7AD3B9A52D3AB0972460CB52D52AEB17387E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624194347, "uuid": "593e9756-a992-4319-90d0-6db019cdad68", "value": "325daf1bcd038e60cb3f2ac479057267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624194347, "uuid": "f33f1a85-fdf7-4469-8817-689971d479e7", "value": "6144:RUX3iI0/ecREJdSjP391Hg/W2jpGbb74inDpIiRUZ466HEXq8RKriR:kiv/ecREJdST392/Wrbb8cpJe4pAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624194347, "uuid": "339508af-7376-4082-a20f-c8a524e4580b", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624194347, "uuid": "1dce07bb-6f54-470c-8a18-0c0e214f27fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624194347, "uuid": "557701b9-3f86-4792-a4f4-b3747abace91", "value": "5d364cc05579b95333d40284ac986dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3007d74f-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225253, "uuid": "821e7fc7-2306-4c90-82d1-ee9567d5bfba", "comment": "Malware payload", "value": "0a390fdb2f66cc82ad74a41a5db5f96e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225253, "uuid": "bd4a76dc-1d26-412f-b208-bd0ba31cbba6", "comment": "Malware payload", "value": "d278dd86853b897580936a9094d1c81b9fdbede64d62df5eacea6d2d15f74cf1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225253, "uuid": "4cba7ed3-8ace-419a-88c2-d72155fd98ea", "comment": "Malware payload", "value": "f87f6787feba427a660d0d03fac5174d89e30085", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225253, "uuid": "dbb4f918-c495-46ac-afd4-b9a15f33fb16", "comment": "Malware payload", "value": "7b06e4a53794aa8157e882002003eb47d8b9a03a8f4136c55213cbf57bb17f54e4c9a169cd7561dcbc8964e973bc6559", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225253, "uuid": "2b2c81a6-c89a-4c5e-bdc3-9a34007ee464", "value": "AB54236FF49815D5C5830C36A6813EB70E7BB85D1DED04FD325B8CCA9A7A0436058A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225253, "uuid": "1fdf1b1c-c097-4698-a777-f26bd30be824", "value": "6144:S14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjg:SvIzBhNU+3WB4d66j9B2dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225253, "uuid": "2c7a6b69-cffe-486e-a85f-d28167fc76b4", "value": 295106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225253, "uuid": "bff68f71-5916-4eea-8106-d68ce0acba9c", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225253, "uuid": "1cf1d7a6-a0db-45ce-b8d3-464cf126d574", "value": "\u5173\u4e8e\u9488\u5bf9\u5f00\u53d1\u548c\u4f1a\u5458\u7684\u8d28\u7591\u95ee\u9898\u8bdd\u672f\u89e3\u7b54.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9936cff6-d15a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624147261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147261, "uuid": "f57312a2-c01a-4776-94ef-a26d94017bff", "comment": "Malware payload (Mirai)", "value": "d5908c0a581a5cd66ae320e39203ba76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147261, "uuid": "8afde8ab-a02e-4d9d-bbff-f75fa996b49c", "comment": "Malware payload (Mirai)", "value": "d3de77487e13ee5e46b58832c1991d45f54fbe91e9ce048ff736eef0dc560b74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147261, "uuid": "04f2f691-636a-411b-9f41-660f30547f87", "comment": "Malware payload (Mirai)", "value": "5f1c5d281b5217988ad498520d6e7c9ab5586bbc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147261, "uuid": "65746671-8bd8-4a56-94c5-599b1b9806e7", "comment": "Malware payload (Mirai)", "value": "f65f3817036d449d28810358f562dc67ffb120fc8e8a0e607514d34199d61fab8f654a92e9ee53b155f9b41d1ef36758", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147261, "uuid": "ab0d31a8-d010-44cc-9bd0-189553d3d4db", "value": "5E64F1CAED01AE75F9D547B9BA1F074973B68BE8D3C3B110E224C61439EE2468B391C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147261, "uuid": "89e2b652-004e-4192-833e-800466dfeae8", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncWoNsKqqfPqOJ:78QpZsKCaiWHKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624147261, "uuid": "ad0bf7b0-9c2c-4c93-b943-5bdb462351d0", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624147261, "uuid": "662f98cc-c12f-4399-9cc7-4adda95aa64a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147261, "uuid": "59acb54f-e655-49ca-aae5-dba94fa62cc0", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee9eb1b-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624176986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176986, "uuid": "1b4c549f-cf3e-4910-a1c6-0a33548838ad", "comment": "Malware payload (Stop)", "value": "e8500569f886585e0aca5cf006015d15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176986, "uuid": "eb1e5b43-8727-4275-a3c7-bb499578af75", "comment": "Malware payload (Stop)", "value": "d7d1bd4d3d8cf7a8575d7360c7fe06abee1608d24dfdd0238959750ca0a8dbc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176986, "uuid": "cf6a0eee-e22c-4192-859d-07739444aa64", "comment": "Malware payload (Stop)", "value": "a9f1ac21e159d081253a25cf7781314ac89407a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176986, "uuid": "5961871e-d75c-429f-a7c8-a4cbebf18460", "comment": "Malware payload (Stop)", "value": "150d1f2b0515ef7407bdc0fe0792ef3fa04860c7425c365c1851efd2cc2085db21f22fbcd9ddec592c32035a30aeb796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176986, "uuid": "c8ded2c0-a7e9-4f29-a118-8d804949b40f", "value": "9C050110ABD0C035E1F712F80A76936DAA2D3D716B6451CF62E96AFA57386E0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176986, "uuid": "88431907-6aee-4ea0-845e-d0c68b03e863", "value": "ae019a60d5bfddacd24fbe52033b970c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176986, "uuid": "67da06ab-c1fa-4176-951f-670ae4455688", "value": "12288:cX8JkwamPYiYE5a+yvxIaPXRPg/y8WvT5NN/2pn1l2j1fVfZX29HyjL1yW56vwM9:g8J5PKFIavR4/Gh2B2jJHX283DDXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176986, "uuid": "ca548fa4-bf6c-4a38-b646-55d2cda7540f", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176986, "uuid": "c5d30240-b0f0-4304-810f-302ee453f1b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176986, "uuid": "b9348905-18a2-4155-9f08-5e6c775eb0c0", "value": "e8500569f886585e0aca5cf006015d15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0f59b3-d191-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624170938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170938, "uuid": "c5818b97-7208-453c-b7c0-0b7ae4c1bb70", "comment": "Malware payload (CobaltStrike)", "value": "ca7d5420a506ce307f9cf5ba293e0259", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170938, "uuid": "752a547d-f3bf-4be7-929e-db7f2ce04a3b", "comment": "Malware payload (CobaltStrike)", "value": "d862bf7394540705d52ee3c46153e4d1e85c9c45f8dd63648d389258f31fe94a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170938, "uuid": "736b9e9f-3b9f-4d2b-86a4-abc5d7e7f9fd", "comment": "Malware payload (CobaltStrike)", "value": "b99bc2ef3144d9deaf573eb4630c416adc259db2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624170938, "uuid": "ecba9d7e-f8d4-4b3e-ac62-9f2988d00e73", "comment": "Malware payload (CobaltStrike)", "value": "b6d755dec87588c1c12ac3f2473db33e2c310e650cfc55eff0c996eb8b87f14b692a91753f9fcda7072df10fa4a6890f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170938, "uuid": "239d0504-3ba0-486e-ab76-85de6406ab32", "value": "20623BB7F70228F1E50706B08D9BB3FF4E7E6103C4239D62CA49C490EE276AD961494E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170938, "uuid": "3553e544-9474-49e4-81e6-3480707a71e7", "value": "e1dcffde169ed8b947dc63acdb78aeca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170938, "uuid": "b1208cbd-5605-4fae-a007-32da534e4d1e", "value": "192:XZVcDxh0c+M7Rgu7povQe0XEsE5b/wDKHrkYFgAgZQjjG4w0PAcc:peDxh0c+QmNvh4EsCcDKI30ttL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624170938, "uuid": "f9c5ec9a-aef4-4082-a656-ba18f16f08a5", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624170938, "uuid": "bb7a3309-9b24-4421-ad97-e19b8aa8eb92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624170938, "uuid": "0f60b104-9180-432d-a35b-ccf4a546dee5", "value": "ca7d5420a506ce307f9cf5ba293e0259.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d311989-d196-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624173037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173037, "uuid": "5df90d16-6488-4f68-afdb-bd3631b46ef4", "comment": "Malware payload (ArkeiStealer)", "value": "703cdaef5b23fbabae41e014803b80a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173037, "uuid": "ab5f2025-4c5f-4602-b5ce-369af81ae3b6", "comment": "Malware payload (ArkeiStealer)", "value": "d99af28c97f63d10334623749b1e0daf3c05387d827b02c83c19c6400114bc06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173037, "uuid": "9bbff1e9-ac80-463a-94e1-61ec9f0c7056", "comment": "Malware payload (ArkeiStealer)", "value": "e6ded22069f7f8e742bfb76ba84eb063a9579069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624173037, "uuid": "332be4e1-b16c-401a-b106-e119d4c15dcc", "comment": "Malware payload (ArkeiStealer)", "value": "4680a4a96223642f5e2186a4199537a17c1648588caf09abcc789a8176fa61ab14a0960ec721891a7fe02c9346652d1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173037, "uuid": "e493e7ba-3c16-4b36-b2a9-39264ece1aa4", "value": "46E4E1107792C031F5F722FC2A79837D652D7A716B6460CB62E52AEA16387F0AC32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173037, "uuid": "fd447b5a-271a-4c48-913b-993ba382660f", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173037, "uuid": "4f1b4e5c-4ca8-489b-b692-76311f34a841", "value": "12288:sEVOEwfsM+Vs4cH1f91NoKHRC7B5Q+xXjTzZeEuM+l:ldwfsMGgtzi4Q7BHjpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624173037, "uuid": "9e7d7ae0-3de0-45e9-9469-b2ac572e5b64", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624173037, "uuid": "7c5557d4-a1ed-4c61-b001-5b8b65c6ee25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624173037, "uuid": "1f58cdc7-e5f2-48a1-acfd-0761ea6b9fa5", "value": "703cdaef5b23fbabae41e014803b80a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af2eb05-d1d4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624199474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199474, "uuid": "bc8a69a6-a8de-4b2e-b146-7261fb14c03b", "comment": "Malware payload", "value": "d7cd9fb2b423fac6e3df3ddc3a1f8857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199474, "uuid": "83b2d2c3-18b9-4910-9902-9913004eb228", "comment": "Malware payload", "value": "dad777a66ec56f2c09572257a58e4cc6344176aef97fb60f2a7b33f443e42770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199474, "uuid": "9a765111-ad17-4cf7-908f-f56814c6129e", "comment": "Malware payload", "value": "58fa0b2bb4a912a34f2a166faf656a84a75d5d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624199474, "uuid": "c018bf75-f0c6-42d7-9c7c-c192e2537a4e", "comment": "Malware payload", "value": "fdbb642b0b2e15602e1e9db386a54dea0dc3318207bf9638f82462508717f47ea6868d78e72ca59b2b7b019d72f6b4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199474, "uuid": "bfd86119-43ea-49cb-ac20-cfa9a085b741", "value": "08358D1036D89A19F17BBBF899A4204197F9BE53F702D54D38B1328E0973B43CD9662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199474, "uuid": "2f3eb175-64b4-4d79-84ee-efd3e1ef322b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199474, "uuid": "ed9aad40-6e0e-4e67-92a5-ed7a787f24ee", "value": "24576:cugrT22dgxWAZkLEUdbHi+HQVfRGXq54kP5+0doo:cNG9kfZi0QRRL4kQ0do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624199474, "uuid": "0e729e91-8fc4-4ede-b075-8d7927ef1d5e", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624199474, "uuid": "c5eadd3d-9997-4047-b30e-bcce967fe826", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624199474, "uuid": "1645f09f-183a-49d8-814a-0c108a5066d6", "value": "qH2tfmLbBO433it.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04549c37-d15e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624148729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148729, "uuid": "ddd61cb0-25ff-4184-bf9d-78f56a0d79d3", "comment": "Malware payload (RedLineStealer)", "value": "a8d081e01b3fefaec84e8dda986c95f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148729, "uuid": "f8c52e99-0d3b-4c3a-86e0-bd2e0fdd09f4", "comment": "Malware payload (RedLineStealer)", "value": "dbb6cceb6f66c32688c162e7a9519a2cf79eb9cf6b54725ea7c59dbcab9ea42d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148729, "uuid": "03c137fc-429b-422d-b2b4-835d7a44a676", "comment": "Malware payload (RedLineStealer)", "value": "11ddd41d8fd4d0e1582031567837cec14d2423a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148729, "uuid": "ba4fc707-d76f-459a-b325-5ad9d9edc3d1", "comment": "Malware payload (RedLineStealer)", "value": "3b8975ccd0d6ad376ea7639c63a3b8ac3272b56ad8e09d55d54babeef6bc65bd5271d186437f88917f3e7c346a5238b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148729, "uuid": "00d99d43-0aea-426b-8fb0-5ee333e53337", "value": "9C84AE10FB90C035F5F612F84ABAD3B8A52D7AB1A72490CF52D55AEA56346E0EC32707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148729, "uuid": "96c56243-6834-46b4-bfa9-d5b25682542a", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148729, "uuid": "bac6f011-4fe4-4b8c-8524-0206c6bace24", "value": "6144:0wn3QLBpcl0ymbKGFhRRXJzmIZ5VVvS3ASaFEpfa:zQLBpcyymPvH5KOr1rSq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148729, "uuid": "021417d3-27c6-4806-9074-696ddf86a5e9", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148729, "uuid": "e582a0ed-2149-47cf-923c-c0d417957b6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148729, "uuid": "58ae0640-064d-45c0-81c0-af51d0375555", "value": "a8d081e01b3fefaec84e8dda986c95f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de4faf6-d15d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624148423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148423, "uuid": "c134efed-7a8e-451b-ad90-a67f45b39dc9", "comment": "Malware payload (RedLineStealer)", "value": "2f250cca4d1d6e83c13f7ec2bbc816dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148423, "uuid": "45f264ae-b34c-4f53-9640-56f8d1bf243f", "comment": "Malware payload (RedLineStealer)", "value": "e128662ced951ef1b73cce64ae2ae14890005dcd160fb36fbbd03e5522d42baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148423, "uuid": "206c05f5-8603-4aa7-8b7c-bc1186372fcd", "comment": "Malware payload (RedLineStealer)", "value": "1964839f2783bb20ad9ab2bd0abc222ac2c48619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624148423, "uuid": "d4b37146-c062-4bb1-a7e9-8df0e286180d", "comment": "Malware payload (RedLineStealer)", "value": "c59db06c0aa82d80816bf9c6f98b547c81b1fecfbc61115072a051a23ef9b58be247b10b990f872bcd596a2e31bf3066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148423, "uuid": "ed8996a0-5678-44a7-baac-20d0cafa5e33", "value": "6494BF10EA90C035F6F652F85A76D3B9A93D3AB0572490CF52D52AEE5A347E0EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148423, "uuid": "59d11010-d75a-46e3-9e82-acff194f80c8", "value": "e621a9dda4bab203878bb79570221dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148423, "uuid": "e0fd0d13-37ba-42d4-9e3b-c3ab261bd99b", "value": "12288:xAEit8VlsxXdb3iDThb9s6ktePrvNw2NYdul:LI8Vlsxe/s6bPrlwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624148423, "uuid": "13f73bc7-0bc1-491c-82f8-70e497e2acf4", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624148423, "uuid": "a863daba-931d-4e13-8bee-409e8bbe7ef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624148423, "uuid": "10030e77-14ac-422d-94f6-1d5270dd916a", "value": "2f250cca4d1d6e83c13f7ec2bbc816dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f021e248-d21b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624230299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230299, "uuid": "8d2d30bd-8375-4434-9ea2-32703dc13b63", "comment": "Malware payload", "value": "7410df6db7dd9dfc0c4103efa8d13fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230299, "uuid": "fcabe360-db0f-445e-b7cb-6b23b087e8ee", "comment": "Malware payload", "value": "e1cdac7f4cf342ffde7d1f1fd9ea4788166bc4f9bfe3706ba5ab71af38682f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230299, "uuid": "3cb3fa7e-46b5-4cb2-ae79-08e9ad0d95fa", "comment": "Malware payload", "value": "ea2f19e981509d96ec2c775af8a1d158e79bfca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230299, "uuid": "b403b216-79d6-41bd-899e-4969bf738c29", "comment": "Malware payload", "value": "d35bc611e10f887dcf588860725ba03deaff4e46f3ab61f88e61bd47092a3cf8476539d686ae2f217552fd5c9782c985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230299, "uuid": "473fff4b-f589-4283-bb1d-31b83fbcb6bd", "value": "09F32A443650629FCA6B8D76C9AC9C6066607C6A630FE34774C33EABB94D697CF050E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230299, "uuid": "bb301e5a-61bf-484d-9c73-08757cf71f97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230299, "uuid": "5147c7a4-dd43-4515-a17c-bdebb48ef224", "value": "3072:a62EXiRPw5J+QVvZokrQ+6tbZYXP+aqcRwV5G5J+ke:a62l451ZpQ+KbZYXP+aqUwPG53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624230299, "uuid": "f1ad767b-ca26-4f03-8d21-11b3bc38747a", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624230299, "uuid": "6ea1b8e9-f958-4720-a794-bcaa7f444430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230299, "uuid": "a53f3e08-0e70-4c8f-856e-04721d1ecc4b", "value": "ProstoLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422dcac5-d19f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624176750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176750, "uuid": "6b6157c8-efb2-42b8-82e7-f711ce4c522e", "comment": "Malware payload", "value": "88ca00752b5d524d9a88a5fc5818d639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176750, "uuid": "82b52d29-3a2e-4ed8-b1fd-17533510ac5e", "comment": "Malware payload", "value": "e37fa468aafa1e603529ee77a6e4b31134f429a81fe9222ef85fcf458e290d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176750, "uuid": "3d7b8e73-46d4-4c4a-8c6b-477dab5c55e4", "comment": "Malware payload", "value": "c7972086b1ed699c99ffd80b279ffabc7cc60095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624176750, "uuid": "63172a29-36a1-4e34-9ce5-a8b4f149b057", "comment": "Malware payload", "value": "2d540dea0a34519322ee8893d98cdcc472b7d411eafa7a08d025c64c4d9ee8fa783de12f33f071c79798c188a938ba61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176750, "uuid": "c9cff8a6-7424-46d7-86e6-684b0c44b27e", "value": "5C5523537BF5C87FF7A606F183F198594AB7F8502430D726B290CEFF2854A828A50B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176750, "uuid": "438fb60c-e0b2-4d6c-9f26-33ad49152dc3", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176750, "uuid": "f28f22a1-5719-4003-862c-c3f5f0b66075", "value": "24576:Hm1ZO1DQmhbBRHw1/Qhai/q173lkp2Cc0HBs5yCmF3D1lqAsC46KeZsxJjrW3A1:G1ZO1DQmd3QWTS13tzxy7F3TsX6KeZm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624176750, "uuid": "26ae558e-c4b6-4608-bc7d-03d2864dd13b", "value": 1328418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624176750, "uuid": "c7335cf7-7f7a-4c4a-b9cb-d3c0c5f2b436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624176750, "uuid": "4d132ed6-1b9d-429f-9455-1e71aadcf699", "value": "88ca00752b5d524d9a88a5fc5818d639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9033d2d-d21c-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624230663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230663, "uuid": "c02fb3c0-d241-4683-b052-e732fe5a6d6e", "comment": "Malware payload (BitRAT)", "value": "8b1007a3d642dc4cab47d198bb1b586d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230663, "uuid": "0d579a0f-e573-4314-892d-49e52aeb03f2", "comment": "Malware payload (BitRAT)", "value": "e4fae47c8647fc72fb1bbcadc0df6814c22298b3040938f81cbe0b83fec8b8b3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230663, "uuid": "edc04bf6-01e0-422f-bfee-2c5ff15c43b8", "comment": "Malware payload (BitRAT)", "value": "2efc9e67fade2a54b97712fb6b55e2f9cf9348dc", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624230663, "uuid": "5be0ceea-ee16-4508-9631-7ed8d5ffbb44", "comment": "Malware payload (BitRAT)", "value": "3fe27775e9fa985c27489af705d796f3b7b2d8d0fbd3c51e9afd282a9357374b7437afe14450a1c236fe577b009c211b", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230663, "uuid": "39eac145-b5c7-476b-88be-74d6f8bb69b6", "value": "548512136F243641E51340706DBA66665922AC2E6502AF4B22C7BF1A4C72E43EDF773F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230663, "uuid": "1a11ffed-0d80-404a-897b-80972e12678d", "value": "42df58c55f636a16fb6429a9ab9b5d58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230663, "uuid": "6eb63308-bd07-4c58-ba9b-ed6c389e1468", "value": "49152:y4ZSVvusbsEaF9QHFaRiIqcH84wiPdeZPeMrqFx:y4ZSVvuGaRib2VXleu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624230663, "uuid": "76983677-f65c-4018-98dd-6cf6d6a94c3a", "value": 1729411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624230663, "uuid": "037630d3-9bb8-4fe2-8999-0dcf6ddc46fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624230663, "uuid": "6ccde210-5c3e-4678-9e24-e84fa4018376", "value": "8B1007A3D642DC4CAB47D198BB1B586D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecf6487-d20f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225170, "uuid": "b4d5225b-24b2-46ee-9edf-5152e9a98526", "comment": "Malware payload", "value": "746b9287522f5c82714b393824c2c2dd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225170, "uuid": "980a2bbb-5cf6-4748-b94f-894cb4e6c700", "comment": "Malware payload", "value": "e7f73bf5ef2e1f244978b84d077ca864fb1c4aae69979d4ffdf8909b8d13be02", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225170, "uuid": "63933198-5d2e-4e3d-83bd-6863a3417058", "comment": "Malware payload", "value": "f3d2c790a04ba7e8b92cdd4fd9ceef2a5d174d6a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225170, "uuid": "350e393b-5577-4a6f-857c-32457761c99e", "comment": "Malware payload", "value": "e62366622077640ce9bd401275232cb604d728023217cb3a90a0c3275be2d8154bc854ea015ca56ad1fda031d685cba7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225170, "uuid": "4185fb1a-fbd1-465e-bebe-8a1d1fc580c8", "value": "DD54236FF49815D5C5830C36A6813EBB0E7BB85D1DED04FD325B8CCA9A7A0436058A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225170, "uuid": "183fb570-5285-4864-b9fd-194b7af7f57d", "value": "6144:t14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjd:tvIzBhNU+3WB4d66j9B2do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225170, "uuid": "5d389cf3-80f5-476f-8935-439a2f4c6722", "value": 295106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225170, "uuid": "90bff6fc-5668-4abe-bf0f-6a2ca113de17", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225170, "uuid": "b8fce208-e9ab-46a3-82cd-afc801dfd738", "value": "\u300a\u5f00\u53d1\u4f1a\u5458\u5341\u5927\u6458\u8981\u300b\u63a5\u5f85.\u5bfc\u5e08\u53ef\u770b\uff01 (1).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26916171-d1ec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624209775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209775, "uuid": "8f912a24-0d97-4600-8e90-e191aa92c170", "comment": "Malware payload", "value": "a81d875cdab7798038d865a7eb9387a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209775, "uuid": "2f793e12-319d-44c1-b05a-7bd9cfda7969", "comment": "Malware payload", "value": "e840b559962b8b36d6096dc7b12a1b05e87310cedf595e2429904f0f5fe164b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209775, "uuid": "4cb7bb95-2dae-42f6-baa3-2801d7ff2fca", "comment": "Malware payload", "value": "c1b551377067b018cf500f80a3fc7e3f92a8720a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624209775, "uuid": "37fd0e85-8578-4318-a6bc-1d5a539679e9", "comment": "Malware payload", "value": "7e01674dbfa73805ef4cc466a93cf736c70be9d219d0064a1c0d4ae1ec32d1b4711504cb72c8f79bc4fc9c35ac161962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624209775, "uuid": "defe5112-5ef6-485b-96d8-889e950648b9", "value": "0F73C082D9C45836D0A2227D27B53B756A70FAF66311C19B79CCCDE5EFC1870A2663C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624209775, "uuid": "58947d1f-925f-4202-abfc-11771cc45825", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624209775, "uuid": "371727bf-4227-418b-b2c3-6d2790da2da2", "value": "1536:IX/ZAT50tQhgNFHKg3b2RjMb+KR0Nc8QsJq39:vTe0g6g3bije0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624209775, "uuid": "38fcb9ce-4cee-4de4-b979-e076e2cebf5a", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624209775, "uuid": "0d82aaa7-3616-47c7-acc2-d00ff87aaa4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624209775, "uuid": "f157c34a-a077-4fa3-a3eb-ddf35276c5cf", "value": "gdrfaAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9bab41-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225324, "uuid": "64b1bb1a-f815-4c29-b971-01668d3130cb", "comment": "Malware payload", "value": "f93d00d0f3c8df72f2041a3deef63041", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225324, "uuid": "67443f31-745f-4a25-9509-1127762af5b4", "comment": "Malware payload", "value": "ea2aba0c7821d6fab49415b040e29fce1216883cc6f9ea294cd554601c8d1754", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225324, "uuid": "809295d8-0846-46f8-814f-ed1ce94e5da7", "comment": "Malware payload", "value": "8f200aabe2c7a0b10da5267bcfcefe1aeaa4fe73", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225324, "uuid": "9f44b4e4-cbe0-4e1a-b849-bad7ebb942a7", "comment": "Malware payload", "value": "fe8cb10d3ac5d37baaee9d436333e497945de89dfe0a7366034572f9e4a63964aee55df289b6ad02963f0df9c0092690", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225324, "uuid": "023b239f-e2d2-4b76-b2de-ee30de185cb9", "value": "B754232FF49815D5C5830C36A6813EBB0E3BB85D1DED04FD325B8C8A9A7A0436058ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225324, "uuid": "8c0f9709-f330-434c-aceb-d713d5896d64", "value": "6144:g14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjm:gvIzBhNU+3WB4d66j9B2d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225324, "uuid": "cadf2cb0-e7c8-4082-90dd-32720b69f79b", "value": 295106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225324, "uuid": "c03d8f52-e3ac-40af-903e-df8ac7c8357e", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225324, "uuid": "ddac6519-529b-45c8-9c08-6297c7a3444d", "value": "\u9ad8\u7ea7\u8bdd\u672f\u5f15\u5bfc\u65b0\u4f1a\u5458\u5145\u503c\u9493\u5927\u5168\u8fc7\u7a0b\u804a\u5929\u622a\u56fe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337c9eba-d15b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624147520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147520, "uuid": "8820feb3-ff2b-4e09-b8b8-705f8229cde0", "comment": "Malware payload (RedLineStealer)", "value": "8941fd3de50d4f47533dda15678beb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147520, "uuid": "2dd53fd7-b6ff-4acd-9c0a-f4ec4bfc5e00", "comment": "Malware payload (RedLineStealer)", "value": "eaef5bc7955e59908899254a575fcefff9982e186e88bc6a2f000dcdfe39ee80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147520, "uuid": "2bd9244a-b000-4f32-bd37-66b2f740d78e", "comment": "Malware payload (RedLineStealer)", "value": "1631f8bde9d0e347c77777f82c657cf1ffe86652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624147520, "uuid": "b915db6a-db70-48b8-b0d9-5fafa42fe3a6", "comment": "Malware payload (RedLineStealer)", "value": "22184fa25ccf8e5bf46283755c01189ad01f4b574b6c5ee81956647be64261eacc44ef26ba8a83e88114831e2373a1f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147520, "uuid": "aa9b0331-d788-417c-9452-5aa24a8c27a3", "value": "9E84BF10FB90C035F5F612F85A7AD3B8A52D7AB16B2090CF62D51AEE56386E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147520, "uuid": "b5d678ba-5688-4033-9507-6c815a346e7d", "value": "0ec6c966c0805e7bf09b7a866ef7691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147520, "uuid": "8da7561d-c8f7-43a1-bedf-5fa4032737b0", "value": "6144:wwnrQLB+cl1ymbKpFhdnZrt9I8HZp8jettWp0RNPHwQelYpoDMw:LQLB+cnymAvdnZrtrr8jatWpawQeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624147520, "uuid": "ee0d5de5-65c8-40a8-868c-0a3b923ec49c", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624147520, "uuid": "b670c0ff-d904-4ebe-ab69-e1c88577963e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624147520, "uuid": "9009758a-0542-432e-b382-230d6c20d24a", "value": "8941fd3de50d4f47533dda15678beb80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98436b5a-d1c1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624191497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191497, "uuid": "799691ca-26f7-42a1-90ec-31131a017b95", "comment": "Malware payload", "value": "0a8543ca2692514e3ef8e21a76d54fdb", "object_relation": "md5", "Tag": [ { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191497, "uuid": "0d61a282-470c-489f-8955-8a631a42d16a", "comment": "Malware payload", "value": "edea96fab438854c46171bf1ae2a01bc998533036075bf38b8d2dc06096651b2", "object_relation": "sha256", "Tag": [ { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191497, "uuid": "91188584-b81d-42eb-9192-ccb200d2c850", "comment": "Malware payload", "value": "9f4ada0ac88940bf4b0418ed3fd6be719177b1d3", "object_relation": "sha1", "Tag": [ { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624191497, "uuid": "660d4eb0-dd94-41ae-a3b8-9ae9a491000e", "comment": "Malware payload", "value": "622f44ffee741f969e88a737d5cf2c4a7289c370ea64b515c3f48a98a1b0125e5964bbd4b5ecdeb177a1bbee0b088142", "object_relation": "sha3-384", "Tag": [ { "name": "Nymeria", "colour": "#B48628", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624191497, "uuid": "0951ec96-79d5-4802-93a4-26bc4f21fbb4", "value": "3B85DF42338DC295C26364B3796EF7106D7B7C2941B0F54F2F861A3EE9A1222116F76B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624191497, "uuid": "874fc879-2644-41de-9427-0dec9f88ed12", "value": "24576:T4lavt0LkLL9IMixoEgeand8KM1lkj9fIT2IjuyQOTwBYDgToGp4q9MmCS:mkwkn9IMHeanKKl9fsYswKgTeaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624191497, "uuid": "1829121f-1559-4309-9d5e-3596bf8ac603", "value": 1708032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624191497, "uuid": "a1e1b34d-b127-4cc6-b1f9-12828adb42e1", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624191497, "uuid": "d466a649-7ba0-450c-a0dc-97e40c5c9159", "value": "ReceiptCopy.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aacaee-d1c5-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624193132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193132, "uuid": "7eb4d3cd-e7a8-498f-a805-23c484c94907", "comment": "Malware payload (AZORult)", "value": "e5687426519282a5472bcf08e181d537", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193132, "uuid": "25213270-04d9-4fb8-bef4-3ee7e9d90399", "comment": "Malware payload (AZORult)", "value": "ef634a53dfb00589d513ce13cc9332fef2749255093f4874ef40b809e353b040", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193132, "uuid": "4db88c22-fcea-46e8-b4dd-f88c6fd3e635", "comment": "Malware payload (AZORult)", "value": "678be3a679bf84bf3e1b91fe3ef5d6fb6bd9b93c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624193132, "uuid": "d7d4a561-87d9-4cbb-ab95-4fbf3feb2bd4", "comment": "Malware payload (AZORult)", "value": "270b10b9eea3ddee04094999fdfb7fab65de037e90a076f121ef073a713f13615e0f7acdf65c6a6306c180fd784550dc", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193132, "uuid": "5f763f8b-4605-4842-980e-064d757cd9d5", "value": "3754CFF0B5A4F5F0E4420A316587D8276E2A2E1949A1140BF5043AADF8F7C768A9D73F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193132, "uuid": "1b89fd3c-f8d6-445b-a0fa-6815bb9bb47a", "value": "89bce6aaef4189bf0baf363795e303e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193132, "uuid": "7370720c-0310-4aa3-b97e-a98033d17330", "value": "3072:CWEJcL+ovqjo+0BErZNdusIKU3bLfeRo5Jn4lBbW26uFlhhhRq3Li5tgWEJc:CWZqovqxrbQs5mJ4lBbNRlhbI3+sWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624193132, "uuid": "890f1bda-2e13-4eae-9592-cc4a32f5d19f", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624193132, "uuid": "9af5f7c8-41d6-43d7-a73e-37d9258cab17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624193132, "uuid": "73d46d81-9f8f-47f2-a5fb-dccfaab4f4ad", "value": "EF634A53DFB00589D513CE13CC9332FEF2749255093F4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad6c169-d170-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624156686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156686, "uuid": "5416accc-0a3a-4975-9cab-98ec36bf52d3", "comment": "Malware payload (SnakeKeylogger)", "value": "2a99a1e7e2a125b1c22f73b52d950a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156686, "uuid": "c48babe9-534e-47b3-be75-892a8d0f671f", "comment": "Malware payload (SnakeKeylogger)", "value": "f0a9a7def731782eb5f60eae60b351564c2558054b0e7969a0e3240228998f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156686, "uuid": "0fda07a9-06b7-4912-8ac6-1bb0f3b425a9", "comment": "Malware payload (SnakeKeylogger)", "value": "ca3dd2291fe51c13ae933347d143a50761397624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624156686, "uuid": "199bb6fc-ccc4-4c2e-ab89-7594cf170253", "comment": "Malware payload (SnakeKeylogger)", "value": "144bb04eedc069affc1700764797ab60618367ab9d7bc38724ccaa8f3d0e6410586cca45d355f54af5e3ebf25aeffa13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156686, "uuid": "9faf06fa-8538-49f7-a0f6-8d7ee8885cde", "value": "D07501203EEA9419F0F39F7A5ED47DB6CEAEB6E32712C46D2495538E4623A40CC9113D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156686, "uuid": "bddba62b-5fdf-4ae8-87ee-6e70184905a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156686, "uuid": "1582eba3-912b-4a7a-8e22-53cc82291d31", "value": "24576:y3jaR/RCNKpjXJqiPN8gT7G0qVpOQBFb9czoSyCi5Q3BM2/2hppuuijpp:smTX1qiPN827Cdb9czogM1hppspp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624156686, "uuid": "677f18c1-4f78-4c33-8638-1f5198a450eb", "value": 1644032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624156686, "uuid": "4c9057ed-ee48-4ef9-ab8b-636f86e09d8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624156686, "uuid": "4fc9a85e-3b9f-489e-8317-cf3cea3d1516", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.8690.6778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7cdd79-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225485, "uuid": "1a3944c2-ec42-49f9-8170-c03a899ccb1b", "comment": "Malware payload", "value": "e3147b9b45dfe1230c585125aabd2f93", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225485, "uuid": "74e76439-12b8-489d-8bd9-b3b739c7913d", "comment": "Malware payload", "value": "f3b96f1731613a1d8e5afa14767f1f96ff4debe9fdc8a9dab6305bbb3162bf7f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225485, "uuid": "9807772d-0926-4b53-93d3-da55751a0ecf", "comment": "Malware payload", "value": "7b677cde5fcb43c9756f48c579b0e67aa4b2c8fd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225485, "uuid": "3937b3e5-f58b-4c57-a648-bee049761ed9", "comment": "Malware payload", "value": "5c6e4aee0f1c6690485dcd0c4e447cd9c86f2175b94043111a2dc1398f3279ae464bdb357aa6e4c8fc360c1a3f3c7c25", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225485, "uuid": "1812fb4d-6da6-4324-9a05-63db076199a8", "value": "1454236FF49815D5C5830C36A6813EBB0E7BB85D1DED04FD325B8CCA9A7A0436058A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225485, "uuid": "991e8120-5ea3-4565-946a-b69d5bd242e5", "value": "6144:M14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjB:MvIzBhNU+3WB4d66j9B2dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225485, "uuid": "68c60b58-9850-44ae-a79c-5f72304bb2ef", "value": 295122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225485, "uuid": "28fd537d-cbb8-4301-9c24-c4f875205d27", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225485, "uuid": "1591d143-bf14-4aae-9ff0-e95e0554915c", "value": "\u5f00\u53d1\u4e2d\u7684\u6218\u6597\u673a\u8bdd\u672f\uff01\u8ba4\u771f\u89c2\u770b\uff0c\u81ea\u7136\u5c31\u61c2\u5176\u4e2d\u7684\u5965\u5999\u4e4b\u5904\u4e86.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276f55d5-d168-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624153083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624153083, "uuid": "fc8caf50-dda2-4982-b093-29bb021747c2", "comment": "Malware payload (RedLineStealer)", "value": "856cf6ed735093f5fe523f0d99e18424", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624153083, "uuid": "3a26c775-947d-4980-a025-7fd6dbf52b42", "comment": "Malware payload (RedLineStealer)", "value": "f47a0c643ec5aa9d2b0302391d39bedfd675abd8892d5a2bd18b66fc303f66f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624153083, "uuid": "bc6e9560-f51d-4ddc-a353-0318ac610936", "comment": "Malware payload (RedLineStealer)", "value": "d8946c746ac52c383a8547a4c8ff96ec85108b76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624153083, "uuid": "62a887ed-3dd0-4cce-a8b4-a0398cd3d5f5", "comment": "Malware payload (RedLineStealer)", "value": "cbdde40db100a1b4cfd539f9166b196fdffb111f8bea6bba1bff462a59347dae3e3e99de10060d2306a7826a897593bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624153083, "uuid": "6e02fd85-2500-4228-a6e8-7a251e4fd0de", "value": "B8F4F110AA50C035F5F711F859B9E379A93D7AB05B2440CB62E62BFD4774AE0AC32B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624153083, "uuid": "0f9a3614-1250-46ee-bd65-9f452929f4e8", "value": "5bc76f4349f7f0afe0c88e229f50d37f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624153083, "uuid": "80fc3dcb-71e7-48e3-9a0a-e0854be5eb8f", "value": "24576:0NWmiLgJDj907ktt4lyWi7tzayFhhmWaKlHhZx+:F8Jvelyx7tzaiPmvSBZx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624153083, "uuid": "efbdcf58-dc35-4d1c-8847-a9915714a583", "value": 790920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624153083, "uuid": "c40e5c4d-6501-4708-8014-9d4139ba4a26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624153083, "uuid": "ca070718-c45a-4d85-ba1d-d553e249b537", "value": "856cf6ed735093f5fe523f0d99e18424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc9b24e-d1a4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624179050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179050, "uuid": "264276c9-b3cf-4230-a090-edb2678f708f", "comment": "Malware payload (RedLineStealer)", "value": "bc8478f5caa7b719234c8e1cf8395b12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179050, "uuid": "9c940ab1-6bb1-4661-89ae-0051995a962a", "comment": "Malware payload (RedLineStealer)", "value": "f5a558eba4843612e1b2e7bbfb431932a94bdc86f9411c0529f4216bcfe0ef02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179050, "uuid": "cd77c0ae-0a79-4d4a-8a79-d5287fdeff75", "comment": "Malware payload (RedLineStealer)", "value": "e0826e5b992b7aa566c557c71d6614804bd1430b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624179050, "uuid": "24c780ae-6858-4d3e-ba51-e9ef7de73142", "comment": "Malware payload (RedLineStealer)", "value": "beabfc9093b1b32cb0f14c7439e24c273438c0f9b5f228e5d4ff3a5d6cd27a3bf5646c098b35b7118182e6221aebebb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624179050, "uuid": "45c6d253-e920-486d-94c0-319ae7a40016", "value": "07B6233BB268653ED5AE0B3245739320987BBB65781B8C2F47F0491DDF264702E3EA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624179050, "uuid": "a095075d-feed-43e7-b917-b1a86b9583c5", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624179050, "uuid": "98a974a9-3aca-4612-b36d-3f25dafff020", "value": "196608:iQwBWytpde02bybOofBlFpTFv1jwFUTeaosQAvOb7zz1V+fjPcWWsTLZZb:iQwBNtve9ubdZ91jXeaonFzz16rSsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624179050, "uuid": "662065c4-7ee1-43d8-8071-fa9c840aa694", "value": 11182368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624179050, "uuid": "f20ee4a9-1e76-4191-a178-0487eede0606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624179050, "uuid": "33ecf915-bd5f-4494-844e-fcd2f3287260", "value": "BC8478F5CAA7B719234C8E1CF8395B12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2757c5d5-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157807, "uuid": "1b7b111a-7df7-47f1-8b96-eff60202ab9e", "comment": "Malware payload (Mirai)", "value": "5ecdadd1a1573827c2417142da78384b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157807, "uuid": "8ebda629-e4e1-42e8-9125-bf7eeff40837", "comment": "Malware payload (Mirai)", "value": "f77ca4cda273bcf6b02f0f4213048684ff43040b52d9c15f615e83765e253650", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157807, "uuid": "3604c9a1-6878-4788-aea4-ec4602074ec7", "comment": "Malware payload (Mirai)", "value": "8d2fd2b6f5d1c18ce938d7e51b3d847b1282ebd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157807, "uuid": "dce0f555-dd1a-445f-90ea-e143db841d34", "comment": "Malware payload (Mirai)", "value": "6293c10fb9d8c071d6f83b6bf0d9c280aa8180a5b67c3071af8c3f17ca3f3ea89ca80c3cad4096fae6dc7fbbd2f533d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157807, "uuid": "72bb8ba4-d1c9-4190-a3fa-de9f1fcee882", "value": "01835BD6B4004E7CFD47E6BA85264A09B92173005FA30F27E77BFC937E321999E0A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157807, "uuid": "6a5e1aca-b88f-4030-994b-b4597aba3512", "value": "1536:dYGmqZaUuj2umnYckQtIvq0gBbQomFL+Zv2Mk1bmMsFGke0ARAjPfO/WL8MK/nO:dbjumnjI9QqF/7LrQOeiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157807, "uuid": "692c4b14-52f3-4cc6-b2e1-25cd24108002", "value": 81728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157807, "uuid": "6e6e28fc-b0cb-47be-982e-374377719225", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157807, "uuid": "2d660988-534c-4418-850b-2bebfd7b772d", "value": "5ecdadd1a1573827c2417142da78384b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963448e4-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225424, "uuid": "44912ff1-fb68-456a-adfd-aacd328910d4", "comment": "Malware payload", "value": "6271ad0fa076cc7c9cd42d52780d4285", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225424, "uuid": "15e13111-2f58-4427-a24c-32b4d4476e47", "comment": "Malware payload", "value": "f9e08b767558b62cfeced3f5ca2bdf2ffcc3ab6149b34c97f9254ff04546a935", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225424, "uuid": "3b801d6f-6edd-4717-8403-1fcf1818659f", "comment": "Malware payload", "value": "aff9a604f2c70eaa01a43600dd72d3aca88c7a63", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225424, "uuid": "fa1a27a1-39c2-46ba-bcad-e657a318294c", "comment": "Malware payload", "value": "4f7e7c6bb1b7c5d37abe95b3b949bde19f17308393522d1f363b4391aed90ad870a0fe6645be54eaf04e66e1cc085a29", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225424, "uuid": "5ae66f0d-cfa2-4bf8-94dd-ae595cd4cc2b", "value": "8854236FF49815D5C5830C36A6813EBB0E3BB85D1DED04FD325B8C8A9A7A0436058ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225424, "uuid": "02e9b1cc-4839-4058-8634-e6835a9d3fd4", "value": "6144:714anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjr:7vIzBhNU+3WB4d66j9B2da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225424, "uuid": "d06a59d4-1914-469a-8783-bf5e791bd2ca", "value": 295098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225424, "uuid": "4c732c7c-b36b-4492-93d0-cc5e9bbf1442", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225424, "uuid": "2b4f5a15-f9c0-429d-bf9a-2eb0769b3045", "value": "\u80a1\u7968\u5f00\u6237\u600e\u4e48\u5f00\u624b\u673a\u80a1\u7968\u5f00\u6237\u6d41\u7a0b -.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81b2476-d1af-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624183847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183847, "uuid": "8a59f5b3-0a02-4120-a9a2-632c6c3d9279", "comment": "Malware payload (CryptBot)", "value": "46e595b82588489e21845e8ddf75cd28", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183847, "uuid": "32cbeb1c-64d6-408a-94b5-8e8648479281", "comment": "Malware payload (CryptBot)", "value": "f9ea5610c7a0bb3fcf4380200e3056266e06819f0ae956ee96961211b1ef98a5", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183847, "uuid": "264cbc55-ff93-42b8-8579-91fdc83fce26", "comment": "Malware payload (CryptBot)", "value": "2317552a3812470d881b08a42e00a4f4cd82b071", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624183847, "uuid": "88647bd8-7c6a-43a3-8165-2afde62322a4", "comment": "Malware payload (CryptBot)", "value": "f0df3b98d6aeeb6c4631a2a148d57cf97d432e0530ec3c20afa9bd557d1186213c9bba8bbe444e83e882f0b029b90f25", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624183847, "uuid": "5c34e772-a0cb-4c42-bed0-cc351b2ae2ae", "value": "C5F4F100B691C036F1F652FD5676932DAA2D3EB0572484C752E12BFA87787E0AD32B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624183847, "uuid": "4513548b-2dfe-4612-9b39-b7f5de6e142d", "value": "cef982a39394466fe74a88f9214df2fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624183847, "uuid": "6eefa2f7-a850-4c87-8df3-eec16dbee248", "value": "12288:iQx8RG+KhpTVDKiI8fH41e48DQ8mJVJG9H6A63NLSk0oNSI2jDhUXtSl:nmG+KhpQeHks2JGpNkNSkH0I2nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624183847, "uuid": "e766a9df-8ee4-483a-972e-c822b0681b57", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624183847, "uuid": "9cd383c9-5d8a-4c43-9c7f-f6eeaf8c5fb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624183847, "uuid": "1f56e55a-c452-49ca-b4e5-cf61474210d6", "value": "46e595b82588489e21845e8ddf75cd28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2528e1-d173-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624157820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157820, "uuid": "89d2f586-b0e6-452b-9402-493add10c6b2", "comment": "Malware payload (Mirai)", "value": "dc42174a8fa35ed677ddb9d1aa826ddb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157820, "uuid": "2488f41b-9923-4efd-afe7-2016a04b27a2", "comment": "Malware payload (Mirai)", "value": "fa2fc30795eafbb646e3621d09a88ca8dccd109836d19273faa6edd075e70552", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157820, "uuid": "bcc079e4-62c4-4521-ab8b-61f5198f9cef", "comment": "Malware payload (Mirai)", "value": "40ca9a6b094f0581dfa5c0c21604a3c1398abd7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624157820, "uuid": "f64327dd-fd66-47f5-82bd-7c94a660fb42", "comment": "Malware payload (Mirai)", "value": "0776a376dd7cc84df7f130c90e6b4222e052853a6b0beac9a7ab717ae8b706fd321338c052cb76114d3658ee2201d668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157820, "uuid": "3389e411-1eea-4e86-888f-b4025432cbbb", "value": "24D2E046168CB5B0C6C9187A7F78428B23E934B9FC1BB01318191AB8F3C7007ADFE442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157820, "uuid": "f9842c8a-0ccd-4c44-91ed-dbe1ecb861ab", "value": "384:aIik454lRkD+wNG1bwSGpl//Vixydg9xUVdGL8NiUrY/UHJjA+LDxsceMz/SmdGA:nH+eRkD+2G1boixySEjTn7BRzq3UZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624157820, "uuid": "56880d97-ade8-4b6c-a2b9-a07e0687cbe1", "value": 30188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624157820, "uuid": "ceb6c12f-6ba3-40ca-b653-e848b47579fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624157820, "uuid": "b11528dc-4be9-4500-b917-5ead1ae4af06", "value": "dc42174a8fa35ed677ddb9d1aa826ddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be42750f-d1aa-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624181683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181683, "uuid": "d6088760-d55c-4e25-b464-c39bc07b5209", "comment": "Malware payload (Glupteba)", "value": "c2bcc227d4f8a2a600e9ecac9e1397c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181683, "uuid": "9cbe148d-2139-415c-a74a-effbb6c80d1d", "comment": "Malware payload (Glupteba)", "value": "fb6dc575c8c198be8af4f170e7ff62ab2301ebef1720cb5ae6a835abd0d3a1b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181683, "uuid": "087f9d8c-f451-4552-8a83-c7b82d4975bf", "comment": "Malware payload (Glupteba)", "value": "41ad96ad60eba352e14e943806b1dc4e95ecc0ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624181683, "uuid": "82cccd4b-19af-420b-bb06-a396e02b7021", "comment": "Malware payload (Glupteba)", "value": "b9ad3ef8269acaf827b06c0a786b78133ca4f6aa6e386dfb9a85c78d21845f273c6d8af000efac28d93b1766feece550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181683, "uuid": "25b2ac1b-a7bf-4c2f-a043-f937385ae5a2", "value": "782633003250E035F97226F94B7A87AE691D369087A951CF62F606EFD2393F4AD31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181683, "uuid": "ef542fb5-cf3f-4c70-97d0-1ebc65676bd2", "value": "868eccae629fe626e7a9d52d5530b350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181683, "uuid": "a3447248-27ba-4a6a-aeef-56ee6d0a778a", "value": "98304:UUZNGjiWMA2YM7n6XZErfWgf+WABCYu7jCi/m5Dd/:UKNwM76XZmHmC7jCTp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624181683, "uuid": "6d0d0fb6-f327-408e-8945-580676d38ed6", "value": 4724224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624181683, "uuid": "673d8963-c18d-4f44-ba6f-73c7c1f8ac30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624181683, "uuid": "ab81fb87-091e-48a9-90ac-aa2937c4e981", "value": "SecuriteInfo.com.Trojan.Rootkit.22046.16482.32179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ece8b86-d1a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624180207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180207, "uuid": "6ff92e54-18cc-476f-8abf-2aecdbeea19c", "comment": "Malware payload (Mirai)", "value": "5d9aeb95fea87537af992c75ef75a2f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180207, "uuid": "35a66991-e1ec-4ea9-9f85-dab4bc005f1f", "comment": "Malware payload (Mirai)", "value": "fc2f5699c53aea267beca93c731e48445845ed14431cf7222be2bcfc4908affd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180207, "uuid": "353ae303-69b6-43ea-a4ec-3209578321f8", "comment": "Malware payload (Mirai)", "value": "6a6e2c0f4378a336d2498f6b4c7f8521781937c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624180207, "uuid": "79e2ed3e-6b5b-4ede-91ee-87b9d01a5c19", "comment": "Malware payload (Mirai)", "value": "b5bf2508192b138d15aa3145f4793afb19e47a41dd0c4bf5a6d78f154cdf38f95f9782af364540087428374322e1968c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180207, "uuid": "b717e41a-fba5-485e-ac5c-cb3408ea389e", "value": "8C23F15BA4B63944C54CDEBE978DBF733D807015B34A8B8D3B09C8C8AB1E90B664D394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180207, "uuid": "2ea8c424-4ecf-4c6b-b60a-dfb28a58eee4", "value": "768:9fmtX4nA1EpmtuCrbdrOpOVk6FbhmMVx613ngkXhdvkX08Be2dMq/TTLzPfmaJfU:tESmt/PdOp6k+hhVxSwkX3kdBhXnvPf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624180207, "uuid": "9f61d0c1-af51-4c98-9ac9-1524c066d87e", "value": 48732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624180207, "uuid": "7e1997de-1d8f-4526-8e8f-7a8e9df9c955", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624180207, "uuid": "86c78348-7b69-47d0-a463-f539264a4873", "value": "5d9aeb95fea87537af992c75ef75a2f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36601e08-d210-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624225263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225263, "uuid": "a1444a34-9ce4-4491-bc2b-fbfb7ebe8a70", "comment": "Malware payload", "value": "ac90017cb25b1e49ea1f458d813f89bf", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225263, "uuid": "f2aeb673-389e-4756-a486-fabb8307bc8c", "comment": "Malware payload", "value": "fcaa5ca2ddc9b6d3215e626c1539b74c2b84e9d67909b032e1084555e07ac83f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225263, "uuid": "be83c8ea-eef5-4484-9887-347af1a1da48", "comment": "Malware payload", "value": "96e6672a0a5744eceb13b7fa9ce0f02a6664b4b3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624225263, "uuid": "84bfff21-0586-4cd6-a232-a2a3ec5b9ff2", "comment": "Malware payload", "value": "e5dc9dcf47234d713060b95e68c6c72bdffbe265826cfa5bf637df81cb2ae16792e219bec070cb88929528e2de67995b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225263, "uuid": "a4d5a22e-6d59-47b7-8e45-e94931d38cca", "value": "9154236FF49815D5C5830C36A6813EBB0E7BB85D1DED04FD325B8C8A9A7A0436058ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225263, "uuid": "40aaa1b0-5cc6-4d42-91e2-29fbaafbfd66", "value": "6144:S14anIzB+YxNUF43WB4q8x9W6j9B2Zs4sjl:SvIzBhNU+3WB4d66j9B2dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624225263, "uuid": "48447b62-e069-48cc-b633-1396362ecb44", "value": 295090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624225263, "uuid": "dc6d054b-c916-4616-98f7-0cf7e0e79603", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624225263, "uuid": "662f168b-8d6c-4c01-853e-20442daf441d", "value": "\u5207\u5ba2\u6237\u65b9\u6cd5\u3001\u6280\u5de7\u3001\u65b9\u6848\u6d41\u7a0b.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd358776-d177-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624159884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624159884, "uuid": "bce23ed7-e3e8-41c4-965d-315704a2194b", "comment": "Malware payload (DCRat)", "value": "a7e3791c631a611d01a3dd21e7817084", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624159884, "uuid": "85ff1a15-1969-4e62-b0c4-28875b984084", "comment": "Malware payload (DCRat)", "value": "ffa14e2110fe11e446cc58d5dd447ee64619a54ddb1aa3dc7ce6805dbab3ff7c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624159884, "uuid": "6c755970-3076-4762-9615-73eaa4e23824", "comment": "Malware payload (DCRat)", "value": "a599fa690df2fbf38459a758dca0e26b239890b5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624159884, "uuid": "83fa63c2-b089-4905-af65-f48b24e7b1a9", "comment": "Malware payload (DCRat)", "value": "ec7cfb6dad6d3e87376c9f52e517478fd0c0bd2526763ec9e77b533a4f1e6f0739f4a7e1f3311b8e86b39288e4448ee9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624159884, "uuid": "94c148d6-5e06-421a-8a3c-c671848f0bb3", "value": "816549427E46DD52C06D1637C9EF886407ACBD013B66DB1B7ABB376D64123A24E0E1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624159884, "uuid": "95c7443d-6523-4a56-9093-20d52f3d61ee", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624159884, "uuid": "ad410bed-881e-4492-9410-27e0c2a37f38", "value": "24576:U2G/nvxW3Ww0tNS8eTTbzdJ0dY3/EiFxp4Fbg/OEtxH+4u:UbA30NcIYvj0qOT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624159884, "uuid": "527d375d-6e98-4a11-868c-93473daccbef", "value": 1498762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624159884, "uuid": "98ad49eb-cf41-4380-9372-c9750544157b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624159884, "uuid": "a938f21c-a62a-4968-baa0-57c17002bcc7", "value": "a7e3791c631a611d01a3dd21e7817084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }