{ "Event": { "published": true, "date": "2023-09-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-17", "timestamp": 1694995381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9d7b0732-1fc2-4d5c-8237-414327291dbd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810fac4d-55aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694990129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990129, "uuid": "edb9f11c-b0df-438f-88db-4c9b14da3060", "comment": "Malware payload (Smoke Loader)", "value": "5ba328846dad5cb3e3a41f579d25b7fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990129, "uuid": "155af0dc-0afd-411a-9d70-6c7603f05bd6", "comment": "Malware payload (Smoke Loader)", "value": "006eeeaf0491717f1021983f1ebbfc8ff71d854730229818fc45f432014d63f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990129, "uuid": "51133bde-aca9-4ff5-b2be-63aa7aa618c2", "comment": "Malware payload (Smoke Loader)", "value": "9668a1a7332cfb92475951466399cd99e2337d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990129, "uuid": "37f6bec0-17cf-428b-a62f-992de2db4783", "comment": "Malware payload (Smoke Loader)", "value": "ba89bf531a1782393286fa786c0e8e9daddb6c136f6b0a7c59efbad9502eb6066d7be22dda3c9d4c18d214126ec2d23d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990129, "uuid": "0c1f36f0-0d07-42e8-a056-a705b26519a3", "value": "T11334D021FBE0CC32E1A749349C71C6726A7F3C36A975C58B33D403691D35281ABAD766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990129, "uuid": "46910f27-aca3-4e92-bcc2-e801d7dc4cd4", "value": "942ca992441c585d4cf2a9252e32648a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990129, "uuid": "6a9fe1c9-b37f-4cee-921e-ec6c6988a435", "value": "3072:CID0ozRIGKOmrGBB/Ej0IBfopYXuCD3CbTwowx8jKJ:C0zCGKfrGi0IxopWbCbcoY8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694990129, "uuid": "43c290a3-e1fc-498e-b73d-b0a525c4cf9f", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694990129, "uuid": "3b8debb6-e8d2-49e5-a204-0bc8f52ba799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990129, "uuid": "5045b40e-d58c-4261-ba91-5085ed4fca74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a40b742-54ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694909318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909318, "uuid": "7fcf344b-db4d-4ad4-959b-dbb211b6742d", "comment": "Malware payload", "value": "4ff01cbc0d241becc42c762c7aba5f43", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909318, "uuid": "5fe65919-122a-436b-918a-f5cf3b6ce167", "comment": "Malware payload", "value": "0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909318, "uuid": "ef1350ab-a48f-4476-8f1d-cbe0fc789b46", "comment": "Malware payload", "value": "db9b78306832022c3d23f0be749bb63d7dc29de7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909318, "uuid": "5bb3447e-a184-4358-8910-2bbe911f25c3", "comment": "Malware payload", "value": "050df827a06d8452e91416e9385a281920c4aef6cfc330023a09eb39289ec45e4fffe70e985024e9d59f40a29be874b8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909318, "uuid": "06160278-121d-44f7-8546-d29614d3869f", "value": "T1CD623A8BB7574DD9D0658371C9630A21E2B2BD210773DB9F13C1D4682FE92827E25F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909318, "uuid": "c3beaeff-4857-4028-9e50-e6567aaeec51", "value": "3bb4152e39bc31823f4f78dad4ac7927", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909318, "uuid": "e7d7b149-204d-4e7a-a78d-f556f952b2e7", "value": "192:xsPFgKBeKpBIRL4CXE1Mzpe/RaSuu/pabagFjwtFwpB0assgAV2Pt3Q5tfMcT:xsPOC/wlXE1MNGRa3uYugTK3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694909318, "uuid": "b60356c3-5a61-4c69-bafd-58c90a2125e7", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694909318, "uuid": "6f9ad5b7-7760-4314-abf5-6bbaee7f2f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909318, "uuid": "f91ca87b-941a-4c0c-9e6f-c1d68e5cedb2", "value": "4ff01cbc0d241becc42c762c7aba5f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27a28ae-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960979, "uuid": "02e5e314-02c1-403e-8ab5-06a7317fb84b", "comment": "Malware payload (Mirai)", "value": "a5ca2fec1c5cb92a0a23ac3e8d1046f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960979, "uuid": "b3e6be8e-f7c3-4763-b29d-0dc06017632c", "comment": "Malware payload (Mirai)", "value": "0202b02f77141ff3aa73aaaccce0d292f03320511b8926376ccb19a0a011714e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960979, "uuid": "a0a8700a-906a-4cf1-a227-2654324306a8", "comment": "Malware payload (Mirai)", "value": "b5a21dedb942fe1c11bd5a2ac60b964669868311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960979, "uuid": "375e4534-c89e-49c4-83b5-a9300b81e428", "comment": "Malware payload (Mirai)", "value": "58751d04703d66e50886e83b20e8e8ed0497a9059235bd00347a834c33ee2848e2baa8f36675081aff46d8fad45f9a85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960979, "uuid": "341c2970-a2ac-4481-a24d-c821768a320b", "value": "T173535DD9B8019D3CF84FE6BE80220A09FA31735151930F2BABABFDD36D721656D16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960979, "uuid": "fbcb7b8e-1d24-481f-9e7f-93129195968c", "value": "1536:q8AeFryZALOoddghYWfKyI68WhS89q+daesm:7hFryZ8OoduYWCf4g+wzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960979, "uuid": "750e8211-018c-4329-aa91-65264938a06b", "value": 60812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960979, "uuid": "cf60ad1e-9a62-4a6a-96b1-d362ea6746f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960979, "uuid": "6e4a162d-5295-469d-9124-424404f68afc", "value": "a5ca2fec1c5cb92a0a23ac3e8d1046f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c08fa73-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968699, "uuid": "b1b8e856-15cb-4040-a239-c0f578eb6585", "comment": "Malware payload", "value": "464be853c3cecce7e302990775c07892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968699, "uuid": "a581bf9d-acc1-47b8-b211-fb74fa14204e", "comment": "Malware payload", "value": "0445161ae3e5ef62d8d4dbc8f834afea54afe42f315599dec67bf59e84ee665e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968699, "uuid": "c37f8c49-e3d1-4452-9e0b-1b0835f174bc", "comment": "Malware payload", "value": "f9f3d4c75566111bb8c8917e18b74a2da8ab8861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968699, "uuid": "8cfd8e6b-293b-4755-84c5-9623bf91552d", "comment": "Malware payload", "value": "1e83a81261e5b456345d39117d4d5620e72b8d9bf306d754936cc70d8146233a4e67900fbce5694150e9042363a08ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968699, "uuid": "ac8d7353-ab0a-4d65-95af-7d2ed49859e5", "value": "T11B720863E9938876E22D89BC5D1DC434D03A2A303F6525E39BAF2D4ED8151CA4B7D361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968699, "uuid": "c61362a3-a773-4084-ae67-f5131aefe6d3", "value": "384:f3HqsREnZX3Qt02g2D9ZgNEVXR3fEyugibF8YQ:/KSmX3MVD4GXZEyuhhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968699, "uuid": "223bbcc8-4c69-425c-8bc2-b9617902846b", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968699, "uuid": "5c4c5083-e7b4-446e-aaed-28b4d6b0876e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968699, "uuid": "9b3d3081-a4f5-47c2-a69f-132719d2cfab", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.24336.7621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2412f9c-557d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694970991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970991, "uuid": "758089ad-ea32-40f8-8241-071451680566", "comment": "Malware payload", "value": "ffcf83fb9e24a1af60d62899e4feaa42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970991, "uuid": "bf942f3a-f5b3-4262-80cd-866441cb8128", "comment": "Malware payload", "value": "08ec59a8f7dd93535d86fbac4879dc522e57f8e3639c4e85c3e976b77543d5c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970991, "uuid": "c356b831-6582-4a82-b853-d236c29255ba", "comment": "Malware payload", "value": "5fc03c9ee58e8f3818ae9f2a8d800b9536006e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970991, "uuid": "793c3c0e-ed7a-4908-a071-a6c68dfe5cb1", "comment": "Malware payload", "value": "49602ec291b7ea9cc5e9f38ea5d423772bd463c4891d4d6422649024cc791cbe11cbebf0d15617303b81d2708886006f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970991, "uuid": "61bd50a2-db56-4c9e-a38a-42f91d88f7aa", "value": "T14D132A997E644CEBE651533E80E7C7762B3DF1C14F235BA3B734BA344B236922099246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970991, "uuid": "e26ed8ba-8053-4b2e-ae08-19e9b9456e7a", "value": "3be01145f2497dbc896373cd25781646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970991, "uuid": "33a8c5a2-f3ad-4d27-9203-5afe588c907b", "value": "768:gqEnKFyKHl7bbPP3lLuzZPKqdDEWx3nh3:7FzbbPP3lLuBZdDb5nh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694970991, "uuid": "509fbabc-e668-4a48-b58f-2ab7140a3af6", "value": 44267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694970991, "uuid": "2e059dce-0fa4-4f6c-9d59-357f5ccb2fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970991, "uuid": "da3eb4a3-4da9-4372-8b8e-dfe9049737f2", "value": "pos-main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eab844f-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968677, "uuid": "4e8434fe-ffb8-449e-a631-5be0c9587a8c", "comment": "Malware payload", "value": "0748ec1f4926d80c602a30e2dd165c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968677, "uuid": "46f17686-8c86-44aa-a6c0-3358131a9062", "comment": "Malware payload", "value": "0adb3edf871a462aa459c4e568a5d90d7cf2d32afc11f11ee124ed072ffac059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968677, "uuid": "cfc6ad42-8bae-4af7-9f9a-3fb1d13ade64", "comment": "Malware payload", "value": "670614ed7318bde727beba6d5f6e78cad26d50dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968677, "uuid": "fca68825-aff3-46a9-be3c-d739e57f54ae", "comment": "Malware payload", "value": "46166378d2c12b894712ce592cd7edd37c1c32480edb88a5c7f6669ca1c18ea369dfc18351bd6c1ccb3d568ea00198f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968677, "uuid": "2cba48f7-06ad-416e-9930-c889967fe9a6", "value": "T1DEF3B0C1BAC680F0F7891570109BBBBE9B35DFDB020E9FE3E1A4EC656523611F926181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968677, "uuid": "6345d894-6043-4d9f-af24-75e5cc101b72", "value": "3072:GaN62KbLeXy3u/999lJwuv72nV+/VwaoaElPDvgjHWEQl6hN:GUXKbaXCu1ku64/VwaoaCEWEycN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968677, "uuid": "0bee05b1-3f61-47e2-9a55-86a5b135f5fd", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968677, "uuid": "029ce97a-b472-44a6-a2ec-949c5c1a9705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968677, "uuid": "55130d8d-abfe-4608-9610-08f3db077010", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.18702.26785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cc7cee-5568-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694961629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961629, "uuid": "b90af275-d11a-480d-a7e5-594518fe0e95", "comment": "Malware payload", "value": "665efa3425a313cde1e9f3f29ddfe90d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961629, "uuid": "30e45196-e84d-4a50-a27b-4e81f96eece5", "comment": "Malware payload", "value": "0c0a6b80b7212f2348dac27f51da6eb551b2a24277211e91fed9087d7932f5f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961629, "uuid": "81591b9d-e80e-419c-8b52-776a15604462", "comment": "Malware payload", "value": "78372a1083d16a0b9a25376b0d3885f370ef2f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961629, "uuid": "0c1ddce9-ecfd-4b46-9af9-d4b518017ae6", "comment": "Malware payload", "value": "60272d7323aa16e573e849443887bcdf7c3ff8d6fc69c41e2e0a785015f3900226d76dce57286e85a62ece9286472c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961629, "uuid": "35b92729-1e3a-463c-9dd8-d00a9a846847", "value": "T1BAC384104974CC9AD6616C701DFCA1C0F1B2E2726A8809BB37E4FD14AE66F5BCD50B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961629, "uuid": "fc6352ff-55a3-41c8-bf5a-53cf9c411251", "value": "1536:uwN8G+rOTm20IF8gdxPCVYVJIWdxPCVYVJIRRCk:vb+iHF8gdxPCVYVJIWdxPCVYVJI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694961629, "uuid": "0487d12a-21a2-4941-9b89-e764dd56a185", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694961629, "uuid": "fe5b063a-ae82-4519-ab18-5974702204e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961629, "uuid": "33786986-b562-4b61-9faf-410b955ef0f8", "value": "SecuriteInfo.com.Variant.Zusy.462805.3778.8748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de52efe-5505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694919257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919257, "uuid": "09b3e550-ae7c-4ab0-a6b3-0a3ca9554ad0", "comment": "Malware payload (MysticStealer)", "value": "e2b96d3893fcb06c801ebb54eee960da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919257, "uuid": "e0636e43-e579-4717-8bf0-6b991cc5a4e7", "comment": "Malware payload (MysticStealer)", "value": "0fb4b0703ee871730124126764f0b92b01eab05c7bd39666a70b906730f44327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919257, "uuid": "e76350a2-9895-400d-b6a7-39c8a90e0a23", "comment": "Malware payload (MysticStealer)", "value": "d4b267f9424013c54c215b169cafdd569bc40885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919257, "uuid": "ca29a430-0767-4d93-86b0-0bb12393c3f8", "comment": "Malware payload (MysticStealer)", "value": "11e297f1a4f4105936a771db96453384564da4068fd40aebf877f1039d6835e3c6800d6a8f36209f65aab3ba1d248f0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919257, "uuid": "d2482475-c7e5-4db1-b7b4-398ec345e19f", "value": "T14D74AD02BAD08473CDBA10359AE4D7B9567CB520039526FBE7E41EBDCE632C09E31967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919257, "uuid": "cfc8d836-4982-4658-87e4-37fea8d620ff", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919257, "uuid": "96d619f3-928e-4fed-893f-2535d7b730a3", "value": "6144:GFcaGEZt20ZSwbz8+Dxe8kVAOZlNQxV7ICoOCHnS+GJpXsOdFm9W0tfPh8Ey:GFFzZtT78TP7uVECop2fm9W0tnh8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694919257, "uuid": "4e6d0e82-ae1b-4397-b2e3-b4e873186a20", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694919257, "uuid": "349ca54b-1f07-473d-abe6-814aa2d2b14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919257, "uuid": "41e1e796-6585-4abc-a6f0-e0351fa080d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9048d20f-54fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694914563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914563, "uuid": "374db46d-f00e-4407-ac4a-1e6006233bbc", "comment": "Malware payload (Smoke Loader)", "value": "422a3a0f71f92c817641307c63355e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914563, "uuid": "983e4ee1-6e95-4156-9a7c-3a8ee1070763", "comment": "Malware payload (Smoke Loader)", "value": "12eeed553b2a15c4fac0fdcc12b0f7ecf75d92a82bb684d5a503dbd542104c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914563, "uuid": "63a67ed6-4b39-41e2-9f55-d7d5bfa9d497", "comment": "Malware payload (Smoke Loader)", "value": "191b8d88e58e55be14851342d67ac28b7feea085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914563, "uuid": "59e8accf-be57-4578-8787-e5991cc24051", "comment": "Malware payload (Smoke Loader)", "value": "77e885a744c5d128be83918ffd64fc105a6fac7529601aa5502a2ff38163c653afe78a1fe7c980f6a69625f399a91513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694914563, "uuid": "48ba773a-93cc-4cf6-acbd-e4e1734ae993", "value": "T19044AF02D3F0AC31F1224B359EBEC5F4662FBC214E79AB5B2318772F05B12A2D562759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694914563, "uuid": "b03c59f4-148c-4fcb-be00-1464fd8125c8", "value": "0e5c0e73b8bfe5fddd6a11f97096fb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694914563, "uuid": "82c3c0d9-e22c-413d-87b8-468e6b959494", "value": "3072:aiWrg8Z+Nf257SH91FL5Mu/Y9lYZ96RGK2R+5aU8AxreW:adDZ+N+ZSDFLeTM96RGhIXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694914563, "uuid": "22d7cb66-cc4f-4eb7-843f-15ff15cf2e88", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694914563, "uuid": "fcd5d647-e7ab-42ae-9c0f-784e88118fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694914563, "uuid": "88cf4b31-8ef9-42e2-980a-1db094bb4dc3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.6435.11358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d07eb76-5556-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694954017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954017, "uuid": "3b6a013f-ef72-4844-8930-5bd8d482dc98", "comment": "Malware payload (Fabookie)", "value": "38475bfe32dc9f2eb24153a55563753e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954017, "uuid": "11476500-dde7-4251-a579-9ed08b45e138", "comment": "Malware payload (Fabookie)", "value": "13432bb69a15fc06f0251ef2aa6261e53136dc808194c7aa2723859c3d057414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954017, "uuid": "c0c1dd64-9988-4d9f-be5d-fea2c3aa81fb", "comment": "Malware payload (Fabookie)", "value": "38a0075f5b5b2cc0cbaaef4272535201a7f8a398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954017, "uuid": "df9c3377-8ca8-48b2-8a93-2c0552172c6c", "comment": "Malware payload (Fabookie)", "value": "a5eb2950ea12155d8441309aff826b25d66843b66c487d8fd81d2ffb1c50e56cf7be2653302fe1d20bc5eef44d961af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954017, "uuid": "62bb0340-e77b-4c04-8948-b7b8103ecbd9", "value": "T1AE544812AB25DFB8F0C7C8B6BD70410218E8B4097758B57E96CDCC751A3BC51ADB1AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954017, "uuid": "c7b0569c-ca95-49d4-9247-086bb8fb766f", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954017, "uuid": "c5ef457a-96e3-4232-ba73-3d68b526d6f1", "value": "6144:kXkMxMrUwCE2kWCZ3j9Z0CI0iNmpxyN90vE:MkMxMqEVBkCInWy90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694954017, "uuid": "8449a17e-7e96-4e18-a135-2b6a4b08a46e", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694954017, "uuid": "0bc37fe5-17bf-4c1c-916e-2bf912c119c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954017, "uuid": "140f5511-0ff8-4a0c-a19d-71a04dabbcb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc078d5-54f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694912223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912223, "uuid": "5a877f05-1db3-43d5-9b5b-0b2f9a896479", "comment": "Malware payload (Mirai)", "value": "1bd42b7afb9d6c268cde7c083a76b26c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912223, "uuid": "3bdd121e-2a0e-4828-aa3c-0288f41b613e", "comment": "Malware payload (Mirai)", "value": "149371bf8eac4816c42e14a77fc09017b3a58aa6d96070642cf3026bca7b54e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912223, "uuid": "41e939bc-649b-40ee-a8b6-0deb7f656894", "comment": "Malware payload (Mirai)", "value": "6d61d12fc6c7586ddeaadf60066280594524f826", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912223, "uuid": "b98619c9-ef9f-4de3-8de6-e73eb32354a5", "comment": "Malware payload (Mirai)", "value": "338a5bba42d1b9b41ad6bae0f2fe49c0de221e330460dec1935e21964020d4e56a24ae251a81325e3fe2337c244a5981", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912223, "uuid": "0a1ea883-9a03-4aed-8e2d-814374a51fae", "value": "T1EA735BC0EE43D8F5EA5306B1113BA7364A32F7391129E943D778EA33BC52201D5A679B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912223, "uuid": "592e3726-22b7-4787-b99e-25c4d8f2781b", "value": "1536:03gZy7h5hSebHcw2Ug61h5Om/PSaOUf+nrOXpK7Vdc0juzFXhOGxLZhTySpxoZ:03Oy7h5hSebH5Rg61h57/PSq+6XSVdBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694912223, "uuid": "49835e6b-6d1b-4b33-8016-702380a7954e", "value": 75568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694912223, "uuid": "b9081c1f-f91b-48f8-97dc-d3a533bbe81e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912223, "uuid": "fa1fbc96-2cd6-4d1e-bead-db14da0833b4", "value": "1bd42b7afb9d6c268cde7c083a76b26c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71e8d3c-553c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694942948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942948, "uuid": "75f01f8b-1328-4c99-be60-45ea60ad8638", "comment": "Malware payload", "value": "19c917125e85f8c783d04643c42fa5d4", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942948, "uuid": "68e5c201-b9eb-4240-8e50-9bf3f6cb6b1e", "comment": "Malware payload", "value": "14bf25cecf0bfbd7e3e07e12b8bf8a68e0540c2e7a38e6e0700eafd4d1028e1e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942948, "uuid": "245491fd-b9e1-40fc-b1ef-185fcbcbf7b4", "comment": "Malware payload", "value": "67e87532a8feae61316a098ed2485e9bfc8f485e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942948, "uuid": "e206f3e6-9cf0-41f9-8d2b-2ae1d5635058", "comment": "Malware payload", "value": "69eb4216e2bad8d92af6f751e7fb4981e7303241ffd93ad2134031fea8a9b784997027afb529ec8dd760b6e4130d3862", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694942948, "uuid": "547218c6-9024-45ab-94f0-d5fccd683d32", "value": "T1773633F3A57D20CF371F2AAB30F54FD2C7BD1643641D0A9E6E3A54A32A12910DE1856B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694942948, "uuid": "a4893abc-3deb-4793-9a14-583165db2e1d", "value": "98304:L4VPccrj4/uJxU+zXOXK03r6PfXnA1BiygoTmiZzcFe05qjdlj4pNbE+6H9:eUA0GVO6HYF6QjdljKy+6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694942948, "uuid": "25edb2ba-1909-4d0e-a20f-5d4c6aaa4209", "value": 5243998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694942948, "uuid": "8f756452-aa06-4d49-9bc9-c0a01146b7ea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694942948, "uuid": "17aafef0-683e-411b-9f95-c54400a70ebf", "value": "Password_2023_Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd59f9cd-55b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694992914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992914, "uuid": "58c7e98a-67a6-4a27-96b3-90c4ece56f56", "comment": "Malware payload", "value": "c2f0ab10869de4c6b8b79556643249ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992914, "uuid": "428fd029-930b-404e-a27c-0651ac457fa0", "comment": "Malware payload", "value": "16ff5dfd8729c37d99a097778c7aa85651179f9985878863babef59a5b0fde5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992914, "uuid": "a237e801-3b7f-4f44-ada4-ced6b956862e", "comment": "Malware payload", "value": "9f762e9464024e0d26ea17f692808e2cb5cbcd22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992914, "uuid": "caf6d86a-8414-4127-aea7-114c0bfb3e7f", "comment": "Malware payload", "value": "900568a33d5cfea195a26b33e9053a0e863d776dd998f98d59834b5026ae5c6fadad277618f8931ef59acb6f8692b827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694992914, "uuid": "b7537f30-aaad-4db1-add8-10024c3c9ed3", "value": "T1CCB5F7BC3E850D72CD8D89F087E616087B50DD925710E1E6251277CFB62C7C2A9AEB87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694992914, "uuid": "b0d8691f-6a88-4b83-9cf3-de5cbe25b061", "value": "49152:jowrxbfpsgAy5dxxCuWtMpE4yOeccKjLwrOwdDNRlKaBD4SAHHedm9iRsgUi29Uk:K+aeKvg/BNZDK1JA1xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694992914, "uuid": "727e82ba-cdee-479e-b2b5-76b688677b6e", "value": 2341376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694992914, "uuid": "05d22422-5438-4a2a-bc59-9515f192089f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694992914, "uuid": "d37c48c3-10fa-4bc3-b479-3a8408bd6ce6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8491558e-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968660, "uuid": "5721d54f-5e48-4cf4-90a8-82ecb7530d51", "comment": "Malware payload", "value": "b3d371f3413c87edeb08020f786d7e4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968660, "uuid": "7fccfcc8-7827-46d6-94e9-bd3e2d093ee5", "comment": "Malware payload", "value": "176c0a7d176fe3e54ae6bcc6dcef5ec61c80f9c7a5e1ae079dfdeae2a512a51d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968660, "uuid": "db5d747f-c4f3-4522-a159-b5762b762722", "comment": "Malware payload", "value": "fb894a7f3a5be9507fd9db49c30904b5b2cbe430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968660, "uuid": "35d2d515-f759-4de5-9176-e4bd669c186e", "comment": "Malware payload", "value": "f881d6c77e3fad1bd126bc27e10a89215b41ddc94baeeae7975b1dc7a6fbb313382fcfe799c83d31d3bc01e359e55ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968660, "uuid": "2aba0f7c-af10-4b57-86a2-5a5861fbaf2d", "value": "T1C2D4A727DD3864C1EE111472083A2A6964092814B40DAD87F796BE5C25FBBD3BAFF317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968660, "uuid": "03a838d1-4fb6-44ce-87ea-d251e85dcca8", "value": "3b9eb7d8da92f034123b8bc3acc8f72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968660, "uuid": "c794d08f-8e0d-49d4-badb-9b694c5c8d4b", "value": "6144:AahDjU0JqbUe/UdKi8CKRSNOSHxbyWVcqZ:AbiqbUeayWVcqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968660, "uuid": "ff62f46c-401b-41bf-9509-fb91d047f0b1", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968660, "uuid": "45247102-82ce-4167-9cba-1dd15f606e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968660, "uuid": "3c22a95a-c092-4838-bede-2aa945b5ab81", "value": "SecuriteInfo.com.Worm.Win32.WBNA.19386.807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6e680c-5581-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694972406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972406, "uuid": "6fe3d9d3-e9e7-42b6-ba90-1bb872ae99ac", "comment": "Malware payload", "value": "553199b88bcb2845c2c9752de9ccab8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972406, "uuid": "3bd31d02-69fb-44d1-9522-4980dec57099", "comment": "Malware payload", "value": "17b13e99c56e753ad156533835db48574b8a5c8f0f99cd9d009c9fd090447579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972406, "uuid": "e9a7f1c2-5182-477f-9651-4e99e0bb7a09", "comment": "Malware payload", "value": "9b8e73464ff523144a15573b07e656e4c283addf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972406, "uuid": "f4dbfeec-8328-4f0d-a4a2-8218eee971d4", "comment": "Malware payload", "value": "2fee7d4e9f51588145af98b3cecb916baab3c5a6a5aba128228d2a2ee4cc0aad676dde619987bf4856548420079081a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972406, "uuid": "7722d12c-9d15-4691-8a86-57bd3444139b", "value": "T1E8A3E02122708831E0A36A34597586725E3F7C7322F5DDCB2B645A795F302C0B6BDB6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972406, "uuid": "9f08f42e-2231-47ec-8ec8-bf30783b757c", "value": "1536:WEpsi7fZAXc8ZHyjcEdFD+PPMApoBQh7QErTBhmYZAQ3WVwUhLI/A+h35:WEL7fZAMg8P9yo8ZGkAlhk/V35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694972406, "uuid": "e503effb-2c10-4c29-be55-d71498bd8cc0", "value": 97941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694972406, "uuid": "feffd54d-1623-4183-99c1-70afc8443c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972406, "uuid": "ea1fb520-faa0-4c1a-b275-713c194c6706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811fd7c3-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968654, "uuid": "5777466b-91a1-47b2-a8ad-80709ac0fb5c", "comment": "Malware payload", "value": "83b7f386c0c7abde6ff22996b94c66a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968654, "uuid": "a88982ff-6981-4298-9d9c-85a0ac361bf8", "comment": "Malware payload", "value": "18c6cb8dbdcb66ab3c7f48de9e8c2317bd16ea6f7953eada4694efbba00ac9ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968654, "uuid": "42a8f878-78ce-4342-943a-d70b1afe152c", "comment": "Malware payload", "value": "ecd3b712a3d51a8d76916119854d3afa5528aef2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968654, "uuid": "6d96f161-250b-4389-bb71-983e431ea593", "comment": "Malware payload", "value": "2f5743c3b21d16436f485880020feefe3650d5c64aac8e93ac0722cc0dccef194f51f56b4bc42baf7020ab843bea5210", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968654, "uuid": "2c64190b-cc5b-4210-b486-cd6fba351fef", "value": "T18CF47C47B074B5A3EC2C2433A827B9655A136C389D8A524BB5D47B2E8CF3053F6335A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968654, "uuid": "f720f346-dfa7-4180-a704-54242a705733", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968654, "uuid": "0a35c788-b8bb-4ae8-8882-4410c62eaede", "value": "6144:+RR5rhZFQGrsUwF7vlPoSTWb2JlSxKzfwY+SNM4VqraB5zboPkPxtoH3yfDWb2Jz:+R5nWFpPoSQhBh5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968654, "uuid": "d3d6ad92-bfab-4fbb-a269-4a8f1e62e800", "value": 769032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968654, "uuid": "5029a428-d258-4f60-9299-e4f2d160a2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968654, "uuid": "f61a4513-db1d-4549-97e2-ad703b3f5d9b", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.5705.6990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98876295-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968693, "uuid": "a365bb95-a5c5-4458-ae49-bf5838eda6ef", "comment": "Malware payload", "value": "1c5d71b2ff1f67c3c6034224f63bfcaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968693, "uuid": "f7f503f6-af69-41b1-8ba6-cad8fb304956", "comment": "Malware payload", "value": "19418bf35ea127603058cc2c8862ba6805d363c20920785041bb420f6b7f2879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968693, "uuid": "628acf0e-7cf4-456c-aecf-a4426cb1a095", "comment": "Malware payload", "value": "c0d0f9a1a7092b4d33c5c29c27762e1b025ea3dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968693, "uuid": "4ffa26fb-785b-4b29-b13f-74be765cf6db", "comment": "Malware payload", "value": "a755aafa9148f973211b6f86f7e959a47d52b5c9c049c31f595fee3fcfbe8224380f81f4972152a4d031a970df3d78f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968693, "uuid": "1698a0c0-02d6-47b2-90d6-a3523ad5da8a", "value": "T1D4965333E91DEE8FF6C344306C1C76E06541ACB4A722DD7272807B59157E943AEA8A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968693, "uuid": "b7883289-9990-4a45-be59-e49ff7b6b43b", "value": "37131fbff34e2558bad26b7f739efcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968693, "uuid": "a95be76b-85fe-4557-9746-a593e0937cd9", "value": "196608:I13w4dCoEvhwyBMprc30NTWFjG/gKvp64MztcW9PmIvJoSZaEuRDPtqgdDQuz+uI:I13w4dCoEvhwyBMprc30NTWFjG/gKvpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968693, "uuid": "5d8fc51d-ff7f-402e-af24-14fb8a1cfe34", "value": 9338880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968693, "uuid": "82d24646-349e-4c43-a9b0-bd88b26f4938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968693, "uuid": "00e98a1c-4cb3-455a-be26-7c15dbfd3327", "value": "SecuriteInfo.com.Worm.Win32.WBNA.8220.32200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48573d11-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983591, "uuid": "4214d5df-12fe-43fa-a240-d62a9da1dcab", "comment": "Malware payload (Mirai)", "value": "b0355e97101929bcda41666e19ca4892", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983591, "uuid": "5593b271-dbcd-4d10-b8b3-d4ab43c5a09b", "comment": "Malware payload (Mirai)", "value": "1aa84b3ba14bf039c5eede66a402cb60b3032172815002722ff8ade0cfcef40d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983591, "uuid": "2b4b7d0b-f377-4013-90c2-04acc00bb836", "comment": "Malware payload (Mirai)", "value": "badaad07e95a1c3fb7ead851a807ce2e6e4947d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983591, "uuid": "c2175117-00f6-4b55-86b3-20b7fa65ccff", "comment": "Malware payload (Mirai)", "value": "e308a1bc02b1168cde80f43d4cde72515b56037066cade02d21120aa206b0185cca0c61871a03bdf00fb0a130a9ef43b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983591, "uuid": "17ba5f41-6602-4737-8b9b-a0b0488ab8ca", "value": "T149B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983591, "uuid": "352a7672-1589-4fae-8fcd-c5c9aaf3866f", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg10/LWy:c9sSyzz36YaWWgg10q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983591, "uuid": "5c969a75-3eab-434d-883e-f203d056c82d", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983591, "uuid": "81e442b0-7413-46e5-8fbd-36e3f391a1a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983591, "uuid": "c804c096-3aab-4074-b2af-83824b72f4ae", "value": "b0355e97101929bcda41666e19ca4892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b38c9f6-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968698, "uuid": "3093c9f1-2c28-47be-a5ca-9c3d0160c545", "comment": "Malware payload", "value": "2c5d342a51c861057a7e069ef3ec2030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968698, "uuid": "b139a55e-3478-4ce5-ab20-c5476135e956", "comment": "Malware payload", "value": "1ad57861e60453807e25c854a6a552cb4a928378b185a059b3b4d1d4be540abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968698, "uuid": "601aaa0a-9dfb-44c9-9b9e-16a8764f08b4", "comment": "Malware payload", "value": "c10c4f2e6170736d393c686365530c990e2a7c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968698, "uuid": "755fb198-45ff-4a85-9d4d-ee65516d2ed2", "comment": "Malware payload", "value": "7eb9c30fdb5afaacf75a7ca5266b8ad64587dc43de9c29f5787320ced064e74938858d4c3c28fb8570e5e465527cb4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968698, "uuid": "09a2b837-586b-40b8-856b-29faa6363e74", "value": "T107D3A613E920E689FD414871241982DD59863C37E0156EC3B7C25F98E87ABD3AEFC627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968698, "uuid": "e92409a2-d892-47bf-9e8f-891933ee070e", "value": "00902fa03f9c68238603ec2d831754c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968698, "uuid": "d5527265-51ea-4eaa-9c26-1986254bdab8", "value": "1536:RO0Zka+YsbJA899j8M8cs7csMsjW26GGP0MWLW08M8cs7csMsjW26GGqqhpXFj:Rj+jVA899M0qhPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968698, "uuid": "3d525cd3-994e-4159-9901-797cb799d5e7", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968698, "uuid": "dcd10b4b-bb90-4833-bee0-08536891076f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968698, "uuid": "c598ccb2-b055-45af-8a59-0d46b838df9c", "value": "SecuriteInfo.com.Worm.Win32.WBNA.33.9208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991fb270-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968694, "uuid": "01397e40-911a-4e46-ba50-5c2d66a911e7", "comment": "Malware payload", "value": "125b5745636ca00da79edaa555b9de10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968694, "uuid": "25d234dd-fa5b-42cd-a553-8e439435e388", "comment": "Malware payload", "value": "1bb335076a4752b62eb362ed6a002c0ef1e5050ac43b1533063ec8a9aec108d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968694, "uuid": "941062b4-2ed1-46bc-bf82-150c7a4e29ca", "comment": "Malware payload", "value": "a93a082b03469e48d9a03cbdae5306b43f53a6e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968694, "uuid": "b9e15103-1fae-4469-84e2-1c09df08508b", "comment": "Malware payload", "value": "6196326c5d9256870a1e475150be890f2f8d00e52517c389d6f4220682189dc9718e77cb9475726a9410b237a5581136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968694, "uuid": "e233de20-44b0-4315-a3b7-0c7c515ff6b6", "value": "T1FA823A63E9C289B3C25189FD1E058534E737AB312365A783AFAE190DDC192C08FED571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968694, "uuid": "d0058cf3-8bb6-4e60-83dd-9c89a2d67690", "value": "96:nPPnZ7fTtzWDgkc6AVnkbg9Es0EClccs5yJNZNE8NoD9icN2XG:nnxfRq8HebguuREnZxNwLN2XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968694, "uuid": "57913f1b-8a56-4525-8e86-480a74db0bf1", "value": 18613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968694, "uuid": "61fb1b3d-e16b-4462-bd5a-2838607e6b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968694, "uuid": "ee15b296-7323-4840-9327-c189d8ee4983", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.2442.25052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8737115-5543-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694946010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694946010, "uuid": "bed66124-66a4-4d2e-9e3e-3e9434eb06cc", "comment": "Malware payload", "value": "4c77bfac974dc61427b5589001c7fb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694946010, "uuid": "36b995f6-eb41-41c4-99c9-d913461591ba", "comment": "Malware payload", "value": "1ea7c167ec0f7c571469c13ddae88556435d365b155082146808945402ea20a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694946010, "uuid": "17c6d723-7d7d-4b35-9c85-ba397017d259", "comment": "Malware payload", "value": "19ac1ddd66e9c215380e620a0fdefed8f2542335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694946010, "uuid": "9f0cb8da-290b-4df1-80ab-d8af561cd3cc", "comment": "Malware payload", "value": "4d1ca70f7b1c9562532b7e7e1ad587f9ec8c702b57d41a3b8a5606327c995d62af57c6134eb9a14d737d4a71b0be1924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694946010, "uuid": "57fb649c-d332-4d09-bdcd-bfcad68bd53a", "value": "T19BE73331768BC53BD5A204B07A2DD7AE12287FB50F7294C763E81E6E45B48C38631E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694946010, "uuid": "e224b91c-6d53-46d0-aac7-11999cda3a60", "value": "1ee3b0da38e7b7c567f93f357ca3751c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694946010, "uuid": "0d5b17ac-6d67-4c69-bf79-a20833322877", "value": "1572864:SntSrZFG7Jwd4USFTPGHcFsO/4EKT+ob7WQ5Rbk6uiTj+he6Y:SMFrAB9Fp4EKTAQ5RdseX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694946010, "uuid": "6b326a98-2957-4037-91a7-0b5036cfa341", "value": 67373764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694946010, "uuid": "2af75b7e-02ea-4bed-867b-0ee315308ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694946010, "uuid": "5382a868-798f-473a-ae88-48239b0116b8", "value": "CCleanerBundle-616-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213d3254-55a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694989109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989109, "uuid": "5134e317-e389-420c-be3f-59302b47e849", "comment": "Malware payload (RedLineStealer)", "value": "0eac27cc974d7871f85ba09f322958c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989109, "uuid": "ad334cb4-6c5e-4d3e-a12b-3b5a988661d8", "comment": "Malware payload (RedLineStealer)", "value": "1eeedaf5b11c7e93797bbbcb4e6dfa2638a66534254694d7f0cd40412dd209a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989109, "uuid": "be52a946-9b81-43af-baee-1b4dc8aba66f", "comment": "Malware payload (RedLineStealer)", "value": "96c8b3a2c9d72c713aa7101b77253c46789da29c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989109, "uuid": "1d0e255a-197d-47f7-b30c-5d771dbc4fc0", "comment": "Malware payload (RedLineStealer)", "value": "38f50fa5b10a4d4c0ac7eca3cbaaad2f4004c1628198157dc4b757d4a0acdcc7b795f83a564b6d9f73f65d8cec4a962c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989109, "uuid": "7526ee91-c14f-45f1-94e8-eb03a01f4883", "value": "T115849D0174E50032DB7A14369E984FBC59FE3DB4079C6AFFAFB80A794E641C1A633661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989109, "uuid": "f665c0b0-3fc9-486d-b068-60e66846e642", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989109, "uuid": "2ffe292e-acb5-414f-8bd1-74cec5ab657e", "value": "6144:ggvJm09zORs+z/TMify9DAOogQDoTiu0xiM8V+Woi81PHPHUnELB/8/:gww09CK5Nrtiu0xV8BU1Pv0oB/8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694989109, "uuid": "b396c89e-b6ac-408d-8ed7-490b2d1a4acc", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694989109, "uuid": "795ae7b8-ce41-4c53-a47b-f04760b9c71a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989109, "uuid": "6aab169e-aea1-449d-8282-d27df2209427", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871eccde-5508-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694920561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694920561, "uuid": "e42ada6e-9d7c-43fd-91be-7cb5a57c35b3", "comment": "Malware payload (MysticStealer)", "value": "50fb6fb7ec57224b2fe144fb96242255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694920561, "uuid": "6edd68b1-46b9-407a-8a6a-516fb09a0b64", "comment": "Malware payload (MysticStealer)", "value": "220b82bdb7bb8fb762da2930a87c89cb72727cc3edd5115f1b525af3a156b7fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694920561, "uuid": "2898740f-0567-4715-ac50-ab92b78e8d62", "comment": "Malware payload (MysticStealer)", "value": "e4e6fed959ea82b9dfe4cfc34abd2bc0a342bd67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694920561, "uuid": "47ca85ec-604b-4026-9864-44bbdde5562a", "comment": "Malware payload (MysticStealer)", "value": "44ef1fa76af103dcd9066f975acfec8b110a6d9fa31badf5e92892214c2398ff5596ca10f493785d92aa97f1c083a60e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694920561, "uuid": "b94f2dc7-4d6c-4993-ab9c-842b1082e24b", "value": "T11074AF0174A08032ECB725BE57E94779573EB86347A315FF23A90EBF4A706E0913166E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694920561, "uuid": "34af91cc-5dc4-4bb6-904e-bdc023945f9d", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694920561, "uuid": "f21c3a50-f42e-4970-bd89-4d82792e6284", "value": "6144:DWcaGEZt20ZSwbz8+Dxe8kVAOwlTKTTn66qI43fErwQOsFCteh8Ey:DWFzZtT78TWUTD66qdErrBh8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694920561, "uuid": "e99a0f82-8420-46e2-aede-2ae37bae66cf", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694920561, "uuid": "8cc1e9af-38eb-424e-bc88-7dc6f95ab729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694920561, "uuid": "f08082f8-894e-44f0-8709-cc50cd0da981", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88aef8c-555f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694957983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957983, "uuid": "f11d685f-e7ed-4c7c-b4b1-b29d9a40b49d", "comment": "Malware payload (Fabookie)", "value": "8bd874c0500c7112d04cfad6fda75524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957983, "uuid": "0992620a-6189-44a9-98a0-f668dadf5d9b", "comment": "Malware payload (Fabookie)", "value": "22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957983, "uuid": "7bb5d942-b10f-42cf-a34a-8157ab3e6046", "comment": "Malware payload (Fabookie)", "value": "d04a20e3bb7ffe5663f69c870457ad4edeb00192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957983, "uuid": "f1e9baf0-56b9-43f8-bccb-564caf51de96", "comment": "Malware payload (Fabookie)", "value": "6f48e2251f7e53500d536a880bef5d58b6dae05206ceaeed84ed058e616dc737d1e1b63c96961ecdf08dd5cec546aa73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957983, "uuid": "536ce188-6b43-4b2b-a312-f4455f573442", "value": "T1D9544812AB25DFB8F0C7C8B6BD70410218E8B4097758B57E96CDCC751A3BC51ADB1AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957983, "uuid": "5c148c02-b7a6-4f36-9987-a880acda6a94", "value": "5f7cc0f5167c2e87d5d2573013f2660f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957983, "uuid": "c60480f1-8e78-4ba0-ae14-c891c608b09f", "value": "6144:kXkMxMrUwCE2kWCZ3j9Z0CI0iNWpxyN90vE:MkMxMqEVBkCInmy90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694957983, "uuid": "1d5c98f1-8fe1-49b5-84f1-07282a7a4fd8", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694957983, "uuid": "58b0368b-0d32-44b3-a488-df606d994d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957983, "uuid": "0422f89e-0c25-44f1-a5b6-3887315b57dc", "value": "SecuriteInfo.com.Trojan.DownLoader45.60905.19173.24804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f1a61f-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968669, "uuid": "3f9ee887-9ac7-470b-af73-ea4dd27b865e", "comment": "Malware payload", "value": "4833724b862ae44f6ec8ea8e0e90679e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968669, "uuid": "0a36694f-74cf-494a-a8b0-eb3d53fa5be2", "comment": "Malware payload", "value": "22e05ba387740402de7964bc2780129d7c1a97cec9f13c7d71cb1a7dbe4458bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968669, "uuid": "117090c5-43cb-4615-930d-303832102b9e", "comment": "Malware payload", "value": "c38eefffeef5a40298d46dd995bcf7d0ca473f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968669, "uuid": "eaadd8b5-84fd-4ee0-b3b6-6ad7d686dfbf", "comment": "Malware payload", "value": "68b9fd946c9317f351d4801af6f810b26b6863b1ea504928f696fdc78f0e728f6dd8aa61b7dc3a99d9e826f50161da19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968669, "uuid": "5848c676-6fda-4ee7-b873-0ee83219cd87", "value": "T1E256A4B3C5054AE9DED45B302236ED6D157B2E76B874A80EA31EB4A1DF323C311A9C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968669, "uuid": "44a366c4-6635-41de-8942-57ebfadab8a8", "value": "ef230f9b763ac4d240f1a90c8a0758d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968669, "uuid": "719b17c0-5250-4396-8724-d281d6352ba2", "value": "49152:0N8LSX4J8m3v3fhBQkHqavfSohJUpBjeZ9u38Iv:0qLSX4Jn3v3f7Qk5q0yp9eZ438k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968669, "uuid": "5b61f906-59c6-461d-92eb-618184da00f1", "value": 6111232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968669, "uuid": "f427e7b3-bc44-459d-944f-3e81c4766ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968669, "uuid": "df3b963c-712b-4f38-a2a9-9a33d12b1935", "value": "SecuriteInfo.com.Worm.Win32.WBNA.31294.997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c08298e-557a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694969531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969531, "uuid": "4433c9ec-b350-456e-afc1-b77bd81e280a", "comment": "Malware payload (MysticStealer)", "value": "6dd0cddbeeb79ae27641ef92e05fee83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969531, "uuid": "b8ae975b-bce0-45e0-a3db-44411cdb9c43", "comment": "Malware payload (MysticStealer)", "value": "242d7eb297977345bf579aa734947f851e21a7c4547f078e81c0606a297df502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969531, "uuid": "d3fb52dc-8cc8-49c4-8290-b55a1df12f50", "comment": "Malware payload (MysticStealer)", "value": "76e4f4fdd1cb1e1849f7c2cb28cdc6c7d2494ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969531, "uuid": "250dd55b-3c81-4cd5-9a10-761bcfef2475", "comment": "Malware payload (MysticStealer)", "value": "aa07a7c75bc592ddeab18fcc3082a0cd316d634108bce0c6ffdd2acaece16e1a2f989ba1cafda85676ee8fe47a755e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969531, "uuid": "0589abcc-e0d1-4bbf-bf07-706ba17c7c2a", "value": "T161849D04B5C1C572DB7331328AE46FBA493CB9A00BE595EBA3940E2E4B667D1D33325D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969531, "uuid": "7f6fab17-fa86-4788-8f01-9a17959eebb7", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969531, "uuid": "7aad035f-62c9-4f28-a6be-527575563a43", "value": "6144:lRvJm09zORs+z/TMify9DAO3gQJ/dBM5qqdKvMgAT7tn165R8/:lxw09CK5Nu0BMnAMtTp1QR8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694969531, "uuid": "dbde614c-4717-4634-9092-73a4e8fd14a5", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694969531, "uuid": "12314d0d-fc7d-4a90-8ba8-3765f049e7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969531, "uuid": "aa0d0e4e-04e5-4efd-99db-4200829508e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a003f12-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983621, "uuid": "14c89121-a073-452f-afea-370c40e4cb68", "comment": "Malware payload (Mirai)", "value": "19f0eafc5cc3d7381fb24ad52168ecc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983621, "uuid": "28ec510d-07e1-46ba-99ff-f4cc6ed5f581", "comment": "Malware payload (Mirai)", "value": "29bb54c55a59bd44a91eb5096bc9d43bb2d56a22e7ae2d705d51e250fadbca70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983621, "uuid": "8c77324a-456f-4d0f-812a-46d209ac6ef0", "comment": "Malware payload (Mirai)", "value": "309f5271a1e3665de32d7d72d381056136af2fd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983621, "uuid": "a6c5d38f-8134-40f5-99ae-498f540afdcb", "comment": "Malware payload (Mirai)", "value": "616b16bbad7a0900a819192630ec290722ad4f80635fe50014c87d5af38b3c65a68f0b753cfdbd47ba62f7dee305628c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983621, "uuid": "2bd35de1-dbb2-4e6c-8313-da9ebbd14647", "value": "T1AC330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983621, "uuid": "4512fbf5-f06f-452a-baba-b4ad0117827f", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGN:r/hqaJMcjeqK806MHdMfQXoHuCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983621, "uuid": "a6c5c610-3b85-4c7d-897c-5d926725c33f", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983621, "uuid": "d9c74791-877d-4654-990d-1ba2caa6b572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983621, "uuid": "5ed386fd-203b-47d9-b4cf-e6312cdd4aff", "value": "19f0eafc5cc3d7381fb24ad52168ecc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3b0398-5506-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694919875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919875, "uuid": "e6ed2cae-85a5-4e7f-aced-a759135b1986", "comment": "Malware payload (Tofsee)", "value": "5efd9bac6ea9504437788d7cd5e88421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919875, "uuid": "bf7dade5-29b5-4b79-8d89-b9ff27d52e98", "comment": "Malware payload (Tofsee)", "value": "2c99244f44f8b73a327f93fbc8d6d2d8f74f5755b1191f80aa3632a9bd6d0643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919875, "uuid": "5fadec8f-687b-4475-8381-003a4aee18a2", "comment": "Malware payload (Tofsee)", "value": "7fdac6956dc080a8e9745127627ec6b2580eb4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919875, "uuid": "8d23b52a-e4ac-48cb-b90d-cf5258f1821a", "comment": "Malware payload (Tofsee)", "value": "07bfcb3d6d3facd3ac642b2c510776bb879bd9a95ab2cdb151c0d14ca6cfbfbed517d52d86908672f6032e7375d749a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919875, "uuid": "8df1e851-0267-4a4b-b4de-f699c200635f", "value": "T14444AF02E3B16C70E52607329DEAC5F4752EBC614E7EA64B231CBB2F08B11B1D56371A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919875, "uuid": "b85581cf-baa4-48f9-80a1-5aaa88c207ba", "value": "0e5c0e73b8bfe5fddd6a11f97096fb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919875, "uuid": "38676ab4-5022-492a-93e9-f02c4d8acb3a", "value": "3072:axawmcpUdRZfy1mCat4QGJI/dF0RwVcw1MCW:aPlpUdzLDy2qST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694919875, "uuid": "c4d4db24-717d-44af-ae7d-5616e2ed2bc5", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694919875, "uuid": "12236edd-935a-441e-9477-6b6c0805586e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919875, "uuid": "c14edd31-969d-4dde-a19a-863b09c765e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c21a25-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968682, "uuid": "d50ac733-e0ab-4675-a693-4af814a3763f", "comment": "Malware payload", "value": "7268dc3302be26219d9c892bd931e25d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968682, "uuid": "33b6afaf-5ac7-4151-bb5d-7c1d1c39c67b", "comment": "Malware payload", "value": "2e1cc59e43194e5f9e6c8a2680ffd9e0e4b43c874cf15bb8fa755a9b9cb6c9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968682, "uuid": "22f20f59-701d-49ef-a2d8-7f5f6a836916", "comment": "Malware payload", "value": "6fb74677a57216d77c889066df77c50c7b8f2643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968682, "uuid": "1218e55c-b26e-4408-9d96-aa80998f34ac", "comment": "Malware payload", "value": "8e6fc710207fa3c31ce6dfa9bb54dc93deff032e7cdb0be6b305e0a1e0b083b6fbe8f2a5902debd658c972a2c0479762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968682, "uuid": "ebc1ff62-2193-4cb6-882b-9fb2ea6b3eef", "value": "T1B584EF574F45AEA5F80088B5044C95083ED6144D74F6FF83698B9B888C73E83BEF999B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968682, "uuid": "2206c390-85bc-41e8-859c-0e8982833248", "value": "ee58af9d92734dd0565f31aa5ba68d9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968682, "uuid": "f7a63860-edd2-40a6-9cce-608ff75e8550", "value": "1536:EwYanu1bKsFEDBhnSSLCvePaVXVTZqqqKKiJvgaV0TCnQXjDf0Sntsi9q:tYaYFFEDPSS2ZVXVT7gO9k16Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968682, "uuid": "e378e2f5-9c9c-43b0-840f-85dcdff0987e", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968682, "uuid": "d182426c-8a04-4432-9d98-c26694cd4c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968682, "uuid": "6debc0fe-2f4a-4063-8ba6-5f72bde50cda", "value": "SecuriteInfo.com.Worm.Win32.WBNA.11890.9557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b47f99e-54f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694913615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694913615, "uuid": "747e25a7-9311-4ab9-860c-3ed733a61647", "comment": "Malware payload (DCRat)", "value": "5966a3fa89bfe51c8b6d259cbb946dfa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694913615, "uuid": "0b3e92c9-df03-4a1b-9f85-84b746aaa0d6", "comment": "Malware payload (DCRat)", "value": "2efed2a9c20d870aa63517886a1c28548aa9162e625e16dbb0bbcdbf67f39ab5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694913615, "uuid": "4bf7cbc7-af22-4e15-9732-ddce0b57e716", "comment": "Malware payload (DCRat)", "value": "a4ed3f7f0682decffad2062234699f65fd80644c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694913615, "uuid": "d4c509a3-0e39-49a1-b2e8-ffe9985bb139", "comment": "Malware payload (DCRat)", "value": "bddbdbfa1b3e0f203668b6758dab3af0232c7ebf191931b925ce74c22321f298bbbe64150fe34db0b5ea4f602b98a9d1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694913615, "uuid": "e438af9a-0124-4757-b10a-0ddd1cbdb2de", "value": "T1E9B5CF117E64CE11F01912B3C2FF455887B4AC5166A6E32BBDBA337E19123977C0DACA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694913615, "uuid": "64bcdd84-e586-4753-9ce9-33a643ca5301", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694913615, "uuid": "7295e8bf-8e47-4057-898f-0dd2a1150e76", "value": "24576:a+Eoca+G0nz4M8c4RgdXZJQ65dPaAoJTo4OgT31BxUlDaL+L/RoKu7jgNfo1JRNq:h+WxRgDmkoJDdTWB1/ggu7RCOR9uIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694913615, "uuid": "5d75c981-ba3e-4d26-9175-469fcbfe3464", "value": 2404864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694913615, "uuid": "f9ccabfc-edbd-4cd7-87c5-f69ef84d90b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694913615, "uuid": "2e5ab159-5cc9-4926-9411-8d0a32af2205", "value": "5966A3FA89BFE51C8B6D259CBB946DFA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4c826b-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968651, "uuid": "a6c16629-8a1e-4f70-9c2f-fda78e064416", "comment": "Malware payload", "value": "5f23101ecb3ba76d120e9f9d23564d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968651, "uuid": "e2f452a9-4127-4fce-b60e-25c60370b93d", "comment": "Malware payload", "value": "2f1280d3798342dc6f53ce6a3d63abc7333216d1b13e3a1393798b62d4ca8ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968651, "uuid": "6324eec7-006a-4c65-9bba-a415c65e0888", "comment": "Malware payload", "value": "a777a401d17b52148fb2cc49b8f0c466383255f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968651, "uuid": "8f2af6d1-746a-4bf3-9541-10b9423dba4b", "comment": "Malware payload", "value": "4b4989a35bffcaa6bd93f783e31b7d254aef0c63f138a6a5b511d0229bfb101095129f3a32f819add4f921e442dd2518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968651, "uuid": "af8ded54-9d42-4993-ba3c-da7469a12b47", "value": "T137C4665FCC1190D7E86044B1252E8EA83D762905F1165F8BE286FA9C1C7ABA37DFC187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968651, "uuid": "886ad228-416e-4714-87a6-e1ce92076ec6", "value": "a57c2772a6d9d706765fc2f2f39176bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968651, "uuid": "320332df-c5b8-459b-9e40-0e3dad49afd6", "value": "3072:475nfGM14sKgx07YIt+OnNPq6e8F9vS5fkndTndwMg4QGcMg4QGX8:me/kx0793nh68XS5fedzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968651, "uuid": "883ff795-35a2-4add-8fb8-7bfc39cfaf87", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968651, "uuid": "2c057ba2-2813-43a4-a7cd-6eee6487b74e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968651, "uuid": "5b94f615-70a2-4043-aff9-309252de630c", "value": "SecuriteInfo.com.Worm.Win32.WBNA.15340.15751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8390957d-5580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694972094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972094, "uuid": "cd9d6847-a324-4dc9-b777-db0568d90aa4", "comment": "Malware payload (MysticStealer)", "value": "94cf9634c3557b08eabb0e85310cebb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972094, "uuid": "38af6ec6-a13f-4764-aedf-56e853b628fd", "comment": "Malware payload (MysticStealer)", "value": "2f9aadf04977d5ec167ab8634c7d5c53c115880d1b8084b199c353148025864d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972094, "uuid": "46e1fd63-9cf2-4fc3-9a10-dd270029984b", "comment": "Malware payload (MysticStealer)", "value": "665e12c79c2af3fdb26f73d6e5dd49fc36c12236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972094, "uuid": "ce72395b-a2ce-47a5-ab2c-46bff7fde10d", "comment": "Malware payload (MysticStealer)", "value": "1ed987695141b93f71fa14c1a6fe9a6b0c7db15156e47ad402beb63a2209d83070b41089dcb4c5ce9c57a43e2f472cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972094, "uuid": "f51b7fdc-b7ba-4cbe-b321-3d0ed01a299d", "value": "T15484AF2035D38436F83F19324AF9CAB89E7E7910075175EB23B01E7A5E216E37EB0A55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972094, "uuid": "534bcb58-3a96-405b-9869-030b2f8fb55b", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972094, "uuid": "c17e5312-85a0-4976-b550-8e8e3e5ba16b", "value": "6144:VwvJm09zORs+z/TMify9DAOPgQoDasDQkxpDR8JIw8/:Vgw09CK5N+1DasDQkxpDR8P8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694972094, "uuid": "9aadb46d-348a-47ab-98f2-0360532c35d3", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694972094, "uuid": "cff92c31-5899-4dac-aa0b-619aa38decfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972094, "uuid": "5fdc7aaf-761f-4f63-8aa0-40b6a0d8daef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352bcbc3-55b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694994726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994726, "uuid": "648837bf-7fd6-4fac-a40d-251cf706175f", "comment": "Malware payload", "value": "d9ad3b14308ebd75ceaa5dcff4178674", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994726, "uuid": "931386c8-15f0-4849-9833-e3d51dbc0ae6", "comment": "Malware payload", "value": "301194c66763022c333592d1a985da1d3a0ef3e87f312f532178cc69e81fb528", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994726, "uuid": "ffbdaa81-2802-4134-831f-a2394946a9d2", "comment": "Malware payload", "value": "fc7262ec2a58b098e8664a584a2f9ae6f05fd28c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994726, "uuid": "645c5fbf-5ca2-4a43-9de7-e796f4f8559f", "comment": "Malware payload", "value": "a48859ea9a6067a46ed4a607d2a0614e062bf42936c3ee8f22374611e118d4fb407eb488e5cdb4525b22f23236f10673", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994726, "uuid": "6f87b5f0-d559-4e3a-83fc-64ba72825987", "value": "T1E7F52317F266961BC8F6D2362174273591778C28CB07BB4B3C14BBBA68B7CD80B856C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994726, "uuid": "efe7f4be-2af2-4e3f-b816-b9c3d25a3cdf", "value": "98304:7SPO6efffnRcj7jGPJqudG8BMSqVauu3kKSz4hz3:7SWXcXgQVaj3tG4hz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694994726, "uuid": "374e22cd-8975-4d77-a541-18cb7c1fd315", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694994726, "uuid": "875309d3-750a-4611-a4cc-7626ffabcb40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994726, "uuid": "9e46708b-5cd9-4985-a7a2-4f4dafd7a980", "value": "KissLands.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b84ad4-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968685, "uuid": "1ee745f7-91da-4b44-989e-90d8c6f27603", "comment": "Malware payload", "value": "50fe8e8b314d44ebf61994913fdab912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968685, "uuid": "26c49e41-9620-4b6a-929c-e512ebe852ce", "comment": "Malware payload", "value": "3598a96d342c2525454c5016d1ec09cb8345d51f2d3dfd573b87aa447ac3c0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968685, "uuid": "fb33a049-41d9-4973-bfab-0d05fce41c25", "comment": "Malware payload", "value": "4b6bd0b4e2f487aea5a6f96a928772ad00183894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968685, "uuid": "71db74b7-064e-4549-b0ad-3d58844359ae", "comment": "Malware payload", "value": "2cd6afd88807704f420c7db2cdfbf23367b8b0dd6b88ff498687eb783b4a8c2ab8719c7f5062465fa61f45122f223405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968685, "uuid": "b78198fb-5b1b-41e5-960d-5fc03bb8bbb9", "value": "T15CD47212B534C155E51A0AB5AD1FC6FC0A267C20DE199903F2CBB75F39732C369E825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968685, "uuid": "eab352c8-4f14-402c-abd0-b649d9dd14fd", "value": "4ebe6447c17a9875eaa0532efb69db9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968685, "uuid": "5a27d620-6f27-4b0f-aa53-60b0f9cea8a4", "value": "768:MsVfdNUObEDF+efIdDLl6tNComvQOmMQNmHQ+mvQjmMQa7RbRzKkcejewbSfV:MsVfzUO5tvQRMQUHQBvQyMQ8Rb1KkvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968685, "uuid": "8a71e56b-c034-4cb9-9478-d1d80c167ed0", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968685, "uuid": "c68ae5ff-7a6e-4beb-b905-fb412eb61ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968685, "uuid": "9e4d50a4-bdc0-4a32-8ed6-4fbbcee84056", "value": "SecuriteInfo.com.Worm.Win32.WBNA.218.29740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf62c1e-556f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694964808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964808, "uuid": "5bafb366-70cb-464a-84ce-128fa8ee3ef0", "comment": "Malware payload (Smoke Loader)", "value": "3d7732ac58ca3d98f7fba6e40314376e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964808, "uuid": "90ce72eb-b5aa-422e-9dba-be166677c2ee", "comment": "Malware payload (Smoke Loader)", "value": "36d451f541fd85000b74a22da8d6f57c68268e067c79beb2873cce1a30df3d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964808, "uuid": "76cb02c5-9bae-4f1c-8616-0b1e5a995fa3", "comment": "Malware payload (Smoke Loader)", "value": "9a8811e4bc764a9ff0e6aac7dc6caca095c718b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964808, "uuid": "62a486f7-d7ed-46f2-b98a-404648e1a5dc", "comment": "Malware payload (Smoke Loader)", "value": "1c65ef279bb1dc71c3100252ab59c5c1c80d2303cad6df6822aa2f36d81bccaf1430ff1d88b54d457163dbc70cf07f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964808, "uuid": "22df1dd5-60f8-498e-a28d-7a9da056e64b", "value": "T1F244A012E7B0AC31E5224B328DAEC6F4763FFC114F7AA65723087B2F04B12A1D665759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964808, "uuid": "824fb833-0830-4c26-881e-08fed1b84be7", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964808, "uuid": "5da1b079-e413-4153-900e-8472d93a5636", "value": "3072:PecmM1MksbHYLWGe0rRC1Nv1xS45rRwVPhz1N:AMGksQJe0dCXv1M451wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694964808, "uuid": "c2ce62d5-d606-4803-94cc-0c349452b762", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694964808, "uuid": "eaf5b09e-43cc-42ec-9c9e-dd0750bc5431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964808, "uuid": "094b5746-8212-4a44-880d-6a77208c2284", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b78be33-55a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694988804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694988804, "uuid": "a97fa350-500a-49ef-b08f-a4ada4a6bf7b", "comment": "Malware payload (Smoke Loader)", "value": "5cc8371d17201d3a40116bf5e723d8a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694988804, "uuid": "d4519582-7c60-488f-8954-948be68ca83f", "comment": "Malware payload (Smoke Loader)", "value": "377eb4b8547b029af09321271509b2f4d848d9438ad021c7eab1193660201f3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694988804, "uuid": "05b93d3e-de1f-40e3-ab39-c61c8756d94a", "comment": "Malware payload (Smoke Loader)", "value": "395c7266e174fc41096174cf82b9993db276074b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694988804, "uuid": "5328bdca-6547-491f-9098-a8d6b69b2893", "comment": "Malware payload (Smoke Loader)", "value": "0e6717e482492cff6bc47a6506688b61535a3e0d024d055077697e58df249bba6a00ca6e4c21f7df895a16e23ee8657e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694988804, "uuid": "6209f40a-e6e2-4845-8846-6bc8d676a10c", "value": "T13834E011B7F1C832F5638A346871C6B0667B7C26A5B9C68F33884B6D0D313825B7DB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694988804, "uuid": "567a4d1a-8bc7-4b68-a3ed-7a46f5195a8b", "value": "942ca992441c585d4cf2a9252e32648a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694988804, "uuid": "080f4b39-542a-4d5b-b631-9bc87d7b9dea", "value": "3072:ADfozRsI6ueK+wDgeNZELyys8ASczz0UNEi:jzKI665DfNZEOys87o0UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694988804, "uuid": "8f3217b0-0287-4c1b-93ef-7a2f71b0e9d4", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694988804, "uuid": "573b04e7-6607-4d39-9e34-5ed2115578db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694988804, "uuid": "ce979450-8889-4f60-baf9-1c6d86a0c371", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c18984-553e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694943909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694943909, "uuid": "28ddd02a-0806-4090-9762-c5b208644cd8", "comment": "Malware payload (Stealc)", "value": "f911e252e69f1eacdd0c2f9696ab6660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694943909, "uuid": "031a1b3c-5f2b-411a-935b-e3caa4a349d8", "comment": "Malware payload (Stealc)", "value": "379cdb7d5a170a6e0df0ae27939d662d1a6f1c5aa0cb76f98ea14e17cbda64d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694943909, "uuid": "6cffec7b-7282-49a5-a723-cf851d24b3d4", "comment": "Malware payload (Stealc)", "value": "7b6e0cc75c7ffd3cf22f52a586b756b864c0dc24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694943909, "uuid": "27a1b735-8034-4693-86ac-0d21eb50f9be", "comment": "Malware payload (Stealc)", "value": "0b54f03e6cceeee8ab84f6c52331dcd801dbd93bb064926e7bb263ee1e26cd41901bac2b1c18bbe896ee8a7f88c7e1f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694943909, "uuid": "8db0a990-ba76-4692-b4a4-6b248e58389d", "value": "T17944BF03E3F0AC30E2264A369EBEC5F4652FFC214D79A65723087B2F14712A1D666B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694943909, "uuid": "e4cee3c1-db9a-4813-ae99-f6c242cb2d5e", "value": "e973aba4424d4cbac463350d8e7d7e05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694943909, "uuid": "d2655523-1b1a-4709-88ac-d1f9d4cca361", "value": "3072:4Ja8juAdkIBnqzHtHc5x05d8aORhrtaYEFEw0:T8jhdTnqztH3YIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694943909, "uuid": "7b2488cd-dace-418b-8d17-cb4f72899867", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694943909, "uuid": "ad6e7faf-77b2-450a-bcf1-13ecae384524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694943909, "uuid": "733cfd02-70bd-444f-a0c2-aa4ac819b81b", "value": "f911e252e69f1eacdd0c2f9696ab6660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e7d137-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983669, "uuid": "c2b6b413-81ab-4178-bfc9-5a4b215b2163", "comment": "Malware payload (Mirai)", "value": "2aa5e22997c0fc9f3bb7bbff34a0f40f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983669, "uuid": "d43d713f-91bf-4456-8937-2b0571f51556", "comment": "Malware payload (Mirai)", "value": "37b6182eb1ca70f711c576fd98965fab5d8ff8e6dbf3b35ba730a4a78462dde3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983669, "uuid": "af7aec1b-c926-4c0f-99dd-1a5bcf58bbd5", "comment": "Malware payload (Mirai)", "value": "503334492d68bdc8b60537fcc66ad353ce7e6968", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983669, "uuid": "15e48aa7-de51-4210-aa86-2c90b4f7faae", "comment": "Malware payload (Mirai)", "value": "7f17e355dbd1b5d2af28ac95752fde3364e0729967baf14ddb0ad67780151376e70d958cacd950f288402456f0c4474b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983669, "uuid": "26856aa8-1b3f-461c-b163-85337d984b1e", "value": "T175A2E119BF1C858BC832697555E9EAD21252FC71F29CDC482A40C16FF0A33A96870F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983669, "uuid": "95da364c-563e-43c0-8c2c-782dd731c7ae", "value": "384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKF:T98o08kxofBE+ZkXaqGbp2F2TWul0c58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983669, "uuid": "27cecfc5-602c-4ee0-92f0-5c88b87b1cae", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983669, "uuid": "5d65e153-79cc-4c63-92b9-f6d02243ce6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983669, "uuid": "6d239670-179d-4dd8-b6e1-4ec59d268095", "value": "2aa5e22997c0fc9f3bb7bbff34a0f40f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768891a8-550f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694923539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694923539, "uuid": "6cd7dd13-999a-495a-b236-0515f7f69128", "comment": "Malware payload (RedLineStealer)", "value": "7a875e5cd69246cbcea435e247b494aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694923539, "uuid": "b5b36e3d-0571-4dad-ab42-613fd7abe358", "comment": "Malware payload (RedLineStealer)", "value": "3b108cea840478ba90db633d5d3e45fb3ce0ae62ef89fcef68a86bda4e022a6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694923539, "uuid": "76cd9db2-2b3b-4fbf-9258-74c667eff845", "comment": "Malware payload (RedLineStealer)", "value": "0c1fab56dfb877e297db3f39fd550d5294c3f5b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694923539, "uuid": "d289aecc-b085-4a11-80ef-9cf69314a53d", "comment": "Malware payload (RedLineStealer)", "value": "90b033544314ce88e02d853de0e94fa0b7ab4be79961d92bd1ebef65a041778f76da643679ec9a47d611142e654bd277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694923539, "uuid": "aacd2587-0857-4d97-92f7-6036b65880cd", "value": "T16DB5332476D5C076C4B3513A09E69D764E24713A07FEE0D73BA91A2E8F321C2677B2C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694923539, "uuid": "90f50020-45b5-436e-8b6f-9926b1504d67", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694923539, "uuid": "b1e0e106-73fa-4c60-a45d-394047176b2d", "value": "49152:2kQTAtfT0q513+T2YNBAZT6PHYIWvTSMCok7hgJlKa/+QiLge+OI8UTo5V:2atbT1OT2aZtWvTG7hgya/+we+OEToj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694923539, "uuid": "bf515a1f-2231-4d5d-b23b-30176b4c237e", "value": 2308608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694923539, "uuid": "4f4c0e51-f4ca-417d-9e7b-b928caa7cde0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694923539, "uuid": "1616d9ab-1a96-439a-8ffc-1f9b926903de", "value": "2take1menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe3ef6c-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968652, "uuid": "9b792af0-0eae-44c9-934d-26bad73533ec", "comment": "Malware payload", "value": "b296a52a107223cadb1167d8d1a15b81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968652, "uuid": "b9a4d957-8cd2-4379-9e32-f7f325166d89", "comment": "Malware payload", "value": "3b171c2717a37497a7b0bd548380d5c7eb5eb7dfa2ceee611ea49cc547a3354d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968652, "uuid": "ad4ecdff-d19e-4481-b74c-9d622cedf8e5", "comment": "Malware payload", "value": "820866131807d581035c95b9bbf2a8d80544fa2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968652, "uuid": "06d18c09-cffe-4ad5-9e42-7974c5b49e24", "comment": "Malware payload", "value": "e8dc3b90c42d885244ca568a61b370aead1180b3fe6e913f0f1c78307bfad9439ce9b6d4f7170e73ab7761f22f15131c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968652, "uuid": "a597c725-abd8-4a84-bc45-c96bf13942ef", "value": "T15E739D10D101ED27EBF2C6FDF5EA84CD17982B5627A865EB1EE01C2462F80D56E3056F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968652, "uuid": "8b02c71b-5a5b-4a29-9bb0-1bc8f7b6e638", "value": "384:4QPtvgSZTYux+o79TCPI/gRjN6pd+mKP+qaXgDdv3u7eULL9/xXew0J7h6:NtvxZTJNngRjIpd+mo+qMS3YHHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968652, "uuid": "292e3947-6e43-4b92-9374-e71af71dcc03", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968652, "uuid": "dc59ec8a-53e2-4466-abff-a6d131c966bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968652, "uuid": "82126485-0b74-488a-b32b-eb5ec1864013", "value": "SecuriteInfo.com.FileRepMalware.26136.5341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca62da6e-5558-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694955033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694955033, "uuid": "223de2b9-2a00-4584-aa2f-953d2b5a73bd", "comment": "Malware payload (Smoke Loader)", "value": "34d7fa01ef6b0957c927b23a165be578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694955033, "uuid": "659fc12f-4035-49ff-b1ab-41a120d6b08a", "comment": "Malware payload (Smoke Loader)", "value": "3d590dced909090620ef7c09e5bac071e45ed9e814a6bc6e1038648929ee1474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694955033, "uuid": "f3331e90-b69c-4832-b628-20fc1b6588fd", "comment": "Malware payload (Smoke Loader)", "value": "94d4c1fc45b8b49b8f7b8bad492b6ae1fc9b7e00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694955033, "uuid": "a7c99a12-0054-431d-859c-ba4ec0f1855c", "comment": "Malware payload (Smoke Loader)", "value": "3d0ae1897fcb5202b9ae8b13b3ed0a83373ab4129aa45c79bd083d0df8daddeef67777eece335209f4533e4dbddc3608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694955033, "uuid": "3aaafb82-7f90-488a-b368-9a74d9cfabf1", "value": "T1DB44B012F3F0AC31F5624B328D6EC6F4692EBC218E79E65723087B2F18711B1D692759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694955033, "uuid": "6484b4ac-b90f-4b34-80df-0f3e7122f9de", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694955033, "uuid": "278df359-721e-4b90-9b58-be8e2e4b7538", "value": "3072:XeDmM1x8MLZPYltgcig2fAAdGSnoBGmiY8Dw25DVGklX0:jMX8MGtaLAGGi2Gm8McDVGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694955033, "uuid": "289be41f-4c9e-4c80-aca8-7e9012a14ee4", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694955033, "uuid": "3b5351c6-5023-4d43-bdac-233f840cc8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694955033, "uuid": "bb103890-1bc0-4222-82aa-718ad94a0301", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8657a39-54fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694915167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694915167, "uuid": "d8a442ad-b41b-4913-a984-967ee49bd7a4", "comment": "Malware payload (Fabookie)", "value": "6f75fdd73946160a17cac7e098a00032", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694915167, "uuid": "9dff76cd-154a-41a5-8036-c6cfb1b76fe5", "comment": "Malware payload (Fabookie)", "value": "4012e12162465ef8b5bd4196d5b45b0b301be663896870aca8d732ee20f16d24", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694915167, "uuid": "1279c884-6d0d-49a4-93e4-e10cdf0bf880", "comment": "Malware payload (Fabookie)", "value": "176b1439b742da727a21d1567a05992818d63fa2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694915167, "uuid": "2c6783bd-64c1-48f3-b465-2c892ebe25e1", "comment": "Malware payload (Fabookie)", "value": "1a33f2950e9f792c2be24979962f12c9ccfd330744dc654aa224b0a8fb65608645eaea0d2cfc4bbbd0332f0bbaf58be4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694915167, "uuid": "5e4a53f7-b8b4-4f3d-afae-5e538ba49d32", "value": "T143D4D081B39095D9C4B88430C693CE71CA317C64DB28569BB6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694915167, "uuid": "5ca41a49-a29d-4901-870b-a801480b86da", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694915167, "uuid": "b93ade41-6a2e-4dcc-8ace-0daef953733b", "value": "12288:772d1oljvJ48XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:Hqolr2WM3/kRc4lAgantPbcHn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694915167, "uuid": "53e51831-1122-46e1-b5a0-7775a6904c85", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694915167, "uuid": "ae3072da-d9c6-4bce-8e75-a8ac962a2c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694915167, "uuid": "1362a4c9-752a-4788-b8d5-67559c84dcf4", "value": "6f75fdd73946160a17cac7e098a00032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c83cce-55a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694989759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989759, "uuid": "16c51599-f10a-439b-a685-59bc44ed7298", "comment": "Malware payload (RedLineStealer)", "value": "def3d157679830bbceb2eee7ba377074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989759, "uuid": "e15c5028-b115-4d95-b442-a0225cb4b462", "comment": "Malware payload (RedLineStealer)", "value": "4215352824a635ba671af9c6e265b99ea2a6aca8af16351ec9befa9c6fc5df0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989759, "uuid": "eb679688-8049-4d87-bf42-6706705f349c", "comment": "Malware payload (RedLineStealer)", "value": "233d5e97dee1333b401e8da54842fc3010ae91fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989759, "uuid": "24ada95c-c2d7-47ed-9d1a-95897928e25b", "comment": "Malware payload (RedLineStealer)", "value": "4ca0719e60cbfcd40a870741510ad61c9ee21a8322ed1d7b136e58746618640902efd6a22bb139c89ffb59bb856ae2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989759, "uuid": "15eb5cc0-f4f9-4040-8500-d1a6d25f4054", "value": "T1E1947C096CEFA237D8EB08759BD9926487147F01571239FB37F42BA999223C0F63168D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989759, "uuid": "ca1f1698-7996-4200-82d1-9e0417756c63", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989759, "uuid": "97913ac9-0dc9-487d-a2dd-4ed7433d6dcd", "value": "6144:UAvJm09zORs+z/TMify9DAOtoQ09itN7IkTGx/a0v9N9aHb0E85:UQw09CK5NMYDTGxiG9k85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694989759, "uuid": "6b099f4a-1e23-4969-b459-4afcb732b7b6", "value": 415216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694989759, "uuid": "b930c36c-ca8a-4a9b-9595-e62b0ed91b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989759, "uuid": "b2163b20-eed3-4952-8ee3-9e6c1f2b16ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edc27ca-5572-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694966100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966100, "uuid": "c0362ccc-0907-418f-acb2-567a0fe2b7f2", "comment": "Malware payload (RedLineStealer)", "value": "81e1ad93faa9c9eb87c1ca190e78df54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966100, "uuid": "b80f8cb9-b376-46e5-b90e-ea3334ab273e", "comment": "Malware payload (RedLineStealer)", "value": "42df844a60c2121d9e334a9fed2b21653adba1766f4a552e747d41917e12fa78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966100, "uuid": "97e44f46-2f48-448e-b59d-141545951a99", "comment": "Malware payload (RedLineStealer)", "value": "77df978e6a2400d4831a07ba23d10914c101f611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966100, "uuid": "da8c463a-50e7-4395-b5b1-286ee1739fa0", "comment": "Malware payload (RedLineStealer)", "value": "f1f637ed5a9f2f86d0d9f344eccd83e79a0cadb6ccae9d4ea8b0a5ddc2eb1b1365760c92c5f9d876b3bb87e6cfb98c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966100, "uuid": "056e2792-86c0-4530-8a23-9d37089e29a9", "value": "T162947D843EB34039DCB5CCB244EA567CDB3FEAA2977509E31778CD199B205F8622E251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966100, "uuid": "495594c6-c827-47cd-b84e-b0b0cad78d3b", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966100, "uuid": "241fa520-f972-4f02-aa6d-b304969c426b", "value": "6144:/7vJm09zORs+z/TMify9DAOEoQHavKkZo7bNHu/E+iy2bHRXova4+br333csGguJ:/bw09CK5Nr+HuM+eRuaosGgum85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694966100, "uuid": "8e9406a6-fed5-4bad-822d-6c00559f639c", "value": 415216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694966100, "uuid": "33a88cfa-fe6c-4f96-b0bb-b5bb5eb8a5b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966100, "uuid": "8164d63d-5ded-400a-a95d-3db64f9b7f62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf0ea1c-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968674, "uuid": "37184e72-fce4-46a5-9b0e-92cbcd720334", "comment": "Malware payload", "value": "b2fa51f3972426a714c5a2538a8755d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968674, "uuid": "98562ca5-59b3-45a9-af1b-73765e0bf4af", "comment": "Malware payload", "value": "443eb1f9bc5827f731f74163121c2aea5381ee44daba150636f53186a571df1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968674, "uuid": "8b0cdc8d-3a57-4aab-a71b-f5bcc75c4ecd", "comment": "Malware payload", "value": "36faa4f0b82430fa048b74fc9666c30dc4da73b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968674, "uuid": "e634a215-4b73-4bc5-ad66-120d855280b9", "comment": "Malware payload", "value": "854e02429f229633a35a2d8cbf39d5f6bca0121341f1e8e8d068d814c0b8834f5ecdfcf7a3e0b5fa3c3dc52f3423f431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968674, "uuid": "7b446962-2037-4fd9-bd01-05eab9fda495", "value": "T1E2A11B97FAD248B3C355C5B959048424E732AB303395A7435F6D640EDC152C04FFD931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968674, "uuid": "dcaae844-d37d-4f90-b509-5423bce07cef", "value": "96:nPPnZ7fTtzWDgkc6AVnkbg9Es0EClccs5yJNZNt:nnxfRq8HebguuREnZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968674, "uuid": "6fd04f2f-9e6d-48c6-952b-4fb3c24adac2", "value": 4881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968674, "uuid": "afad0ef3-d364-41ec-850c-4cfbe2b73c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968674, "uuid": "62bc5022-ae95-4fc5-a415-5c2a343246c6", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.8542.31872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7aaa8f-5557-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694954662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954662, "uuid": "a042d199-b6ee-405e-b5b7-a542d06f3484", "comment": "Malware payload (RedLineStealer)", "value": "0d93c5fc6a04c3869c1dd5e8256b9cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954662, "uuid": "661a8dfe-d48b-48a2-b09e-b540766bbb28", "comment": "Malware payload (RedLineStealer)", "value": "46708920ef342e349ea2368a3a4030da4ea2f441c1415581e9ff0576deb65706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954662, "uuid": "7ae22e4f-7cb5-4ba9-b3cd-3dd90ded0aa9", "comment": "Malware payload (RedLineStealer)", "value": "1b6d072b1a851bbe8bc64df7664f0f4c45b05844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954662, "uuid": "95548826-9860-4573-a7dc-da1d537b9675", "comment": "Malware payload (RedLineStealer)", "value": "ac8e7fec7366de610b29787a641fc14bae6d462a6be5607517469cd20bf3299f4c42e590dacdb1e1c8103e14315d10f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954662, "uuid": "5cf6bc35-3ad6-44b9-ba95-22348b01e85d", "value": "T15E947D10E68140F6F823213F0EE48A318DAEE813678DEBDB63DD891949F51D78AF7459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954662, "uuid": "f3faa6a4-513a-412e-9497-53d63ad82a9e", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954662, "uuid": "2a3d6ec4-9efe-4bbc-b5cc-cb32d676dcf8", "value": "12288:9/w09CK5NlTBENYXCzIkrrNEfLhZCv085:q09xBdVZCv0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694954662, "uuid": "3a19a93a-1c3e-4ab3-8a6e-9d811f26d731", "value": 415216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694954662, "uuid": "5a90cbd8-ba22-47bb-b946-ba8c159591fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954662, "uuid": "a8e7ca3c-5892-43ce-bf86-9a29d77f4954", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f0c524-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968659, "uuid": "09a29a54-0ec3-42da-9678-2a3154d93c76", "comment": "Malware payload", "value": "a0f94293e4c96b2174e1ad8c0185436b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968659, "uuid": "d5baecd8-8d6d-4a0e-aa58-9f4ca1899ebf", "comment": "Malware payload", "value": "48605d3a01fb579d9ac43491564d06f42ddc81b24138934b7af6c93e8617376a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968659, "uuid": "5dc201b0-8da7-4ddb-beb3-4f7fba2cdb84", "comment": "Malware payload", "value": "fdd5a8d6d060394fcf39a0ada48a4ec2099ad6a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968659, "uuid": "c6d2517c-b7c4-47fb-9bf6-dabd3313f68d", "comment": "Malware payload", "value": "ba8b1bc3a3e45c23ed71d589ea64d2c8687addba6bf3c92e376a9f3a1336ef4ce572f193cb7c03e9ccdb9d6e9173a7cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968659, "uuid": "171b7299-358d-4bf2-b579-f8400f8e78a4", "value": "T13FF4BF62BB638907E8D145740967CBB4B6013F2AFA135D4B31A4BB2CB472B837D99217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968659, "uuid": "ee86f817-d234-4a4f-8e20-e8481c20deb9", "value": "b94452e665e74709dd8cb628b8aab705", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968659, "uuid": "4cec419f-f292-4a37-a8ec-f9757f31d7a6", "value": "12288:4RENG9MRMEg469smnawI4FBMdY+3Nk9bwNAwGG8peu8nIw89wr:4RENG9Ui9MpNCG8peuqF89w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968659, "uuid": "7045960b-6127-4994-94df-297dc90d9a9f", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968659, "uuid": "965072d4-da5a-4464-ae15-2a07cacd4a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968659, "uuid": "da3670b3-9c93-4505-884a-81c67ca2e966", "value": "SecuriteInfo.com.Trojan.VB.Crypt.13078.16635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012c0e1e-556e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694964144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964144, "uuid": "0ab88d33-b082-42ea-96e3-ce2563edf2ca", "comment": "Malware payload (RedLineStealer)", "value": "0720b998777bcc6f0eb3ec7e1da5443f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964144, "uuid": "65b01b48-dfe4-42dc-84ed-b3f69edcd93d", "comment": "Malware payload (RedLineStealer)", "value": "49c357cd4f7c7f6e5b2d3e19b92535c914f2e2ef5404d07f9f0bc44ee00cf48a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964144, "uuid": "c4296833-0cde-4596-b47a-56cdd612126c", "comment": "Malware payload (RedLineStealer)", "value": "4d4b8b13cc9a573f41829e938157def0d77ebaf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964144, "uuid": "f2cfd555-99e8-442e-93e4-f01b8b5bc462", "comment": "Malware payload (RedLineStealer)", "value": "f7fb1297429772cf62c89f53bb02c60bba46beec61a9690f3458f9499fdaa8c26fd151376b2ab33702d7d8b10571ecb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964144, "uuid": "56e3bf3a-a558-48fa-ae07-346c8d7390d0", "value": "T1D37429D0238675CDCC4F8BF1A16907688A71D442B657BB537C8BACF63C5A3D4AE412E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964144, "uuid": "0677ce6e-2643-4539-9c00-c0da6d9d9152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964144, "uuid": "114e284f-0d5d-419c-9cb2-1a5d5a89c935", "value": "6144:JE5WZkq4Ws6p4FaME7VjQ1Z3bwayLN1abTi:Juqou4H3bwayj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694964144, "uuid": "755ebace-89f0-4453-9af3-486fe2bc8d6b", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694964144, "uuid": "cb8cda3e-86ca-4e6a-b974-b1216c232376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964144, "uuid": "394d6768-8669-417d-8222-4de583240504", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f693a9-5565-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960639, "uuid": "84628437-ec94-4d0d-93ee-d89b081a64d3", "comment": "Malware payload (Mirai)", "value": "0a10cf6a402e777ad610c0d6a0af95e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960639, "uuid": "2f8f88f2-1ef3-40c8-8328-fb97f035c29a", "comment": "Malware payload (Mirai)", "value": "49c75088a324a9ed8de8acaa1cfd84f58278c89f63e002cc91ba5228a568aeeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960639, "uuid": "bf0e2e71-2b80-4f13-aa38-d384edbb5b98", "comment": "Malware payload (Mirai)", "value": "08a9757f3bc5d3aa2a375660f92add020a542e3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960639, "uuid": "93f4f6ad-90ee-4b76-9369-1a19c721afae", "comment": "Malware payload (Mirai)", "value": "04d14d23e5dc1a78dde3136d76f4c64e29a6e6e8721a9e5b9c1417ade7f48821b59a4b2874c19145e3c27f337b2d43e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960639, "uuid": "8e8541cc-0663-4f1e-aff9-98e8b6bc7129", "value": "T120434AD6A4009D7CF89BE67E80170A06F521336059A31F2BA7BBFC936D731944D36E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960639, "uuid": "8e3f0f87-42d2-46e9-8e37-81023500159e", "value": "768:l7BdehFPzA/u699R2hS13UIhscjltuFtr5b1N+ImSkOM/18TB1G1:VCFPh69aS13U0dlcFtr7N+Inkxd8fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960639, "uuid": "42bb818b-35cf-4e9f-a36e-0e2d240ab59b", "value": 55400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960639, "uuid": "8b683789-15dc-44a4-997f-0c9dce2a16e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960639, "uuid": "57e52dad-fda3-4046-94bd-bfdb840c122d", "value": "0a10cf6a402e777ad610c0d6a0af95e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004b0e0e-5504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694918616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918616, "uuid": "a38b3eff-f762-4be7-9a7d-49260f3557ef", "comment": "Malware payload (RedLineStealer)", "value": "069f46ef1499d1b2f56e8c04cb9d5946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918616, "uuid": "790b4ddf-0a7c-41d6-bbf4-9a99bd573fbd", "comment": "Malware payload (RedLineStealer)", "value": "4c424b278100f486bbb1051cd4215d25bed271de77feab7bb95e629e3e383c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918616, "uuid": "e2ffe5a5-350c-44f9-ab8a-814aae4713c1", "comment": "Malware payload (RedLineStealer)", "value": "484723138cadadd78cf30f7a610b5900bfd48eb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918616, "uuid": "b7cd1d09-d3b2-4854-9fc1-1971a9f7413b", "comment": "Malware payload (RedLineStealer)", "value": "4aa4e4c4f7dd2c82494855bf1c462886a618b7ce714c027306046d034dad1b9946a9d5a318a3135736be28d5e495d713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918616, "uuid": "5e6b59dc-5745-43f4-963d-5944ac44536a", "value": "T17194F202D7B1A875E13249358EBEC1F4792EFC619E3A9B4B338C7B1F0872161D592729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918616, "uuid": "fdd59d0e-210e-4a58-a9d9-e277b39bff6e", "value": "0e5c0e73b8bfe5fddd6a11f97096fb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918616, "uuid": "cc8e32d0-ca6b-4dcc-b56b-ad0e9e149e7d", "value": "6144:aBsrCjD9el//SkkJM8VyqZoUiJLBm63BJudg4zgRse6O30TPhFg+VWTI5:ouCjRel/aA8XEnmymcRbNobYTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694918616, "uuid": "0edb01c1-b575-42c3-a858-d6c5d537c312", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694918616, "uuid": "be9c04a3-b29f-419c-8866-a172d5950b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918616, "uuid": "35b26a65-dd07-43bd-bea2-118f7d4b2884", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea004e8-54ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694909326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909326, "uuid": "b4d62b87-380f-4006-8df6-7fb1510bab03", "comment": "Malware payload (Fabookie)", "value": "3bffffda1e470fede020d005d03929da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909326, "uuid": "d8be74ea-de36-4c28-b8c4-7169229f3b25", "comment": "Malware payload (Fabookie)", "value": "4c4e0c61380662adc756d147f9c51ead1d3a6913f49510eae2766270b778f427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909326, "uuid": "38b5b747-e5ed-4b7f-9a56-8fc683132617", "comment": "Malware payload (Fabookie)", "value": "42bffdd24aa6e60b3b0807ff2aa5d321c9e3d9c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694909326, "uuid": "ceaae727-2603-43d2-9321-e6b386f3beda", "comment": "Malware payload (Fabookie)", "value": "769114d0bf118324b01e867e282379282f04ab8bada4154388fa2fd3eb699f201134deef46e31e94bcecd85331957c65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909326, "uuid": "dbdd20f2-59b1-4734-8592-9b65a0ed00b9", "value": "T17E46D0788C018F1A4B330BFE49F432AD07D700A7C53CA55453DE9BE8DA2B257B1A59B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909326, "uuid": "a8b7e6d8-5968-4fb6-8149-a34217cbd749", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909326, "uuid": "f766a87a-b4bb-4933-a8b7-d474968cec0f", "value": "98304:CI4SpjHLG9bNutbyeexd2jqLGAXXdAW6eH65r:vpjHLGBibyeuoD/eHgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694909326, "uuid": "54ad3bac-04fb-4d88-af4e-0295014145e5", "value": 5446656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694909326, "uuid": "1f88a2c4-ef03-4c3e-9073-bfbc2409631f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694909326, "uuid": "2b6abb9e-295a-4873-b358-dc6553a3a53a", "value": "3bffffda1e470fede020d005d03929da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8260f415-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968656, "uuid": "332349cf-5b6b-4d88-ae12-370476a04854", "comment": "Malware payload", "value": "c10e0920f9292014536326a317215bdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968656, "uuid": "94cd6deb-88f2-4c55-9028-fc72671718f1", "comment": "Malware payload", "value": "4ca251f949834926265c9509f89ea3b2611364e81d98cd5876c564d64d7fb6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968656, "uuid": "0b188f79-ce72-4aa0-b1f2-f93eda972ef7", "comment": "Malware payload", "value": "1dc078fce8b8c53da83719aa342656da71994b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968656, "uuid": "79f1745a-5c55-4004-b3b7-828786bf0c0d", "comment": "Malware payload", "value": "8073b3ebb7ac07e679937b9f09cba105c7b72e714885185ac9233ef46d49d6b216036cc39bbe61bf3eb0029ae0fdfe78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968656, "uuid": "82d7be33-5d71-4eba-9c58-2c30d0358601", "value": "T1844422A70BE856F8DC793433897C48B8122231C0EAC6B95D5DD1E75EA033994EBC1F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968656, "uuid": "a86b027a-b17a-47f5-a105-2d6b154c2dff", "value": "6144:Vp7D5snYJveZu3FmNvjSuloV0h0ATR3OQAWEyRxNG4GLgI93hcyh:Vx223FmxSulU2FTxOYRxgWIJhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968656, "uuid": "fe8f68bc-4fe7-4502-94b0-c89e764fc471", "value": 274870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968656, "uuid": "d6aa77c6-5de5-4c0b-bf66-80940544e8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968656, "uuid": "c016c0d3-e7e1-4d48-b600-3c103a3be676", "value": "SecuriteInfo.com.Trojan.004bcce41.26529.7568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73193df0-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983663, "uuid": "b6dd8dd2-b065-48c1-90fb-4c807fded2c8", "comment": "Malware payload (Mirai)", "value": "bdcc3d3f5310cb46229cd7c6d1ea11a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983663, "uuid": "09dd8dd6-1856-4192-b93b-4ef21b04e99b", "comment": "Malware payload (Mirai)", "value": "4d4f676abe2a3e9e6191f24311b700683b61f1570cfe3311dd0ff7b6442b5ee7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983663, "uuid": "9cf52cdf-e02f-42ca-b18c-b8bf8c864a45", "comment": "Malware payload (Mirai)", "value": "cbdc15423f0d764c29c487474b364cfa9c5a01db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983663, "uuid": "6508dffe-39b9-462a-80e1-b12f657826f3", "comment": "Malware payload (Mirai)", "value": "3c259851800cbdafb947a024ffa9d7c6d00d2635be6516ca6cb57035265bbc683cb88400fe65f7b04f9fbc91d49d6797", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983663, "uuid": "ba0b5c4a-68ef-4279-9a9f-d83cf4476cd4", "value": "T136A2D01576A32D55F3EC1C3DC9AEC357F9670BFC80F532B669415620C90D24A3E39A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983663, "uuid": "0437c47d-ec2d-4419-a050-3b79ff736c83", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjaSahymdGUop5h8:UvQn4j+ZO5fKAlxDas3Uozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983663, "uuid": "738edc73-992d-4ad3-bda7-94c5fd360009", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983663, "uuid": "c1ecbaad-8146-4ba3-b16e-fc6847b3b530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983663, "uuid": "77b9a48a-b2a5-409a-9bd5-5de611d93dba", "value": "bdcc3d3f5310cb46229cd7c6d1ea11a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582cfb6d-5534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694939380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939380, "uuid": "476757a8-09f7-48d0-b31f-9b34371c3956", "comment": "Malware payload (CoinMiner)", "value": "4a27d272fd5b2ca37472619dc23d7a12", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939380, "uuid": "757c70f7-d857-4ffe-ae3a-1fea634ffe4a", "comment": "Malware payload (CoinMiner)", "value": "50c8d5f76ad3575fa6c3423505fdb7dbed03064ee67677c2d1bed838f86bb336", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939380, "uuid": "fdcf439c-6e4c-41af-8eda-5e4bfbb3209c", "comment": "Malware payload (CoinMiner)", "value": "0bd0e5c3ea4c4bb2968caac20d6c83dabf550269", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939380, "uuid": "1475da11-cf46-4959-b7b9-8d08eb6795cd", "comment": "Malware payload (CoinMiner)", "value": "65495597b1e8d55440e99da29066af959f114468c5c87a63bd3d51145e307a64ef412b224cb1ac1971ffcfc2ffe730d3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939380, "uuid": "33e5b04d-04ff-43bb-9743-48117f0c6589", "value": "T13044AF13E3F0AC31E62707368DAEC5F5662EBC118D79AB5B33087B2F0470261D6A6759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939380, "uuid": "d44995cd-b72c-48a6-97de-6c976485dbc9", "value": "e973aba4424d4cbac463350d8e7d7e05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939380, "uuid": "c8cfa97c-520f-4b15-93ff-1b40839bb9f6", "value": "3072:Exa8ur8nJzRx1VIbGqI0K+1MTWpgLqKPUgm0:j8uInJz1VtxbcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694939380, "uuid": "e3d52988-3261-4f2c-a143-c922f871a05f", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694939380, "uuid": "4558fedb-87f1-4d40-98ef-d282d10a4588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939380, "uuid": "1da459ef-6ca6-4db4-be96-7f983730abdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e7cff-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968673, "uuid": "dd8583f9-9164-4368-bbeb-73cbeff90502", "comment": "Malware payload", "value": "b042872081adda2af5784d6ac9ad94cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968673, "uuid": "cc83fd67-4ef7-4a45-88e6-b683fd582644", "comment": "Malware payload", "value": "51b0ece48a248fb0bceac9e126c008d33d97f32aaff901406b9275084b8e6ed6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968673, "uuid": "85428dbc-75f6-43ec-a24d-30d192ff707c", "comment": "Malware payload", "value": "8281010956e8310b659002e84daf426e0b6977b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968673, "uuid": "f1f159e6-4ddf-47ea-a717-f74ba8ccf04b", "comment": "Malware payload", "value": "74ae845adb5d8c467737861df970100c65915e2f2449360b18909c16309a6529c4af8aa1dee5405fcded3c07ed114cf5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968673, "uuid": "97287e98-d3fc-4aa6-91b4-6e12ef0620e6", "value": "T10CB45B467539C692C02EC93146F5D6A527A17C7FCDA51BCFA0D8774E8EB23C3221A0DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968673, "uuid": "ff48ef45-cb6f-4ea2-a6db-1acd0233582a", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968673, "uuid": "8d66de01-de34-4504-b162-961d3234de05", "value": "6144:+RR5rhZFQGrsUwF7vlPoSNyF3zn6JCYf9JQ3p8I:+R5nWFpPoS/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968673, "uuid": "a5e1f271-6bf6-4fd5-b9ad-065bf8ab71fe", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968673, "uuid": "f094f0fc-54df-4c9e-9887-53a4e25161bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968673, "uuid": "41a16b38-f95f-4f8a-8d9f-2840cafc1bee", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.32204.32526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6aa754b-5555-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694953712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953712, "uuid": "0565161c-3ecf-4cb2-be56-18b5b9f2ff11", "comment": "Malware payload (MysticStealer)", "value": "7c34771f87f3ba99cae6945744bfeb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953712, "uuid": "a5a4dbcc-76ed-4b9d-a242-5b9807457cc3", "comment": "Malware payload (MysticStealer)", "value": "53c138ca2e0c51c0fdf76ef07b9819bdfb69891db862de5b330a8ecf55d6dacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953712, "uuid": "0faa4b38-a342-443b-b0dc-71893e5c3749", "comment": "Malware payload (MysticStealer)", "value": "0d00fe2807907149db280b4874f7e1194db15569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953712, "uuid": "85e20f60-3d80-48b8-bcad-96bf35486877", "comment": "Malware payload (MysticStealer)", "value": "0478052b4def33d3d6dbc64dd98aa261f99f598ff0bb7d157462405de8b005d388bca845f177b6c5779dadc2f64dab47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953712, "uuid": "fa55c4de-9542-46e1-ba82-811d3448f449", "value": "T11784AE927090D472D833253665E8FAB4596EF8500B83D9DFA3F80F7E4FB49D09970A92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953712, "uuid": "b43a0ed9-956b-4417-bd8c-24338a557b90", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953712, "uuid": "c6d5e05a-9c57-4957-9d23-5bce94bbd6ea", "value": "6144:vbvJm09zORs+z/TMify9DAOdgQ4YpsMebz3kudMWRy438/:v7w09CK5N8/YaDbE08/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694953712, "uuid": "fff55943-161f-4506-af86-99360460e425", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694953712, "uuid": "ac9a8e40-6478-4edc-8051-f54e615ac38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953712, "uuid": "f5ae0bd9-2dd0-420b-926c-761c0f67e5a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84000dff-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960928, "uuid": "e482db04-4025-4af4-a67c-5094ad058aac", "comment": "Malware payload (Mirai)", "value": "8451ac3cd242e9ce9aa6c7a42b7454a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960928, "uuid": "2f897a41-a7a0-45cc-8402-362b0918fdbb", "comment": "Malware payload (Mirai)", "value": "57ea660a95fcd43f2eb4ca60bfd520fe32143124519b5819af8cb8a90bc8906e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960928, "uuid": "4f9e0330-2373-456d-9109-5572c687048f", "comment": "Malware payload (Mirai)", "value": "d8be17f5140e9d422bef44e2898b4ba9eb3daf59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960928, "uuid": "743fc779-6b89-4db8-ab32-081df8211667", "comment": "Malware payload (Mirai)", "value": "197589803b70e55cde1553e386da2f1073c70952fdc04e4f5fb51a8a7d8d3979bcd9d7752177ba4a0bd62e28ba8757c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960928, "uuid": "5f461cfb-7fe8-48b4-a179-a4cc311d3e42", "value": "T1DA53179178D19A16C5E423BBFA6E40CD372563E8E1DF32178D216F4077C982F0DABA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960928, "uuid": "81e648c9-a95f-4315-9a7e-eba7e6684833", "value": "1536:9amD7RhzxhC4K+jbxEGh/VVzG+u/WhKXcQ7dfWl1de:9aQDFphhVuuhY7df2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960928, "uuid": "2816585e-1e54-4994-9f24-2d996eda00d5", "value": 64408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960928, "uuid": "f395bb39-3298-46ed-a7d6-115e8542199e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960928, "uuid": "2df25cac-f012-4275-8acc-3cae9bb96243", "value": "8451ac3cd242e9ce9aa6c7a42b7454a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f6e6a6-5590-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694979111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979111, "uuid": "82414ab9-725b-4b82-82c0-fc10117cbab8", "comment": "Malware payload", "value": "bf7512021dbdce0bd111f7ef1aa615d5", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979111, "uuid": "2818ed59-897f-4b3d-b18a-7caaabda805c", "comment": "Malware payload", "value": "589dbb3f678511825c310447b6aece312a4471394b3bc40dde6c75623fc108c0", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979111, "uuid": "1544f7d4-92f0-4034-be84-560de0eceec9", "comment": "Malware payload", "value": "ea8b0d95924605292f994810103ee95b9cc37914", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979111, "uuid": "8aa538a0-3439-44f7-8527-d5af795dd695", "comment": "Malware payload", "value": "7ffdadc0b811c46e7243bc1f30057d6e839646c27ac7707c7538eabcde2b34a384ba86e07f45dd54ed359bdb2f22bc5b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694979111, "uuid": "fe6b334b-4c21-46f1-9488-326709f5406b", "value": "T12BF4C863D366D503C6CA77F0AA8B6329D310FE10BEF65BE7E650D1809EF42465E16B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694979111, "uuid": "fe8fc7d6-ae38-45a6-9690-5d28ac4bce20", "value": "12288:JS/bsnF30rsNxqxxosL98Ku9xVuS5HFzeruKTCaftiA:JY20rwqxHS/erDCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694979111, "uuid": "bf6109ba-acf9-43ea-bafd-16ad28e7ec56", "value": 790688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694979111, "uuid": "0fa05502-fbd8-4f61-9932-338138080981", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694979111, "uuid": "f6fff5cf-1a7f-4eda-ac30-201a476e47af", "value": "AppleApp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9316b4c1-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968684, "uuid": "3478da27-305c-4008-87e2-7391750db6d6", "comment": "Malware payload", "value": "dd5f22aa658472321b07df3ca721bc0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968684, "uuid": "30de5bfe-7625-49fd-ae9e-b434f9f49c56", "comment": "Malware payload", "value": "58c356a62be9a2912623030c86236346e08923038a319cd69b896417d205071e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968684, "uuid": "8d7043b0-793d-4e01-849a-cdd217115a11", "comment": "Malware payload", "value": "adbae108f20b6b55ecd4adff3a33efb3106b9ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968684, "uuid": "52d1655a-3cdc-447e-be3f-a95e6a980fb8", "comment": "Malware payload", "value": "caa1e4807d574dc4850aed205c8c9bc7c46605fcc18e3b5c7888b73c819324693f1110b46ff6987de520ee2045d1aa5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968684, "uuid": "13952b1b-bfdf-4770-83a4-e90548bbf3f2", "value": "T1B9D57DA2787C478FEBE247332C6D3155380E0F0CA3C449B6B1967AD42577682696E37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968684, "uuid": "1723663f-ae05-4614-824f-f4abcb0ade98", "value": "d7e89519996cd66a0eaba4d0ed536a49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968684, "uuid": "bc538322-985c-49f8-9dd9-35b73e030aa3", "value": "12288:vRTdjx5cE2q7jz6yeZxjxveyTIR8mxouOTKNpt:vRTtzcMWysjxveykR8mxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968684, "uuid": "26db46f0-450b-4d71-916f-c4cf8ce61ade", "value": 2764800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968684, "uuid": "0b8a7583-6bdd-4d11-9cab-e5b872865d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968684, "uuid": "2fd4bd3e-6de0-4a3b-bed1-7aa9ab271749", "value": "SecuriteInfo.com.Worm.Win32.WBNA.26898.13217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9533f99d-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968688, "uuid": "7bed5d7e-5f86-41f7-9719-6091ed23941d", "comment": "Malware payload", "value": "2535bd91e81a0edb251de9f11ffe4680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968688, "uuid": "45d88788-9a59-48bc-9f2e-e5d1f451599c", "comment": "Malware payload", "value": "5a4bfc961c81c0fbcb8933ec8dc3da69ac80b74ca574a4742d2a1e6429ff8a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968688, "uuid": "da706058-0156-45bb-983c-53517d8cc7e8", "comment": "Malware payload", "value": "b954a2f08c2eeea21cef51ca95899761431b216e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968688, "uuid": "6f4aa232-de65-4c29-ac85-73337084028a", "comment": "Malware payload", "value": "2cb1db4fffa469f6a942996d91e35f3f74b609bf98c2f380031e5cfb69daaa63fedf1c1f2503209efb0681f825b5e304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968688, "uuid": "29f4c32f-fa72-41d6-ba2b-794ce0b54c9c", "value": "T1BB74E604BBECEA64F3BE6B7514B3415006B5BC46BA32F60D09E275BD2A727C10D417AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968688, "uuid": "c8cab8b0-adcc-420e-abfe-cb8720ac4b91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968688, "uuid": "b314a14f-12a2-4101-ab41-8c3177d4bd7e", "value": "6144:eA6fYzhjOJEthhwDfqJ27AZlwMOmZNx9ORdBjQtPO+S:DY6gmth+DfqJ27AZ/nZNxuruB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968688, "uuid": "de0c2255-3d8a-428c-b558-bf86421d6d85", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968688, "uuid": "b501ca2d-6347-4961-9872-8305ca4cbd28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968688, "uuid": "edf8fc65-b204-4e6f-9611-7dac58e71565", "value": "SecuriteInfo.com.W32.MSIL_Agent.CAC.gen.Eldorado.693.17788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a8b4a0-5506-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694919567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919567, "uuid": "3ee59df2-7892-455e-9a5e-e7ed862a7349", "comment": "Malware payload (Fabookie)", "value": "73792b9f21378cbe3f8ecfb0a7019b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919567, "uuid": "a5a1aa1d-a57b-464c-bbba-47428f7cfa2e", "comment": "Malware payload (Fabookie)", "value": "5c8d09a3a75d5d3da94201eb9f9086497341b7541c2eb7aa641f1b98d1ba927e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919567, "uuid": "8776d250-76a6-4cbc-a35e-a48cda6a2fd6", "comment": "Malware payload (Fabookie)", "value": "7876764626c7370327b18206aca48111bb0f7b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694919567, "uuid": "b88b5ec7-1776-4f3b-9ac5-689a69c5ca54", "comment": "Malware payload (Fabookie)", "value": "ed749bdbb7db3962778027594b8acf6d11bc24f9e63a57b45b7337b335d5ac6b05905cf7317e2ea84e8d1af6929dcda1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919567, "uuid": "e7e13f83-f66f-4f09-a991-46e6ed62b6dd", "value": "T1E8D4D081B39095D9C4B88430C693CE71CA317C64DB28569BA6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919567, "uuid": "485c3d57-d866-4d27-9a50-98c78adb3390", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919567, "uuid": "ebee9f7b-de0a-44ad-b7c4-1cb42856eb6f", "value": "12288:772d1oljvJI8XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:HqolrGWM3/kRc4lAgantPbcHn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694919567, "uuid": "2766ef09-8fff-4ab8-b3cc-360f9148609d", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694919567, "uuid": "b2e23992-bcb3-408f-993f-61b09a52df35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694919567, "uuid": "a2e612e4-ec7a-44fe-89ad-7ff3b5bbf45c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43c21ff-556c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694963640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694963640, "uuid": "03a3f8a9-bbc5-4584-b302-3ec43d487c0d", "comment": "Malware payload (RedLineStealer)", "value": "f9c6d425abd8e8208352dad8a84c78fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694963640, "uuid": "4df262cc-4c90-4b68-b17f-0f253ad4e2fe", "comment": "Malware payload (RedLineStealer)", "value": "5ca217aebae40968f539fa5d9a7529a380f3b08981eff45a5e9404d11a3663b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694963640, "uuid": "ae64a50b-fa19-45f9-8829-8c0953db2d5b", "comment": "Malware payload (RedLineStealer)", "value": "62a1b67197d2610b6153fee65c217bb64241cc3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694963640, "uuid": "9f803437-6497-4bf6-bdfb-c5b9be81266a", "comment": "Malware payload (RedLineStealer)", "value": "678acc242d624865f543d48271ba64ec4583d1bbc221181c66bc251bab84285bf800bf464a240553fa409790dda3608f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694963640, "uuid": "95596274-c88e-43c9-93a3-81c13b22f30d", "value": "T187556A713C91CE31E9A212BF85AC7823519CA4610B2B25E7519B1EDF5D1C3F2EA34D8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694963640, "uuid": "48ae9f6c-71b2-41c6-a02b-f090c8fd47b3", "value": "8d5160aba42ffb2e8789bc5aa4f2911e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694963640, "uuid": "93632a1a-5604-47aa-a879-2d90c8c00819", "value": "24576:qz/bHTbbK8HgneSBMJHoqbQvFJU4V+zL9yzveyyy2hfvygCV:qnbK8HgnevB87XF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694963640, "uuid": "57b8841d-0999-4604-b249-4420ccd32225", "value": 1320760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694963640, "uuid": "dce3c6c0-73eb-4dd2-aa45-3c91ad13e5bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694963640, "uuid": "1639f2db-b6be-4ac8-b2d5-eddaf5a39c1f", "value": "f9c6d425abd8e8208352dad8a84c78fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1f1481-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968671, "uuid": "afeff16b-29ba-41fb-a5e4-b63a25c6e90f", "comment": "Malware payload", "value": "be88220d76ec5a07d005626fc32bccdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968671, "uuid": "2b89a7d5-1698-42a3-9244-a5a1105269bc", "comment": "Malware payload", "value": "5e590553ae549780ed1210fc73a38e99dc077616ab981e47e7ea1f0fc2a569c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968671, "uuid": "02091872-dfc6-4566-a57e-d39dc7ddcb0a", "comment": "Malware payload", "value": "e81fa4be2180179f765e59de048e56b82eddd53f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968671, "uuid": "d1018cdf-7951-442e-ab51-957ac432ec62", "comment": "Malware payload", "value": "f103855236f698491adab2eda0ca2f51d5eac1dee0439bf2e28a77754b92c67e5f079b3cd292a32bd7ac8336b34a04f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968671, "uuid": "35a18ee3-79b4-4aef-aaf2-1d9c9b52fc88", "value": "T13F61CAD7E6D248B2C34EC5747A494128EB31DB3133A197439F6DA10ADC153805EFDA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968671, "uuid": "14e40d0a-60e2-4468-ac58-7685de7bb101", "value": "48:OEPxKItHHkHL4D3fTyh6aRev5fFmQbiDgkc6mHTraCfVnkKQjhg4EboFX:nPPnZ7fTtzWDgkc6AVnkbg9El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968671, "uuid": "f672249c-dc75-4f86-82f0-dc900d1d94f7", "value": 3443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968671, "uuid": "2dc77be6-dc32-40de-9ba5-16aa3db29ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968671, "uuid": "e750834f-ed9a-434f-acc2-dbcc57a667a1", "value": "SecuriteInfo.com.Trojan.BAT.Qhost.122.9543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e936ed7-559a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694983145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983145, "uuid": "5fad710f-d50f-4adc-9da8-4e4d62976dbb", "comment": "Malware payload (MysticStealer)", "value": "308de956608270da2946f933e45ddbfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983145, "uuid": "1b5e25ef-dfa5-488e-ad03-34f346dfd724", "comment": "Malware payload (MysticStealer)", "value": "5eb0a8d0ae7da3b30ecb5c0e6e479c5b5ac87c0b4fdb489863a4d5e6c7864519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983145, "uuid": "8df642c8-8aa5-4d5a-80e2-4c1d61666e21", "comment": "Malware payload (MysticStealer)", "value": "23f97ee0e3f0f6bda4c918488cdbc462f10e0e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983145, "uuid": "2f36cdea-1bba-4918-90dd-514c3b2c6918", "comment": "Malware payload (MysticStealer)", "value": "dc98249b602d5b3d9df51acd612f00b26d3b65b08255c7cec817c9d53d76639a1d54681a5644da57b734d10f0fb57146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983145, "uuid": "28b5c3a9-2b03-4142-a8de-8fde634ac7a1", "value": "T173848C2078D28332F9721531E9BCA279563DB960077519EB57E40E2E8F213E2DB33E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983145, "uuid": "2d5b8a6c-ff79-47b6-8a8b-b7fc5ef4d78b", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983145, "uuid": "a751d7d7-d90f-4165-8b54-8e8ce39a20ff", "value": "6144:wovJm09zORs+z/TMify9DAOMgQs63H/8WtlnFsMXE0nnnj8P8/:wYw09CK5Nbf+f8cF3W8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983145, "uuid": "bbb11385-4d29-4a7f-90f3-54349cc03104", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983145, "uuid": "c181e112-3e7b-4f60-be0b-e5ece2e1d150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983145, "uuid": "4048078c-3089-43a2-84e9-b450900e11f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c37e5f-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968655, "uuid": "617a6da7-f318-4396-b635-32be39d93a77", "comment": "Malware payload", "value": "857a3670f4c2df498826e1c83194706a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968655, "uuid": "ad6a2e34-9a70-4dcb-98f1-7d2a5d244997", "comment": "Malware payload", "value": "5ed579051ba019320250a1cecb7946971e25890a5927b2315165d731cfbe49e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968655, "uuid": "3fa2498e-467e-4ac0-83bf-3a0f45804fde", "comment": "Malware payload", "value": "a7f18641ec992281a76eec106aaa90189d871937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968655, "uuid": "4fd0c046-6d80-473c-953a-f83fce5b86cc", "comment": "Malware payload", "value": "7544cf40807bae6562a9d7a0a64b5354b2b316494484f2ca6f8228d2485582124fbfc1c3a103271e49d6325acfb9c817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968655, "uuid": "cf26a8d5-6fa0-4a28-bc29-a15b3c08eece", "value": "T1FD05B726A650510FF4A2C5F1E8F9498768663D7516ACA85BB3936F0D61327C3ECB032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968655, "uuid": "ebe47fe6-0108-4778-99cb-ab6a9039fe93", "value": "54a0413246e3aff56d80d0ba2e83e5fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968655, "uuid": "5e1fca91-4615-4274-b722-db6cd00c45db", "value": "24576:t/9g3kQclp0GrXCUzFWmgnoO1eNwIByy8:zg3kflZEPoO1eNwIBt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968655, "uuid": "97527b46-1046-4be5-b620-ecfabc7f314c", "value": 860280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968655, "uuid": "b103f7f1-8c03-440f-897a-492272ceedaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968655, "uuid": "a3adf41c-2910-4618-89af-112e398d1104", "value": "SecuriteInfo.com.BACKDOOR.Trojan.11010.1435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3420916-5581-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694972711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972711, "uuid": "8cf16974-25d5-4f43-bf36-432baaed030c", "comment": "Malware payload (RedLineStealer)", "value": "1ad302af7f75f7e3cf4691041e791d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972711, "uuid": "d2584ce5-a0ec-4097-876a-a63bf691caed", "comment": "Malware payload (RedLineStealer)", "value": "60cecb79eeb765d094743f7769c5530b4375874f73cdb623dbc8c831630afe72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972711, "uuid": "daf151e1-11a5-4977-ac6c-7a1560cd34e0", "comment": "Malware payload (RedLineStealer)", "value": "0433dfcddf09e96c9cab342050066952bf4b996a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972711, "uuid": "c3cd0ecb-3224-4d50-8e54-fb1c73f0a9ab", "comment": "Malware payload (RedLineStealer)", "value": "e7e8944ba84781fcc48ca1b15479a74d64a0bf2a207075f323fab1d344be69ebb4a20a841b776d3ef49c11a7c07da1f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972711, "uuid": "ab946df5-0f04-47b9-b4a8-d2c32a44f2c6", "value": "T1853502A2F5809531E626053E64C95ABD853E7D181F758BFF5B807A680FF03C38B3A652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972711, "uuid": "077c57dc-578c-4b1b-a4f2-e22cceaa97f6", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972711, "uuid": "4f24d28d-8f33-42f0-9ad1-7852b3aba62c", "value": "24576:8iuBtZ4JpZ9DCDodPgxy0ax6LC78cdRtLFcnb2zd:ruBf4DZ9DCDodAy7x6utT4nK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694972711, "uuid": "5d7a5b82-3eb2-4c6b-8bfd-85fea3166d34", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694972711, "uuid": "68f840e1-881a-41a6-8263-845873fb5d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972711, "uuid": "644fc867-2b5e-4f23-a6ed-9ea2f41ce1a7", "value": "1ad302af7f75f7e3cf4691041e791d4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f32be6-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983634, "uuid": "83c9f5da-5e2c-4a88-8a30-3f4cc1489155", "comment": "Malware payload (Mirai)", "value": "99d66731fb1b2ce8beb39255c75018d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983634, "uuid": "650e1901-93d6-4473-bcf4-cea56a7f563c", "comment": "Malware payload (Mirai)", "value": "60fc4bd17a9649e6f0bfa5c39eaeacb68ff5921c3230a9d5808998df3a3ba984", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983634, "uuid": "0b72e9f1-74a7-417c-ad54-110f6362b93f", "comment": "Malware payload (Mirai)", "value": "0b5547e15b049f5738d57402ebb8f755797904e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983634, "uuid": "f9e7437c-3208-4782-9134-f8a6a74fcc64", "comment": "Malware payload (Mirai)", "value": "6d086688e0ad2c1fc7fe3d40e6d20f50cd09dcfef0f1e4e5cedf9a2edde88b92552e319c789108c3da1c1edf9f2f12ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983634, "uuid": "a7507ae1-0d21-412d-8dcb-bfbc55f5cacd", "value": "T191336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983634, "uuid": "9956e879-e4a5-42c3-bcfd-48d51c46597a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983634, "uuid": "0b925a92-4e45-4b2c-b094-a385c270ab6a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983634, "uuid": "d3a08b97-fe1a-4b47-902e-565f6ca1eb8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983634, "uuid": "b5adb441-6101-48e5-88e3-b845450b2a59", "value": "99d66731fb1b2ce8beb39255c75018d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911f63f8-55a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694989297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989297, "uuid": "f6ef152b-39b2-4da9-aaf9-1c68cfd74734", "comment": "Malware payload", "value": "a99b863be7e866f7f3f4f88d3ef5b0d9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989297, "uuid": "0acb60dc-5968-46fb-bbe3-f8c536586a82", "comment": "Malware payload", "value": "6281f8a509aba0522fb93a2ed7ec93cec0396e1a6a166cab74328665fae1b2c8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989297, "uuid": "e9aaf224-096a-466a-8c20-52bea41029c1", "comment": "Malware payload", "value": "7386d5ef1a95b2e7af3c4b48e84c42f59f8dd01b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989297, "uuid": "57824177-a2f6-45d8-9c89-10e52a964880", "comment": "Malware payload", "value": "e3ee60b39aac7d93510bb3f232d634debfd3055e3bfa9bbd94cd84b504831090b1a1dccc9a01476114215dddafc1262b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989297, "uuid": "e4a7aa90-c00a-4844-9deb-25e9bee8c5fb", "value": "T133D5226BF325982BDCF6C3362064163655371D289B43F7CA254873FA68BBDF90B81489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989297, "uuid": "69bbe953-940f-4689-b1f8-e3ac33c4595c", "value": "49152:P/UjG7mjM01uqwh9Ne10xYWpOSF31OJOkuzINghEV9yZAQSq:HCzjM0Gh9NeU7M6zYghMy6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694989297, "uuid": "f417835c-9af7-475f-9faf-11db60eba539", "value": 2898281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694989297, "uuid": "f884ff1f-e0d0-4732-984e-b1e622aa0dd6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989297, "uuid": "98d84cf5-908d-440d-9100-a074178452fb", "value": "Eblageh.sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f40022-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968667, "uuid": "f3937324-04b8-460b-89fc-42d570ca676f", "comment": "Malware payload", "value": "ef6f2aefd398fa31a1533041a329181e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968667, "uuid": "e695a15c-2f36-4d54-8dcd-98a026336a70", "comment": "Malware payload", "value": "6594bc5ef4ea23acbd0a46269e24713a51a9a206f9f50a88440c775cebc807fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968667, "uuid": "2bbbf7df-9736-4c48-9fb1-9d05997c390b", "comment": "Malware payload", "value": "87038b5cba939217dc0e33c39274bee495244b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968667, "uuid": "698fd1de-a098-4d1b-b00d-684a076918dc", "comment": "Malware payload", "value": "103a1200de172ac722d0f8cb8b6c3af11ba790bb0b40b2af5b4beb378569971a51faff0b42049d84a263cd1ab05a6353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968667, "uuid": "e5fbadd6-6eef-441f-ad51-19178fa85490", "value": "T1D0F11B93EDA288B6C55DC9BD5D498934E5322A3176E2E2D36FAF580DCC251804BFC712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968667, "uuid": "620c97dd-fec3-4862-8516-d50b3e88cc9c", "value": "192:nZxfRq8HebguuREnZXbzNbotbFtZKN8lryIlK:V3HqsREnZX3Qt02g2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968667, "uuid": "eeac1f9c-16c2-42de-908b-70f8c27b3155", "value": 7779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968667, "uuid": "068eb85c-c13f-4a15-b70b-b3cfcf07ebd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968667, "uuid": "158bba47-6966-4313-b6c3-bd444fc1c5d2", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.3442.30633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c1413f-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968695, "uuid": "a04d4a40-f54d-4f74-b790-ba81ab1d3dc6", "comment": "Malware payload", "value": "7431c10052ebaa845001c673cc5d8d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968695, "uuid": "bc549b05-eb80-47d9-ab9a-21b51bad09e3", "comment": "Malware payload", "value": "65eb694460e5d93fd9e24b217f67bfea7af793cd2cd26bd255dbd8c48c3f02a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968695, "uuid": "be07618f-e145-4580-9528-70e37fa66f56", "comment": "Malware payload", "value": "87f2ec075915f2f67e684e04818b8af5ae427c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968695, "uuid": "4f483e00-aecd-4e67-b58a-5af8ce9e51f1", "comment": "Malware payload", "value": "7c954299dbd26dc988444d85b2c2f5e6e624aefd998d4c1b9d419e5f01cceaed0fc04d156b6183973d7f002da2348f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968695, "uuid": "0ebf01a4-9419-4b1a-bbb8-6f11b0f68321", "value": "T13204963FDD114242E92169711419BE896E329802B4159DC3BBD7BACC283BB977DFC293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968695, "uuid": "c77e732f-7974-4454-b3fd-d89b5a9efe45", "value": "a8339b92f43b8c7fdcb5a8b809b792e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968695, "uuid": "2b8ddbf5-fdc8-4780-8217-663a74cb28cc", "value": "1536:xV9x51EFzCbHtZexjD9sDrOu5HYtobpiDo8UgiSI6Ww89kbcAJ2o4VevdcAhuwm2:Lb51EFGbHSxhsDrOuxYtobyWbFD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968695, "uuid": "f94ef9d6-a224-4ebd-a77c-8bc2c8818493", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968695, "uuid": "e12092f9-e65d-4115-a758-fb54e9fba964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968695, "uuid": "1b1c0309-3760-4bd0-9b5b-d8f68c67c4d0", "value": "SecuriteInfo.com.Worm.Win32.WBNA.4162.5129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8663cbda-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968663, "uuid": "65b04ab8-faf3-4870-b22c-7347def65bae", "comment": "Malware payload", "value": "bc1648454384a7152c6127ce91bdd4fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968663, "uuid": "73c9ab79-e9cb-49a8-8bc9-0fe31088cb39", "comment": "Malware payload", "value": "660266ed24c207478d251977db52d4dd490e5048409178506d97d5e9b64ccafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968663, "uuid": "54c05f26-9535-4df6-b0a8-a54887fe92ce", "comment": "Malware payload", "value": "c562f9b9062905db15e8648562826445c1c58cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968663, "uuid": "5292b8c6-4d3b-4df0-970a-ae373fcba7ca", "comment": "Malware payload", "value": "cc3e4a519a26c4b54745837f72bac1358198c6f68e6d190e925c615a1961de9deaa973db6ce00fa02dc17050d18ce331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968663, "uuid": "119fb9b8-b66a-4206-b3f9-22574c271876", "value": "T14661CAD7E6D248B2C34EC5743A494128EB31DB3133A197439F6DA10ADC153805EFDA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968663, "uuid": "45b4dd55-f2ee-41a1-98c8-e1478f4f7447", "value": "48:OEPxKItHHkHL4D3fTyh6aRev5fFmQbiDgkc6mHTraCfVnkKQjhg4EboFT:nPPnZ7fTtzWDgkc6AVnkbg9Ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968663, "uuid": "a77d3103-b1da-4155-90b7-278013816e0e", "value": 3441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968663, "uuid": "007d96ed-a4c7-422b-aeff-5a85ddfb9b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968663, "uuid": "15405a52-060c-4832-9a34-da7d5636f704", "value": "SecuriteInfo.com.Trojan.BAT.Qhost.14113.26218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7695ea02-5573-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694966489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966489, "uuid": "96e26de5-d8b7-43b4-9ae8-fd0fdac19ba2", "comment": "Malware payload (Smoke Loader)", "value": "afcfdec7f1675a6b234d4ac2983327d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966489, "uuid": "a861e1cd-bc58-4de6-9c4e-73bcdf723843", "comment": "Malware payload (Smoke Loader)", "value": "69a871ba7d2670d162b2feffd9665fcebc4101a47d7892be98c3abbd602573d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966489, "uuid": "e74450f7-dcd4-4106-9bcf-1dad68a2ee91", "comment": "Malware payload (Smoke Loader)", "value": "26fedfcffeb4514a65b5fe05676eb1e9d0c6eec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694966489, "uuid": "e0b50142-8971-44ee-a2d4-b86b632bef7e", "comment": "Malware payload (Smoke Loader)", "value": "d09b67283e44ade86e3cc1b4f371c43744136743663a11e71bc1dc48660c850692e722b9cc874315ea7c42ca3d5810f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966489, "uuid": "e45bdbe6-deb4-4626-b86e-cd087beeed1a", "value": "T1E444BF12E3F0AC31F5620A368DADC6F4262FFC218E75E64B230C7B6F0971261D5A6759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966489, "uuid": "61f688c1-a99e-443e-86d7-303b81560b73", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966489, "uuid": "2dc963fb-f602-418a-9a65-1cb4f492b12e", "value": "3072:Ze1mM1SeATLuEayh1M8yOINUQjwAccQNZiVWZ5AYShN:DMMeAbayL7IWQwA9QrOu55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694966489, "uuid": "57541402-fc54-49d0-a1d4-3ea60777c2fd", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694966489, "uuid": "cce766e9-bec3-4ca3-98ae-9ad0f19dc921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694966489, "uuid": "d6eaadd8-a8bc-4447-bbe0-6f3b3a03d4e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70a706d-55af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694992421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992421, "uuid": "9ac1e4ce-43db-4297-82f5-312bc67d01e3", "comment": "Malware payload (MysticStealer)", "value": "db887a6003a41d914d81aaade2f8f018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992421, "uuid": "e76634bc-c61d-484f-a0a0-63341a2bdc69", "comment": "Malware payload (MysticStealer)", "value": "69b038f15023d54771871c6255f13b044b404f6e74be5c6b91bce9d7d9b49fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992421, "uuid": "c74c4e34-6f95-49ae-b1d1-ac2a1655b8cf", "comment": "Malware payload (MysticStealer)", "value": "c5c3b8379d9286f55f8241e0a4e74172f0404f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694992421, "uuid": "c7ab5cb1-db9c-4060-a66e-4f000c42727b", "comment": "Malware payload (MysticStealer)", "value": "20cadc9ce728c98a33db8f966245b525f3e72f2fd210ab97039652052dbb833b9d2ecbc36b4ec1a2ae8c48401ca2a7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694992421, "uuid": "910bac3e-fd74-4def-b7ca-064130735261", "value": "T12884BE3974C14832D873163D46D86A799F3D7C2027B02AEB9790DEAD8E201DCA6F25DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694992421, "uuid": "5ab88c9b-c26e-44dc-ba48-32fc688a4a7e", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694992421, "uuid": "dc974dbd-1b84-4290-85da-f43529e301a6", "value": "6144:2XvJm09zORs+z/TMify9DAOOgQ/e9JG3Nct0aI25Sl8/:2/w09CK5NtQp3Wt+wQ8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694992421, "uuid": "26b09a00-53d3-40bd-be9e-266fed4367b4", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694992421, "uuid": "f6e54b25-8a8e-468e-811a-30358040114b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694992421, "uuid": "88324c77-5153-426b-a89c-9bfaff3a4d1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eabe66e-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968650, "uuid": "663d4255-3539-4c3b-afb5-3b8432163623", "comment": "Malware payload", "value": "66918d4fe7d8d2c12d83d8359cf8c037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968650, "uuid": "4e4c6663-30b0-4776-b7a8-ac949c33b538", "comment": "Malware payload", "value": "69b4d879fac6e552929f56ec9eadc2ed23fd66829b015fbd5f64f50c1b7afe9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968650, "uuid": "7c9eedc4-4463-4e0e-979e-0fc3768751cf", "comment": "Malware payload", "value": "c5ea0e43dfdf509db0fb2efab2a48bf2053b86ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968650, "uuid": "53f86b78-4fe1-4ae6-aa55-9a81e9cd7886", "comment": "Malware payload", "value": "b351d1162f486760d82487176d67f1df2e1e64850365932a641923070d8443bbdf120362e962411cca9f1fe1b05263e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968650, "uuid": "cefc73e9-b8e5-449d-b2d0-e070c58e243f", "value": "T1BC636B10E9828872D1480E7C5D0BD935E8393A152FBDB1C7B7AE1F4CCD7A78B491927A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968650, "uuid": "4a3fa7c3-76a1-479d-8f59-f3e6a474f414", "value": "1536:0BAp5XQHGVkXKGY+4ecBU3IZyVdpGfhECljVp:0BAp5XhKpN4eOyVTGfhECljv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968650, "uuid": "a969ae6a-4839-41f2-b499-ab501df1a7f0", "value": 67815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968650, "uuid": "5bea99a9-a409-4453-8100-be9923261a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968650, "uuid": "5cbb80ff-4aa2-4dd5-aa84-bcf1e4ee3c6a", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.22560.11891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9254ef62-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968683, "uuid": "9a07f084-5532-4546-858e-ed85d13f6401", "comment": "Malware payload", "value": "b66bc6f603d290278f1a4298d970e52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968683, "uuid": "99e95a20-d7a5-421b-a736-f82ed320a5e0", "comment": "Malware payload", "value": "6ac71544bd8c403ae8c4a097c6bd00648d765fae211dbf5df1838bfdd07ccb20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968683, "uuid": "db604c11-a12c-426e-aefc-b5d1dc48eb4f", "comment": "Malware payload", "value": "868f934037a2d2aaed8688d8e5bc7a1981ecc498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968683, "uuid": "ce27f254-ecbc-4e97-ac58-52181dd3dc00", "comment": "Malware payload", "value": "c044ff8d5b68375df67bd15842aa4e7ac58dc02164e22142f2e48d097fe1cf7502b88a8c1f128105081a4742d881a18d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968683, "uuid": "3716e7c3-1fdc-4337-9376-10d0c02df3bc", "value": "T140F11B93EDA288B6C55DC9BD5D498934E5322A317AE2E2D36FAF580DCC251804BFC712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968683, "uuid": "e21b196f-51f8-4bf4-b4c2-46143e736881", "value": "192:nZxfRq8HebguuREnZXbzNbotbFtZKN8lryIl5:V3HqsREnZX3Qt02g25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968683, "uuid": "291c52ac-2769-4110-bd4a-228d2fd123ab", "value": 7785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968683, "uuid": "5aeeb5e0-73eb-4c64-abbc-f228282af257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968683, "uuid": "3c15f8df-f15e-4d2d-adf2-c2dcdc332174", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.17875.14646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b61e36-54f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694912217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912217, "uuid": "27ce3bf4-d309-465c-a369-5c5f33388d77", "comment": "Malware payload (Fabookie)", "value": "c268935f0f5f82c94c918ba9911a0b1d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912217, "uuid": "83c90d6f-8962-4040-b9c8-6d82df286512", "comment": "Malware payload (Fabookie)", "value": "6b159b28d5e088d7186e164215e9cfe4f4acf13c040629adb93c2ee33d2942bd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912217, "uuid": "512d7dee-5fe6-49b9-a5f6-bb5b517893a6", "comment": "Malware payload (Fabookie)", "value": "bdbcc1f3e28e764a41c757149878cb5acd6b869e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912217, "uuid": "217a1e29-0af1-4bbd-b0df-5a2fe501f56b", "comment": "Malware payload (Fabookie)", "value": "b87f5ab6bb11184f6a8ac011730f9095065bafc5d6a07c930d49c03b9dbdccf06faa42a8a37905fea5ce42ceb5900969", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912217, "uuid": "949f1815-8c47-49f4-ad23-c043a8833aa5", "value": "T1EC15CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912217, "uuid": "e45a3159-d5cd-46f9-966e-a1057e746b60", "value": "02bc376d1ae63a2fef892492d891a666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912217, "uuid": "66dad914-9b06-43f5-bc24-e2389d19de2e", "value": "12288:CwGetS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:kuS/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694912217, "uuid": "18f1318c-cfe8-46cf-abf6-165161c3b67b", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694912217, "uuid": "4deacd65-19de-48e0-82b8-839d731bd387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912217, "uuid": "5ea132d1-dab1-46c6-a901-950e8f48d9a7", "value": "c268935f0f5f82c94c918ba9911a0b1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd6db1f-5533-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694939070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939070, "uuid": "4f26f8cb-f2a5-4f0f-9613-35aa5035f71c", "comment": "Malware payload (MysticStealer)", "value": "8d7b85f6cdd896857cbf4bdee0eb920a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939070, "uuid": "408036c0-d4a4-453d-9824-fa418f6ffda0", "comment": "Malware payload (MysticStealer)", "value": "6b643ca0b34defb2996c36f34af070d4a9424a06640262363fb96c5f1ac82667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939070, "uuid": "914ef102-e315-4c98-9ddd-08b602f65178", "comment": "Malware payload (MysticStealer)", "value": "b509b497c7391a00956e2c76d7042b649548ae87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939070, "uuid": "cb65ce30-c26e-476c-96dc-ab174343f9fe", "comment": "Malware payload (MysticStealer)", "value": "a72501b77c18e57a4c7363a490179f1b58e04da0c20d3f0e4b5b9374d63d3bab6d5f9d6f4c263b8d2e264e134ecb4d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939070, "uuid": "7816285e-0f18-4608-b936-cc0026effa1b", "value": "T14C74AE20B5C19072DDB719368AF88F76513D7A6027A009EBA7B44E7DDF183D0A23166F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939070, "uuid": "855e6517-f043-46e2-803e-d9f14b44d485", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939070, "uuid": "32f1f93c-b792-486e-a62d-02d0ae9a1d89", "value": "6144:HncaGEZt20ZSwbz8+Dxe8kVAOUl7jsiV46Tr/WjbmBRQkzLwwLB6oema5vmbh8Ey:HnFzZtT78T+2O4EjWjTOwGXh8Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694939070, "uuid": "b125559f-c5df-4d9d-9257-d140dc316f2f", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694939070, "uuid": "0a1fd245-4612-4c9e-92e4-7fcd3bb30b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939070, "uuid": "1a92d0bd-7bd4-47db-828d-7f87a9a3c17b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a442bff5-5582-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694973008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973008, "uuid": "b8cba9dd-905b-4bf7-b303-d9fd29f25375", "comment": "Malware payload (RedLineStealer)", "value": "03e03ca84c49914e931ddc79d6020165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973008, "uuid": "8d13f31d-b926-4dfb-90fa-ca9f699c328b", "comment": "Malware payload (RedLineStealer)", "value": "6b78025559a22275c1d64fc0b485bc7306b8f7ed64825a7ba9e8846880ac6c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973008, "uuid": "7cc4da52-8752-4876-b1e4-1620a7b6e5db", "comment": "Malware payload (RedLineStealer)", "value": "527ade22c01aa8816fad094b1acaa2b1745edfaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973008, "uuid": "d0050ec0-1ad2-4272-8a97-ddee3454856d", "comment": "Malware payload (RedLineStealer)", "value": "b9d3a9f7181b8c77f3ca5a8437c11bca05314af18f57e7e44dc51e2fa5b1a7f8e78006667161a837fcc330e80a3d5bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973008, "uuid": "09d94e07-b324-4911-82ce-99fc17c7a60e", "value": "T15D947D4BD711C2B5EEC4BC74D996CD9006F798203E695EB344EF4AF47B8668E340A21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973008, "uuid": "bb1d9e1c-fe5c-491b-8f30-c973a88148ca", "value": "00db0d6cb6d6029717d7aaa60b4f12a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973008, "uuid": "4bec83bf-52e2-4689-bebe-d6d29600e72d", "value": "6144:r9RUKJwyq0b3ryo9OPYDPgssPd/K7970UxkIrIvCM2Vc7NS:Z2eqe3rXMPYD4ssP694UxkIrIlIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694973008, "uuid": "cfb34586-2a3f-4730-ac9d-75f9aca16b52", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694973008, "uuid": "1bf03c83-26ea-4996-8c0b-a85c47eeead5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973008, "uuid": "51e9d7b0-18c8-4024-b23f-3eed24a6778d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecd9ae1-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960973, "uuid": "ac06c1c1-8830-42a1-861a-1a08bf408d5c", "comment": "Malware payload (Mirai)", "value": "58b55f0b7eac37e6750476fac4d7547a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960973, "uuid": "254788a4-b4eb-49d1-9213-d153d4e271f0", "comment": "Malware payload (Mirai)", "value": "6dc315219939cc6976e563da113ad7ee57288813772150bc25f74784805bed1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960973, "uuid": "9b3a3eb4-ef89-4896-bc27-ded8a3832e16", "comment": "Malware payload (Mirai)", "value": "d75f81f832bdfec878ed591d10dc5e5ea56f16d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960973, "uuid": "071a2189-a225-46a4-928e-63accc2ea356", "comment": "Malware payload (Mirai)", "value": "97fb024ea836f269d41a7bb83bf770fabc3c7d253ba8fc7bef2331e41a53c4a4f0e52fad02b721845061895dee992316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960973, "uuid": "b3b66f2a-ca33-4a87-b785-00c0cad51ccc", "value": "T11D43F79178D15A2AC5E423BAF67E518E3321B3E8D1DF3257CC201B147AD952F0DA7B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960973, "uuid": "aef6f4d9-4ca4-4b54-a9cc-1350ab28ed21", "value": "1536:018ZuVJTQfcnfgyr25Io8wwtxky5eWhKlz12l1dO:q8ZkqRx835thSRWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960973, "uuid": "c52eef74-9a0f-432e-b8fa-7515ec7bdffe", "value": 55584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960973, "uuid": "6066ed13-6207-4a74-aabc-9ba95fdefb92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960973, "uuid": "45b14f5f-bba4-4b16-83f6-09d4a9c551d8", "value": "58b55f0b7eac37e6750476fac4d7547a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d600680-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968701, "uuid": "6e4370cd-e458-41f3-b022-4ec535806073", "comment": "Malware payload", "value": "d51eda2acca5e9ae59ce19558af1948e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968701, "uuid": "60acf466-2c49-4420-b273-333b7511fb47", "comment": "Malware payload", "value": "7002fa5f7da890bb07e413c69e0becdf6c94ac435daabfe1696bbba284a0e590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968701, "uuid": "428918a2-61dc-4a13-8099-fa12827c698b", "comment": "Malware payload", "value": "036acb739951bdac1bc60863b9bccf81e984a30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968701, "uuid": "e8115300-a7c1-47cb-84dc-9d27782f2173", "comment": "Malware payload", "value": "7ab015762f739793b238fb64ccc710e57d3f6bb0ac8fcb8fddb8c79e1abc6cf49fb63251e0bde061cf57a53ceebab5e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968701, "uuid": "3b4e0789-3346-4d8d-b3cc-74b43138e7a0", "value": "T165B581239D04E086EF854C32286E51A538054D2AF4596E87F786BEC81479AF3BEFC753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968701, "uuid": "4aaa2cc0-7586-4cbb-9c3d-2b98e021616e", "value": "7b13db5e4fd45d44a47ae92fe192a634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968701, "uuid": "127878ce-9c8b-4bc7-8c51-2d4a3946b97e", "value": "24576:9WeYgB9AMxpVe+oXgKLOA0fXc0ooYAgwQhf:PWMrWjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968701, "uuid": "f6ccbda1-4f07-4b83-844b-5fd16debf4ec", "value": 2404352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968701, "uuid": "98f27014-b071-4029-8a2d-d1ca6dd4ac5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968701, "uuid": "4553f8e9-51e1-490a-ad16-6920c979a713", "value": "SecuriteInfo.com.Worm.Win32.WBNA.29788.24793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79ab8cf-5504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694918951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918951, "uuid": "9af5c544-ec23-4ea8-b54c-54438660cc67", "comment": "Malware payload (Smoke Loader)", "value": "240e10774caaa467e7413c1810c0e8e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918951, "uuid": "f07b538d-0910-4133-a0a2-5ee3b9b7bcc1", "comment": "Malware payload (Smoke Loader)", "value": "71f11d3eb13ebafa7e684a9af520c9296122b01d5375395964752f67755da6dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918951, "uuid": "2d2531fc-8c9b-448d-a716-bc820aa053a4", "comment": "Malware payload (Smoke Loader)", "value": "e5e0537949a5e2ad78b9f36a773d491a0ae38632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918951, "uuid": "d7766083-c27f-4e53-9a12-00ccc82b579b", "comment": "Malware payload (Smoke Loader)", "value": "522dbc22e4e75e6d19ac0def69720ce9a6d1b90c75b5ab16429a0906274ee55be81777ee20e1d5594c90efaa7f475df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918951, "uuid": "67908879-adc7-4b4f-8393-4ae9e7faf29c", "value": "T15744AF12E3F1AC31F12607325DAEC5F4AA1EFC614E7AAA4B234C7B2F08711A1D56271D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918951, "uuid": "f1bcffcf-696c-44d9-beff-88f260d82e11", "value": "0e5c0e73b8bfe5fddd6a11f97096fb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918951, "uuid": "397d56d4-1646-4707-bcd8-4e3d361fa032", "value": "3072:a8/8q4cpfdrEfTdEgxqoeSVCJLUC/1FEYMobRnfW:a8drpfd66uqovCJRzmol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694918951, "uuid": "75d2b43f-5294-48fa-93bf-eaa532e9a738", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694918951, "uuid": "af728536-5065-4197-84e7-dfff0a6a1eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918951, "uuid": "b4417e92-af12-4bd1-a486-c8391347e057", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26965ca7-5568-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694961630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961630, "uuid": "3770584d-c620-45f7-be85-16fb78a78e4b", "comment": "Malware payload", "value": "cca6e6c96383ec6a132a2d0aaf823c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961630, "uuid": "571cecd2-074b-4f86-9652-2e7d9339ad09", "comment": "Malware payload", "value": "7532269e3aa92d4a1698fa3fe61ebae14cd717534862b904657c810eb4a3a07b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961630, "uuid": "46718daa-1d1e-465c-87fd-abc3c543cdc7", "comment": "Malware payload", "value": "0b48c96d3d23bf14a24978b3e9a63026d1be38a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961630, "uuid": "b7899f30-4ea9-427a-a912-67aff04b26ce", "comment": "Malware payload", "value": "408a3f92ae54c827ce4e29722dae3a76ecd2c8e82307ff40c8986b5bd7d45ce93934501cf2db033e842314b5f2b70fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961630, "uuid": "220387fb-1901-4d89-ae1b-c0a47130c65e", "value": "T181E53340BAC066B2D0A2113526BD0F2175BC7C204F708AEBD3A45B5EEEB57F09536B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961630, "uuid": "ce3ccf7f-a760-4be8-b617-fe321addd434", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961630, "uuid": "17e99512-006f-4e40-9cbe-9328553a2cfa", "value": "49152:HdgEUN5fahMhL54OaK3oN259qgZPeC496ukdqV4exX2hFQlJxuiFLw/hDTb0Y:HBUNBaihSxaV4UVq3RKFQt1FLCTbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694961630, "uuid": "e29096c2-afd3-4cdb-86d2-93e86dbda978", "value": 3237454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694961630, "uuid": "201c97f2-3341-4c74-8ca4-5026157360d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961630, "uuid": "2ceeb97e-d517-4c80-857b-41335ce372f7", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23036.30691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227908a4-5570-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694965059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965059, "uuid": "a2180d94-b352-4c7f-a387-bbe0e1a105fb", "comment": "Malware payload", "value": "eafba56f876c04229c33c88a0bd964fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965059, "uuid": "1d53ddf2-add0-4608-82d3-72219b2c1af7", "comment": "Malware payload", "value": "76c77a70b8ff02ec28049a28fdb538a5d663f548b48e9a449371edd4c414a15e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965059, "uuid": "f7a4445b-939e-4430-9d15-7df0e57db516", "comment": "Malware payload", "value": "d34f886a895f190c8a2d1bf4e46cbf104358126c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965059, "uuid": "3a641447-042a-48d0-a8ad-898635367154", "comment": "Malware payload", "value": "7916634a5639d0b0efecd3ad351afb2b4eb63eb1bc2ae0e59c5f8541acce1b406fca6331c1765b051deba1bb40c54a3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965059, "uuid": "249e0e9e-266a-45e8-b078-6143a8562d82", "value": "T1D9D55B16AA50989AD3A28474CD56CA76D7723C1D43F642F331E4BED73B3BA913A36301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965059, "uuid": "2a9ecbea-c2a6-41a5-8d6f-4807e5c19b88", "value": "310b1cc8abef97edfcabf0ed406947cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965059, "uuid": "198a97cf-5cc7-409c-be8e-fa3b8501763e", "value": "49152:AAOdl4d7NHNUb75uEEbOyYWHxL9X5zT/dRSAUA/J:Zl8DFWH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694965059, "uuid": "82c92322-fe44-49fe-82e8-575002c0b8e9", "value": 3011584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694965059, "uuid": "38ab6c12-4f15-4cdd-b327-d1d5fa4ffed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965059, "uuid": "9ad240e3-269a-4590-b64f-00043911c70b", "value": "SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.UltraVNC.gen.27745.639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f7ce2b-54f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694912230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912230, "uuid": "ffcf2ef9-4d92-43ef-b838-960b9303f9a3", "comment": "Malware payload (CoinMiner)", "value": "2a2af12e0103c189b57826f735eb273d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912230, "uuid": "fa41a0c1-03d4-4889-b36e-a8dee7c0e9f3", "comment": "Malware payload (CoinMiner)", "value": "79020d8e21c6684fd049b4f89b23ab950fb9bfe03ae529b3253d7e9189e76a95", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912230, "uuid": "3125b8ee-c39d-4871-85f9-ad8bf18dc958", "comment": "Malware payload (CoinMiner)", "value": "af0b63d552b676b92547dee2f25df6b7c88d9580", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694912230, "uuid": "25732a5d-d6ec-4ea5-9daf-a65f1402bfb5", "comment": "Malware payload (CoinMiner)", "value": "22cee5d6197c9abf4cd03e8cef48fb5da0b89dc55d53221331aa1a8b7b642e28cfd724432ae1da77cae86cd3653392bf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912230, "uuid": "d16c5c67-6f65-4174-8a38-0bb333175858", "value": "T1BCC4293F1A0C6F2BCB5B93F790E22666F1B0C44EA7C3C7E7A960AB915845B45B901F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912230, "uuid": "870eadaf-1135-44e5-92c5-2e70a80b8d3d", "value": "6144:WWZ0nEPU0Tzd528t5vp+R2obwp46gBT22uWIlxqkH27NIajmmIS9r5haXoszvdfp:J+Ae8zRk29KT5VIlxqkuieISThaNT5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694912230, "uuid": "77b5420c-1cb5-4290-bdb7-c4a77093c9ba", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694912230, "uuid": "db3034b6-f578-433e-9647-b9dd65182eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694912230, "uuid": "425127e0-8299-4d4a-9005-f3e1a4e93a40", "value": "2a2af12e0103c189b57826f735eb273d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9705e7e0-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960960, "uuid": "5aa0073f-6312-49cd-b7fe-9ea60bec14ee", "comment": "Malware payload (Mirai)", "value": "5083ff4335c52985e6b5f9dd2f00449b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960960, "uuid": "008baf7f-eb9c-4ceb-953a-0009c0fcfa21", "comment": "Malware payload (Mirai)", "value": "7b7650a3a38980bbf1438f175d47a76983f29cb3b8ff0cf5ad0197d388adbfdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960960, "uuid": "699c2adf-e875-4f99-b62c-6f47bd03e912", "comment": "Malware payload (Mirai)", "value": "76a65b02c862d7c56fea6ef75ddf03a0964b6719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960960, "uuid": "1922514a-0248-4ca5-8b5b-37bd0cc2cc86", "comment": "Malware payload (Mirai)", "value": "9c4eb06716cfc946f53b692192b5751c473c47a68e280b80264123849f51fca608acade4139d4bed87617f1c45ad8422", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960960, "uuid": "6e2d449d-9fde-4685-aea9-16f6eb0c07ab", "value": "T15643AFB6C42DADA8D1084234B8258E740F53F64591B76EFA8AC582924047FBCF71C7E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960960, "uuid": "4ef122e6-52d4-46bc-a9b1-d9e2985190b6", "value": "1536:Fydz2nZCfwtNjOzCEg134eDjNCysl1d8:Fy0nZCf3U4eDjNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960960, "uuid": "d1566d45-e472-4ede-879f-8bb4f48df6bd", "value": 56344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960960, "uuid": "f4aff073-7c97-4ba0-9f3e-94c672053c53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960960, "uuid": "29f8b567-c5d3-47dd-af58-373060fd81c7", "value": "5083ff4335c52985e6b5f9dd2f00449b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e36e4c-55ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694991612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991612, "uuid": "3efed492-5f1d-4eaf-85cd-886f7e33c5a3", "comment": "Malware payload (RedLineStealer)", "value": "1712e0de8444b76eb6c55cb415a67f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991612, "uuid": "82b9997d-3dae-42f0-a1ed-9ca35fee945a", "comment": "Malware payload (RedLineStealer)", "value": "7bac4b3399b01709a7d335359bedbf421387aeac4f81c777c77944dc2beffa19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991612, "uuid": "7f6f361c-2313-47cd-9aef-157292fbd259", "comment": "Malware payload (RedLineStealer)", "value": "3ec3f4e3713ae0a7de1bfb351d36907be60ac1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991612, "uuid": "492a0166-f1c5-4c64-81d9-04a44efdb683", "comment": "Malware payload (RedLineStealer)", "value": "d0312f92b7110099d313fce1ccb9e707d255be721de40547997e0f9572fece8e4a68b0e46df9ee98f93cdfeefa31b117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991612, "uuid": "67110194-1a0c-428e-b84d-0e84e6ab9879", "value": "T10E35014634D2C161E7B21A369CD0DFBC453ABC9107B289FF2B624A2FDA603F19536671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991612, "uuid": "062d3804-19b0-4ca8-9c98-846ce559e8c3", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991612, "uuid": "d474ae50-b1bf-463b-a7a9-d4a4b346d424", "value": "24576:JiuBtZzzy+uwRAGzzYo4FceT/1AwQKJD9T:0uBfzzyLQ+lT9AIB9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694991612, "uuid": "b0e67fc1-759b-4ef8-8fc6-0e298b71d77c", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694991612, "uuid": "fa430111-f567-423b-8fe5-ff9a70124326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991612, "uuid": "86c6a1b1-a8e2-4c17-b7f1-cb0914b2337c", "value": "1712e0de8444b76eb6c55cb415a67f75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2949835e-5538-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694941019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941019, "uuid": "baebc9ad-3838-4e6f-ab2a-5ceaf15e69a4", "comment": "Malware payload (RedLineStealer)", "value": "ca0acae581f1f0d0051c75c50e0e8fed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941019, "uuid": "2b23170a-1601-4d1f-8b80-c7b8e63d3189", "comment": "Malware payload (RedLineStealer)", "value": "7c21f688089226d4e1de7023c94b5b8a8ef8a8a5599007bbd659590f2c282c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941019, "uuid": "4a20b9e5-5849-424b-8f28-64b048d529b6", "comment": "Malware payload (RedLineStealer)", "value": "5e7d4cf151ebc4270cafb59515865b9b1e949805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941019, "uuid": "ed0ea21d-217b-4536-a431-6b797cadc1de", "comment": "Malware payload (RedLineStealer)", "value": "90e9cee72fd5bd4af980120b434951ca26027bce55adb7f08c599c174e683f5c7a132fac01851552dd72aac816e9ad13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941019, "uuid": "1dcf49d3-bc25-4599-b43d-0d118e9285a1", "value": "T1B1846C05B1F34239DE33D27B4BDA86344D69E9C21311E5A75FA00D2DCE984F171A8BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941019, "uuid": "c1222bea-623c-46d9-8b02-fa223a4e3291", "value": "fc6316c96fc105fcdafe08845aa690ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941019, "uuid": "32ff09a5-164e-4b6c-be18-a9cd3934b4ca", "value": "12288:JeFzZtT78Tiym0cIWLZs9FXu/uSwNh8Ey:gZt/1uSwNhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694941019, "uuid": "7ee478fe-17e9-4115-b77c-61f9120a44a0", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694941019, "uuid": "ea40af92-9d9a-44ca-82b9-9a2990ac040d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941019, "uuid": "08e79892-b167-458a-b5e4-190c8eea7085", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8dbac8-5558-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694954988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954988, "uuid": "9a0e321d-3676-412e-9cb2-24ad9b07f7ef", "comment": "Malware payload (Mirai)", "value": "025a300c373738d0b3a8033fefdb3c84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954988, "uuid": "1cd7b723-d02d-4da8-bd04-241551c1a36e", "comment": "Malware payload (Mirai)", "value": "7dd6d1eb3fee795598cd2f41f6f77399eeeb7d317b48aec315c8e91c47ad8491", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954988, "uuid": "cc793285-8d43-4d76-ba47-114a07ab7cad", "comment": "Malware payload (Mirai)", "value": "b1b5ea1a8cb2076b9eae4ca6d44c9e6d8c4cb0ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954988, "uuid": "89dd4048-a905-4732-a1ed-69c2e7e1a75a", "comment": "Malware payload (Mirai)", "value": "d0d29bbcf50404183ec6b16aba09e4b928ab0a758ff68471c3dcbdcb03e160d95659b08598ddbbd0e123584254d03929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954988, "uuid": "c4b6856a-d036-4b66-81e5-0e0e813fb191", "value": "T136334AC4AA97ECF5EC1506753073EB338777F03B611ADACBC3999523A881A41D50B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954988, "uuid": "057805c3-6f94-4454-b3ac-b381ba652ac2", "value": "1536:Z8MgMbNgZpAu+h9afOs+ORXZhg62NvC4ObwkZw6PBZ:azMbKZpADh9U+ORJhg5xC4sfJZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694954988, "uuid": "d6544878-5de8-4c15-8b86-60a2f90a3d13", "value": 54288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694954988, "uuid": "66d90c2b-4aec-4c18-b567-cce63e60b9cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954988, "uuid": "3fc370b7-18a9-4fb6-923d-c46ccd41e43a", "value": "025a300c373738d0b3a8033fefdb3c84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5627679d-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983614, "uuid": "c3f6d32a-7515-446f-96ea-4a918c70dadb", "comment": "Malware payload (Mirai)", "value": "cd6caefee86f404d5f40d45765c594b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983614, "uuid": "d3849cf3-04ea-4b28-885b-278570928b5a", "comment": "Malware payload (Mirai)", "value": "7fa55aedaa7a4d8b29e77100e1e5578a33055c0bf3d01748da9d2384d766cb45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983614, "uuid": "7cb1582f-02fd-481e-a047-77e6da68cfbc", "comment": "Malware payload (Mirai)", "value": "8a7fee52bb14ea03495e60aed8db31435602372f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983614, "uuid": "41ee27b0-41ef-4727-a77b-9700281315ac", "comment": "Malware payload (Mirai)", "value": "ff1e2511e92993ffa3262e8f4aa4a6ad6693c1db615451db0e7b5a44ae1dbf3a63610cedb17ab1077e3bd567a2eaee55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983614, "uuid": "4910e21b-3b99-49ea-af69-1f2ecee4fbf0", "value": "T1A1432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983614, "uuid": "1a519099-998c-4d75-8f7b-574914607863", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw1:RqtmZPuutfbltZFBSJsBcfDSTFI+BE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983614, "uuid": "88e3500e-b2bb-4399-a9df-8603e24e6278", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983614, "uuid": "8b4b2056-e19f-47a0-9a84-a9886a564dd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983614, "uuid": "03444ef5-34b1-4fec-83f2-619faf51a1a9", "value": "cd6caefee86f404d5f40d45765c594b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84de96a6-5513-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694925281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694925281, "uuid": "a8022652-abde-4460-b2dd-ff98c4de144d", "comment": "Malware payload", "value": "fd72bf93b13b7a65dcfa785c168aee49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694925281, "uuid": "ddc98fb2-86a1-444f-a4dc-87014f95f178", "comment": "Malware payload", "value": "8054d021d9609e8ccad05324511c8e378c6f537f756c1ebff9aa1813a7030e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694925281, "uuid": "be3eb7ff-5e1c-4cc9-a361-25c0ab4cdced", "comment": "Malware payload", "value": "9f124506aa1efa443e657b4efaef6cb08ca6b960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694925281, "uuid": "1917392d-77b2-454e-a2be-c7218a74ee31", "comment": "Malware payload", "value": "752b92dac1e607d0a56daae362b3e7f2fd6fced1ef9670f3e0561cb9cb234fc6c612e8007dda43b52dae566c25c12a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694925281, "uuid": "cf428592-4ba4-4eae-b462-557cc623b068", "value": "T15DF533123B9045B3D8332A728FA56716D7BCAC701F645ACF6390E46CE5315C2EB3AB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694925281, "uuid": "e1e01777-2672-4f3a-966d-fd4c395c9c27", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694925281, "uuid": "68939a2b-f00e-4e57-b24d-053d4ddf02a3", "value": "98304:xWhl0BfKEDDx+AMRdzItvryFdvvqJbDGz3yDgs6tnkRqlXmS:AsM7zgvG/7zCDl6poqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694925281, "uuid": "c6478d62-026e-4895-b99a-7ef8b69f73ed", "value": 3443755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694925281, "uuid": "4bd418c6-ddd0-4bb6-b6e6-5b07559a2705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694925281, "uuid": "e1d488cb-c6f6-4167-b72d-686fd26040fa", "value": "SecuriteInfo.com.Win32.InjectorX-gen.19495.7412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e4d989-550b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694921788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921788, "uuid": "0bc09e2c-532b-461f-8370-dfec591390c6", "comment": "Malware payload (Fabookie)", "value": "118badc392be664ad88cde4a29d59f9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921788, "uuid": "cfeee10a-74a0-44a6-bfd9-71301c0a9e2e", "comment": "Malware payload (Fabookie)", "value": "81d15f9c6b9fe72068cdc5862fa3764de5bb13b88d4f8e170fbc730829efd955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921788, "uuid": "72269c0e-1dc5-4254-9f7d-cf50cf717607", "comment": "Malware payload (Fabookie)", "value": "b74eb6f83f5ed1bd0b677b233ff192ea64b26508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921788, "uuid": "498febaf-ea73-4a6f-b560-528d01d18a00", "comment": "Malware payload (Fabookie)", "value": "54584f78d3d710123722d08edb1a5a3f792ea96a383fbf2f935ea503976ea84db05abf7a8e04facc471a35db1d8ede56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921788, "uuid": "610fe7a3-22d0-4b2e-8453-0321ffb24cd4", "value": "T14AD4D081B39095D9C4B88430C693CE71CA317C64DB28569BB6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921788, "uuid": "ffffaf36-cc44-4181-b132-919e6e614ab7", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921788, "uuid": "44142bc5-9554-49e0-9257-6f2c922e5816", "value": "12288:772d1oljvJ88XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:HqolriWM3/kRc4lAgantPbcHn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694921788, "uuid": "4043a0d3-1ad1-4602-a752-15ab713f127d", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694921788, "uuid": "94b3ecbc-a1a0-4ea7-bc8b-23e2caff8a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921788, "uuid": "8681beb4-299d-4f66-927b-eee55d5d15f2", "value": "SecuriteInfo.com.Trojan.DownLoader45.61795.30069.11406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8c3288-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968670, "uuid": "c6108edc-49b7-4017-a8ae-427d70fda277", "comment": "Malware payload", "value": "772dba37106e4639b7579f32749090e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968670, "uuid": "4ed708ed-bebb-4e51-a407-69e7f276f664", "comment": "Malware payload", "value": "8604c28f54223c0cb5c01c4a9d91e65faf42de5d027ca36db459e5349703d6a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968670, "uuid": "8a75a350-747b-4c14-b089-ba411ff1928a", "comment": "Malware payload", "value": "02cbc5ab604b9cd1c8d070fa33449e57bb871bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968670, "uuid": "af74bdb1-2be6-478e-a64e-9cf4fa18ba4a", "comment": "Malware payload", "value": "a0173569d569ba2e81c89e6a1fa50f682dd97fab1c89f1f3641931d5faea461406dea41fe7bad8b235d7706356960112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968670, "uuid": "03ca07d9-b47c-4973-a8b5-4a7b97a5acaa", "value": "T13054F72263D4BA56F6B58AF02D760694C87FBC355970D90FE6C11A0D3AB2E83D631327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968670, "uuid": "c37bc91b-c191-4627-9c95-dfff93f18df7", "value": "4d509ffe740b37c7b6ce748642da3704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968670, "uuid": "4daa3741-5df7-4dcb-ae96-bf8dec60d632", "value": "6144:BuO/emROOMqMA8K3eEGOCUgtLD2J9dh4bYTJ6QGh:wOdOmMQGp2J9Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968670, "uuid": "8df8eebf-6ee6-47ee-b436-513bba1473e8", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968670, "uuid": "b73ea7f6-9e7e-4ca4-8b2b-103db0c5fbe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968670, "uuid": "e6e20d1e-5fd4-4e7e-896b-825d4e3dfcb6", "value": "SecuriteInfo.com.TScope.Trojan.VB.31499.27833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c41a173-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983598, "uuid": "4996458d-4ede-4b5d-9fdb-0f633776d446", "comment": "Malware payload (Mirai)", "value": "bdb57c6a28c2fd3e27ca6b8872f16126", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983598, "uuid": "e84328c2-b718-4264-b95a-4bdc12526a5f", "comment": "Malware payload (Mirai)", "value": "86d2cfb89af198dbe5fbe068078d9f557b8cf7d0bbd07b88676030b174d57cc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983598, "uuid": "cfa341e6-0bd4-492f-b3de-90f23d22dcd3", "comment": "Malware payload (Mirai)", "value": "eb4e4193d34a099c200109b3a33f6c3976b6f372", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983598, "uuid": "146e77e7-5d2d-4ce9-8d58-fff3fd6836b9", "comment": "Malware payload (Mirai)", "value": "92578587bdf30e2fe86ff6897439b7f02e326c8c268780d7101f96d6aa4ff2a57c75b0917b739adc29daaaa43ca1b70f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983598, "uuid": "e2c578e8-68ab-4395-a178-01cb7c21fa8b", "value": "T182A2D025E3456EF8DFEF9C9452C1C2C276E943C7278AC8E340FEAF016506442B789D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983598, "uuid": "bce7bc4c-3303-4244-ab6f-12e0588d8ecf", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5tM4uVcqgw05VxJu:MRxsSVsMD6xiJJE5zRWNw4uVcqgw09c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983598, "uuid": "e3220153-3354-406c-b50f-8b7a96446db0", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983598, "uuid": "7f44116c-9e53-4877-a15f-60f807f379a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983598, "uuid": "1447a475-e5bf-4aa6-bde0-08e4e02c6587", "value": "bdb57c6a28c2fd3e27ca6b8872f16126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afe9d5f-5564-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694960108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960108, "uuid": "40ca37dd-eb6f-42fd-943a-99ad3c8a7968", "comment": "Malware payload (AgentTesla)", "value": "d5b7fe6cac36329f22bdcb3b5cb17fbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960108, "uuid": "110ab8f2-d914-475b-8231-0ac85b1f7bf6", "comment": "Malware payload (AgentTesla)", "value": "88080f19c9f055d11826bcde90abea78f3531317a840e7ddef759192615ca499", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960108, "uuid": "6f99b0c4-944c-4986-a3f2-8da9d06b4f45", "comment": "Malware payload (AgentTesla)", "value": "0749fecb85b56319d5ba0f336f04010f427cbeec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960108, "uuid": "cc2b3f1c-2d96-4900-b1f8-0675c887dcc0", "comment": "Malware payload (AgentTesla)", "value": "277619688d67d1580fc95a8eed9c3f4dd202b0955ab2ee8ce259760d46a1951f63d0e2e6838515d664fe04a4cf87cb71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960108, "uuid": "27ba6913-2980-46d2-9441-163608fe538b", "value": "T1A144FE037E48EB15D65C3D3B92DF6C2853F1A0C70673924BAF48ABA529522436C6E37C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960108, "uuid": "d046650e-d55b-4555-ad0b-099cb6b0ce7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960108, "uuid": "07198332-6191-414f-a946-030f3867a25e", "value": "3072:Y9iiqY2SmTxxErFa6b/HGr8H4DEKSM5s:qcNTxxErrb/g8HNKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960108, "uuid": "cd032811-88a5-4553-8315-595d244c138f", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960108, "uuid": "77599fd2-f379-46c6-a24e-44f94412b849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960108, "uuid": "078ac5e8-b31d-472c-ab61-7ae53916538c", "value": "obizx_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e7395a-5502-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694918119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918119, "uuid": "576764fd-2794-4747-acc0-bb5e093e4615", "comment": "Malware payload (Stealc)", "value": "a7be047e27cfe019ade71a4b347efb00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918119, "uuid": "80f6cd55-bb71-4a58-81fb-e6f327400529", "comment": "Malware payload (Stealc)", "value": "8914ea1630012f740ca6a0cf49ae12af8eedf258da990b477bcff2b6afe4fd5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918119, "uuid": "c74c3647-052a-463f-9759-e727178f4db3", "comment": "Malware payload (Stealc)", "value": "98ffe93b434bebc548e4c73263bf4724a34a0ae2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918119, "uuid": "1ad9fd6b-51b8-4888-bd4e-c0a36aff4a5d", "comment": "Malware payload (Stealc)", "value": "6e13e3a1af9621cc9f9852ef8fdfd0f42aed21eb21aed838c4eab36e687cdbb88728459e9593d371945c56fce7cb1869", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918119, "uuid": "ed0a7254-63bb-456a-9b1e-b4b9f557033c", "value": "T18B147C5370FD8023F0B69476C4145E34B96D6C1FBE23A37F16BB16A9CA00FE5DA21A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918119, "uuid": "2aa782d1-73b3-4350-bbf3-25d94168078d", "value": "d0d523c12097b517245d838376423429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918119, "uuid": "ed55db24-30da-4261-9ab2-5a0ccceb5e75", "value": "3072:n6DdURkMVhMsK9Ecy4CESHUYoRHSkWJoF9FwiK:nGURDK99PS0RlWJo+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694918119, "uuid": "5e1a82cf-a009-4ece-b2c3-d560238c8a97", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694918119, "uuid": "7c751b5b-2c34-467b-abd9-df8044e07172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918119, "uuid": "f3cc6b7d-2bfd-4906-92fe-96b6092985ec", "value": "a7be047e27cfe019ade71a4b347efb00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab7922a-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960966, "uuid": "cce3cd0a-272a-4614-a2ee-f81849f72f5a", "comment": "Malware payload (Mirai)", "value": "4428575f74fb59a4bfb6fc2112db6ee7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960966, "uuid": "2a6574e2-1417-4d91-aab7-98dfb617b1a8", "comment": "Malware payload (Mirai)", "value": "8b7bc2f3251b2c1b07f2a1cecc7d21bce68d1ec81ff0ecc1de9884d57998bfd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960966, "uuid": "bf62ef5b-fe30-46d1-939c-bb0b959f8394", "comment": "Malware payload (Mirai)", "value": "a7522eff8404a844e95186a0637f0950f9930ecf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960966, "uuid": "385f99ca-181f-4230-b4fa-dc1f3484db97", "comment": "Malware payload (Mirai)", "value": "d1580f8f647ee0d84e2606a01e3a7e23b1feff31bd86d43c7c2b534b736004d1e34d87f88f4945f38a6eb53763942c79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960966, "uuid": "fb0a1c9b-1206-47ee-8bc0-8c915bbbfc0e", "value": "T17E537B316A7A2E17C0D0A07E22F34754B2E0679E36A8C61E7D721E4FFF25650A40B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960966, "uuid": "c105b1e0-2e6b-4c90-961c-d3c10ba86b2c", "value": "768:LuoVS5CjwAE+RU+fECef6Vq98bttpqoXdC12AgYMO+EkqrwJh+CVNUB:LuXkjY+RU6ECef6VS8bPpqsm21f9VNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960966, "uuid": "5d262efe-3c1e-4503-9df3-4a0d4e74833b", "value": 64768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960966, "uuid": "81c499f0-1e23-4f21-9f38-18598229b1f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960966, "uuid": "ca26a93c-552e-49d6-bb2f-93fed781201f", "value": "4428575f74fb59a4bfb6fc2112db6ee7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd393af-5581-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694972410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972410, "uuid": "2b8a7d53-6525-4da0-b0e0-078684d196d6", "comment": "Malware payload (RedLineStealer)", "value": "17c6ce86837ecd18e357a2f37bdbc8a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972410, "uuid": "c6b54509-1f66-48fc-908d-b6eb9511e0c8", "comment": "Malware payload (RedLineStealer)", "value": "8c32c54f48ad0a6cadb7285b322c3d45ccd32cc87fd37969c8d698a9639759f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972410, "uuid": "f1895afd-0162-41af-a30f-85bf4877d28f", "comment": "Malware payload (RedLineStealer)", "value": "9acbfbf474907d2ca71c6965e56ddfb9870ab8e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694972410, "uuid": "7010516b-9699-4571-8d1e-7e5146815f39", "comment": "Malware payload (RedLineStealer)", "value": "0e6652efb678c266b45824eecb4368e94ce029c47b1b1c4b58705cb6f9322a18d9b0750d53716cfb9c9ba55e9f7c489d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972410, "uuid": "65c0d286-496b-430b-b7aa-90f169821e34", "value": "T12026591176F94B69F9F30BB856BAA612087AFC6ACF11C6DF1250905F0921BD08971F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972410, "uuid": "b6a4a4bb-77e6-4847-88d9-b2caebe5e2b2", "value": "06500afa79d4009a0fa967e7c375115a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972410, "uuid": "d653c5c8-3fca-4a97-a5a9-ef390254f01c", "value": "98304:XUR5Q+JvJR4R3La6Nl+zRinjLnukBHbEaj:XsQ+Rf4ZCzQjLnJEaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694972410, "uuid": "ba1ff56e-124d-4954-a04b-5a5a7ff3463c", "value": 4628480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694972410, "uuid": "e079c9fe-bc56-4a70-812b-d43696886d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694972410, "uuid": "93c72991-a636-4f0e-af28-9393b8d976d6", "value": "17c6ce86837ecd18e357a2f37bdbc8a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc62af4-5534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694939634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939634, "uuid": "a6e5d6c9-f073-465b-bfe6-f1ffa55cc9f7", "comment": "Malware payload (Smoke Loader)", "value": "0fbe47b8e3235776b2c41356f7836d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939634, "uuid": "927da790-71ec-4947-82ca-169649996b98", "comment": "Malware payload (Smoke Loader)", "value": "8d1b5f9c660205e3475c482dd9a4618aee5b7d165126a844b5148bf8bb3c253f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939634, "uuid": "284df30b-77c7-4928-9159-92970f16b804", "comment": "Malware payload (Smoke Loader)", "value": "c3ad319bb78005831aae016e7a57113067ea9fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939634, "uuid": "b38209d0-b803-4706-832c-96d6a2a39be9", "comment": "Malware payload (Smoke Loader)", "value": "da66586269b2151862971693c874dccd3aebe5f37f903df5cd6deb2076283a9ca2b492d838db850277168dede73d1d73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939634, "uuid": "5fa57d21-70d7-4d7e-a52c-969c8220efaa", "value": "T1AC44B002F3F1AC21E5264A328DAEC5F46A2FFC214E79A757230CBB2F04B1261D653755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939634, "uuid": "3a2a16dc-6462-4c8b-865f-c7a210ba7070", "value": "983ad0b1eddf77f1ba43ff2b67eba232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939634, "uuid": "9b5a13d0-1524-4b2c-9b22-1ea9563fbb7c", "value": "3072:d7Indu86wxUJuqCZ1faGZgkZDeDg2s/O1Tl0:adufHJOZ1faGZgIeDhp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694939634, "uuid": "34de33de-dd82-404f-b51e-95e595831712", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694939634, "uuid": "07dd361f-9226-469d-8333-f2d5949d2bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939634, "uuid": "d3290547-7ece-4c3e-9219-e1c93001a38c", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.20283.23682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18c0b17-5576-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694967903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694967903, "uuid": "318a14d6-1855-4161-9d64-ff51a81ba327", "comment": "Malware payload", "value": "49e2b70b5870d3d83a2246c8108ed724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694967903, "uuid": "1303e04f-0f54-4898-969a-02edec30df8f", "comment": "Malware payload", "value": "8e47f6cd224829ba928c6fbc0948cf5fd7990dddbe1d1d29cb458d4942ebff64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694967903, "uuid": "e33bfb2a-3f07-40bf-a191-491fc5b52422", "comment": "Malware payload", "value": "14a839e3aebfef3e91b638504f6d9ab44100a40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694967903, "uuid": "418c2d25-d137-493e-95a8-c7e82e9d929a", "comment": "Malware payload", "value": "46fb243ab8d6882f01242a2251df72f4f0502a23b16adc8d4d08e318f2e720abb74e4b02aee714124d5e7ef4dfb03f20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694967903, "uuid": "dc4f3acf-3707-4d55-9ed0-95bf148865b2", "value": "T12B940203E6E09971F6224A328D79C6F56A3FFC524E79AB57234CBB2F0C711A0C1A6355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694967903, "uuid": "b0060c3b-713d-4c44-8598-418a00fcfc4b", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694967903, "uuid": "49e85cea-812c-45ea-b151-0b161f539c7c", "value": "6144:SOZ+uPF/ufUPnEb1YU5ftCKKMz54agl6BTTvGOPwqi:SruPqUENf4gz54agl6FGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694967903, "uuid": "151c864a-4c5a-4e8c-b4a0-2ea26f8034c3", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694967903, "uuid": "b08c53bc-0324-4bff-b018-a6b19d52fef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694967903, "uuid": "55378948-e27e-41e1-9d54-058a3d5b9467", "value": "49e2b70b5870d3d83a2246c8108ed724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57545f72-5539-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694941526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941526, "uuid": "2037fea9-a3a5-47c6-8b44-da8b0dabea4c", "comment": "Malware payload (RedLineStealer)", "value": "75ca44f61049e4a314df26f6aa0c49fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941526, "uuid": "d9578d6e-cf59-4052-bdd1-8caa2217f3f3", "comment": "Malware payload (RedLineStealer)", "value": "8fcff17b725c45f34de3bc8629ab69d811e21ef443ca5fdbf35186d63b909291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941526, "uuid": "474bd887-29ec-4153-b268-48653dd98639", "comment": "Malware payload (RedLineStealer)", "value": "441d5778372a88b764ca5ac6686f1fa82037a123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694941526, "uuid": "191ccbe8-826f-466b-9c37-ce9a1d0cb502", "comment": "Malware payload (RedLineStealer)", "value": "52c92d78887f0937e821b90cec05bfebfa73e4576b45d798845bda82ac48696d453cbda6c4aa844fc6d12e5fc770c8d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941526, "uuid": "bb8bfe26-b770-40cf-a3bc-3a65ef1891c0", "value": "T1A9758C2034D38E21DCD2D0B90A9CB536609FD56C07271AF7CAA763E9D7632E06F39985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941526, "uuid": "39003b34-7fb8-43ae-a2fa-ec23526e11cd", "value": "7429a55998cdcbbefa3f6b7825280de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941526, "uuid": "14410750-8b33-461e-9ef2-e66e3dab0e6c", "value": "24576:o//kLASoMc42yNOvyjUD3mZKpFI0QgMe6:olMc42yRg2ZoS0Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694941526, "uuid": "511f8b4a-c746-4b6e-b0dc-a80f5f3333e7", "value": 1695744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694941526, "uuid": "2cfeab5e-893c-49d3-9c37-7480b57cc93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694941526, "uuid": "80955567-d0c1-4400-bfcb-22da231389df", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6206c6b4-550b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694921787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921787, "uuid": "107ef6ce-c222-4cbe-8be3-4527ffc228e6", "comment": "Malware payload (Stealc)", "value": "a96c7ec7bf374b42da5ec0608f383f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921787, "uuid": "f4f59dbb-bdc7-40cd-95ec-e27e93410295", "comment": "Malware payload (Stealc)", "value": "908c6c2f0dcf951c6b06f4375a89fc9de4ab0663d542d66987f35b8abb364b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921787, "uuid": "f0460b39-c0bc-4897-8513-3cc62ac82210", "comment": "Malware payload (Stealc)", "value": "bbf56d3a37dd20d4d206781d391c09a15575f045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694921787, "uuid": "8c37f12d-9a7e-4c63-859a-4c749eebe848", "comment": "Malware payload (Stealc)", "value": "fa431bd0fe11207dd3a83457a5fc018f6cd24fd2abbc430685aabe4caf2456567ad2713dcd8998dad7f9cde604ceca3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921787, "uuid": "29762401-dce2-4047-91e1-2f31e182c6d2", "value": "T1CC44BF12D3F1AC30E1264731DDBAC6F4362FBC224E76A657234C7B2F09B12A2D556729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921787, "uuid": "300b056c-395e-46c4-94d7-5cc3729d5f1f", "value": "0e5c0e73b8bfe5fddd6a11f97096fb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921787, "uuid": "f81001c2-2286-4a90-a504-d640640e3f43", "value": "3072:aS/918Z6NCQKV53n7e/nJcLO0cZww9drUHJ94nW:amuZ6NVKX3qwawYJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694921787, "uuid": "d52b2cec-836d-4988-96bd-4595beee41b3", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694921787, "uuid": "da9dad86-77ac-447f-b31f-19fe0cda34a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694921787, "uuid": "22494c59-5394-44f2-81cd-423580e4e024", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26739.10690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9758074a-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968691, "uuid": "3f64a83e-bd50-413d-97a0-af2f2e46cf92", "comment": "Malware payload", "value": "bc4d7dbb97f916681ccc98d0adc4f619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968691, "uuid": "a8b7f2bd-e0a9-43dc-b9e7-369bce23a263", "comment": "Malware payload", "value": "90d28ff1f4e548b2add4a4e07cf204b97b3d4ced1fb9ed083b23a0bb180eddb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968691, "uuid": "3d908884-f838-47e6-9cbe-8cdd4c62f567", "comment": "Malware payload", "value": "17c78ddd8b6d853dc348a54a1d6e8c11ca6e1f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968691, "uuid": "2ca461d2-5579-4b59-8fe2-e7c39647d2b9", "comment": "Malware payload", "value": "98326704c0abdb58f31d008d1983bd06b6f4a7cfd5db033fccaba81d78c1876137e65bd3a4b946864ca54cac323cd82c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968691, "uuid": "e799360a-eff0-4569-b5ff-937356567ae9", "value": "T15EE4FB222900C486EA0055766C1587FC6EA42C7AED454A63FFD57FEDE43A583E8FA307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968691, "uuid": "60bb856d-2ce9-43e6-a1cd-21272c5ced0e", "value": "aa2885d5e1a1cbcbb71702536528adb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968691, "uuid": "e43830dc-ec14-4284-991e-42ba8f6a641e", "value": "3072:4YdqV4omL+52X0Hqzf6rv6v6DySEof3kKMelLr63jeA7mGRaD5prkVg8vcr1Apsr:7qILEHcI4SZfZr63jeA7mGRaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968691, "uuid": "51f39ed6-3e3f-40d7-b71c-026cf4b1954f", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968691, "uuid": "f575e3bc-953c-47f3-8110-9e99f40d3cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968691, "uuid": "9e7a3339-8bb1-4b0e-a2b6-dafff5734604", "value": "SecuriteInfo.com.Worm.Win32.WBNA.1369.30846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f427343-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983656, "uuid": "5594aaa4-504e-46ef-b031-668415d26fa1", "comment": "Malware payload (Mirai)", "value": "c8e545e2e093a25c967d9bb8e55fa89b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983656, "uuid": "7c53fa38-a15a-461b-899c-95e73e7b3f10", "comment": "Malware payload (Mirai)", "value": "95267b470032f52b514d7d480dadaae779cd248542cefec8fee1952a60a76378", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983656, "uuid": "6a2df182-daba-4c84-9298-67f79678de5a", "comment": "Malware payload (Mirai)", "value": "739135929b84203b21f63bc8c0f71907ee55983b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983656, "uuid": "605959fd-fb71-414d-bbdd-619509b4ab0e", "comment": "Malware payload (Mirai)", "value": "f23932365c8c958bb81c2974aa59455148ea060c3d8948bb6174feb0133ae832d183dec2e9ad34d6bfd7112b7b931ff6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983656, "uuid": "530a5615-431b-419a-86f8-02735d708f53", "value": "T16AB2C0CC61543484CA8D7C7C2B8D4A674F6CA190BAED9B26E354CD98B3BDA4F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983656, "uuid": "9f195a0c-2244-4e7d-8fe1-70eb12da2548", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpu4ZqEWv1:/QlS07FUXqIYSXQKquHqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983656, "uuid": "d0822ec5-7546-437e-9bec-d6e7721fe98b", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983656, "uuid": "99b49c6e-b75e-4ed0-beee-0e9c8ba02956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983656, "uuid": "c62a1469-5376-41a0-8a40-695c54c9e668", "value": "c8e545e2e093a25c967d9bb8e55fa89b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d69070-5571-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694965790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965790, "uuid": "55a3e1a3-0abc-4813-b3b3-89b3f7ee8715", "comment": "Malware payload (RedLineStealer)", "value": "35c5e1a80ebf3269ac119f6a1ebfec4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965790, "uuid": "e4ace463-4198-4e7e-ae62-fa966371ae0d", "comment": "Malware payload (RedLineStealer)", "value": "96a31f753b45be4bc03c12c8c065917f0c9eccb8e1b12fc8f956bb9de0877528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965790, "uuid": "1c06974b-f11b-436a-8887-7e931c35af5d", "comment": "Malware payload (RedLineStealer)", "value": "f6ecc65bdf377efd9f593a753f0530d6ba796ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965790, "uuid": "088200b5-3967-46d1-a4d0-830cc28c8c60", "comment": "Malware payload (RedLineStealer)", "value": "53e46a4d97aeaad449492be42471076a0246613ba6f4d244ad2833fbba74f27e059da1feddc68482e62596ed86bf22de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965790, "uuid": "c5455b6a-079e-4bc8-ad67-4550c846924d", "value": "T1E345BF253F05CA81C5AA223EC9C7441407F57EC36772E61A7FDA76AD81127EB6D0E0CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965790, "uuid": "c6d0b205-1f47-4cd8-8d40-1ffee9b98994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965790, "uuid": "3bbef330-4509-4b08-a750-4f488d2d371e", "value": "12288:BKIEAZNmqqTsQsTDETqV/sIX/pExFfvrv/ZcLwV2HU+E7Ycafg1aBigoxAyakdxD:9EAZV3pV0uE/bvgu+hffgioxAyjdxS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694965790, "uuid": "6adf7146-b9e5-4b41-9c96-7ac29502f97a", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694965790, "uuid": "385fe860-ac2b-46c9-a7ee-519d25ebab92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965790, "uuid": "bd813e4d-1fb2-418a-bf0d-603874f21384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219085e4-5532-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694938429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938429, "uuid": "d3db05ae-3801-45a7-bf93-68a59d507242", "comment": "Malware payload (RedLineStealer)", "value": "7020c196532e57d40f5137a87b99b607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938429, "uuid": "54458313-9532-41ca-b3b1-dc0b6b24fe4e", "comment": "Malware payload (RedLineStealer)", "value": "970b494a325512a3bc0517079fb9ec038b3da9f8efe0dfc44785fef9d4244cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938429, "uuid": "fcdfb88f-b935-417e-b3b2-02742c1a8e52", "comment": "Malware payload (RedLineStealer)", "value": "87e0606889ce417a6d513ecd736d8d47009e7467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938429, "uuid": "02d03f30-b128-4bc4-940f-270bd2aea833", "comment": "Malware payload (RedLineStealer)", "value": "f65dd9892fafdc8b99d74cf5d1d8c3aa5c51a63f611c7e86d7a20c0ba5f02252b27f6e268cbd7cdc8d7df4f028858b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938429, "uuid": "39bcf88b-5fdb-4416-a2b4-02a91b4f2859", "value": "T17D94F212D3F1A870E5234A328FBAC6B47A1FBD214E79661733487B2F05B11B1F562359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938429, "uuid": "1ea6309d-d2c6-4f0b-b5c8-b2d70444f665", "value": "983ad0b1eddf77f1ba43ff2b67eba232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938429, "uuid": "689d10a6-359a-4d1d-9d49-60088c14c621", "value": "6144:7fGzPmkdV3aQZ1lKW5k71s15zgGL3Q5QOrpLvwyMbosQ3fF:jGDR3aQ1jNL6f1vgbov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694938429, "uuid": "6cd95401-1272-436e-98c7-9dc016eb102a", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694938429, "uuid": "fa3030dc-b800-4657-8555-839cc882d1ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938429, "uuid": "d9c4a8ce-5457-441e-9cfa-cf4c9e8ae9d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4522856a-5570-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694965117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965117, "uuid": "792799d8-8d49-47c5-9261-43fee89ea3f5", "comment": "Malware payload (MysticStealer)", "value": "d21ee3613f6aa5a391f47fb880913ba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965117, "uuid": "1fba192c-e421-487c-8e63-0dea0fb5bd08", "comment": "Malware payload (MysticStealer)", "value": "979a55f948ac28921bb6d324a807fa69a970d4f3528649b0aa5cfdbda8652076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965117, "uuid": "87ff453b-ab2d-4d91-b296-cc773139837b", "comment": "Malware payload (MysticStealer)", "value": "b61cd4ffe8a018a2d2c54570de90dae0e7ba5f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965117, "uuid": "3a84f5c0-36b8-46a3-b903-c36a3f41bb26", "comment": "Malware payload (MysticStealer)", "value": "d88062d9b89016399a8750f8ff221f02059f1a442cdaa6a1964b86dcd425a2d63e7f5ca8faae1185526d54d9eefa789a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965117, "uuid": "4790e242-8be3-4f93-9968-334fe2c05dad", "value": "T10A84C00070D0807ED83315F645F9CBB9983EF8706BA145FF93A40E6D4E696E0693697E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965117, "uuid": "91316311-437b-40f6-bd5d-85e86116f7dc", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965117, "uuid": "9e766dd5-d5c5-45e8-960c-be15d45033b4", "value": "6144:tVvJm09zORs+z/TMify9DAOjgQlw/5caRhXuU3q7/hYFH8/:t9w09CK5NGHcShXuUazhmH8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694965117, "uuid": "8d1bdcb8-2e84-40b6-8795-ac07c2007b2d", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694965117, "uuid": "750fcbc6-a83e-4bcd-bc5f-436a248cab8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965117, "uuid": "38ef6612-9646-4dc6-a138-be49778395df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6982c97c-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983647, "uuid": "9174be19-f3bb-42f2-b7f1-46d8f8497500", "comment": "Malware payload (Mirai)", "value": "3c2670606a6fe18f37f9706a7fd9294b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983647, "uuid": "846b86c1-6ab2-41dd-a90f-b2523ae81469", "comment": "Malware payload (Mirai)", "value": "98ccacd994def7012a3505fc3cf85a5e91afafadf30c3dab7f5044661b33ee5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983647, "uuid": "11bcf782-e82f-4832-baf3-ff3ba2e5d96e", "comment": "Malware payload (Mirai)", "value": "3a69e188dcde0827d3a6f6f88e7c7e701372c6cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983647, "uuid": "6cea98da-3bb0-4136-b923-537e77cb9bcd", "comment": "Malware payload (Mirai)", "value": "7bfa7ecdd3cddc3655ae8989899c0114392ac9675838ed68066f8c999bacd6949e310b6883c998ee9e25b02288504f99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983647, "uuid": "f3963b54-4864-4462-b6c4-b000603dc3ad", "value": "T1F282DF30919B74F4DBE10435FAAECEC6A7160BF8D1FC36A312586B78894150661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983647, "uuid": "5d578bbd-52fd-42d7-9e62-897d4194e261", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMayhymdGUop5h5l+:6GV0P6+kom0tVAoNvm+to1ys3Uoznl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983647, "uuid": "85cad099-76fd-414b-9e31-3155ecf16b7f", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983647, "uuid": "f3361345-ad45-4b9a-a24b-b0743aa15226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983647, "uuid": "0f6260ce-7ea9-4738-9ff5-25d047286097", "value": "3c2670606a6fe18f37f9706a7fd9294b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824e5643-5599-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694982829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982829, "uuid": "f2bd3499-55d6-486c-9a0d-c6381c8bd2ae", "comment": "Malware payload (RedLineStealer)", "value": "fa010da36f646226b62d8b37fc44b10a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982829, "uuid": "3b8cd38c-872f-4182-8c34-a296357201c1", "comment": "Malware payload (RedLineStealer)", "value": "98ef4e193a3bfbad975da685ebb6d334c214f4fa0f5a2e5420bd9ba6dd2c3f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982829, "uuid": "980d68ff-6c96-41aa-9bec-a5f6b5b262b0", "comment": "Malware payload (RedLineStealer)", "value": "28be3ccecd3a151d8bece48da011671b4b69c4dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982829, "uuid": "fe928e1c-167d-4f04-b3a1-30fcb88ae7c4", "comment": "Malware payload (RedLineStealer)", "value": "ceed0da9c0c236bc0f33c92f7594af7760a13b6fc86e1fb345276076ced00af2137117560a1f73c2a048b594d8acc3e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694982829, "uuid": "473c63ef-16d9-4915-b08e-464cda83bfb7", "value": "T18E556C303C89C1FEDDE62C75C6DCBD25522DA0B03B2685C35E8516E9CE316DFAA35886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694982829, "uuid": "f3b7259a-7e00-4b46-894d-1c7eae36629d", "value": "1e870e4b4919ed70a6295fb438223d93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694982829, "uuid": "286bbe8f-ad6b-4d62-bd59-9b6332a15f47", "value": "12288:UP4LgJiayLp4PHmYObr/VbYDBrcO0Ff1siFgw1R8XavduZxdIIVj5Rhy2q96:ng1yLp0HmYObxpsiuw/88SjZy2q96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694982829, "uuid": "25164797-2340-4c92-8d6e-02baa6e4091f", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694982829, "uuid": "d1d9edf4-b62c-42fd-b181-e6f6484ce136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694982829, "uuid": "4dc80272-467c-435c-96b4-7cbf08616e1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2dfa5c-54f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694911521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694911521, "uuid": "33b38e51-b8b5-4301-9f87-911b46471cf0", "comment": "Malware payload (Smoke Loader)", "value": "1fd11be066371fbe09287888dd4275c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694911521, "uuid": "cd867d80-e03c-46ff-a6ed-8e59087a4852", "comment": "Malware payload (Smoke Loader)", "value": "9a3c17bc99d69c0ff856d84e9425ab3ed1e95ca1f7c48abfef2842b0a1917473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694911521, "uuid": "ef94db68-6383-48de-91c5-c759dac854ac", "comment": "Malware payload (Smoke Loader)", "value": "139981ea85424dee339d7660c27549caec1969b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694911521, "uuid": "f1f831ac-caa3-4383-98bb-6d375fe875c8", "comment": "Malware payload (Smoke Loader)", "value": "503c0f02302e69c01e00dd9b0db1c455d9e0744fcb64caad38d13ab344a8f8517caae2cd5096e9d1bcbdbf05874acd0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694911521, "uuid": "18ba64fc-69e5-470f-a0db-330496a4abbd", "value": "T19844A003E3F0AC31E52647358DAEC6F4652FBC219E795B5723087B2F08712A2D1A7769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694911521, "uuid": "37c94449-42ce-41da-a83b-2b43219811eb", "value": "0e5c0e73b8bfe5fddd6a11f97096fb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694911521, "uuid": "2e7b5a08-0651-44d4-af5a-9fb37703750d", "value": "3072:acMAu8ZpNpKpH+kegGylMuhBNpuZScrSic6lnCslvwW:audZpNEozgGylMu7fM/Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694911521, "uuid": "cc38e23b-3ff8-43f8-a8d3-528680b2c35d", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694911521, "uuid": "4f73f90e-1966-4859-9d72-1bc25d6b1802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694911521, "uuid": "4537cf78-63ec-4293-8fb7-67b0a0ff4ef5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.13900.13233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249566f8-5557-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694954325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954325, "uuid": "ef595924-c61c-4860-ae86-20795acc5a72", "comment": "Malware payload (CoinMiner)", "value": "8711b0f84531c6aa872bd7b9cbafe866", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954325, "uuid": "062d472e-571b-433a-8b37-71d79d9b7be3", "comment": "Malware payload (CoinMiner)", "value": "9c9b7260556caeabcb0503f3b105b059b1d7ad78c7efc12d15ba506e7e2c2052", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954325, "uuid": "07d5860f-6080-4681-9038-bb6a389e3a78", "comment": "Malware payload (CoinMiner)", "value": "71e860db1fcd61be5c5034c1a6e7f60db822c32b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694954325, "uuid": "e457920d-467e-43f6-abdb-e1f20a952cd8", "comment": "Malware payload (CoinMiner)", "value": "d8dda6d587ea8582fe8f47e99a29360bf7ad937010a90bf4b13aef62b5f56dc5a225c1ccacc2a98eaff3427a6bebc3f8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954325, "uuid": "220cb2f8-7443-49eb-a672-76bcbeded274", "value": "T1A644C012E3F0AC31F5234A328E69C6F4662FFC219F79A697230C771F08712A1D562769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954325, "uuid": "d18275ac-4b1e-4c66-8fe1-90f93960bc5c", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954325, "uuid": "561cc909-d3db-4972-86e4-d8b914889ea9", "value": "3072:geTmM10cMLLQ6vbxXhBjOlUK1Pm2jWyhG4OK8ZzIMxfezD80:MMecMQ6vphBq1NrjWyhrAz/xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694954325, "uuid": "149f9e98-9301-4652-8703-2a00112e17aa", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694954325, "uuid": "40a89d7c-59f6-49c9-98fe-f0ff63b1d602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694954325, "uuid": "1ae9040f-0bfb-415f-a032-6eb17c707336", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234685c0-5570-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694965061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965061, "uuid": "9348e80c-e4c5-4db8-b02e-564ff1332d24", "comment": "Malware payload", "value": "089db8d96835566184136bc30ca3aef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965061, "uuid": "5e9de82a-ad94-4ff1-92c5-808dc5cb5019", "comment": "Malware payload", "value": "a29c0badd53b5cbbf0150475e8c0f2f6c1f42b8a78e08155474e71b249cce306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965061, "uuid": "90e4befb-1213-4d6b-b017-99ff8695128e", "comment": "Malware payload", "value": "edb8fffc3afdaf755261abd2e801a771ea75d18a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965061, "uuid": "481e55e3-57c8-454e-adc4-64039a2e4bb8", "comment": "Malware payload", "value": "49055fb45cb8f5d0ac83cf69a7e415e2b74bb81eb142b1bf920568b44697901db28b89da65243608ea2a98a0dd1321ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965061, "uuid": "d9f6fbd0-ecf3-4960-b956-9fd96eed2524", "value": "T1BAF52303BAC1C8F2D65305321AA96710BA3DF5B46F50C5CF67A45D6DEAF10C1AA32367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965061, "uuid": "431fbf4e-1d36-4a19-a3c5-868b507e60f5", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965061, "uuid": "fdea5a83-5526-4f9b-bc32-5b7e00a9bf9e", "value": "98304:xWhl0BfKEqYNzsaeQLZVerdWdL7HM24OKiRo4PWrnUhOkqz:A585F8rdWduOKyoqzwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694965061, "uuid": "d1d114e1-671c-4638-abfe-133a374ade85", "value": 3459236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694965061, "uuid": "c4411daf-9fcf-4388-be10-4cf7ddad0e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965061, "uuid": "ddf30d0f-73ae-42ae-b537-f13fa0b78c2f", "value": "SecuriteInfo.com.Trojan.Uztuby.4.13445.24784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f9d54d-5502-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694918111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918111, "uuid": "041c7a3f-de98-464f-9699-cfc664cea2f9", "comment": "Malware payload", "value": "cf75403e04f4d4527f4fb25958a387c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918111, "uuid": "25b5b060-01dd-4df7-aa5e-d9eb050a78ee", "comment": "Malware payload", "value": "a4706512878883f194a126e7bdad4d05f245d0f891c5a1fd442bbf8959be3a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918111, "uuid": "71eeed57-75d8-4ecd-ab0a-5519c129c357", "comment": "Malware payload", "value": "7de46fe7471d7d5faf22a4f5bacee6b0e463ab46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694918111, "uuid": "373ea007-4b1f-4c64-bb25-0c6bcdbcd2c7", "comment": "Malware payload", "value": "ab20298fee03812b7104261bf6918d1fae48747048ce05bb10cbed5975f0de04a3dfe3bb17a8871dd96f573a0dc4e553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918111, "uuid": "a61b7c0e-0e57-4346-9bf7-2a6de4f681a3", "value": "T113F52396F2C080B2D27219731FF9E766A17FF8704F14C69FA3D45D5CA866281873A362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918111, "uuid": "bb7988fb-b147-4a42-97d5-1b0b6d1e2889", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918111, "uuid": "537abf06-cf81-43cd-95c8-775382a31d49", "value": "98304:2WhlrBfKEixPnwstRUE6DHcQ1P7GFF8k65l007P8:Q5N6hHB1jq56bP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694918111, "uuid": "7efec70a-0471-4bbe-bea1-5e3dc46065d4", "value": 3379980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694918111, "uuid": "8a003ed4-a9c4-4aba-b6bf-5f2ce3c7f61f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694918111, "uuid": "7f87786f-613c-431c-a21a-dc4da38fbc03", "value": "SecuriteInfo.com.Trojan.Ciusky.Gen.6.14912.7647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a96eb1-5555-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694953406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953406, "uuid": "128ce537-a534-4005-bc4a-2c7b677b2e90", "comment": "Malware payload (RedLineStealer)", "value": "37b7c3c0796772c2c2508d6c32f8b9bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953406, "uuid": "bba4b43b-6a99-4fc0-a53b-d4d9fe21c1c4", "comment": "Malware payload (RedLineStealer)", "value": "a475d7934b941e9a1c857556eb17e8863c5fb82bdda00e237ac68cdf655a56c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953406, "uuid": "cd1d2974-3f39-4855-ae37-5acd7a02f9fc", "comment": "Malware payload (RedLineStealer)", "value": "2a2d25935fcec3e6d08a12c37a3aaedbee60ed27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694953406, "uuid": "120e0731-8b1b-41c7-881c-13bdac8d7f8c", "comment": "Malware payload (RedLineStealer)", "value": "f5efcd502fa3c7b0d30c326caa3078aa2e9ebb44a365c019dda700d4ac5823235a2ec8f9ee965ddd248976b65e22491d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953406, "uuid": "f8b1d9a7-4a6e-42d0-9920-b1befa85e31b", "value": "T16344AF12E3F0AC31F1224B368DADC6F4662FFC215E7AE65723087B1F18B1261D656768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953406, "uuid": "57901545-d35d-438a-b60f-e6effeda11ef", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953406, "uuid": "27a771a1-8cd4-45b0-946a-d6af8463367e", "value": "3072:telmM1M8FvnSBNe9Lw3sHv1VcbgYeNW0kRSLhv0:3Mm8FH9LwE1VcUMr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694953406, "uuid": "67ce72c7-2d1a-4423-91be-30a0fb5b36fb", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694953406, "uuid": "909169fb-7025-427b-a009-2837b6e1e3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694953406, "uuid": "841d91cb-1139-4975-aaf2-3f034f860496", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02eaff4-556e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1694964492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964492, "uuid": "401b914d-3d62-41ae-975c-1a25ec60f62e", "comment": "Malware payload (Stop)", "value": "e52b10352bd30c9049ca0e5ed4ecb503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964492, "uuid": "22d63111-58fb-4a6d-b509-b2f8601a89f6", "comment": "Malware payload (Stop)", "value": "a4f702819548499595cfb484106944739c629a615d1a1bca13bfd5a44b0bb36b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964492, "uuid": "9a7a3de3-b442-4d61-9c02-579b60f513e4", "comment": "Malware payload (Stop)", "value": "be77f129b5edca05325c2e97ce867b240b0575d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694964492, "uuid": "85949c3d-eb3d-460b-991d-ce69c63ee8a7", "comment": "Malware payload (Stop)", "value": "315d252540fee5ec61f2a6ca083725a3dfaa5a218ca8f063089ed8e3e979470e6efa06e2763b81db9a1b38c1750622a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964492, "uuid": "7e2d3d44-7043-4a7d-af55-c966697ca490", "value": "T146F41211D2B1D530E5754B32CF6AC2B81A2FBD529E65AB473348772F00F417296A631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964492, "uuid": "d474fcc1-b1de-4f96-bfb1-1f6cb6e318c0", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964492, "uuid": "4a30a82f-9a91-4c2e-99b8-bd1551d7a5a5", "value": "12288:7uoGGoVjpfbnbX2RsQFAL6ibPp3gpflLPEeOOaZ:7IGgpzbsAL68hcTOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694964492, "uuid": "428daca2-7a73-4ce5-b95a-c2ea99683f06", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694964492, "uuid": "9cb18256-1fe3-42fc-a00e-c87316464d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694964492, "uuid": "075de9c6-3c84-444a-bc41-2e9c88be14a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d9b2c2-55b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694994809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994809, "uuid": "b8b00928-951e-41be-b5e8-8e977545db25", "comment": "Malware payload", "value": "c776f0c727188307afa3a0b99b980cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994809, "uuid": "1c499877-85c0-48b2-bfff-f86d31f90a67", "comment": "Malware payload", "value": "a5c248a2163a9a65206765387f62bba8e2d0935d7d895810a8f9e14aec46a66c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994809, "uuid": "bfc26fa4-57d6-479c-af19-8ad05094082b", "comment": "Malware payload", "value": "d17c4488686a762d08127da8afca6bcd1bed1451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994809, "uuid": "bb46e3e0-b015-4284-b4dd-7c6067c9967d", "comment": "Malware payload", "value": "93e5859f82d3902ffc2c58af93caa2194a8512c9456fd7a7a221982a78bda7f0396f165397ff432505f3d132fa5027b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994809, "uuid": "e245e327-67f8-462c-b983-c9c72612d57f", "value": "T1AED52311B6D19872D073193329290F60B62DFC202F32D8FB939465ADEE755C19736BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994809, "uuid": "89d00817-42e5-4576-8d9c-c41ab49df9c6", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994809, "uuid": "bf225be6-a01c-41c3-ab09-85a8385ae86a", "value": "49152:nILQUPCrvUz+HdHiwb6t8nEEI0/SAPAI+24fBj564J0Qgk:nX4z+8wwWS3rj/7J0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694994809, "uuid": "58b60bdd-4606-4cd4-aa5a-2e0883c37a0a", "value": 2921093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694994809, "uuid": "83ac45af-1fa7-4774-8290-8e80a8163ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994809, "uuid": "9670c811-62df-4ea5-8cf9-94997e594a66", "value": "SecuriteInfo.com.Trojan.Uztuby.4.7171.17940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08e747e-5534-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694939635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939635, "uuid": "89343078-ccd8-49a6-8c95-a09d06e201a2", "comment": "Malware payload", "value": "56393e1f0d98942660ce4530466efaef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939635, "uuid": "57c1858c-6568-4d61-9e68-af2e0e33af5d", "comment": "Malware payload", "value": "a6a972a320e4b9d653c8776109a836bfe4d73a19c1615d4d330038f528d120e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939635, "uuid": "7214c759-5e20-4f86-8992-342109b1aa1f", "comment": "Malware payload", "value": "2520465502cc94d06175bfedf1c8e7fa41c79528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694939635, "uuid": "a373270d-0605-4600-855d-2b96f2ae0a0f", "comment": "Malware payload", "value": "76e0c3e3382908269022886e7f9a5fad3bf5e78f9a93a8b0cad8768b348d87dd2e0bb6653c064adaa46c251ef067cfa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939635, "uuid": "5288e8e1-b305-41ad-b5f9-0bd4041791d7", "value": "T1BFD52301BEC6A971CC3319365A24EF5164BCBC202E35CAEB6394245EDF265D0AE317E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939635, "uuid": "5b145b01-12e8-4523-b30b-57e79fe1ca1d", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939635, "uuid": "95486fa5-a961-4812-9379-20a6690aeafa", "value": "49152:nILHJkP7tYcZGKjeJaWiVPdoMh+fN/7uOWyb8OJyGXmIm2dqFORvI:nEJI7ycsKHWiBN+fN/qOnb8xoJ/gAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694939635, "uuid": "057428bd-d21e-4615-a7f7-bb73e7415165", "value": 2917692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694939635, "uuid": "8c79d131-8a92-4e15-badd-10de832fa65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694939635, "uuid": "08ff761b-4a60-46bb-8f92-8ab47f29879a", "value": "SecuriteInfo.com.Win32.InjectorX-gen.4797.11243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853f12be-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968661, "uuid": "dcdb2cd6-31d0-4c8b-8395-c7dc9d42c96e", "comment": "Malware payload", "value": "ee9d84cb2b15039689cd573ae92521d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968661, "uuid": "fa58f100-86e1-4e50-a11f-9c6545b75820", "comment": "Malware payload", "value": "a863a7d17c7182ac71a39837ae069f4a6a73da3c65f290789e36a06844cde43c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968661, "uuid": "f1e8fe6f-b6d4-4bb8-91fd-c650c4f86849", "comment": "Malware payload", "value": "00cabbe3806fadf3167d5f4499e607440e37d281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968661, "uuid": "3bc99e3c-8c55-4507-8d67-cd17ff8d07c2", "comment": "Malware payload", "value": "4a8baa78e84cad353ad4373abf934498a9b0d77cda2c1cfece3b55f18a5a46162342e7d28f3969f5a700e196834d755f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968661, "uuid": "5b7058de-bd0e-428d-8a67-567de0325de6", "value": "T19705CF02FBCDCC44C1D221700AD7E6F72B768B17956449C7A8E8DA3B5E710A98A363D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968661, "uuid": "a9467638-f856-41d4-8702-8b5efc1db7f7", "value": "12288:ZAQVWEUQWrKGYSbUXS79H/qoDiZ1Xj5p:ZBVWEeKGYSbUipfc1Xj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968661, "uuid": "efdac8a9-90da-44cc-a526-db636c159db8", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968661, "uuid": "ea1c2630-f9dd-49ca-a636-b9473873bbf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968661, "uuid": "3333dc1d-a668-466d-95d7-25979e64db69", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.18044.30893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f433ee9-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968678, "uuid": "2e5a8b46-2e0a-4e30-a5f4-121447054920", "comment": "Malware payload", "value": "6c8bccca56792b61bd2bb09dc5d956d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968678, "uuid": "3eb74fb4-9aec-4801-b820-22e73f2dff7a", "comment": "Malware payload", "value": "a9ce66bbc32374289e2a7ff29466e7312bd5ef5b77039d81559d661390fc02cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968678, "uuid": "5598943a-aedd-422b-9087-26a5b96cd687", "comment": "Malware payload", "value": "97e96c48460172f747df002339830cd9468ab35f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968678, "uuid": "14e2cc19-ee35-4763-ac20-27b957a58839", "comment": "Malware payload", "value": "8e86295cbaafe03c561b60afd9d35502042a93ee137f268acede8a6ae9988e5ca70bccfec8aff4de0667d085829d93d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968678, "uuid": "0ab94b31-73c1-46d3-b369-9ff72a23a09a", "value": "T11814A73EB52D6982D96C453CDC3D41AA0F054C0764129E4FA9D6BDD82733A836EBC27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968678, "uuid": "b93775f1-42ad-4cce-b0c3-01128530047e", "value": "4aa847687141221ddd7ac3bfa9987a13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968678, "uuid": "1007e162-0b35-40be-b5ea-0ab6e90f681c", "value": "1536:opTRc9IEd9ACdatpEUrCQG6gp9qBhNDMtWHWaGmmlsJ1p8oWKHp8oWK2p8oWKgpc:o1RcmWhatTrpGbbqBEvf/+9SiK2JS42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968678, "uuid": "6fcf84f9-e156-4a62-a7a3-c24a26f72759", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968678, "uuid": "ec4ad1d9-010e-46ca-8136-f5006f2f5c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968678, "uuid": "fbb20a5a-863f-47ab-8870-8f8cbea37c6f", "value": "SecuriteInfo.com.Worm.Win32.WBNA.12877.27573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90759862-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968680, "uuid": "43d7ca92-80e8-4ca0-95c6-e7f3713055df", "comment": "Malware payload", "value": "b5d3ee1e4856b025baa40d8379077caa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968680, "uuid": "afc75f29-6237-4e0c-beaf-e15425df273c", "comment": "Malware payload", "value": "aa5b871ad08cb63815d04468eafce0f747219e6cc03d48603de3c27d507d597b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968680, "uuid": "2a2a95c1-1e01-4b41-a1b4-9f30405c40b0", "comment": "Malware payload", "value": "fa7dd395c67b7db30fb40ac4eed964457ad92661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968680, "uuid": "2c18fac0-40aa-4e7a-9b7d-862bb9209bd5", "comment": "Malware payload", "value": "5d14ff67e00b2d63fdbe197c77be21947265ee50c51f8c116497df7f5c54fe25f17263949299d8c05ca977961f93cd5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968680, "uuid": "33d8c39e-7e54-4e7e-a3e5-00240f527634", "value": "T1FBC23A66E8D388B2D22E49BC1D0ED534D83A2A313F18B1D3EBAF1D5ECD151C60B69271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968680, "uuid": "336f39ef-f960-4b89-bde0-98a424ee4ca4", "value": "384:V3HqsREnZX3Qt02g2D9ZgNEVXR3fEyugibF8YLEwLEXpDsmCq33sjP3GHvp:9KSmX3MVD4GXZEyuhhq5Db3Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968680, "uuid": "09c22c96-19db-49b1-b499-29a9b7710ec0", "value": 26111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968680, "uuid": "0784fddc-71db-4f2a-9f41-811ecba8a5a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968680, "uuid": "2675dadb-5405-4474-8ec2-55d59e9ee56b", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.32240.5415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb6f6ca-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960941, "uuid": "bd0dd1ba-99bc-4af3-9ba4-dd8e093beae8", "comment": "Malware payload (Mirai)", "value": "fbee230b2f8d3f35b8b9bdf51e444bef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960941, "uuid": "b318bf12-2de1-4f7f-93af-4bec73671d14", "comment": "Malware payload (Mirai)", "value": "ab3d440c95dcacf59bad9020e5b7925a198604c6604406d788d9ae882c2b1648", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960941, "uuid": "7625a135-4b6c-454b-acd1-b21968d17e66", "comment": "Malware payload (Mirai)", "value": "9caff8af75ac3bfc68ff4086d4f00deacdce5498", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960941, "uuid": "8bb37dbf-2808-49d3-9f2f-29a6edd22564", "comment": "Malware payload (Mirai)", "value": "169900fbfa2b7e481e1137f3fd751a80f37c4b72c99985311e8d5b71e64d6357d188f995d81e106e8735c67c4945e2cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960941, "uuid": "584b3ee2-a4da-4b52-b87f-a7a04ecc66ea", "value": "T194D35C46EB818E13C4D5177ABAAF41493332E754D3DB730689186FB43F867AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960941, "uuid": "ae1c9163-983c-4c6a-ab93-0fb01b0f83d8", "value": "3072:wN9IgjSha3tJLsmHLLrXQ6qYTpYxom1X7HHlOM/9waLYj:y9IgGha3t9smXQ6qYTSouHHcM/9wsYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960941, "uuid": "79e23f05-87a0-4e9f-9ab5-6a4e4997b5a7", "value": 136315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960941, "uuid": "342188c1-9905-42f3-8036-e9b159c2e5b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960941, "uuid": "9efc0ce7-8a15-416e-ac14-7f2c2fb726d8", "value": "fbee230b2f8d3f35b8b9bdf51e444bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e11c359-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968649, "uuid": "274aad86-bed2-454b-b4b8-775b82759404", "comment": "Malware payload", "value": "db00d1061a8b3aab60fc407cd304ab06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968649, "uuid": "56ea0c79-5812-42f1-a828-e2f61d525dc8", "comment": "Malware payload", "value": "ad0bb5631f262607117452aee44ba2dd9d74a9c414a849212f05ce62e7af0766", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968649, "uuid": "9866f110-e453-4927-9ffa-642ddc9746be", "comment": "Malware payload", "value": "915cefc8777cfc34208e27e62c6bab81d695bdd1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968649, "uuid": "44957eb6-d532-4e83-9f57-baa1e984d76a", "comment": "Malware payload", "value": "6703d3e06b42ae5298d4be5701ba783f1ad3710dff35c5e1e0bf9a24f33d7935b22dc47dc7365a296858e398885cb413", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968649, "uuid": "d6ba9547-ca74-42c8-9a0e-6c969b632632", "value": "T1C1B47D18FB41EC63C0293634C882D7D1D7E2B844AD61A38B7695EF6F2C612548E2FF95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968649, "uuid": "99011bbd-6492-4f77-9740-750b9676ca73", "value": "63bc622ddbb364868c646ebb5f982ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968649, "uuid": "f0541d1c-6579-4b0c-b885-b1478364581a", "value": "6144:roeIyfEl6FSWGCgjrlGsAU36UECrD1bCGWnmDAasnVI9xfyPYzBrD1bCGWnmDm:rK7D0GW6xf3D0GWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968649, "uuid": "1ca7610a-ea5c-48a5-8b45-bdea9fc0cd33", "value": 535634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968649, "uuid": "421dc1a6-2dc4-4aa9-81e0-f7abf338b8a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968649, "uuid": "e631af09-4da9-4eec-a9b5-8a538469cef3", "value": "SecuriteInfo.com.Trojan.Win32.Hider.20408.10875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc7f6d0-55a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1694989214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989214, "uuid": "8b682415-0ff8-48d4-a342-db2fb8d5917d", "comment": "Malware payload (Gh0stRAT)", "value": "0cd2592362c4e572f0c70d8819c8b970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989214, "uuid": "7fb517df-8586-4889-8d22-adcc3955bd7c", "comment": "Malware payload (Gh0stRAT)", "value": "ae4a2511d4a76b8c9c3ae0a02c944665dffe9723a66cd7f2dc1d112fa2f32c0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989214, "uuid": "a9873c51-ffb9-419a-b200-108cb096a141", "comment": "Malware payload (Gh0stRAT)", "value": "dbe615592ff37efea076946ccc23883d02a66425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989214, "uuid": "c604bb34-dbf8-49b9-873a-74dad2bf2021", "comment": "Malware payload (Gh0stRAT)", "value": "7a3a48b5067cc27ed350ce57e8a33a5251f9e87d4b2c744d2bce02b4eae7e2699c7dc5462246daa30b8dfa78d9f72639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989214, "uuid": "9a2d9bd0-8bf9-486d-b2bb-1fb3db87a20b", "value": "T10D93D023E854D656F15BA17489870EF8D90A8C063341CFAF66A1DD8E2DA13C0ED7F19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989214, "uuid": "3990ad0c-b4ce-4271-b471-5051379246f2", "value": "042c3e0dabd645f5ceb44bd41cdd4002", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989214, "uuid": "9b835c02-a05b-43c1-a647-f4c10e1e75f7", "value": "1536:CXALnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHMWK:CXh0hq+Yc7Hf4oa5r5sojsj+oM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694989214, "uuid": "c7bb7917-fde3-44c9-8501-d39e587dd913", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694989214, "uuid": "febcf16c-ad72-4012-b881-c99d5f9b3f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989214, "uuid": "ddc1e37e-eaa8-4fe6-81d1-a37ee2571716", "value": "0cd2592362c4e572f0c70d8819c8b970.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec90146-5584-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694973911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973911, "uuid": "024c924f-9b27-4714-97d8-c543e9621792", "comment": "Malware payload (Stealc)", "value": "14f0ee4fdab5b553a90b444de02d2b87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973911, "uuid": "9612d1ac-dbe3-4384-a4ff-a4c11c309fbc", "comment": "Malware payload (Stealc)", "value": "aebd9dbd821d4a8a2709aaa3cd16464a0096694ae8cafc6f0bdf9f8793446292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973911, "uuid": "b718e387-88eb-4170-af1d-d2709d46a815", "comment": "Malware payload (Stealc)", "value": "34c387cfa9403ce21353d6b2861fb918f046755f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694973911, "uuid": "3bd349de-fcbf-4957-acf2-08caf21bfd56", "comment": "Malware payload (Stealc)", "value": "6fb0e4e192d5bcf46b3a55f0aa011d40d0e06a97a949107873288f26a4ab13a2fb4c3cea4a49d26ee1d2e02bcb2dfabc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973911, "uuid": "6ac5e275-9536-4f1c-bcb4-19faaf7cabd5", "value": "T134852015D60B2AE4EF1A2E73264FB42F46585DF0BC72DD85D84D9840347B8B20A4FB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973911, "uuid": "9c398e26-3def-414e-bbbb-c8b04ac531fd", "value": "41092a07b5c5b05b7b7731f41b080a74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973911, "uuid": "d0cbb2a7-44cb-41bb-b7e5-492eefac3263", "value": "24576:CtCNfs7kaRa771kGyhSBl7Nv4ZVkCOA/WQuD3oOssQM8swbX7NiRsQPu2qizI28O:pMXK+3J1BHaZNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694973911, "uuid": "16bf2d92-7148-4607-957d-727684df045c", "value": 1733968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694973911, "uuid": "beb50bb7-c8f6-4d9c-a3c9-81c1743e060d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694973911, "uuid": "c1574fa6-fc11-4e20-aded-1c3c0de01ed6", "value": "14f0ee4fdab5b553a90b444de02d2b87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94553956-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968686, "uuid": "9e249f40-af04-4c3e-bb58-b3fc696c0af5", "comment": "Malware payload", "value": "044b91a89365ed356eefe7915183db7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968686, "uuid": "3494b278-eeed-4cfd-afe0-b1563803ab50", "comment": "Malware payload", "value": "b1eb77eda01eb8b2a125d4863ed9efd97e5bea7aabc61929ae17ae99968c95db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968686, "uuid": "60d68128-38c9-4bb9-a857-69fd284aa99f", "comment": "Malware payload", "value": "fb240e8630c4fff01af7c0eea5bc7535fe4044f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968686, "uuid": "059a9dc6-1951-427d-bc69-59939558c2b9", "comment": "Malware payload", "value": "ab9f25dbd8b22972b4abd3e7a5440d64109f2576721fbd0b36703daf7f0893afb2364b161f5b57fe2f8ef654c282176b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968686, "uuid": "36917053-ab3c-4e6e-9201-fe90e2cfc323", "value": "T1C5047D12FAC17475C49A26FCEC0686B9973F7A295A2DD17E3EDD8C084C79284E84D1E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968686, "uuid": "c415e178-4c82-4d5f-b1dd-107182e43b3c", "value": "3072:JeS0t1K2btjKQvnegAyOj5vqdE+++Ma3HAX:ES0Teg+j5veE+++Ma3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968686, "uuid": "ca6cb735-2982-41d4-9962-41ce355d3793", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968686, "uuid": "f710dd72-ff3b-44ee-9338-4f6ae1ba9086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968686, "uuid": "23dcfd0f-6a71-49e1-8a70-14ae9759044a", "value": "SecuriteInfo.com.Worm.Win32.AutoRun.28747.7558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a623fe64-557c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694970434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970434, "uuid": "4c300b77-e46a-40a1-8451-bc1dd59ea228", "comment": "Malware payload", "value": "1d5e7d2f1e3fc981a5eb32b00c83dbdf", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970434, "uuid": "9d061287-581e-453a-89fc-d58bf40584d7", "comment": "Malware payload", "value": "b1feff99f4f5f7f17f6fe19dadaa1f53be277fd21a8e749f269d067abeb5a4e5", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970434, "uuid": "ceaca0f6-9fb8-4a3e-a68c-675e6f86a2c1", "comment": "Malware payload", "value": "74e26a41778aa79a77c62f9b95cb85a39ca8c0cc", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970434, "uuid": "92f5b545-d2d9-4214-adec-4b3a7c316ca5", "comment": "Malware payload", "value": "1806264aed45a9f6bc2f566f223269b958b25f51e7cf3b3e89e91d42227e40f62afbfa6fe959d5b917ceccc65a5d5a3c", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970434, "uuid": "d5479089-c001-4286-96a8-431ffa202f15", "value": "T166B633C6504BEC8AF91EDC3391BA2DC1821950B3D167E835A7DDB744693EDE0821B1BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970434, "uuid": "7764eef7-650b-4a64-8d32-dfa3519751b4", "value": "196608:wMGH/COpgGO6vLxuU5hSS1hSDOkj+d0Jf3HOly8XTLWU7Ss9AMClm:wxH//j+jiul3OlyGV7xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694970434, "uuid": "0ddcd84f-bc30-4bc4-b48e-625f5cd68d0b", "value": 10572721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694970434, "uuid": "24abaea2-15c5-486a-9a62-c13e7f1afdd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970434, "uuid": "3c6b9556-bf26-4767-ad4c-64f9cbe819a2", "value": "\u0421hr\u043em\u0435S\u0435tup.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75cfa95-5532-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694938761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938761, "uuid": "1d4e6c02-06be-4fa4-aad2-c17872796c9b", "comment": "Malware payload (RedLineStealer)", "value": "01f1e21dc707c151f1b8b6120ead485e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938761, "uuid": "74b3c46b-0441-47bb-bb63-cc5dd4dcfe0c", "comment": "Malware payload (RedLineStealer)", "value": "b28aaeb1caf08f4f8254c63d98ed7cc6f494e4598c60bb94d5d29222d44d2cf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938761, "uuid": "fe3bae52-3713-48c8-bb7b-03658fd0415c", "comment": "Malware payload (RedLineStealer)", "value": "c32aa3b2102bc18522e4ff2fdf21def5f2e3527c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938761, "uuid": "380bb787-36fa-4c4d-ab0b-a451d7bc3fbe", "comment": "Malware payload (RedLineStealer)", "value": "294dfa3fca0425dbe8ff1d83848ffc5a7e56af503d31fef190aaeeb7f83635d56b5092137f0b7ea66cdf8727026640be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938761, "uuid": "169f9c6a-b32d-4521-abb9-a4b253216549", "value": "T15044B002E3B19C71F62747318EADC2F4662FBC214E7AA7572348BF2F04B1161D666729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938761, "uuid": "5b7fbc84-3735-48a1-9f6e-9872632abe05", "value": "983ad0b1eddf77f1ba43ff2b67eba232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938761, "uuid": "0af66dff-dbb0-41c7-bb5e-cc10a93024a1", "value": "1536:rhSXn97SN4bTHL0dOF4PQbKTcc2cA5E3ZG+gdpbOvB6As6IYCvRN/D73t8IeZYoV:rhmndt7Le1h3ZGfsvBe9skoaxQYB110", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694938761, "uuid": "e5044d5d-a622-4a07-acb3-0cb699868d9d", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694938761, "uuid": "e8625a9e-1510-4471-b9ec-e58bb37cfb45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938761, "uuid": "7a73f108-baa9-4248-befa-14290dd0d097", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834e1aa0-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968658, "uuid": "a681ac57-e20c-4a40-9b5a-42a1d3aec928", "comment": "Malware payload", "value": "192386661cfced2138bac5206a37c4ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968658, "uuid": "2aa4c3ae-8895-4032-94ea-3ac8eb5c92a7", "comment": "Malware payload", "value": "b38a871d2d73d7de8c96c7d6bb3b50b779922ba49707898b6360bc59b0f6abcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968658, "uuid": "9adbfe73-d1f8-452b-96f8-e8e4112b39ec", "comment": "Malware payload", "value": "5ededa272466618591fc82240b1096e36d2fb8b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968658, "uuid": "5e93c28d-1b7a-4c97-aabb-59a77d066f47", "comment": "Malware payload", "value": "715e8925dd33fd7615d70567fc83583463f9c8d4ac80433c0b0dfa03a77a60136f30dc6e13b4b68c3932e12ca90f228c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968658, "uuid": "270f7dce-1f67-4760-a107-c616d4dba21c", "value": "T14936D553A240525FE361C9F094A8D5352A673D32059D748FB2C53E4B72B36E3B8B9B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968658, "uuid": "6be23c84-953f-4a26-a686-1bc36d1da907", "value": "dadf74f17a3b53ff1e054f0ee70dcde4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968658, "uuid": "4b3c4db2-8022-4c20-8784-7fb92670f7b9", "value": "98304:czzwfPuc30fU7nPpzGmS2CmMIO4fuvC+V8x/GWU9Qhpl:czzS0fU7nPpzGmS2CmMIO4fu3S/GWU9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968658, "uuid": "96e9e68e-2b4b-4cfc-a038-e6bf6e5b8bdf", "value": 5210112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968658, "uuid": "60144c80-4fb5-4ab4-b6df-b085c74d1909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968658, "uuid": "729311f1-134f-4ea8-88c4-d9b4b80c0a54", "value": "SecuriteInfo.com.BACKDOOR.Trojan.3757.13104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9673b0e5-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968690, "uuid": "8aea2745-c835-408e-ba0d-c3a97914a76d", "comment": "Malware payload", "value": "5843ebd8b5a7d97e15128287729e6f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968690, "uuid": "549b5202-f02b-44f3-a706-f521dae973a6", "comment": "Malware payload", "value": "b57caf233558da836f849071fbdb8a782ca51569ed8135f3ea6298d639ab571f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968690, "uuid": "fa6dbadb-547a-4da0-b357-ff7d8398e3d6", "comment": "Malware payload", "value": "6dc78a1e9df6cfc280784b2adbc417dd1cf2356e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968690, "uuid": "53335f8b-7235-4073-8a66-857810b2a6a9", "comment": "Malware payload", "value": "b61957b7883f22cc8ad2d41ac535aa13f0798b0bab66d63ac214777d72a87c6698429914144c6a242514e421bc59548f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968690, "uuid": "10b2071d-16db-48f0-ae1b-e5ba5855bac0", "value": "T193E420774E2CA4C2DC914C71150ABA567815081EF4069C83E395BBB4583ABD7BFFCAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968690, "uuid": "7a01e7c7-34d4-41b4-b1f9-b7685119ec9e", "value": "8a9e343ef02b2796ce6de11d3fa514ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968690, "uuid": "789d68e5-92c3-4451-905c-c63c664c1c8b", "value": "12288:hvhXo0QFcg41r5KGtlPNZ/b+rpzyWEzJVqkoLTvs3k/cs7JyRuV2N+Ck5y9BFJZF:NhXo0QFcg41r5KGtlPNZ/b+rpzyWEzJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968690, "uuid": "b8ef13e8-a054-4cc5-8533-8cc42efd21ad", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968690, "uuid": "bc239ca4-bd01-4faa-86cf-c54f9faa1b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968690, "uuid": "3f8f12f7-da9e-4224-93c2-bf79c7ed729e", "value": "SecuriteInfo.com.Worm.Win32.WBNA.9866.22068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a57f035-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968696, "uuid": "2f7e9713-f99c-44aa-8045-6fb6f99ab808", "comment": "Malware payload", "value": "c1e5a9434d962e6f71b08200102aeae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968696, "uuid": "5927bde7-2788-4e19-b1a8-762d27b304cf", "comment": "Malware payload", "value": "b705f27c56880633cdb2ce71b2b22711fb2321ed5c3c4cab45ac3678370220aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968696, "uuid": "8ab29d75-7914-4964-ab55-6a08fb6fdd2a", "comment": "Malware payload", "value": "ab9b4879587a1008ce629590f9e8da13861240ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968696, "uuid": "67d1a5bd-8990-4737-bc5f-61a6d467b656", "comment": "Malware payload", "value": "103af2d6f37af80db0ce5e8932b9bd2f0c11e0e52a3f5635735fd11858c358296c22df6fff0324408e8eacc0f67bc71b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968696, "uuid": "b93e5043-6e84-4845-967a-be93cde1f0aa", "value": "T16E61DAD3E6D248B2C34EC4783A498128EB31DB3123E197439F6DA10ADC163805EFDA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968696, "uuid": "e14fe13b-2847-4099-a468-66342dbeb6ea", "value": "48:OEPxKItHHkHL4D3fTyh6aRev5fFmQbiDgkc6mHTraCfVnkKQjhg4EboFr:nPPnZ7fTtzWDgkc6AVnkbg9E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968696, "uuid": "673d08b5-1558-45e5-b20e-2e004ed57425", "value": 3425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968696, "uuid": "9adf1a74-b582-4e60-ae42-c2bf257d0364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968696, "uuid": "6ee58fd3-7e50-4754-b139-e4d4cd6db45e", "value": "SecuriteInfo.com.Trojan.BAT.Qhost.3988.26443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056d1f93-5592-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694979613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979613, "uuid": "ccbf7a6d-17bd-428c-99ee-3b7034e5cca5", "comment": "Malware payload (RecordBreaker)", "value": "1c6063a5cdc97c32dfa4e2c9ec1fe4c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979613, "uuid": "fbd7781f-2b27-45fa-a840-89a849414518", "comment": "Malware payload (RecordBreaker)", "value": "ba515106cf5032b6dd4714b15e4bbce4f4f5a708241cbc755f68698fac8b7343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979613, "uuid": "abf040b2-58d2-4fbd-8f35-e938041df1cf", "comment": "Malware payload (RecordBreaker)", "value": "9ef3fd392b373cf20942f2d1e346c0ff44058450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694979613, "uuid": "344915c2-c570-42fc-bf9d-f9089fb9c0c9", "comment": "Malware payload (RecordBreaker)", "value": "b09c52f830cd6008d189b1804fc41f5f146fe34e90fe39e3b525b0dc0d0ee4c429007f58dd4fd17d9b0bcaeb6ed1948e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694979613, "uuid": "c327ce86-4eae-4155-9a94-fc171bfbf02d", "value": "T1A695BF3273E2C136D4B30270D6B9ABAD9579F635635450CBA3841F099E706E2BA3934F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694979613, "uuid": "e91679ad-689e-4978-a813-871a699aadea", "value": "727e887293b86cc1e52864ddc723366b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694979613, "uuid": "36a5ebf4-d5e6-4b87-a494-a332f0e2c44a", "value": "49152:erZvH/mJr3Nxs9NHWHWT1YmIfVt10gdN7gIrP7CtEvTsZvK:exH/mJ5xs/HWHcEInIqETV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694979613, "uuid": "59c8b8e0-de84-4b18-b63e-7d3c2033f2a5", "value": 2031136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694979613, "uuid": "f04d2d1c-2c2f-44a4-ae22-79cf960bddab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694979613, "uuid": "17c59e8d-5386-49c3-99bc-820d0a9c7c49", "value": "1c6063a5cdc97c32dfa4e2c9ec1fe4c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3149fb-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983628, "uuid": "06c5b717-5c46-4233-8239-c2a5ca0ff621", "comment": "Malware payload (Mirai)", "value": "391103852a62af569a4a4f34effb22fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983628, "uuid": "6144c0ef-a964-4aad-9796-4afc14b2c66e", "comment": "Malware payload (Mirai)", "value": "bec8305a3cf1d3b08d0499902006a8fe4adf557dee88e1c420e5a8df2fffad9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983628, "uuid": "e1222a38-59fc-4aed-ae54-9b43dee29b54", "comment": "Malware payload (Mirai)", "value": "d35af9d05c9dd3b002ba8ea51301e7dcc23bcc5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983628, "uuid": "18ae4a7d-f018-4115-9691-c524de232e7a", "comment": "Malware payload (Mirai)", "value": "615dd90aac72ee54737106f61b9d705c07c303cab71b88682916bc4d4eb36a375946c4cde619449b7f882f1c9a8d3ad4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983628, "uuid": "753cc104-6eb2-4a3a-8bee-1e2c915d9371", "value": "T175C2D1E07726FA31C4206C3DE52B4D8A3A51067C90FE393664159C398FC1A9B63F88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983628, "uuid": "9149ab7d-6e69-4da8-b3b6-6b8736820674", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrQ9q3UELu6:OKy4qfqoeJdXWgZL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983628, "uuid": "7ca36347-b2c3-4104-a1a6-7333d3b09acf", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983628, "uuid": "8e559e3d-bc08-45cb-b059-3b0a23edad73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983628, "uuid": "1cb69f5e-9b8a-4217-a3bb-fd9c0c581bd1", "value": "391103852a62af569a4a4f34effb22fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a30a2ae-5546-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694947194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947194, "uuid": "ad132642-5b46-47e5-bb81-0951acc14d0c", "comment": "Malware payload (AZORult)", "value": "2bb1767607b30730a1fbd012fbdaf1f4", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947194, "uuid": "0806956d-9abe-4334-ab70-b52dd045b955", "comment": "Malware payload (AZORult)", "value": "c06db424f77450a146e45a9919d223ab1631db8ebb71fcfe3702d6b925e234fb", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947194, "uuid": "116149d0-d9b3-47ec-93a3-8b7742de0cd4", "comment": "Malware payload (AZORult)", "value": "b501b32d39a243444b5668ef42b86bf00a17b228", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947194, "uuid": "c1db5a7c-26c4-4031-9bb7-32e668cfacce", "comment": "Malware payload (AZORult)", "value": "07d4950ce06c4021e578171ae850ca41e49fd8019ab6bdd49f9e6fba7ae0138a07669a00c402c1e816ae3e2d27fe1a5f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947194, "uuid": "0f95182e-717e-47d5-a5e1-50ef9df7f6c9", "value": "T1C9D4014472B72364C8B08BF30495127343B7AD5915B2F7B80DD931DB2A36B464BA1A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947194, "uuid": "9e71c4d8-78c2-4159-99f8-df0c36bb9904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947194, "uuid": "0b3875b6-fb75-47fa-b114-92fd48e20733", "value": "12288:swXbF21QtNChQLxvorSEAtdHsorHD9b9+Lh5/sxQemMSB2O2:Tbs1YoZAw8HaLQeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694947194, "uuid": "ad64fcb3-aa37-40b2-ae1d-b2438f433b26", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694947194, "uuid": "4c244c53-9ce3-421a-9bd0-acbbec7eb205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947194, "uuid": "e91542c9-6849-4eb0-a439-47ae932c0230", "value": "SecuriteInfo.com.Win32.PWSX-gen.2461.29326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932a0e7f-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960953, "uuid": "ead039d3-7e6b-44e0-be86-d9efd1c3f5ec", "comment": "Malware payload (Mirai)", "value": "8dd899a5c6688f197fb933f6c2c38beb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960953, "uuid": "c7748fe2-831a-4461-a96f-78c7dad010cd", "comment": "Malware payload (Mirai)", "value": "c2be7b0a3875879c8ea9865e40c1d579322632a2ed515fcc03a655f5cc2bd2c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960953, "uuid": "c1ded767-e72a-478b-89ae-f63740049bd7", "comment": "Malware payload (Mirai)", "value": "f1dc135a561143e5ecd001ef196ca30a0f9a60b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960953, "uuid": "9ac3b92f-ebc2-42ae-b536-09dfb291b3fa", "comment": "Malware payload (Mirai)", "value": "9bacb978aaf261d55781f620d2e5347d6966bcc2e9d282a521e8eeaa08bef19fae416a51f4f8e7a01ecf2ad260673690", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960953, "uuid": "010b04f2-4e62-41e9-9b94-8e84cc9843dc", "value": "T14273CA1A2E259FBCFF9C423447B7DE219A4833A626E1C645D15CEA012E7034E741FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960953, "uuid": "07c3ccbc-7247-4475-9d0a-3e5e837aab4e", "value": "1536:2Ao2zmbsTaL30vC0vhh53ba/BsNkTRjLzcS4WMV/xIl1dq:2ARmb53IxZ3ba/yNEjLzcS4WMVpIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960953, "uuid": "da8a7735-40b1-49a3-8578-3cd18913a827", "value": 80080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960953, "uuid": "f2029641-622d-4b82-861c-2e1fdb444b31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960953, "uuid": "95554f53-c31a-4746-8d9b-41d7c9790666", "value": "8dd899a5c6688f197fb933f6c2c38beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4433f06f-557b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694969840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969840, "uuid": "91224abb-b4e3-4669-8552-1d4faa28b982", "comment": "Malware payload (CoinMiner)", "value": "968d7b91a331234c30946bf3b6834e85", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969840, "uuid": "ee6fde52-5fa2-4346-84f6-2c9e2a55c38d", "comment": "Malware payload (CoinMiner)", "value": "c5fc6da4ebc5e3685e3b4d162d52a0688edfd1dae0d202a921b470cb7dd08cf9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969840, "uuid": "45c29b86-55a8-4676-b322-9b466d5d2331", "comment": "Malware payload (CoinMiner)", "value": "b8fd455add6140b20fbb1244d9cd33a7cec9f85b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694969840, "uuid": "8f510de8-392a-429a-bd27-342bbd8b87ef", "comment": "Malware payload (CoinMiner)", "value": "49712e0b0629bc7086baa38fe616a39d3d35101071f699526a342e057b5174fa8dbe6daabb54ca6d80b7e047a74eb1c9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969840, "uuid": "87cad774-e383-409c-a21b-eb2b3a8343b3", "value": "T14C34D052B7B1C831E1A349342931C5715A3B7C73AAB5CE8F3384577E1D312D0AAADB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969840, "uuid": "a1e514c1-088a-45f2-870b-d9bf7580883e", "value": "e7524ccca7833a80ac6449284f271ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969840, "uuid": "38fc0c35-2d8b-4012-bd25-f223a523e286", "value": "3072:WEL7fZAMg8P9yo8ZGkAlhk/V3yDBzAlz:pfmMg5o8ZuKiDRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694969840, "uuid": "14ce9271-5096-479c-b359-e6709a02f0c4", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694969840, "uuid": "f26d949a-bfd3-4aa7-98b7-8ddf1d38acac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694969840, "uuid": "312d0108-e4b2-4043-ae25-a9bcc37a93d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e132f52-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968676, "uuid": "e7d13d53-8580-4eb9-ba26-c179b820108c", "comment": "Malware payload", "value": "63e64f7addc62b6303ce80fb69614a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968676, "uuid": "eea62a9a-1c60-4172-92e5-77b071400964", "comment": "Malware payload", "value": "c7404d602e86f80c707a583bedbdfe637c90e751a4fc03fecfe42b0efa3dacae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968676, "uuid": "352ee1c6-9528-4dcf-93dd-7c8465826a66", "comment": "Malware payload", "value": "66b8a25e965ec57980aed5f6c18676a887ba6757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968676, "uuid": "bd34a1b6-43c5-4b58-a53b-234fe8f48339", "comment": "Malware payload", "value": "9e23d851e2f5b2c9f95927b1bcd8438e5b6c97ecc9e9013d4414687f5ea8caab5d1b2421f193dc416663e2f77b9059ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968676, "uuid": "75013b6d-aad8-4146-bf93-00b3ec47403e", "value": "T1B1C4553B8A50564DDD2728F3321526B5AE5A3818B455DC07F3C1ED68AA34AD3EEFC213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968676, "uuid": "12e498b5-b9c6-4e06-8be6-c415a52608a0", "value": "4b26e929de13a2ebae1def696838021f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968676, "uuid": "f53b6310-77fb-4547-a0e2-0a47cc3b0f5c", "value": "3072:5lfbwMNX+GVUjldqnPoTyVjovTDTNA1wg95nMQwBrvLQAiKryGQJpaz5jjVAhY9u:5eU+FqCyHuBjVkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968676, "uuid": "f32eaab1-1f30-45f3-87c0-8b9fae3d495c", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968676, "uuid": "97b79837-e75c-4957-97d1-2b3bb25bcef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968676, "uuid": "61c6da21-7970-4fea-9063-e01433316f8e", "value": "SecuriteInfo.com.Worm.Win32.WBNA.7046.21168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e3435e-5598-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694982478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982478, "uuid": "176d1fb2-0bee-42e5-8897-3efcc7692c2c", "comment": "Malware payload", "value": "f44bc360b07800a4746511aecf5e3f3d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982478, "uuid": "3f0c8553-5cef-4a92-8392-a44cab15f2e2", "comment": "Malware payload", "value": "c83c7b000a955f2b8cb92bb112ed606ffd9fbebbe3422f80d90d06b167f2f37b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982478, "uuid": "83fdefab-9fec-4485-a1a2-632776151f88", "comment": "Malware payload", "value": "cb123a197a3baa8865a3ca2cee25022d0a578371", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694982478, "uuid": "0f5878a1-b039-4a8a-a7cb-e19fb68b8970", "comment": "Malware payload", "value": "54b083d209d1d618c4ee513effd3682813ce67cbe9ac68669cd38c4d6b286dacae71a8983953e1b7d811587614541b09", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694982478, "uuid": "533c1d51-3e5b-4e02-9beb-4a1601a7ce89", "value": "T17F263B07F89151E4C1EAE23486759252BA707C885F3423E33B60F7B82B76BD4AE79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694982478, "uuid": "e7a55133-4f67-4b01-ab0b-a59a0eb50503", "value": "49152:oNNSjsN+HlTzerb/TzvO90d7HjmAFd4A64nsfJ+b/pP5k21FKbJSgWdEIqkcKo6H:Vn2d5rTcWE3nN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694982478, "uuid": "1a19b097-18ad-4867-930b-f27b5b13af4c", "value": 4837376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694982478, "uuid": "87ae5a65-bff4-434e-a74e-4f0b99281fb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694982478, "uuid": "0fd3dd20-9b53-4190-8f20-062b4a0408fe", "value": "test.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a0d00c-55a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694989418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989418, "uuid": "4401578e-32c6-4a2b-8731-081c1967aa4d", "comment": "Malware payload (CoinMiner)", "value": "08ddf487428637e7a3e31307fe75a845", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989418, "uuid": "64c8a78f-5405-495c-bf21-c0f23ca09ede", "comment": "Malware payload (CoinMiner)", "value": "c92cc3e4c75f7943035e4c7ed664a685ed42ed4f46f457251d6bc76c207ae223", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989418, "uuid": "56be18c9-3e84-4682-8cb6-9e20f160ff3f", "comment": "Malware payload (CoinMiner)", "value": "4859901051b1e80411c2a12c2de2a5d74c5ff66a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694989418, "uuid": "9671df71-fb7b-460a-87eb-da0423b0e067", "comment": "Malware payload (CoinMiner)", "value": "5dad0a191be4433d4d12d8a0e99c05e706c808ba5f65701086a6b05122ebff65f4b34c89fe52f6314c17146a48da978a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989418, "uuid": "3c241a10-4da6-45ff-a0be-b2434b2fdc29", "value": "T12334D111B7E1C835E9A386351471C5B26F3F7C23B6B9C48B338457BA5E72381A9B9702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989418, "uuid": "259965e4-5660-4814-9cd2-3cb1020b9bbe", "value": "942ca992441c585d4cf2a9252e32648a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989418, "uuid": "5342a38a-2b40-4087-9bdc-f72d9aa3cda4", "value": "3072:sDzozRswyP0pirGjSKKrRMZ2HJg5AIUjOmW5:jz6wyRJV1MwHJgoOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694989418, "uuid": "7ee32aa5-2f92-49e9-a24d-129d04b0d7f5", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694989418, "uuid": "20003603-080e-4f08-83ac-bab09d2fd147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694989418, "uuid": "ce217287-1c33-4e1a-9c61-f2e2c1b91c64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ae822e-551c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694928965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694928965, "uuid": "b981168c-e4a0-43c9-869f-8dd31dd30159", "comment": "Malware payload", "value": "031bd3a51acb1b7a6e31e0a5a1ce3a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694928965, "uuid": "9ee3c077-e0f2-428b-a59f-c544a2fa21c7", "comment": "Malware payload", "value": "cb94a1209a79362bc533134f14bc709e9068494f4268e0c948baa14e3ef70e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694928965, "uuid": "52f0d781-f08c-4155-b4c6-a295c0e9c89f", "comment": "Malware payload", "value": "197d2dacc2beb0fabdced8b3ab4950f2c4e2707a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694928965, "uuid": "3ac86c8b-a6ca-4b2e-9ca4-9fee40bc0e4d", "comment": "Malware payload", "value": "8638ce2b3c29a716b7ffe353f684ae11696871566e2162a554a64a674f4d0ca1bcf474416767bef9f3733b69d1ef6bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694928965, "uuid": "28b9bcc0-a992-4033-a5ea-5a98101c1a64", "value": "T188E523133AC05272D43226329E7AA711E77CBD704F658DDBA784A16DAE231D0A337B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694928965, "uuid": "175d14c3-27a1-4a6d-ae9c-eb0323af1343", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694928965, "uuid": "77f89647-5c68-463c-8fc1-dd8d2ccb07f0", "value": "98304:rlYWs4xo6iDvIV3emNmavqLtGQYlRbxmSMQBg9IKyV+4EC:h1svs3R0SQYlhx5MRPyVyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694928965, "uuid": "9543bf21-fa8f-43cd-95e9-702351a1d6a7", "value": 3244218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694928965, "uuid": "1d0a26cb-e5ce-403e-b3f0-147bbcacc925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694928965, "uuid": "786a43db-0a1d-40be-bac5-3b2bc8fd7aba", "value": "SecuriteInfo.com.Win32.InjectorX-gen.7723.22211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b30aae-54fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GootLoader)", "timestamp": 1694914624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914624, "uuid": "966e402e-fc90-4801-97a0-8bd0081fce1b", "comment": "Malware payload (GootLoader)", "value": "659ba1b4182d42eb963fc30b70f52c48", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914624, "uuid": "31f52be8-e7cb-4c08-84bb-f2416b3b8091", "comment": "Malware payload (GootLoader)", "value": "cbb94dd87c3ce335c75e57621412eedce013fcc77ac92ec57f7e74ac70dde119", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914624, "uuid": "1f94e3cb-a6a2-41dd-a3db-c3b6baf649d1", "comment": "Malware payload (GootLoader)", "value": "c47e04eef7bbc20dc91b2a82bda02c59291861a8", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694914624, "uuid": "fce1a845-1a9d-46f6-8a70-e9cc9c2ae184", "comment": "Malware payload (GootLoader)", "value": "8f6af3e43f78e4b6bf501645396b7184b6e9bc72917e2eb256ee0f924405ddf5d52ef31d432f388edc0cdd489d2d6694", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694914624, "uuid": "acf0c6d3-133e-42a9-bc93-14dc353b6cd7", "value": "T184F3A51826E640F6455B2C6A4B2F214DB257804F86265898FCADC7DD0FA6B3413B9FFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694914624, "uuid": "2ad412f3-1bbb-4763-be67-3d5105ba3d31", "value": "3072:ogg1kjSdLzERyjO/QQCQFMSBz2bax8uLp35onGmiClC2H4fCWMeL1HzSY99Nov97:ogg1kjSdL4RyS/QQCQFMSBSbax8uLp3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694914624, "uuid": "22b9b55c-a836-427b-892c-334c60f1ffba", "value": 164224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694914624, "uuid": "040c8b8e-0116-4f15-9f88-0f73eda8a34f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694914624, "uuid": "d7d12155-a9c9-465d-ad4c-c31559b7d961", "value": "schools first credit card responsibility agreement form 29662.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aff0ed3-5525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694932808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694932808, "uuid": "4b9e18eb-14e9-4570-b784-c5512a9615d7", "comment": "Malware payload (DarkGate)", "value": "6dc286f30c31f186ed724b0c29942352", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694932808, "uuid": "44823bc6-0a6a-417a-bd04-fa73c4f46995", "comment": "Malware payload (DarkGate)", "value": "ce3f1d357e4e27f1dd49c3c6901e9a9c52179cfbc66824fe1dee181a7896ce9e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694932808, "uuid": "961e100e-ba9e-4e16-9cc9-83fa89752a80", "comment": "Malware payload (DarkGate)", "value": "a2fd0922e47ca651e1213bd30bf0922067d53ac1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694932808, "uuid": "edbcef60-9be9-431e-b502-fde9b0ad13f1", "comment": "Malware payload (DarkGate)", "value": "9d2ba92bf1184c6a49d24e0caa5a39798541ffa49918d63c18c4c9f90b2b7573781d74f7e522b92b1a90689a3f61c0d7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694932808, "uuid": "9200cf03-1bd8-4436-9727-3d6ac2e45971", "value": "T118D0A73F266F41E6F550AEE920B690D5E0A7248F03680D1C6EE44CCC840844BD50E9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694932808, "uuid": "bbfc0f7a-b334-44ca-a93c-8305794f54cc", "value": "6:4I5fJQO3glQ/mxiPU7Cwz3HiPUKyGvFxPOwD:4I5FgK+xmYCwzXmT9uwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694932808, "uuid": "393a8915-a8dc-47ec-952c-d4b7a9a70bf5", "value": 225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694932808, "uuid": "7f4f819d-2d06-4841-81b7-33a6dfef294e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694932808, "uuid": "23880576-f70f-4282-b078-bbbae83e725d", "value": "zckgnyuh.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885d5ee4-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968666, "uuid": "941a95e3-bf60-4f0d-a1da-29c75ce0e997", "comment": "Malware payload", "value": "c0ebcdc58791e4979a554c9752e010e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968666, "uuid": "121af929-cc6c-4327-9616-585c617a9b0a", "comment": "Malware payload", "value": "ced95af05bddb43325ce0e32299fc910f73dc99a553db67d57e673e1074e7443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968666, "uuid": "53c5b5d2-2178-4853-84be-5a909d4aeb25", "comment": "Malware payload", "value": "1fce5af19201718b1c30e1d552646413c9ebbb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968666, "uuid": "ab778c05-ecc8-461e-b8b2-2e20eec090dd", "comment": "Malware payload", "value": "66597f52f85e593a36f540dc08974420eea8865fd72c689ff183114f1e1b65ebe6b594c35eb7520bcfd77fc01982706d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968666, "uuid": "b7b57b2b-25ff-4af7-8239-9c07c8761d87", "value": "T181656D4AF9C28C9ACF91243005776632BD77869B2B25DB9F921CFD24B923C406DAF1D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968666, "uuid": "63193a7b-fa5c-4701-8e95-61b44363c29b", "value": "24576:2TSlxaCJqZq2Zjc1Rz+evIXQ6nnrEbnpil:ZJLU01b8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968666, "uuid": "4a1007ff-c344-45e6-9aec-39d738d07075", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968666, "uuid": "66b73a69-b1ca-4624-b3f0-26cfe5e5e879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968666, "uuid": "dad6b8da-916f-4779-816e-7d7d73de32f2", "value": "SecuriteInfo.com.Win32.Trojan.PSE.AEMAUR.10920.539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d24220-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968662, "uuid": "155cb51a-d9d5-4081-b3d8-f043fb365a08", "comment": "Malware payload", "value": "482269054630fd33ea529e2613783f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968662, "uuid": "c695b03c-81fd-4712-b35e-ac7fd8388422", "comment": "Malware payload", "value": "d05c1e87d6162157ed32ba29d920612b58c182f143b9192d6da7fe5083e6c070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968662, "uuid": "328f9734-cb14-4547-b8c6-8954b1cdedbd", "comment": "Malware payload", "value": "c08943b418ad40dfbcc7062fac8ea4393189c4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968662, "uuid": "866f3d0e-8c6d-4f54-a266-51626d67b794", "comment": "Malware payload", "value": "e6ff230aa01c98415e57dacf1c49bbadd4a807e2ea1766aa6750d4489f06c623fe898c824317ebebaad28decc429cbb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968662, "uuid": "fa1b4b10-60d4-4fb4-bea5-a26a790642f1", "value": "T18061C8D7E6D248B2C34EC5783A898128EB31DB3133A197439F6DA10ADC153805EFEA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968662, "uuid": "b1dd1e77-845f-47e7-9980-cf1b1beb507b", "value": "48:OEP6ItHHkHL4D3fTyh6aRev5fFmQbiDgkc6mHTraCfVnkKQjhg4EboFT:nPxnZ7fTtzWDgkc6AVnkbg9Ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968662, "uuid": "f3a7d47a-1833-4b43-aa47-dd81d1c87cd4", "value": 3441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968662, "uuid": "a0e1f1a7-ed74-4d53-9449-9e5e99ce096a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968662, "uuid": "d80c12ac-9202-4382-a451-264e03e07c7e", "value": "SecuriteInfo.com.Trojan.BAT.Qhost.12988.4404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5d49c9-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960947, "uuid": "23ae4021-c45e-4173-9bc6-2b06a6c87df4", "comment": "Malware payload (Mirai)", "value": "8b4b3b257a067363b7bab4e9adb95dac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960947, "uuid": "0bb6562f-a7fa-4eef-905a-994c021c5a41", "comment": "Malware payload (Mirai)", "value": "d94f8c5bcb512273b1cce5ae8d0c1ecc8e1c32e0cd774a9f55547ad0c0a73a50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960947, "uuid": "1ae25f8c-12fa-4bab-9279-eb6966b5542d", "comment": "Malware payload (Mirai)", "value": "a14763648200d81a02358c73f0663428c5f09318", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960947, "uuid": "1d6d1382-82e7-44b1-82f5-01d89e6121b0", "comment": "Malware payload (Mirai)", "value": "7e854d62cddb1619cfda2c61ece9d3539a1aa8baf135dc64d28f7066832dfb6a54b960d6032323065bfde9c993f90dec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960947, "uuid": "2756919e-d44e-4c16-8b61-b6375bd57382", "value": "T19F83B509BF641FF7ECAFCC370AA92B05248D651A21A97B367D34D418F64B31E19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960947, "uuid": "e8405b5a-2605-41ea-9468-16bc89a8b9bf", "value": "1536:/Ou3TUx46zrKch57ev1a/vZQLJzQl1d7:/Ou3AXnKM/v3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960947, "uuid": "45d6e7cf-dd87-4c5b-8f92-fb9daed35e6b", "value": 81328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960947, "uuid": "cd82dd7f-a256-45f5-81a6-fb8dd0fb14ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960947, "uuid": "3308c220-becb-45ab-ab3a-c8fb760161c4", "value": "8b4b3b257a067363b7bab4e9adb95dac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d4e95f-557c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694970539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970539, "uuid": "3899cce7-9096-4563-9ae8-07c374c9e485", "comment": "Malware payload (Smoke Loader)", "value": "4326f9190ac7668c45d788bd100e7edf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970539, "uuid": "88b8731f-14b1-40d6-8726-b95e01514258", "comment": "Malware payload (Smoke Loader)", "value": "da56e58fab731a84a632df79098f9de55742f30526059fe581e71aef46abef81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970539, "uuid": "e2cd2bbc-2443-47b7-8fa1-a2365bc13e33", "comment": "Malware payload (Smoke Loader)", "value": "74887f61c1ee11495cf845729fbe95d2c330bc01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694970539, "uuid": "1d43d909-8c48-4b9a-992b-7eb01590af77", "comment": "Malware payload (Smoke Loader)", "value": "1d75b2cb10ad3fb6a3f6bdbc6174eebf328bfc860a8ff90813f2de5ad82728a06e2ebb1621176e5d9378d8904d80e194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970539, "uuid": "e499a821-5bbe-4303-88c8-05be87503d04", "value": "T1E134D120BBF1C832F0A34A38A835C6725A3B7C72A675C58B3344577F1D51782AAAD753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970539, "uuid": "de8dec9c-34a5-4854-938f-e3ee5557cf83", "value": "e7524ccca7833a80ac6449284f271ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970539, "uuid": "fe124d0b-e79e-47a0-8aca-8749e91d6f00", "value": "3072:IEs7fZAkg8zJrsFSHTuZXirrd6ZTYF3AOzcZ+MeZZyTmG:sfmkg4SSzsyam3AMPMSZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694970539, "uuid": "bb956b22-77a4-4ea6-ad87-e67a5a61927c", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694970539, "uuid": "1474826a-a50a-4426-a374-7cc466b512ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694970539, "uuid": "2082d7f2-be96-4c40-bf9a-0834daf18a2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd657c-559b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694983641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983641, "uuid": "92fddc7e-20f8-4bb9-8fb1-3337ca349182", "comment": "Malware payload (Mirai)", "value": "534cb37ffb076c3fcad54ac1c2a45e1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983641, "uuid": "ba9fd720-e261-46c8-8496-0c0ebb852f93", "comment": "Malware payload (Mirai)", "value": "dbeed2efa85d8fbf25a8e2ee41bbd4d4a2db1e5da8018c7dceaa8f9bf39f8be9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983641, "uuid": "bd74889c-9021-4f74-9cfe-f17f60c2ea21", "comment": "Malware payload (Mirai)", "value": "3c8a0b600b804fa1c972441b3d7129364f331991", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694983641, "uuid": "2fc24f5a-a5b0-461d-ba07-cebd601c40df", "comment": "Malware payload (Mirai)", "value": "8b2b8926a73eb7cc9e68470fe81189aca43a7b5f792e54531b0779f18fe9b8cba906a03b7f649e8128f624e22e21e424", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983641, "uuid": "33809bfe-b392-44a9-bd3f-c60628cc3a76", "value": "T190230271880E9EB125703C72EAD59393B6E12AB1C6673013D6280A383FA5B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983641, "uuid": "a4e0f971-9168-4f8f-b694-dd8a73d3be00", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3Whj9q3UELbUXfi6nVMQHI4vcGpvo:gECFd+A6YHAxW8LRQZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694983641, "uuid": "7cb4c4bb-86cd-48fd-adab-cf63d40079b6", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694983641, "uuid": "3781639a-05ba-4995-bf93-78a2b9abfaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694983641, "uuid": "ff3cc52f-f17f-43e7-b764-0f4e98fab975", "value": "534cb37ffb076c3fcad54ac1c2a45e1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c51cc41-5546-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694947171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947171, "uuid": "3eae8b69-5d79-4c36-8769-5971e24e9f1a", "comment": "Malware payload", "value": "c066a9b74c6ed33fb7e8a8f94413b798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947171, "uuid": "c7997139-166b-4c10-bfc9-5ceeafd97a8b", "comment": "Malware payload", "value": "de3e53ef11c40625568ffbf773486d23efdbcc6831e1bca61915348940798ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947171, "uuid": "4ca3cab3-ea39-46af-a37b-22d5fe989269", "comment": "Malware payload", "value": "58b410c4a41f4dfd18cc02c61337ed7b8ea63d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694947171, "uuid": "99d7fe50-9ac6-4275-8853-f184a25ed8de", "comment": "Malware payload", "value": "166920785d46f7ad5fdd3e4c6c4bcf61d906421cab41b37927b87c5f204f179c0efb5afdb36f411fd29af21d4a38bae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon Stealer", "colour": "#A0B20A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947171, "uuid": "74834982-7309-4b4a-95a8-90b8807fa66b", "value": "T14F772330738AC53BD6621570AA2CDBAF51697BB50F7294C7A3D81D6E04B48C29732E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947171, "uuid": "37d47cdf-2481-46a7-98fa-7f0ad4147cc4", "value": "1ee3b0da38e7b7c567f93f357ca3751c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947171, "uuid": "71fc729d-a099-4128-9b32-75c525f8cffa", "value": "786432:hE3jlM8Ok4SswMWifNtt7Z1oGwnicL1cHDC0s3T:y3jlgk37MW8NttpSLCH0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694947171, "uuid": "98cf6028-3c23-4ddd-b3fa-92a06ecb6d95", "value": 33573449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694947171, "uuid": "163ce0c9-1d1b-4790-b8f3-a68bad8da4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694947171, "uuid": "1aa611b5-c637-43a6-86aa-1a64621bb80b", "value": "driver_booster_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8b28d3-557f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694971787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694971787, "uuid": "c085a890-c6ae-4f87-bc7e-e81498b04f9c", "comment": "Malware payload (Smoke Loader)", "value": "7c5940c3eb79c3a97f4e98f1a8dac782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694971787, "uuid": "a25f7305-cd4f-45b5-8087-7c3481df7d70", "comment": "Malware payload (Smoke Loader)", "value": "e7cf7131e4c2578bb51fe33d2b6670622233c651a86827a461aa7b081e19b99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694971787, "uuid": "21c57b7d-6124-4a9a-80c5-41037d11a0db", "comment": "Malware payload (Smoke Loader)", "value": "906603a5e1b79584844fffe441af49bde89f73ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694971787, "uuid": "7f43fbbe-7394-4700-9f4a-436db6561d3d", "comment": "Malware payload (Smoke Loader)", "value": "778cbf0fad1e83fc40eb5cc960ee2d823e390f2066083403f164446292ddbb69b19eb3cbc941393a52d474bb6494f4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694971787, "uuid": "413090f8-3b3b-4326-9e78-958b2e64af1b", "value": "T10734DF21B6F1C876E1E34A344831C9725A7FBC6266B4C58F338813BE1D712D1ABAD356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694971787, "uuid": "6fa8cd73-30aa-4f56-a191-e142df74b956", "value": "e7524ccca7833a80ac6449284f271ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694971787, "uuid": "fd6d4a5c-91fd-479a-8129-7d6fd5966dc2", "value": "3072:gEs7fZA+gkMbHfHWhv5zbSftq4SovLD8h1w:0fm+gz7fuVuY42h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694971787, "uuid": "3d315824-fa03-4267-b1b4-78c51cc1c8aa", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694971787, "uuid": "285ce5e6-eadf-4254-96c3-0db193c6fffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694971787, "uuid": "d562cc81-daac-4a33-a8fd-43d6423ee1e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca385c9-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968700, "uuid": "49c3a9f2-fb6e-4ff3-ab71-5fca4c2c061f", "comment": "Malware payload", "value": "f36470d54057f976466a5abbc5241a9b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968700, "uuid": "8657fd6e-a663-40ac-956d-cb6ac25adb5d", "comment": "Malware payload", "value": "e9cace18923b153625052e9aba3ee7cf793d5a40c11a23fa3e1bab1794349b3b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968700, "uuid": "87585a1c-f8d4-420c-a002-2fa5c6eec745", "comment": "Malware payload", "value": "0e7e31c03fee215ac15d59a32f7e62501b2f9eb4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968700, "uuid": "24f2f48a-dd65-4ca4-b3e9-0602eff5f121", "comment": "Malware payload", "value": "549fd4633af33d0f71d6c020826dcfa83e9b01946fd3e1062e90c8c08c7aa2a91cc910ccd9f1b47b2cd340b727c85418", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968700, "uuid": "81f22bcf-a53c-4fa6-af6e-216ba3f208ad", "value": "T12EC33A68F3C31B12D0B21F76C839976ACA1EFC60392B64DF7DD60A0D653C590BA58B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968700, "uuid": "0699c478-5541-45b7-b517-fcd54df7badf", "value": "1536:jTP8ZJWpcqPFiyOWX3oes01vFUJrdgspucawz5NhjKgwPEOMp3aaovJ9:jw5qPF7OS3zslJrHawz5NhDw0laaCJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968700, "uuid": "4ef8e293-21de-470f-be7c-5d03fbce29a3", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968700, "uuid": "5532a563-5587-4a3b-9c8e-4791843f7387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968700, "uuid": "1b82fa47-47a1-4112-b3cb-dbaee32b868d", "value": "SecuriteInfo.com.PossibleThreat.PALLASNET.H.21856.27119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2914357-55b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694994614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994614, "uuid": "ccfc0229-4d74-4741-8517-da3d28691752", "comment": "Malware payload (RedLineStealer)", "value": "0df236be5c866e6dd526ce08fc0d7af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994614, "uuid": "83735805-3df0-4ad5-bee8-53ac34884f8e", "comment": "Malware payload (RedLineStealer)", "value": "ea8f96403c01333b59c609571bf5bc4d9c69b7617d05bcc93942d170d113b556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994614, "uuid": "68c5ba74-9832-420c-bbe9-ec1a5489640e", "comment": "Malware payload (RedLineStealer)", "value": "7b13d758265be4cc2319e04cee1be360d9e5da27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694994614, "uuid": "d95677f0-c8f0-4a77-a054-00eb694ed8a5", "comment": "Malware payload (RedLineStealer)", "value": "b7fd6a89a614e3c133758844981afe70b6972108ce71e64a819daf8c4c6d4f8539c8b297935df60c42730c7bc4b8de46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994614, "uuid": "a4e220cf-d95e-450b-9137-1ca85ff7dd7b", "value": "T14FB47C585521856CF7DA09B12482AEFD29E05F204BF6DDCBB33C6DABBD3064D3A23419", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994614, "uuid": "b28b6357-9413-434d-ae00-7a542119320b", "value": "5719bc293157bac53be8c9a8dd7ed0eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994614, "uuid": "e0e3a494-384b-4a83-9692-82a6095bdb7f", "value": "6144:L6WAIGo7B/Jq8a+4PADp+kExCwFvv+CFztxjdfKS2cWhHz6gWxVIfbyomyMFFD:+ux188aluAxPGCFzt9/IacbLrSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694994614, "uuid": "756934ce-c857-4c1d-abba-4e59d024c056", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694994614, "uuid": "73a6d36f-ae16-46b6-a95d-f88e1112a99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694994614, "uuid": "cb310747-5245-4a03-94a8-639961ef9d66", "value": "0df236be5c866e6dd526ce08fc0d7af2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f4aa89-5568-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694961628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961628, "uuid": "5cf24614-6fed-46bc-83fa-d999e4ee640a", "comment": "Malware payload (Stealc)", "value": "ceaf3ba9ea8551d7142141a9b66aa629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961628, "uuid": "63977d03-47d5-4889-834e-bf34d3007c2c", "comment": "Malware payload (Stealc)", "value": "eb1574144fb3e44f9d455633d51e2e7d593c6d6d6d740d8b281707619b2dd4a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961628, "uuid": "f3656554-ebf8-476f-8112-358bab7765fc", "comment": "Malware payload (Stealc)", "value": "87bcd58f6a202b6cbe11642d46da36e5605280d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694961628, "uuid": "0b5f0dd3-ab94-4ba0-88ff-52cf6db900b5", "comment": "Malware payload (Stealc)", "value": "ec95c87bcd40676e310e438b497cc84f51795f935e984f592c72050a74fdb1357fa08f3d78ead2d1d691ce361e17caff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961628, "uuid": "b810a8ba-f0e7-4377-86a9-a8c08c7c81fd", "value": "T18D44B012E3F19C31F2234B369EB9C6F4262FFC215E79A6571308BB2F0871261D562769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961628, "uuid": "102d0569-2c40-49f0-a123-04b86862ef54", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961628, "uuid": "0ae6f4f3-1a07-44f6-a481-f8c81030b83c", "value": "3072:OeVmM1SPAaH4XUaeZY1kC6As5WGhyBn47mDtLVZGya6T3+0:cMMPAlX6ZY1kC6A3GhVm5Lu96D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694961628, "uuid": "a3963480-bd18-45b6-a317-beb9455902e2", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694961628, "uuid": "544f18e4-1cb9-4cc8-b82a-94d418e5fe9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694961628, "uuid": "53015183-ad40-4655-b3d0-77e6ccf4aea7", "value": "SecuriteInfo.com.Win32.PWSX-gen.17950.2431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d2b03c-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968689, "uuid": "82d4dec7-a64c-43a4-a22c-529b4f894bac", "comment": "Malware payload", "value": "9aa211cfe25845d78b79cbc391ef1688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968689, "uuid": "f3472b10-c53e-43e8-abc5-0cd53aa4852d", "comment": "Malware payload", "value": "ec6c07ac2a45fed66c51648547f61b29f2fc4d5d3bb013f72d266e4251f0b863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968689, "uuid": "bafd95a5-86ec-4f1a-aed7-3edc802cde41", "comment": "Malware payload", "value": "290f2714b13e9d7eb0d6aa7df82b79289e382265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968689, "uuid": "d1658dec-aeb5-41b6-9b3d-f85903b4e21b", "comment": "Malware payload", "value": "b2bd994174b19bb6f395967668d81863451ff1c1b496a5a4bf9b88b73a0c26f24c1aa2b063943bf6e5e64c6771511173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968689, "uuid": "175df06c-c9d4-401e-9793-46c9541a5d59", "value": "T159E43563CC2945C5EBC108B611258254AB345823F40EAD8777C1ABAD2CF5EC3FAFA657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968689, "uuid": "af5328f7-2bc8-4f42-aed4-ed66176b0778", "value": "7a685526043c1387cbb08c689ced4405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968689, "uuid": "f1b325aa-2721-4443-a21e-543cccb57b4e", "value": "6144:O+tiAX0iNwj2zISls5dxc3yavVDwCIe5c4Uf0MfzZqpQ0fMzjY2NltjcnHl+k3B2:rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968689, "uuid": "e575d96b-b6f5-4aaa-acdd-171ed86c8174", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968689, "uuid": "b0f2737d-2adf-46e1-bb25-334879981353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968689, "uuid": "0451778e-b05c-46ae-bb87-3e62b84e14aa", "value": "SecuriteInfo.com.Worm.Win32.WBNA.20740.11515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ada491-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968665, "uuid": "e174384e-a910-4c6b-8e23-b000439f840b", "comment": "Malware payload", "value": "6dcdee8e8a7b127245944f9cf17eda5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968665, "uuid": "0d0cdd21-e13a-4d82-b6c5-836e46e6ecac", "comment": "Malware payload", "value": "ecd8dda8fa1692a04c683191be518d6c5a21d08d1b09004c4fbfdaec9046b8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968665, "uuid": "a55d3ce3-8e9c-46cd-818e-d0a539d03130", "comment": "Malware payload", "value": "32adb4efe26f5bff475ad9a870a771a1ec320f12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968665, "uuid": "ae7530c4-003a-40fa-96ad-39b1580d3570", "comment": "Malware payload", "value": "cddfff7a63d12081209089d715e81c17f235d483607402c0e518443425a7a6428c8dd38cdb1260246594df1deb56f0de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968665, "uuid": "940b7db9-0230-4bd8-b7bf-cee4c0d14718", "value": "T1B575721BAC0D9482FE01053209357F679409AC49A8348D9776B5BE4CE936FCF7BBE252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968665, "uuid": "1d53d1b7-8ecc-4cea-af78-7c83d1a91540", "value": "c073b10d35fa6f60761b5fae41c86945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968665, "uuid": "a6589ee5-d2e8-4888-ab59-3e41cf859419", "value": "49152:Jv2cJqAzMrQD9rgnYU+I3SqsVc1dZtwy0lc8U+F/aBxyfyLcFBV57ts0MwBy78ri:zgDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968665, "uuid": "09e28f5a-0f34-408f-8d96-01fcfd24e485", "value": 1597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968665, "uuid": "a56cfe03-650a-4a6d-9147-0e42391e84c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968665, "uuid": "335dc29a-bd40-4dce-baf8-41d0cfa300d0", "value": "SecuriteInfo.com.Worm.Win32.WBNA.22781.26348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7bba66-55ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694991651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991651, "uuid": "553606e8-60d8-4266-bebc-00666c0df0ab", "comment": "Malware payload", "value": "a72a5a1a47641ba0174174850c40ae96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991651, "uuid": "d772f9bc-b921-4fe5-8e9f-80d0df6cb6fa", "comment": "Malware payload", "value": "ecf3313180ce02f661b4d3807efb4f2016bfcf7a2e1cef313a467e8473452375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991651, "uuid": "dda0fc3d-ee84-4752-911b-a75063d6c9b0", "comment": "Malware payload", "value": "0a161a2b399d518b53b63fbbd6c59dacb02335d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694991651, "uuid": "427e3a06-4a7d-48c5-a251-362590e70351", "comment": "Malware payload", "value": "f2194668cf7d4f706604abebbd47f531e17d66fd65be1b1e36f729d965e5ee360b09ae8287ae25047a18d33db4ce4737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991651, "uuid": "1cd51f52-f6ff-4cb6-9cf0-64be6c4685e1", "value": "T17A84AE1C39FA8872F9B61A364AF887B59A3D7470435209EF93F91F3D4F211C1A63161A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991651, "uuid": "78347416-6660-4777-92cf-1aba7a255f9d", "value": "b513b6ff92f9b5c15ac75813ce229ad0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991651, "uuid": "ad831569-0651-4b0d-9e9e-9bc7a2572563", "value": "6144:f2vJm09zORs+z/TMify9DAORgQ2jcGbX834EEqQGWmY6HwkIXUX5Nt28/:f+w09CK5NMdjLbyVWmDNY8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694991651, "uuid": "04212000-dd67-4226-a052-d69e08fb7237", "value": 380792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694991651, "uuid": "291f7d73-2c27-4d73-835c-2df56e8e85f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694991651, "uuid": "a0b16012-9975-4954-bcab-af2287bab6fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e939faf0-55aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694990304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990304, "uuid": "ce3cdc25-9bec-441b-8f2b-8059ca7c47f1", "comment": "Malware payload", "value": "03671f0276dd3b924c3f42c89815f8ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990304, "uuid": "c5e76ebd-793d-4ca4-8398-b4521f918693", "comment": "Malware payload", "value": "ee04c365fb435e57e46c72335d62e268e1fa22b195b888aa2e6eeb10821c6fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990304, "uuid": "1a7e7916-8beb-4489-a515-97a4b2fc81a3", "comment": "Malware payload", "value": "aa27f0571148dc4b82f1459335a9aa46638804d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694990304, "uuid": "9aa848bf-4a77-4c1a-83b7-17e460a85f1a", "comment": "Malware payload", "value": "ce5762815287b4ea9d030c026dc49af3ca501e01360ed93a27043e9cd6118897a14189a161fdbc77cb213d252cf267d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990304, "uuid": "e9370fcc-eb6f-438f-aac0-3ec8eb78a7af", "value": "T1F1E5234276D192B1D5B235336E265F35A93C7C104B2A4FEBA3146AACBF111806736BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990304, "uuid": "14f94554-ba9b-4d3d-8343-a265bae1206d", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990304, "uuid": "b3114d8c-60d8-4bd7-b0b2-7a43671606b8", "value": "49152:Hdgi76L7vJS58jesbBQappfR19DHgi7obei0FORWvjAQ7wcUIbNVI:Hf7Y7v45sTWMpfRPDH58F0gREAQU7IZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694990304, "uuid": "cd7c90bd-e391-4176-b961-6bdaaa2e97cd", "value": 3266059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694990304, "uuid": "f8b07b31-70ee-456d-a0f9-a7db4eb1e378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694990304, "uuid": "517067dd-2fe6-403f-b31c-e7c711384dcf", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3201.23454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127f038b-553b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694942269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942269, "uuid": "fd544a6a-c321-4db2-a8ba-b4f53fdefbad", "comment": "Malware payload (RedLineStealer)", "value": "a8f8eed22c74ea80d9e73a80dae2c260", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-easy111", "colour": "#4AEF80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942269, "uuid": "8996bd63-3588-43f2-b99b-b6914c7c7ce5", "comment": "Malware payload (RedLineStealer)", "value": "f02772a7bb7e2692c66b6335542fd6016a2e245fc74a489545d834127690e2bc", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-easy111", "colour": "#4AEF80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942269, "uuid": "78a4e209-3465-419c-b637-f22fddd9026e", "comment": "Malware payload (RedLineStealer)", "value": "8ce663b08a60108610d04ed554a64104de8e6c86", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-easy111", "colour": "#4AEF80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694942269, "uuid": "61a8a511-f47a-458d-a08f-e3ce8bf21c27", "comment": "Malware payload (RedLineStealer)", "value": "db10a441ebcf0dfd80aa5da9ec1300de2679808e4d367d88f7fd5f35637c2cac378aa34dd1aceefc7bc77e5a28ff2f0f", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-easy111", "colour": "#4AEF80", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694942269, "uuid": "14c38821-f395-4ea9-8a84-77bc5d7cb769", "value": "T16954233695989AD0A50663F7BA768411F82C4C075F44DACD0D2F3CCF7EA156A4E03AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694942269, "uuid": "94a1a48a-7770-4cc8-8192-e00ba7ea60d2", "value": "6144:gl/DTX4D0v+t3scMz6kwG4fq36SzBzfeGI3aUN/9nTM7SX36:ghDTXs+cdkwG4f7S1CGIN/y7Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694942269, "uuid": "446d95e7-52e4-465e-bf4d-54daa6c400d3", "value": 292558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694942269, "uuid": "d158f43e-d4d6-4623-9841-0f33466e69cf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694942269, "uuid": "0d8c7ea6-7797-4ade-a5f5-65020406f1e4", "value": "Hack Injector.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6becff-551c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694929349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694929349, "uuid": "4e395c69-5106-4231-a3c2-1ebd4845f588", "comment": "Malware payload (Smoke Loader)", "value": "a137245d8bc8109c4bc3df6e2b37d327", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694929349, "uuid": "fc037e14-faa2-4749-9b56-c4bce581df24", "comment": "Malware payload (Smoke Loader)", "value": "f342950ea78a3910911df852de530912090acea09b895e299d4ba0132ee146ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694929349, "uuid": "835c5515-60e9-44d9-9c3f-ae88ab8f7dee", "comment": "Malware payload (Smoke Loader)", "value": "ed8973e65b2aacb60683787831de37e7c805fa6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694929349, "uuid": "5029ef3c-e864-4f49-813d-0ed43e410f48", "comment": "Malware payload (Smoke Loader)", "value": "3259b33cf73cf2e9968bd2725b7a3f649033ebfd5b4ab4876c7d296a6f2cb8e3639a3998821b6795cf1ff426a29de8cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694929349, "uuid": "2a4f6d72-9674-4315-9494-89dd97114327", "value": "T1E414CF213DE0C073E6A755385974E7A06E7FBC122BB1860F3704067E5E716D28F6A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694929349, "uuid": "a0aacbd7-88d1-40e2-91e9-abb72916436b", "value": "b402c7220872217841e38133c9655d5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694929349, "uuid": "d2159d1a-1f72-4fd8-9c84-74cd17192507", "value": "3072:NmryVYLB2K+OZvhatgDcYYkTz1ICn55cD5WJA2Y:CLEKfZvlc4X13559X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694929349, "uuid": "ac42811b-198c-4242-b468-1c4a575cbb20", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694929349, "uuid": "31aae013-fcc3-4d63-a223-8f940f41e0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694929349, "uuid": "f6add3a8-4f60-4dbe-998b-cee5b364b5f3", "value": "a137245d8bc8109c4bc3df6e2b37d327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc0eae6-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1694968672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968672, "uuid": "37693cff-6247-4041-9fb8-6f8635b184e3", "comment": "Malware payload (Adware.QQpass)", "value": "615b2d6b3df0ede92432f7479b0518d5", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968672, "uuid": "d24e7da9-4e0b-491d-ab31-0c5f2994832a", "comment": "Malware payload (Adware.QQpass)", "value": "f4a1731a380f00127773af5341c55858bd908f69548185136aa4cb3076ad2add", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968672, "uuid": "70e98dd1-df7d-4d92-b25c-127d7b96c671", "comment": "Malware payload (Adware.QQpass)", "value": "ad9625c26caa45a90d1671383b7e8be3b7dfe09f", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968672, "uuid": "3f853702-d35d-45e6-abca-c73d002fe99e", "comment": "Malware payload (Adware.QQpass)", "value": "ac0e6a2cfdaadc4aef16ad9eb6082e210a33f1c8489d8f3ed8926a8f031ed46271c4fda1ba6153834a07aa4329eb3c2a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968672, "uuid": "815148e5-6aa6-4d06-a39c-fb16a5988ebd", "value": "T1DEF49E16B6C280F6D225153009ABEB79AA76E7061F15CFC3D394DE2C1DB61819D3B23E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968672, "uuid": "4e60c5b2-bd66-42a2-926f-5d4e0d875ed6", "value": "3c666a5030747cd1abc3d971de28f540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968672, "uuid": "fc842912-51c4-4e78-bd2e-16edc4595611", "value": "6144:KBbBjp56OYJH4dTOsL5jLtv1jUyL4HzaIytwYHrc1NipWrZVZx3oAosU0D+6bBiE:KBbN/9a4dy8d1jUykcQTi4rZVXoAPNuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968672, "uuid": "dc24ca31-2029-4c50-8049-ebc5acd9e6d1", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968672, "uuid": "53d9cfe0-f14e-4080-9763-944cae61581b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968672, "uuid": "5079a19c-3600-4211-902f-99244e86b378", "value": "SecuriteInfo.com.Win32.Evo-gen.10471.19957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2f477a-555f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694957747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957747, "uuid": "d1a9a0e8-63a4-4ff1-9356-a9003aba843b", "comment": "Malware payload (RedLineStealer)", "value": "ee629be336cb1394d8902ad966703722", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957747, "uuid": "70717e7e-501a-4918-ad61-8b45aefe791d", "comment": "Malware payload (RedLineStealer)", "value": "f6ca072660301d01562b087fcdf04b8697a15ea706264d079726f09067c253a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957747, "uuid": "0a33bb0a-14f6-43c2-87dc-b33d36c7154f", "comment": "Malware payload (RedLineStealer)", "value": "aeaba97bdc99e4eea45df6d87c0671a621215ef6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694957747, "uuid": "fb0c0514-d61b-4feb-b8a6-4fab3ba575b5", "comment": "Malware payload (RedLineStealer)", "value": "908791cb9c0dabc525881c8e6f97b25a05aa3070ac9df5429e7f470e80b6aeb7c195bcefb861057c978c1cb41a55a5c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957747, "uuid": "8bfdf568-533d-4884-8791-d723e7520608", "value": "T111A45AD53EE63B51F972253357A0C1E1B226647E3AA380DE076FF310612854E7B35CAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957747, "uuid": "ed0fb696-d3b9-4e1b-bdfd-a76bfab7132e", "value": "a051afa6afb2fed9c604c2121e6529dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957747, "uuid": "927c9ed7-7578-4092-9fa6-0b4dd2930438", "value": "12288:SpHKaeR8yuI9K/bsrbzcCXy15hC3wnFvt/HjDcBtldlqPEXE2:FaeR8yuI9K/ArbzcCXy15hC3wnFvt/HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694957747, "uuid": "a7ff6c05-930f-44d0-9705-dc8a2870a76f", "value": 468296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694957747, "uuid": "db9f3153-843e-4d85-ab2f-44f79fec4703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694957747, "uuid": "5486f7a8-97db-4286-aaea-d658154a19b7", "value": "ee629be336cb1394d8902ad966703722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807fa268-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968653, "uuid": "9b507ce9-038d-4f7f-9658-62cdd706cc26", "comment": "Malware payload", "value": "4546c3ec86280bb09a93feb4963db8b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968653, "uuid": "8eef1eb7-fdda-498b-980a-ce01f250f6a8", "comment": "Malware payload", "value": "f81263446f7fd4ad2b3ec0184b48cb090163466857d1ccc62616b83ff4c1151d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968653, "uuid": "36be3ee3-0b75-4025-93d2-51df90c26926", "comment": "Malware payload", "value": "8a515fb913c4ea6293b600cd91d90e247caf9eb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968653, "uuid": "c3286891-0aae-409f-87df-0e199e3ed2dc", "comment": "Malware payload", "value": "cb43065ae4a191385fb8e2586077e988d4dc3792485ebf8a52b3e2a89b308488073e4455b249c6f5ee545b0e775b3f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968653, "uuid": "aec7fb70-dbe0-431f-956a-0f170a849116", "value": "T1B9C47D2AF6D0417BD1A32A3C8C2BB3A48C7ABE017D24AC8A7FE41D4D5F317997415297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968653, "uuid": "825be3bb-5669-444c-98c3-845b185ae060", "value": "252daf5ed835645a48557990fa7fa663", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968653, "uuid": "69ab7cf5-7251-4553-aaca-29e9bd7e8dc3", "value": "12288:vP7xef5dau9rUPDwrKrtojzpVQKPi42K:ndYdau9rClxGpVl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968653, "uuid": "007e631c-6829-4564-a44a-7e73c86ebc8a", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968653, "uuid": "631d3b39-5e82-4d85-bb05-ad636019fcbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968653, "uuid": "63780129-50d5-440f-927c-d3903d5c7725", "value": "SecuriteInfo.com.Trojan.PWS.Banker.27812.26061.23450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91252d45-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968681, "uuid": "a14949c6-3e65-4508-a379-ac7b688f7f58", "comment": "Malware payload", "value": "80c96d504589ae0af670815f2e0745a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968681, "uuid": "57d03203-d2f5-4ba0-8583-06e8524b4378", "comment": "Malware payload", "value": "f8d24013d745f18ef1b53ee2fd280d200cd22366b46dca56121b0a9ea2015005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968681, "uuid": "9ab8a962-580d-4390-b2a0-198c3efee322", "comment": "Malware payload", "value": "c3d0d45c1182cc0f73709c5a9ef0bcd2b09a7182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968681, "uuid": "6708e440-a23d-45e7-8c7b-8a6a4ce0ea70", "comment": "Malware payload", "value": "93a69feccecaf95aa42d83fc9f210c39948d9bd6ec42acbd9b0e26cc217a022b4a48afb8524b982be1d5d911e366b3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968681, "uuid": "86308187-24b0-459c-b417-f5e2b648ef00", "value": "T1F3758E71B19280B1FA1927700C9A63319A38BE664F355E8BA3A4FF6B3F73151FD25109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968681, "uuid": "605cff4e-7f58-46e4-ba06-ccd45b1a207b", "value": "24576:63iGJZeSMZwqMFjP45YlftIKAaLmtrj8x7rj8xU:6y+ZFljAeXIKDmtr47r4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968681, "uuid": "bdae7bdf-4620-492c-93b1-79b04e4b84ff", "value": 1553408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968681, "uuid": "5d2f6f57-6c43-4aa8-ac7e-3fb6f3098e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968681, "uuid": "0666d0cb-ca38-4b6a-9b02-645a505f79d2", "value": "SecuriteInfo.com.Win32.Application.PSE.1THOGOA.30952.30003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3995955a-5531-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694938040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938040, "uuid": "0fd13cc8-51d1-478e-97f2-d97476fb1708", "comment": "Malware payload (Smoke Loader)", "value": "48561a8a9227062684e34dce3d5003ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938040, "uuid": "1abe391e-d9e0-4022-ba0e-cc74448df107", "comment": "Malware payload (Smoke Loader)", "value": "f913ccf328361219c48c881da151670a2999401ecdf36d2e18f97d441ba381b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938040, "uuid": "9b830bc3-d4b7-4e8d-9de9-3c21670fbc67", "comment": "Malware payload (Smoke Loader)", "value": "dd591141771298c0483cbb4eb36e4ed8232644e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694938040, "uuid": "1ffc4f20-2892-452c-b9ca-4a9fe05571d2", "comment": "Malware payload (Smoke Loader)", "value": "77aa8908dd9d8e89cd9790d6d263ae9488d17215023de9094071cce9bd6ed04a8865c07ef3e3afadf3d33b66dd0d1145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938040, "uuid": "d4512f67-bc6c-4605-8ef9-e1f41ba42a88", "value": "T1C244AF13E3B0AC31E52647319EAEC6F8752FBC214E7AA65B23087B2F04B11B1D567719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938040, "uuid": "37ca57a2-a139-478e-8153-245698ea6daa", "value": "983ad0b1eddf77f1ba43ff2b67eba232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938040, "uuid": "3917475a-fb02-49ad-8d27-facb4cb2ef9e", "value": "3072:tSSndD9swXtJ4YSVGV4cFhX5UqbXfzX0:zdDtXfzSLcFNhbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694938040, "uuid": "ec7154a8-4b34-4563-a0bb-ced6fd6eeb13", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694938040, "uuid": "48cac77d-5e38-4f7d-98d2-aea31e12a45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694938040, "uuid": "74ca87fc-d50b-4308-9936-4c8846730e4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff1762c-5570-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694965431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965431, "uuid": "64a8c8e3-ebfa-4c87-b06d-03466e701807", "comment": "Malware payload (CoinMiner)", "value": "5be25885e054363699942cfeb30ea384", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965431, "uuid": "acfd76bb-75d4-4e8f-b99f-8fc812cfd97d", "comment": "Malware payload (CoinMiner)", "value": "fa3b3edfaccf278a6f0ea3b398810edbfc880133436340f4306cf059043bb7d1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965431, "uuid": "b510aa4c-86e8-45e3-88df-687018401fe1", "comment": "Malware payload (CoinMiner)", "value": "1a53f584df5220850f2ef6edb7d9fc4ce1b02e6f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694965431, "uuid": "84ae57b3-d29c-4093-8c87-13d0e7f04e3f", "comment": "Malware payload (CoinMiner)", "value": "cbcb9571b521e2f30c3f164e2ee10c5d4c2dbbf91fe3a84ce0e04862e5310a82a271270011b2c0c06d0a51446858ab29", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965431, "uuid": "8800925e-d1c0-4b86-97a9-caa5506dd590", "value": "T1EE44B012E3B1EC30EA2246328D7EC6F4752FFC225E76B6572308772F0871292D666759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965431, "uuid": "18e4613f-6eba-4b61-b213-30ac9659e8da", "value": "0247adcd329847ea0db225ff728b6ec9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965431, "uuid": "e41c7ac7-09f9-4e41-9e92-bdfa56fb1271", "value": "3072:8eOmM1sUMHZZWMQsWV4fghLzmcVSYZ5BDIeiDhkoPAcogN:VMmUMDQdV48uuSYZ5aVmMAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694965431, "uuid": "21c549c7-82d2-4d84-b56a-6a2e04095aca", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694965431, "uuid": "991a0efe-c972-4f32-a724-cfea53c8ff07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694965431, "uuid": "ec6ea272-2504-44d8-b788-db29f7022549", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d17d643-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968620, "uuid": "fd5646fa-8208-42b7-9d47-6ac70b6a6c8e", "comment": "Malware payload", "value": "f54607cb4c49279cfb8e638f9c2ba1f3", "object_relation": "md5", "Tag": [ { "name": "wirdo", "colour": "#1F13AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968620, "uuid": "be810a41-d010-467f-949a-ff0bd9891dbd", "comment": "Malware payload", "value": "fb2fb4993a2561b74a2151ada48ee5502379d4735878b83c5d5fedab2431bd10", "object_relation": "sha256", "Tag": [ { "name": "wirdo", "colour": "#1F13AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968620, "uuid": "48e5c90a-4dde-447e-809d-0ca5efeed245", "comment": "Malware payload", "value": "a429a99edf3b2e9ca050bf2762c54f16930b24e5", "object_relation": "sha1", "Tag": [ { "name": "wirdo", "colour": "#1F13AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968620, "uuid": "b4722123-3a48-4fc5-92cb-2da1c4e41e22", "comment": "Malware payload", "value": "efaa1a1d60b10e21df9de144cc1fc718e6bd9f176ae8808c12ebc6615e8e170acbe40e568006a65b604a1740e38ee6c9", "object_relation": "sha3-384", "Tag": [ { "name": "wirdo", "colour": "#1F13AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968620, "uuid": "c46bad64-c072-4bbc-afda-726246bd8ef7", "value": "T185358E967B8D4DB3386F09075F843709C9CCB99B01FDA9A85A6076AF3984C42F4E351E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968620, "uuid": "c7a68a37-6896-49b9-b9b0-91ad3f47423f", "value": "12288:1X8iw0RaOftmC9LiSFHsYNeuD2hVgXkqpCAbUsL6rIXCqJSC/kBqm9Hm7B74VDR7:V2OVNFpMYNX2Efd+eFmgB7qeXgsO8ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968620, "uuid": "ca431684-ca94-4c0e-916e-70bf5626ff69", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968620, "uuid": "c31584f1-a655-4e03-b3c5-b514aaedbef9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968620, "uuid": "3072849b-20c2-4d6f-8788-3a86a0d71803", "value": "Kakadu_update2023.xzy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87005c5f-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968664, "uuid": "f256ea98-f55c-41d8-9ee0-d3b55cf67d88", "comment": "Malware payload", "value": "807acef291b9b8daa9b56deae2b58fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968664, "uuid": "921ef707-84fc-4c6e-9a8f-ccaf747bc7bf", "comment": "Malware payload", "value": "fcabe90cf98e4565549e60bca4cd11e2063b8b30a941446b89339d353a10abd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968664, "uuid": "41da56e4-9bb6-4fb5-9f19-054d8b525089", "comment": "Malware payload", "value": "59a273c4445c44ced8e8ac5264eb4ca7bb92fc41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968664, "uuid": "780ec073-947c-464d-a660-5c84c76cd2f5", "comment": "Malware payload", "value": "d851bf98b97dd131db87a96dc0b463c4d9ee530f90886187cf790a0931bd41524792926fe7e76b5f9834dc809daa28a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968664, "uuid": "1a8386b7-d831-4298-9e07-7c664963f348", "value": "T1C8742927DE2C5A82EAC015B0087916A51A132C166418AF47B2D47DCC69F5FE3FFFA217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968664, "uuid": "b19e0fed-c8b8-4361-a760-2755a87c6946", "value": "c5024f140124825d34a1b69b8f451264", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968664, "uuid": "560a9969-ad8e-47dd-8ca9-09da4b980c03", "value": "3072:SBp8A7Lt2IwXUQu+M7IZcvb1yfQG8EF7Zifg5cet0e1wlH+WOARpDf9uzWLIWRbV:8t7PRb4F/ycfyvQUGMGWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968664, "uuid": "2f3a0685-5e35-4349-a800-62a236d406e2", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968664, "uuid": "f5301ec4-9d3a-4de0-97be-2a6a22c3df9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968664, "uuid": "6df39463-9acf-4957-bad6-e6b37febe903", "value": "SecuriteInfo.com.Worm.Win32.WBNA.9257.25159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe29eed-5578-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694968679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968679, "uuid": "1f8b60c8-e04f-491d-b1b2-d811bc6a8b7e", "comment": "Malware payload", "value": "b45a5f3afa11d07ec2c674cd615375b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968679, "uuid": "dc04ffce-6f92-4fbc-8893-49e578f97221", "comment": "Malware payload", "value": "fcc3080ae1134cec4ea5149d6eaf9b0721b6136513a3bca3a87b227b25a9bade", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968679, "uuid": "d2c49aab-3266-4b6b-bde3-d4239bb88d83", "comment": "Malware payload", "value": "f454cbf878dd602cf2c9646c3e6cb251e00fb6d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694968679, "uuid": "94542e45-ecb2-431d-bf28-15876555a200", "comment": "Malware payload", "value": "d9380661141675b1ccf3a6de2e8a3dc01c41bafc6fbe52ef35a1f9890752d93e35cd02e2317ba59c2c284b38057aa61f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968679, "uuid": "2a74d563-1b51-4d75-a1bb-f83055258ded", "value": "T19FB4393576E2C473C0EA033448E28764EB72BDA08ED287077E5C765F2FB9690DE12A55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968679, "uuid": "926e8080-a836-441a-b7a4-5a8aa52ab411", "value": "87ea5aaefe0409eee3f315c546b085e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968679, "uuid": "602691ca-e38e-4b17-8dde-a76e47c63b96", "value": "6144:xxYCd6trhCfCCx77cjKGOrSyu2QlhHnnFsMMkMMbf3a7BvoTnK:xRd6trUx9rSyu2QlBFsbOK2nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694968679, "uuid": "b7dfdc9b-e727-409a-b0d8-2a904f907d20", "value": 526585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694968679, "uuid": "2b472ecf-2bb4-44d8-91f5-0f5522a07af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694968679, "uuid": "87b894e7-5aea-48ae-a2e3-7cc8aa5c34ae", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.13136.15110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cb9afd-5566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694960934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960934, "uuid": "be0090f0-d24f-40c3-b38a-95f8c3ef38c4", "comment": "Malware payload (Mirai)", "value": "88c480e111c8ef752215627bfaa978ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960934, "uuid": "5a17d695-b250-4ba7-912b-26467391faf2", "comment": "Malware payload (Mirai)", "value": "fede5bd8eb1aeb65b30da52bc5721e66d4a33437eb4f6c82be81d0392b028cd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960934, "uuid": "3a863b30-07ea-426c-aad3-401e46fc841a", "comment": "Malware payload (Mirai)", "value": "b1e70945b1540bd57116b9ad107e48e35ca24079", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694960934, "uuid": "c0d66dd9-c2eb-4099-8012-8f76a9665628", "comment": "Malware payload (Mirai)", "value": "0264c7dd0bb86928a9d37ae558905c9e7413e64e4509580ed5ec20eef4434e5bef99b746bb0b70c9cfd078f1e7e5d527", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960934, "uuid": "a980bef2-c6ee-4b29-af39-c2160d01f26a", "value": "T1FDD35C56EB818A13C4D5177ABAAF41493332E754D3DB330699186FB43F867AF0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960934, "uuid": "011f4232-a16b-4d2d-8ab0-45380d1b272b", "value": "3072:wN9IgjSha3tJLsmHLLrXQ6qYTpYxom1X7H+bMxVwaLYj:y9IgGha3t9smXQ6qYTSouH+bMxVwsYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694960934, "uuid": "d0f18e5c-21c3-4de8-8e96-609b26bf1e9e", "value": 136315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694960934, "uuid": "e54e7289-bff1-44a4-aeaa-7b74a70c342b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694960934, "uuid": "e8d311a0-2c09-4f1d-af90-ba6b1eaf6d73", "value": "88c480e111c8ef752215627bfaa978ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }