{ "Event": { "published": true, "date": "2021-12-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-16", "timestamp": 1639699381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a76c0d4f-cc2b-4e8f-80c7-9de90e5ec5d3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c94dd1d-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641683, "uuid": "201b36ce-3c4a-49b4-b477-ccb870a307f8", "comment": "Malware payload (Formbook)", "value": "5b2030abc91c6a2b191832d6a1745fbe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641683, "uuid": "d06d16a1-7438-4d24-82de-9a9bb41282ce", "comment": "Malware payload (Formbook)", "value": "01fda3068f24c2d6beb21811c22e1ba5b433508da0b46295d14343484ee7f652", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641683, "uuid": "8168dd67-5d45-4434-a935-fd000d70b674", "comment": "Malware payload (Formbook)", "value": "55d93044ec67483c9e99a9f66abf64de7b48d45c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641683, "uuid": "e1b6663b-99b8-43a6-9272-c37b5f08beeb", "comment": "Malware payload (Formbook)", "value": "80d5583307bd64e22b5de75c0662650e68bbc8124d123826c3798b6ad517f6e6fc0b33c4945c6013274c60209de5610c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641683, "uuid": "52eaeecf-6489-456c-ac47-1865810c0d4c", "value": "T14672C76DD0A706988F8567BC6B2B5F85159D7A2EF789A533323C973827D2D7A400383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641683, "uuid": "98d11367-24ba-4f2b-ae01-4b388374854e", "value": "384:lsGTCyVtK6rliUGLYu4i+RivulGrMf+K3p6KQY/JT:nDDZ4+RivK982JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641683, "uuid": "0b1e7578-a3df-4f93-b309-19b7c3287a6d", "value": 16908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641683, "uuid": "d299783b-5459-4073-b4df-e253e1ab1bd9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641683, "uuid": "5b53c619-2a70-4513-8626-7a3b41dead79", "value": "2025893654.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbea567-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639644983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644983, "uuid": "d6bc706b-e421-4692-8137-29275d3c7757", "comment": "Malware payload (RedLineStealer)", "value": "9753fcfc4f6d3c1c7c4928e0285ac883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644983, "uuid": "a4381b33-daf9-4b97-9282-3941286e3ad4", "comment": "Malware payload (RedLineStealer)", "value": "029ab5454401a5c37fca1c8dcd240b6727cf0ccb8c5aa1d121196e2a76db5f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644983, "uuid": "dc4b1dd3-b0bc-44c0-9000-c2771e605c60", "comment": "Malware payload (RedLineStealer)", "value": "ae3cabef7e0474fdf55f9f23336ee0a2de5d20ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644983, "uuid": "144dec80-6a85-4482-b3b1-d08ade412ea8", "comment": "Malware payload (RedLineStealer)", "value": "e2d0cdabd9cd2250b2c676a14d9629830cf00fea5cfa58b78641cdf2466dc2f5ff8ee2af3e706566aed70d05e9f21baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644983, "uuid": "c08def14-0977-4218-a776-de90c48322c4", "value": "T19BB423533253A49BDA921FBFFD8616B4AA017CBC02B1829B73D33D07656A182FC74752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644983, "uuid": "f4b62cb7-26d7-4718-a753-bd1cfb54a924", "value": "8f0c185cb9b8613a020b2b4e396b234a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644983, "uuid": "a0861944-6029-4f70-a4d6-8c8087761474", "value": "12288:x8Hw84Yzm6K7NWO2g2uZo+7EDBc1q71UO1+Y0wglI1y6NG:iQ8VVyNX2g2uuMEDBSOB0nlI1xNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644983, "uuid": "beea1460-4019-4019-be50-668a92e40db3", "value": 541936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644983, "uuid": "d40ac5ef-4a37-4e45-97d6-6d291b114ee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644983, "uuid": "81729b91-0b9c-40ad-a897-67d7685dc816", "value": "9753fcfc4f6d3c1c7c4928e0285ac883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79622e9a-5e90-11ec-96a4-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1639673514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673514, "uuid": "96901ebf-363d-4409-9916-949abb11cf7d", "comment": "Malware payload (Conti)", "value": "f61817daf163c6617b22418bc887b9d3", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673514, "uuid": "e598fcc7-6b4a-481e-86c0-bbc0f15d374f", "comment": "Malware payload (Conti)", "value": "03597628e999d791f4cc442328024235db9a929467a62ef0a00c91a76161f0e1", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673514, "uuid": "0ed63275-26b9-4bb8-b82d-24764d82bf62", "comment": "Malware payload (Conti)", "value": "e78d49cd87c37659890603bee2acca888ab381fd", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673514, "uuid": "eed1e5b7-19bf-4c83-86d7-61ba64ca39d6", "comment": "Malware payload (Conti)", "value": "4fa452555c4720af649f1787c44ea5be6c42af03e41bbe998f8508057cefb8bdf4d0bc9cc2e550712de17d35d97f1a48", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673514, "uuid": "cc7cb944-48fa-4f52-a7ec-aec5598d751d", "value": "T185145B01F64D827DD6AE4D31267A7EB280B99D383B5FCCF7B3DA882816606D06524F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673514, "uuid": "9f4e4f13-ee37-4fdf-ac28-8629842de28f", "value": "77679e1e454376d19c1c76600c17ea98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673514, "uuid": "80cb70bf-12c3-4347-a824-7188b9262935", "value": "3072:HJkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34o7dVxt:HFcuVqTATicDNYVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639673514, "uuid": "40c536bf-ba7c-4c60-8c08-e88511bc69b2", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639673514, "uuid": "0991e7a5-fe4c-4305-9b37-9f33c3e86624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673514, "uuid": "1ab590b8-a010-45cd-9fc3-c54ee7d665aa", "value": "03597628e999d791f4cc442328024235db9a929467a62ef0a00c91a76161f0e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01be931-5e1f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639625180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625180, "uuid": "4f4ba078-301a-447d-8182-879b33327b19", "comment": "Malware payload", "value": "30f3c087d076ce0ab844fc0bac301bbb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625180, "uuid": "8a08a9fa-fc27-43f3-8293-408068fdd684", "comment": "Malware payload", "value": "0386e58a26d58077f53f7fb496e9be0963ff5e9dc687e01b05d6276f3cad2ad9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625180, "uuid": "5a11c6c7-0306-4f98-9476-719a3d061dce", "comment": "Malware payload", "value": "c7a04c4cb7e60f15d8c05c711af86182dc0bc35f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625180, "uuid": "a02c6cd1-24e6-45c6-b920-e2b20fa23e09", "comment": "Malware payload", "value": "6e4ffddd30c26e2214ac7c0bf847977f29478eb1ab34d1ed081d893aaa547d59948113b2bd9216b964e53b168d6d58f8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639625180, "uuid": "41847518-a578-42eb-99d8-5de812d9eb66", "value": "T14F11B5629E7891D8CCA3883057F86D0685C09A8384F7F03F457B79C071E29D851462A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639625180, "uuid": "042b39c4-615c-461e-b58f-e8b8026dccc1", "value": "24:96IjDI6b9+jrAbqYf07zd5MTuwGAcBwa0q8fgupa4So1G78n9j/Oe:96kI/Yf07zTwGBPfPusy1G789bOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639625180, "uuid": "2c032ea9-9458-4bd0-9091-4fc6b45b0daf", "value": 1050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639625180, "uuid": "705af939-bf50-4a08-a418-4c2c65435693", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639625180, "uuid": "dfebc0af-a9a1-49f3-bb4f-dc3df97b6e4e", "value": "Edge.fd8a4c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3a8258-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639683694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683694, "uuid": "9acb9658-965b-433c-ac71-d71c585726ac", "comment": "Malware payload (Mirai)", "value": "f0f6b1fe156a88e4811f272ee688e127", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683694, "uuid": "7a3011a3-596b-482f-ad09-fe1ee818a6e3", "comment": "Malware payload (Mirai)", "value": "048d232b868d6b80c412d211bb97b50a55f565fa10fe1cdacdf0c04e65e8fc79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683694, "uuid": "cc947de0-1cae-4ee4-ae97-41de571a8813", "comment": "Malware payload (Mirai)", "value": "4f26a38ba7d614fc20f7b3456e163b6be95e6b78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683694, "uuid": "461cbb82-d595-429a-bdce-c7bb237bdea5", "comment": "Malware payload (Mirai)", "value": "95c53095d19273347b9c18dfcc2fa151bad60f03f8245830e2203386d20721e1d25f98d5b11fd581aea75e9cde2bb773", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683694, "uuid": "b0c26e24-e050-46f2-b29a-1fbf8548deb2", "value": "T1EF237B75D02AADA8C1850134A8688F750F63E2C8D3675DFB2BD582B19447EA8FD09FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683694, "uuid": "d20dcbe5-4a56-4505-8c0e-368fab379360", "value": "768:qtALrtYVl3xgsvtb9SYL2aFjDBgmxfnr1Fj6COoGAACeCE8wQL:qt6J+XN3FjDRr1Fj6uG2eCEdQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683694, "uuid": "2501e1f3-a4df-4b83-88bc-33ebaaed2db3", "value": 47184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683694, "uuid": "3c010f95-ce49-4428-b95c-7ab3064182ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683694, "uuid": "775c9a87-e8ec-40d9-9e54-adccca81a7c7", "value": "f0f6b1fe156a88e4811f272ee688e127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c897a9c8-5e9d-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639679230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679230, "uuid": "691998d5-28b2-44e1-b926-bcb0cb343b69", "comment": "Malware payload (DCRat)", "value": "237344a3d7fda56595a7166b14473117", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679230, "uuid": "8426c281-4138-4a1c-b5b9-d0b4bcf4bd6b", "comment": "Malware payload (DCRat)", "value": "04b30ddd7a655f7319b71da4f5ffacd3f546d7fd8e31e08c29aa1e2249108151", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679230, "uuid": "85d6d154-ea9a-4485-b238-e9e55beb02f6", "comment": "Malware payload (DCRat)", "value": "a569bb386d436aab566c1908294a8178eea82a25", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679230, "uuid": "40f4fce8-abfe-44bb-97d6-6d9ca00caafa", "comment": "Malware payload (DCRat)", "value": "5aba8f1d22d998fa2991eb1b0e75901110b7b43705f93e9a7d34b5d0730bc610bc175842d2b88a06b91a689b00d15ca4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679230, "uuid": "adaeb873-5241-4c65-b914-23c70787b442", "value": "T112E418242AED5519F17FAF7895F079A69B7EB57337139A0E04A103CA0A13B41DDC0A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679230, "uuid": "1cfd01a3-1f50-4d28-a2b9-a4462a39e7bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679230, "uuid": "a672a16a-ebf6-4211-beb4-ec52271ecf49", "value": "12288:OqnOno6g+R7ajAsqCzNFztt84LW9BbyO59GMoPgxFeL5Cjzt:O+OnV7YAsJzNFzDiyEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639679230, "uuid": "58f2edd9-18e5-49d8-9c11-e4516db1d561", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639679230, "uuid": "8684af28-40be-4259-898c-963fade9cecf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679230, "uuid": "0dff5082-eab6-42e9-96ca-dbcceacf0209", "value": "04B30DDD7A655F7319B71DA4F5FFACD3F546D7FD8E31E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fbd669-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650254, "uuid": "3814af9e-0938-4dd5-8973-bfac4771a62a", "comment": "Malware payload (Gafgyt)", "value": "b11af6e467a2a88f233a5d177445a285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650254, "uuid": "90076c71-cbfe-4560-a24e-423e74f84f31", "comment": "Malware payload (Gafgyt)", "value": "0534096281702745a8238cde5b8e5a6a6eac22c41112b78c5f24c7a0c445221d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650254, "uuid": "d09f384c-ecae-4b56-a347-edcd899dbb9e", "comment": "Malware payload (Gafgyt)", "value": "6b12c048a1b409dda74ba8b80f1a2a66c601bf6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650254, "uuid": "3d7b75bc-cb3c-4e68-9034-95e280e768de", "comment": "Malware payload (Gafgyt)", "value": "e9dc5ddb3b81c4e06ae8b2de7c51f9eac850104d036c742bada33c5c183b2c3521fff2400eb5e0ee8a2dd3c93e43817d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650254, "uuid": "1a518aa9-7269-4698-a189-c51960b3788a", "value": "T145C3082B7B270F23C0CA507112E31732AAB5D79934F953D3A9D07DAC6F1AA843456BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650254, "uuid": "157580d2-f05b-48df-8c29-8e0ac1cf010c", "value": "3072:U2IN8Q9d7BphaqDKedYCcmmrFoqzoJf1iM:U3+QjBphaCncmmrFo0oJf1iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650254, "uuid": "31b9e5f7-cc22-401b-9659-e11c4d4f19ca", "value": 122569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650254, "uuid": "e8789aeb-f9ad-4b93-ab7a-dd0831c9dae0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650254, "uuid": "b92f4a8d-ff96-46dd-b988-d644b1185bb6", "value": "b11af6e467a2a88f233a5d177445a285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86f445a-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641810, "uuid": "abda0861-7de4-4e40-9d36-6ba543f52340", "comment": "Malware payload (Formbook)", "value": "64a7ebd803d51adfbdf6ac59f80c480d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641810, "uuid": "c63cc1cc-1a3c-4af4-8cd3-7ac546add3fa", "comment": "Malware payload (Formbook)", "value": "065082cb9c1f153dd36a418b551c33187148b5f56e28dc14f9208e81c40739c4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641810, "uuid": "742257fd-719a-4921-807d-491307a4e99a", "comment": "Malware payload (Formbook)", "value": "5cc23d9eb83bcfc85478869c2582a49704e31025", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641810, "uuid": "3f4b59bb-095e-4ca9-8ad6-38ee74d98b9d", "comment": "Malware payload (Formbook)", "value": "7bd945f29133645364c36358d40a828f1d578a78d9936c321efdbbcb31c4da3f539cdd85429831afc256ccf753ac0108", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641810, "uuid": "020c9d06-fc5e-4ac1-8a79-40b56d24add3", "value": "T109641376B94E6266CE6E9134A779FB271205CC79693C44BD3242FFCD09B4202F984B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641810, "uuid": "ffe0fe13-29d2-40a9-af09-7d18cc4f0fbf", "value": "6144:iwwC9vDBXxRB7ZyPMh2RFd+2ORDoFxsi2y2HF6D81abvi:iPC9rRx/dykkRuxo0Hy282azi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641810, "uuid": "040574ca-dc49-41e6-ae91-4081d7be83e0", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641810, "uuid": "d59534e3-8d0b-4bef-8e7d-8d85bf5a7a66", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641810, "uuid": "2413d506-c648-4a13-a554-40c17c178ae0", "value": "Payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b06398-5e3b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639637006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637006, "uuid": "1a955ad5-afe2-4fb8-9872-e65e46ca0f31", "comment": "Malware payload (SnakeKeylogger)", "value": "b313ebb237972f87cef81dce36005a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637006, "uuid": "d6b99317-e226-4909-b2ae-f5f5d7444ca7", "comment": "Malware payload (SnakeKeylogger)", "value": "069a5bceddda349a9098d3a754993c6ac51b44f1a24e096673738af09fa97f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637006, "uuid": "0b6104bb-7d9d-46f8-91e6-e5453ec5fc28", "comment": "Malware payload (SnakeKeylogger)", "value": "1eb96df93bef95c10361307425463a1294fb841d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637006, "uuid": "b998149b-373c-4730-96b6-f0a33294669f", "comment": "Malware payload (SnakeKeylogger)", "value": "c1a0eee25fe89b9f53bb52c0ce62881673a7a793e3970188323276701e664457e2f558bb7e11a0d7d4a5f5d5dfb810ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637006, "uuid": "23eca275-9fa3-4711-b241-d0002de14d10", "value": "T1466412A52FE8DB3EC8CE07BF543156404776F23BB2AAD74C8E0865E91E923504F42697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637006, "uuid": "5a4eae05-6600-423c-9d7a-9f7088801b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637006, "uuid": "9c5a582f-1ebd-499c-8a22-4c1d16dfaa01", "value": "6144:t6avSmtXFAd/bfRTXe8kGRunkVUY0/SVJnj/s0sRJh8x2OKubGKEyX:cK9FQlAq0Kn7s0aoQLuSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639637006, "uuid": "ebe9b0a8-a58f-4ff8-af7e-364d4cba0bb2", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639637006, "uuid": "2cc6d891-8ec1-4594-98e9-156268fb9998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637006, "uuid": "bf6d7809-9ebe-4384-905b-cbf0af33456b", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b39e5f-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639641943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641943, "uuid": "ecfd81a4-cac1-40c9-ad52-6f362969fba8", "comment": "Malware payload (RedLineStealer)", "value": "8e7121d402a76184bea44ed11048ed20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641943, "uuid": "312c20e3-8798-4caa-bea9-9d4f89b50840", "comment": "Malware payload (RedLineStealer)", "value": "0878bba4d4b252a80ddaafb13c8eea9a066023d0933d272c6e3cbfc773f3e785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641943, "uuid": "8f3e9f8b-1fde-4b19-b6cb-4eb4924ee521", "comment": "Malware payload (RedLineStealer)", "value": "e456a2fd6e3d53185833c7317b89e0e16978b257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641943, "uuid": "96f55cdf-7279-400e-af7e-f6c1a858c69b", "comment": "Malware payload (RedLineStealer)", "value": "006e15d17bf99e6b9c48bce4dfd46ce7868cfb3033ca5883e8edfa3ba395f30877a2a16cc21b82d20f196728254c154b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641943, "uuid": "6f84f986-89f6-4fce-b2ba-0de732f8d264", "value": "T1D0A4BF00E6A1C035F2B352F859B693A9A93F3DA25B3460CF13D51AEA4B346E0ED31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641943, "uuid": "c24d9ebe-3fc0-4c0e-b0b9-7483e44f9705", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641943, "uuid": "353654e0-642c-4531-9466-6320f1e44818", "value": "6144:kWZxBUpJozULTyS0ul2+FKd6VMt4ibESIpi1IAtL9CKIGphYpq9gjLNC9U:9CJsE1SyKkt2ETpmIAtL9CvGpapq9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641943, "uuid": "94c79645-e473-4e2f-9d2c-b185acc6e3b1", "value": 455722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641943, "uuid": "1a6dee9e-af0f-45e7-b915-f7acb5d722fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641943, "uuid": "17600625-c7ed-44d4-82f1-7d5c8a894684", "value": "8e7121d402a76184bea44ed11048ed20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7d677b-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639642787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642787, "uuid": "57551654-aeb4-465a-ab25-afdefbee6322", "comment": "Malware payload (AgentTesla)", "value": "81bcac0789bb4c54bf0a28ba92a9c23b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642787, "uuid": "696a43a0-c4e9-4cc2-9bf8-2f5fd810a778", "comment": "Malware payload (AgentTesla)", "value": "0a756ae180555f71ca41152082bd43b3362b9bb4e14d3144d1c6694dc19cd087", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642787, "uuid": "33185dd1-992d-47ca-ab04-bdb7814fd037", "comment": "Malware payload (AgentTesla)", "value": "51f0eea06b2482adb5ae9c0e0490cc524a65f932", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642787, "uuid": "80982dbc-7136-4f45-b159-9d6e2eda1977", "comment": "Malware payload (AgentTesla)", "value": "c922f7bc068e3f725bddc077a102f4ff5ef8f3f50fa313cfd8fa98da66f762d687dc3576a657fc902abb94dc0c169cef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642787, "uuid": "b4ca591b-173c-4f15-951a-5cccfc19d8d3", "value": "T12D41840E7997E030D87108E7B96B883E6B75125AA079C488760C8EF45F3841CA6C1AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642787, "uuid": "ac5c80e8-7818-4a55-9d77-00a54ddd8088", "value": "48:XYmjDMiNaIOH13Jk5yd7Y0JWvWkXtbNjxEUnL0GW3A+pzOO0fK:omvMisIOH15koRJyWk9bNNEUy3AyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642787, "uuid": "31f6acd5-f5ab-432f-a9ea-69ef7086e425", "value": 2208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642787, "uuid": "a432b3f5-2b9f-4cc2-aeba-9c8ed43a607c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642787, "uuid": "5f7203ff-c44e-429b-93ef-59a5cc42a854", "value": "BKG_CONFIRMATION_08612220.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00121bce-5e9d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639678894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678894, "uuid": "d1bd5ab9-8783-434a-9545-da6baa17133b", "comment": "Malware payload (RedLineStealer)", "value": "6bb8ba118e09db09ed6b2897aae5ffec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678894, "uuid": "04154a97-e9b9-43fc-a170-3d57dd545cee", "comment": "Malware payload (RedLineStealer)", "value": "0b5ed304c2e97e197067470525d51939955bef53a1240233276fcc7266d35462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678894, "uuid": "c86a8a6c-1edd-4a8f-982d-2d2d11f349af", "comment": "Malware payload (RedLineStealer)", "value": "920b626e7ff32ea455c408fe3ab2a56c152a685f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678894, "uuid": "5770adea-5198-4c4d-b5c8-d433eae04839", "comment": "Malware payload (RedLineStealer)", "value": "7768a37cdc3fc01e6ae2e19674abb78bc070ae7344113990c011d91462aafb55a3fa3acfba978b4df2b6fc3201bf4022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678894, "uuid": "8bbe200b-838d-432f-a3ca-4f33be732f64", "value": "T1A0A4C000E7A0D035F1B213F85AB6E3BCAA3E3EA1676450CF12D526EA56346E1ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678894, "uuid": "460b595e-5d35-4983-992c-b3608596b6ca", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678894, "uuid": "4d946d20-f99c-4207-8c43-34147025bbec", "value": "6144:RvY6t6Hqn0YUUWBFboyYSI4HepiYkhUndqouvrV15raVFo7Jz0F:hcKyzBFboiHdYk8dqouvrVHraVF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639678894, "uuid": "b0b11441-701c-450e-a084-754fc8b159c3", "value": 455214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639678894, "uuid": "9813f9c7-93a3-4999-8e77-d346f9f9f0b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678894, "uuid": "dc0630e3-3cc3-40bd-b560-19a171e39a6a", "value": "6bb8ba118e09db09ed6b2897aae5ffec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfc042a-5e67-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639655748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655748, "uuid": "ade73cb6-ada0-4d8e-87d1-f01022c92bfc", "comment": "Malware payload", "value": "f2c2c3c44446cef89f9af36c54bd310d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655748, "uuid": "770c1940-d8cc-4f1b-a49e-9127f009d624", "comment": "Malware payload", "value": "0c393153a4b043e39b093b5bb7113b2759b06e93c1947283e14c9d936e7d48dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655748, "uuid": "17f18ba9-d497-4e86-9065-20d5c633e38c", "comment": "Malware payload", "value": "de97f5898d71129985dd70be197878ca4059bbd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655748, "uuid": "dccd6de7-f0dd-4e94-8eca-4f9e20369f4b", "comment": "Malware payload", "value": "bfdf3d57f4c52f735d5d2ca1c10561cd4a32f084a5171670d827e89d9e38f704eb03fa22102d9b1f46f2e4000afe03df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655748, "uuid": "b7089558-3d6b-4db1-be9d-ddf3a768de29", "value": "T103A4AEE622A96B95ED3DA3340020807053FEED49DB12E71A7DEF11F7D829EC1466A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655748, "uuid": "68e97412-bd94-4402-9dc6-cb4f412284eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655748, "uuid": "954d8ded-a87c-4904-8c40-41d550ff820a", "value": "6144:E4rQOaSas32kw0/OzK+3hApndzJ8BoudHXf95Bx+6aGiFJ:E4rQOaVkw08Spddyf3BdaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639655748, "uuid": "7e21fce6-6e8c-46aa-a27e-cd1210ce7c7b", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639655748, "uuid": "4d333eff-143e-43cc-bb70-0d30d28ca5c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655748, "uuid": "48c1486c-1b4a-46ad-bb04-e2b4f37d07af", "value": "f2c2c3c44446cef89f9af36c54bd310d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6dfa3b-5ec0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639694003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694003, "uuid": "64cf7990-f944-4e2e-91a0-fd684ba65244", "comment": "Malware payload", "value": "f5749077517631121d6d9cb43708bd0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694003, "uuid": "53c68078-cae1-4ab9-94b0-c287091353c3", "comment": "Malware payload", "value": "0c425dddb88f963f7a1e8adf61342b62f8988aed43be64f7f95635611cfe763c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694003, "uuid": "e0b11af2-6ea4-4bd3-9c6d-d47a92f4c698", "comment": "Malware payload", "value": "a6fad15bf8dd122c1c08fddb5fee9db0f42c9680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694003, "uuid": "4f651471-2765-40fa-965f-46f5b03031b9", "comment": "Malware payload", "value": "2ed5a4a1c78b83dfd7da6d64de6643013ff152e95ba12b7010cbe53ced1c57d5da58cd075f5357e88a9ea1f136c48eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694003, "uuid": "e6154820-11a3-47d0-9480-21127742a8a9", "value": "T103648D322BE52FA4E187FD77DB09E1F3C2179C222B438156B695230B90B28D6DE25717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694003, "uuid": "ec193b35-71c4-4e77-92a0-aba592fd7db8", "value": "49b0e9c062a84059576bfb9ab62c53b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694003, "uuid": "f1d49f27-e6f1-4e5c-b516-f9ae40cb2b3f", "value": "6144:6QPRHSiXCofwayHYNW4BmC4PzbpebhEW3DygjijRIciIw1fgDGaBNsI:6QPRHTXCofwP4NW4BE7VGhEWWgjijRPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639694003, "uuid": "dafeb4a7-4fdb-43d6-a852-53d432aa05ec", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639694003, "uuid": "19b7c3c7-7bb9-464d-bbaf-dffe05a29189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694003, "uuid": "4aa85814-21e6-4357-801d-10853b87cc09", "value": "0c425dddb88f963f7a1e8adf61342b62f8988aed43be64f7f95635611cfe763c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37a2d85-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613455, "uuid": "d999cb94-94b1-4d61-866c-8504bc5134f8", "comment": "Malware payload (Mirai)", "value": "cf0f4c3356b115486e132679e598394b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613455, "uuid": "73e1525c-b06e-4b41-adf1-0f88a44c8093", "comment": "Malware payload (Mirai)", "value": "0c7c6cfaefe345b44a2207149a98e2040a7f565640eefb0924a4896df7b034db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613455, "uuid": "8420ba54-a5f7-4f39-ae9f-9ae52c565b36", "comment": "Malware payload (Mirai)", "value": "b656975b293370454e986446e801f859076ff2b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613455, "uuid": "b13de857-4fe6-4e48-97c5-4ea70f93a3a9", "comment": "Malware payload (Mirai)", "value": "82ab2dd831faf30b55c20d20024ce72a02eb98404e9eff6cc655dcde8eb51ff4314edcaabd6c55028cd026ffc95d45d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613455, "uuid": "f717e230-1962-4bdf-be15-402ad03b2895", "value": "T178E3756E3E21AFBEE268867107F75F70C39525D326A19382E26CD6085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613455, "uuid": "779241aa-ee38-45ae-94d2-492e5743ce27", "value": "3072:QfdfppqGvlfDfh5hKWEdSmURxuZq+1uPNd5R:cwOBh5hKWWURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613455, "uuid": "58635986-e4d9-424d-8ca0-d2e2e3c8b899", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613455, "uuid": "17299713-9788-4eb4-9ba2-73f4269f29a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613455, "uuid": "7f186369-af2c-4de8-9ce7-ebe379dae507", "value": "cf0f4c3356b115486e132679e598394b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8eda446-5e49-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643180, "uuid": "ae6ca943-cba2-43eb-a370-43f9fccc6463", "comment": "Malware payload (RedLineStealer)", "value": "795952794276a019830ad46c63ec19da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643180, "uuid": "dd761bbe-a819-4bc9-a7e3-cba11fd9a8fe", "comment": "Malware payload (RedLineStealer)", "value": "0d5adbe308dac4749cc975f480cad469c9a2e6a2dd6dd3979fe5d809cada61e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643180, "uuid": "c200587e-7a4b-40cd-a51e-d9110f7486cd", "comment": "Malware payload (RedLineStealer)", "value": "1105e5572838fa5afe8edd411a492d74d1a70c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643180, "uuid": "59865976-08d9-4621-87c8-788da8ea8cf7", "comment": "Malware payload (RedLineStealer)", "value": "6084b2da986484cb2cbaa01979654feeed8cd3e9fe7751efb2d6be9052ebef8f24a9fd3633a246ce166dca44f39b3684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643180, "uuid": "65c6365c-7bd3-411b-80a6-10ba2514dfdd", "value": "T155A4BE00A6A1D035F1F752F84AB6936DAA3F7DB16B2451CF13D126EA4638AE0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643180, "uuid": "444cf398-8a42-45f1-9326-ddb6bbadcf45", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643180, "uuid": "b1ccf3a4-ad9b-4635-b222-ed811f765d02", "value": "6144:oSN685Kkggs15Si1JPAPLEODlIrhS22z1TEo55DrD0SFwEwZC/R:9hKWK5DYPLXZIrhS22z1Qo5x0SFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643180, "uuid": "44d6f30f-7511-4a36-8d7e-dc9e83b700cc", "value": 456234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643180, "uuid": "e2026133-a602-4059-9649-ec4ae6acbae9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643180, "uuid": "9ea75243-f4e1-4481-9f09-4b35b97f3fe8", "value": "0d5adbe308dac4749cc975f480cad469c9a2e6a2dd6dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05058d1c-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639644972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644972, "uuid": "2162ee9c-24bc-4e53-a6c3-d4d3e98bad61", "comment": "Malware payload (RedLineStealer)", "value": "b57e94a7fde06f0b2ad60b2cb7b0ff69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644972, "uuid": "579e7f94-12c9-4911-8782-e1061867f259", "comment": "Malware payload (RedLineStealer)", "value": "0d91979c39b255eab433d1c2597eaacb9d58cef50bcf321bf9e02282e6715531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644972, "uuid": "3024bb06-6f5d-486b-9f55-f90881ab9002", "comment": "Malware payload (RedLineStealer)", "value": "2f644925e24343a459d5b964fbc6a5bbd80c1e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644972, "uuid": "f6a64a94-590b-4630-8f4e-31a8f2aa35b2", "comment": "Malware payload (RedLineStealer)", "value": "06fb52202d91b9d2e551a26ae0f2adff5aa497d678c9041172654abd5aec8b54863009f81ff940e56646f3085fb458aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644972, "uuid": "dd47df47-6124-4110-b5b8-71fc6003bc68", "value": "T182A4BF00E6A1D035F1B312F85AB597ADAA3E3DB16B3860CF03D526DA4A746E1ED30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644972, "uuid": "7479736b-c25d-4af9-b9ce-b5ac5e721995", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644972, "uuid": "a2f5d350-545c-49af-991d-d1af8b342d79", "value": "12288:YQReUiWXD0vcHxmvmWekPoZUlcP/zMhR:YRUNgvcHwmg5sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644972, "uuid": "1f205687-5568-4a01-b352-431dd46d7b86", "value": 456207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644972, "uuid": "6cd4bc98-11c6-4d94-b91e-632d0938a7b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644972, "uuid": "94bd4925-f7c2-4fca-ae12-1838b72e2d83", "value": "b57e94a7fde06f0b2ad60b2cb7b0ff69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b569629b-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639615633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615633, "uuid": "de73a4db-bdfe-4f3c-8a74-513dafba840c", "comment": "Malware payload", "value": "63b0c3bcef34a06a8028c38df11ff1dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615633, "uuid": "c737f412-d428-40c4-b624-11a081285d06", "comment": "Malware payload", "value": "0e307f5d46a6281645d8a083cbfb9896f346541f77cce5c33da95dca88656126", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615633, "uuid": "f65295a3-b061-44b4-becd-cd8cda147e94", "comment": "Malware payload", "value": "51d77fecffb91a573e87caa8aa5155a98a4a9318", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615633, "uuid": "65785dd9-3c59-4226-83e9-260d60eba244", "comment": "Malware payload", "value": "37c989bd9de2cf79e1986dbc0b9cee7a3fd4eaae27672a15cf2047e379f06f16997ef61e7165f4139e34770f4f9dc82d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615633, "uuid": "5a09911b-7df8-4c0d-8948-b518d03512b7", "value": "T13023F15FD3A968ECC9DD683E702E1774DDD6F88AB7D80A9F0F901680C55AC472188CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615633, "uuid": "0f21403c-2a0b-4608-a802-4c3b71a9e062", "value": "768:Knj0d797KvLD9YtDoNUvwE26r12mThX2pbYQlNPO133fZwmLQWpAaa/WRtTKXApf:KnjS92v3qtcNUiQ12m9mpbYQPUnyWpjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615633, "uuid": "ce59d2b2-d6e4-4793-aa3a-ce1bade997f2", "value": 48016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615633, "uuid": "bb95d0ca-b78d-4303-97ab-dce1d9938bcd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615633, "uuid": "c1879307-9a82-4cae-b596-f0d090111e73", "value": "63b0c3bcef34a06a8028c38df11ff1dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c141776b-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adwind)", "timestamp": 1639642711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642711, "uuid": "7f7ba55a-dd84-4280-a7d0-a358bdd3fe0b", "comment": "Malware payload (Adwind)", "value": "9801154f6498bcaaa9d53d879e9bbc89", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642711, "uuid": "1cfe511e-4529-4155-83e6-33dc49ce5708", "comment": "Malware payload (Adwind)", "value": "0e67c1c8ab52d7b13cdedc7dbfea234e5c6209304ef0407ae5bef8c5e3681481", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642711, "uuid": "1fb14462-0fe0-4fa9-9407-c9513ae3ece3", "comment": "Malware payload (Adwind)", "value": "ebb9f3e353ebc244593f55d9384af565840fd25e", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642711, "uuid": "8eb8926d-2b7c-4295-aadf-4426c399231e", "comment": "Malware payload (Adwind)", "value": "30c38505326a8b837eff4eecbcde0d0d32c0aa942b8bee9cebbe5710ffa609fa5f1ef33458ff836aa87945cd21959162", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642711, "uuid": "057f7e97-ec12-4f00-a051-9b3b06e4e3ba", "value": "T1D3D43305FC8DC4108304589AEF7A469E8579474346F3AA8894EE6EE97468FB1DCFFB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642711, "uuid": "2391a1df-52d1-47fe-91f8-c438fe69fa8f", "value": "12288:Rp9sNtmnX/loQICEAa3Dikau94S9vuiWKfnMWNLAcaOhJt1MV:ONtCPloQIvA8+kt2SdfnMWNLZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642711, "uuid": "cd6279c4-518e-49da-a942-6449df9c89e2", "value": 653769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642711, "uuid": "61e2632d-a070-450b-a916-74c72992e65a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642711, "uuid": "e2c8c25c-5d65-4a40-8dc8-89f214a485fc", "value": "L2992-PR03660.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fa4577-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639644066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644066, "uuid": "e25704d2-0765-43a3-b3ad-dc5b1f9c242d", "comment": "Malware payload (RedLineStealer)", "value": "8a22ce9cca030747ac6e88385cde7aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644066, "uuid": "b9fd7bed-4637-4ba4-985d-50c65d0ea60a", "comment": "Malware payload (RedLineStealer)", "value": "0feaba23f01b5ad592812309dfedd7c8e04b6771a2d1760d486a09cc4d6a1068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644066, "uuid": "8113ebac-94ed-4839-a086-bb54ff768af7", "comment": "Malware payload (RedLineStealer)", "value": "2653c59bbb2dabb95e8486a0314e9c90a741bb58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644066, "uuid": "ed38add5-dcd8-4dd8-8af9-7bb280acb568", "comment": "Malware payload (RedLineStealer)", "value": "9e128f67b928313e406911cfc2d696ff49a9df9df1137dcffbb59968724f13bebc0cf52c2563bb1a78380b7058f8ac62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644066, "uuid": "2841b5f2-4a68-49b9-965c-4574f1cab394", "value": "T1AFA4BF00E6A1D035F1B312F85AB597ADAA3E3DB16B3860CF03D526DA4A746E1ED30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644066, "uuid": "b4da2191-8edc-42a6-acdd-3db1315e452b", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644066, "uuid": "4fddfaf5-24b1-4650-9ea4-48034a06686f", "value": "12288:YQReUiWXD0vcHxmvmWekPoZUlcP/zMhR:YRUNgvcHwmg5sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644066, "uuid": "90a4c253-2837-45a5-a708-870486e887af", "value": 456224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644066, "uuid": "80b3c960-3528-44f0-800f-c5c26b8b88aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644066, "uuid": "d54d14cd-8c9d-4c06-a6d1-5b66203d77bd", "value": "8a22ce9cca030747ac6e88385cde7aa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42540a69-5e89-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639670415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670415, "uuid": "76735319-3244-4cf5-b997-62016e27912a", "comment": "Malware payload (SnakeKeylogger)", "value": "6a8b7d329e79e1d5c3deace8e56da790", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670415, "uuid": "4ef1f795-ba76-4fea-a758-e4629a064d46", "comment": "Malware payload (SnakeKeylogger)", "value": "124977f843aeb96e1aef5079f7599001b5e90453b852d786183a849d79722255", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670415, "uuid": "37632e81-3947-407a-a142-4700884723a6", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3f8eddd875bb53cb1dd37f90e91fd00743fd94", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670415, "uuid": "2af3e0b3-79f6-4e8f-9ba2-678cf5b04deb", "comment": "Malware payload (SnakeKeylogger)", "value": "85e3c6ee1eef98d58af10545c085e6fae083476263f22cf8566c420f14cfdb1234befa2ac5b85b1bd003db557bac787c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670415, "uuid": "99bbcbac-bef4-4bfb-8eca-7c99fcedd7bf", "value": "T11B1533657F7699C86220FA1FCF0249CB6C6A093412ED5CDBC272DEE0B93B16177C8291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670415, "uuid": "7c721925-6e0c-4679-875d-a8eed33da342", "value": "24576:O4SkpYsUGFtiPgIbL/t7DFaE8g7vUymSZwC1S2z8Aq3u:O4S2cciYchQjkvUd9i8Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639670415, "uuid": "10e1e580-b34a-4c92-8ccb-23e1d2c005a0", "value": 956366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639670415, "uuid": "5e9b016e-6aa2-4b63-8179-fee1573921ab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670415, "uuid": "bb5c5540-295d-40c8-810c-59c42fff208e", "value": "NEW P.O3421280.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af02d24e-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639643969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643969, "uuid": "0c90d496-5cf8-45f9-b0d9-d6d34ce374b7", "comment": "Malware payload (Formbook)", "value": "a207abd748cc7716f237abc76e244aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643969, "uuid": "2e9a5003-61c8-473d-a9a9-8c2674aad26c", "comment": "Malware payload (Formbook)", "value": "12a3b36150ee28df4f927c413fd0a7262dc5b9701aecb53428ef801edb3b7bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643969, "uuid": "00d606a3-cacc-494a-ad03-05446d409902", "comment": "Malware payload (Formbook)", "value": "3b56046926a26b9b100b3227d35f0e4df652600b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643969, "uuid": "f6c67af2-d4a2-4387-80bd-ce1ad774f2cc", "comment": "Malware payload (Formbook)", "value": "e76dc223c8b116d7462747fc0ccc750430f5b3c30f4d55bcd42db52363d854ffd7d25d91387531b6550d6c5e07c52b17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643969, "uuid": "b614e871-a5a1-4491-a19c-30324c798125", "value": "T1A455330715E24227F8FF3278D997492C8F75AE04D032B74B94E169496D23B8EDCA2F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643969, "uuid": "89d64b37-78ba-4921-a36d-6d8154127bf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643969, "uuid": "7c5a4368-9c18-4dbf-b095-87ea8e6649d2", "value": "6144:E96uAxp+ZTzkjUBh7lXUaIdmHrgA2qZ+Qnm/zBEkdC7KbR94m8Dv3tECPv78ErbR:Hxpus3IVqWm6oGNMlCnYjif8jupopZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643969, "uuid": "54acd608-63d3-40e2-bf21-980e139f3c3c", "value": 1334784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643969, "uuid": "b067a3a1-35ff-408c-bb72-e14a0b5b268a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643969, "uuid": "c838d3a3-e31d-4ed4-8580-b10258bc69cf", "value": "a207abd748cc7716f237abc76e244aa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1baa8a3-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639641477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641477, "uuid": "2744932d-f62f-4355-b389-c6ce5859fa44", "comment": "Malware payload (AgentTesla)", "value": "d48bb400090ff130079a7ddf7f13787b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641477, "uuid": "055b4292-da8b-4f65-8119-6f24e1443e8a", "comment": "Malware payload (AgentTesla)", "value": "12b2906174350f82229f31d2aa68a04b4d802d2e13e8fad3439a8c208e3f6ebf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641477, "uuid": "ac0765d9-2947-4ead-9e00-ba1b1e4e13d8", "comment": "Malware payload (AgentTesla)", "value": "ba1a9f05900dc4f6a37a74f65f51fffc5d0cff88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641477, "uuid": "4ebe5a98-9d07-47f9-9d1f-9f0db24a23c7", "comment": "Malware payload (AgentTesla)", "value": "5010b338cc91770ffd100f33bf0f6bbe7ac034f92262d7de3cba42a916882422bc5acde887545abd773cf6e51387611c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641477, "uuid": "fe7e067b-4080-4744-b78a-eb69b2dc7b33", "value": "T19092A2ACC99342E88F4267B86B2B6F45018C7A2DF7849533327C4B3527D2D7A602787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641477, "uuid": "0f074363-d8c2-4dba-8561-acd818502f3e", "value": "384:80ft0WxBQ3/HO0ukAa+ciksOehdJV62QQgZHMMl:80fnQ3/nOciks3hzsugZ3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641477, "uuid": "1e1cad5c-fcb7-4922-94d1-a5db791f9e16", "value": 20172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641477, "uuid": "38aa2e42-a8d2-4dab-b4d9-c0385bb842c0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641477, "uuid": "28082aa4-f577-4c78-9413-00fc25d6d7ea", "value": "FARIDA GHCU123.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ffcfed-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639641159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641159, "uuid": "774353a0-9857-422a-9f54-56e214eba205", "comment": "Malware payload (SnakeKeylogger)", "value": "585df34557414f3eb00552580fa984d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641159, "uuid": "bd31101a-39b3-437f-8784-b729d854deac", "comment": "Malware payload (SnakeKeylogger)", "value": "1332f016c96028681eca98552bc1e865b49ebf45484cdba2c665ccbda2133a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641159, "uuid": "854f451d-d95d-4ff6-adcc-07b674703549", "comment": "Malware payload (SnakeKeylogger)", "value": "b6ef2507b6dc0b0b35b9a246905978c3d302296a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641159, "uuid": "c25859b3-1c22-443f-bf9f-0c0dc3e3eb2a", "comment": "Malware payload (SnakeKeylogger)", "value": "69516d33a16c33af3648a6c280b2a7b2186fab9d41d9a4d6934544a952ed4e431a793c55cc5df582fd8be72a6a4bf7c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641159, "uuid": "fc37549b-3a62-4169-8083-92d3be4f52da", "value": "T1E7B4AD00E2A8CA17DD2842BBD561F6F403B15CE2E51FCA976ED57CE632B2B41C531B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641159, "uuid": "ddf5dc10-473b-4c0d-b4e4-4bb1550586bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641159, "uuid": "3d6495c0-91d4-4e00-a8ea-e65cd354b795", "value": "12288:tZ9uHoA5QfJYGNrdDsi0J+ChJFkzJu7oqCOvDW+cMynvuSK3X:9YoA5GWKDsx5JeGsOaqNSK3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641159, "uuid": "da0a8740-e39a-43d2-8b73-259be14159fc", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641159, "uuid": "cd34f54e-7972-45c0-b432-b0eb02034ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641159, "uuid": "2691190d-bd9d-4734-b321-d06910523bc1", "value": "STATEMENT OF ACCOUNT - SWIFT TRANSFER COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4911b6aa-5e7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639664843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664843, "uuid": "0e78e0cf-0606-4516-94a2-349f334fe568", "comment": "Malware payload (Moobot)", "value": "439cad80af5808467f00c7a1cfab2e06", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664843, "uuid": "44c72566-75ce-4c57-9a9e-1e91c2f7b57e", "comment": "Malware payload (Moobot)", "value": "138bcc1d5c2f664a71f3bbdfa9f156ca4d514aa4e5dc5a2f630ca35b23a78899", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664843, "uuid": "dc57ea1b-755a-4fca-be13-2b2ab6354e81", "comment": "Malware payload (Moobot)", "value": "996c7359e3f7ca4234592092d0319c6c1dea16ab", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664843, "uuid": "71ab3b86-7ec4-4ae3-800d-ef23fa6f329d", "comment": "Malware payload (Moobot)", "value": "1a91f412c61cefd7504a9e91df789fc6f7d730b53b7e0ab87cab1a54e9a4721a693879847be7bb331325a05dc6c0ade1", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664843, "uuid": "5490f391-5b67-4439-93dd-b2efc8800adb", "value": "T19CD2E744BE869D07C5C84377FB4E028D376523C8F2EEB213DD163F56E68E527099A0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664843, "uuid": "f679b06d-6644-46ef-8908-40de7ed3f23a", "value": "384:Oju92lifJdzBqSP/yFf1vgTuQqXnPT0PMJ4aZyXRi37vIzuICv7z4vKBzsMIcPTZ:OjiZz8tf1LBTTJbzwRwFzbR49jwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664843, "uuid": "b207036f-e96c-4cbc-a269-b4f9613bf92f", "value": 30464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664843, "uuid": "8f1802f2-1bf5-4b02-801a-4f6b25ea8ad1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664843, "uuid": "d124e56e-9d14-4aa8-8adf-bc9d7682ba50", "value": "la.bot.arm-20211216-1427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c0c816-5e4a-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639643546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643546, "uuid": "990a52c7-efca-4534-b3fe-0358ef287ae6", "comment": "Malware payload (AsyncRAT)", "value": "2aaeb72e001240b1515740ff883c0f4f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643546, "uuid": "2c1878a9-bb1e-4595-8b7a-87e6f9c8abc3", "comment": "Malware payload (AsyncRAT)", "value": "1426bcfb50fbfd748ccf84cfb2c106ac52f5f2ef82b70a7be46e8f473c701658", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643546, "uuid": "fbbbb20d-3c57-4d7e-abf5-1cfb26a6b9f8", "comment": "Malware payload (AsyncRAT)", "value": "61284b7a0ceba6246fa1b9ba527270cf8a916439", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643546, "uuid": "5b88bc24-974d-4ab0-97b5-bf86818a613e", "comment": "Malware payload (AsyncRAT)", "value": "1fc6789a0798b0a228fcff8a1dfe8c84f7b53c8df22a9e363683fda53b474448ee1bc4a3ddca25fe5800f59f7f08d71d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643546, "uuid": "d468dbea-9b37-42f8-8787-5154036c00ad", "value": "T176846A2D2587E7CDF43ED3B53A60619403E5ADF5E747E0DDFCA9308B8467A523A22620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643546, "uuid": "a5ac5e2e-1c68-42cf-b537-3ddd3d5b740a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643546, "uuid": "d6deda66-58b5-46cc-9b49-f15df5d4bdea", "value": "6144:K2e1xmWFRSRtebkTlk+PE/T+J28+EcPmuHMzic7V1U9a/ZPxo/vfDiY7RAZorudQ:K2eP+P/28+4zi6U9qZQF7RNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643546, "uuid": "ade952af-36a0-4cbe-ba43-a05242034cf8", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643546, "uuid": "6d99d92f-0853-4596-a7af-edf39582f4ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643546, "uuid": "9933e884-f7fb-4a9e-ac98-bd4e1cc11988", "value": "2aaeb72e001240b1515740ff883c0f4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe15e4e-5e6a-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639657258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657258, "uuid": "ffed4986-d719-4a21-9e20-262961371c09", "comment": "Malware payload (NanoCore)", "value": "afcbd3981fba580b2466cff357a3f9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657258, "uuid": "b89e19b8-9fc4-4048-a008-7d5a81f8e465", "comment": "Malware payload (NanoCore)", "value": "14ac687895698a5fe4ab63cb51688dac89c8baa0d37c839446cc6680c8e0559e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657258, "uuid": "63f3ce69-8b95-484c-bf2d-21fc9f62a21b", "comment": "Malware payload (NanoCore)", "value": "e143615e67729995f74d8a3a8f8c752aac351829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657258, "uuid": "409605c3-4286-4cd3-a2c9-a7f90734f12e", "comment": "Malware payload (NanoCore)", "value": "af0d365567115aa1e92a25a24710ba6d99361e4dd12648275225b360a73a81e1d1816f2a11ceaeec93218d0983948ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657258, "uuid": "578e4f42-8a46-452b-a22f-420172a9828e", "value": "T1FBE47A2366FC36E7E46847BC1447161A0FA17F367933DA4D6AB678F62376F810122D82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657258, "uuid": "583e7893-a979-4510-8206-9f93b7bcca38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657258, "uuid": "16244396-a8ea-415b-9bd1-70761a80f9ef", "value": "12288:2whuHoA5QfJYt97vUNJlWH78dh2qhkKA/AKGvYu0CxuSK3Y:9YoA5GSXvUNbWHohLttNveSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639657258, "uuid": "bbe5c76c-6a43-495e-98b8-7e535d4edb45", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639657258, "uuid": "6151715b-0996-4f12-9fb0-4d915728eac8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657258, "uuid": "1af82ffd-13b1-4eca-bee1-9496aadfefdf", "value": "STATEMENT OF ACCOUNT - SWIFT TRANSFER COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85294f3d-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639616840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616840, "uuid": "93b0ca41-19ab-4779-8dca-5ff6dc4c1494", "comment": "Malware payload (AgentTesla)", "value": "feb5a4dd38e8fdd20f7b267d3cc74a88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616840, "uuid": "1d2e3724-2d39-4542-89fb-96f857dc1d8f", "comment": "Malware payload (AgentTesla)", "value": "14b4ef2b5db3ccc4fd1756d6bf5b8f94cd208398d55cc609f1629a513742a9cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616840, "uuid": "4d427d07-381e-4d48-934c-f4c709920aa4", "comment": "Malware payload (AgentTesla)", "value": "ebf2a487e0d0d3ff51bebda47bc2f19fab941b47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616840, "uuid": "f15b26ca-79de-43c0-b9cc-bbbcbd52c759", "comment": "Malware payload (AgentTesla)", "value": "2f297a812bedc9a0d1022843c5dcdcb4517d800b9f656e7decfd92d9ff0bc1d057b83e0bc4dd38cd0ced32226046d6e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616840, "uuid": "e41703c0-0aa2-460b-8879-902359651fb6", "value": "T127E45BAD3582B2DEF837C9729A942C54EB90BCF6C30BD28BD067355A994E457EF100B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616840, "uuid": "b87185a9-41b1-43e1-91fd-577c602f54c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616840, "uuid": "16102132-c5dd-42da-90e3-635b519e4a20", "value": "12288:XIiUGvLer5gdlI2Es7dE59rAS4BiR54g8mc/IK8cFlGKEo6imyQ81wbNmh2v:XtUGvqNgPI2EOEt4pJX/IKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616840, "uuid": "b421b658-ea40-40e7-bc56-2329fe5f3704", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616840, "uuid": "d0948088-44e4-4126-8b6b-5c8a5be54f5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616840, "uuid": "a93c9a7a-b31a-4ba5-94f4-3cde37e0b747", "value": "SecuriteInfo.com.Trojan.GenericKD.47662240.22190.25346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a78b11a-5e66-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639655504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655504, "uuid": "bfd2ca29-068f-4b16-80ff-6b534df7223d", "comment": "Malware payload (AveMariaRAT)", "value": "2b1f6968321aaccd1b3ab12fb35ab9fe", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655504, "uuid": "d0c033b2-a520-4122-b002-c05f4aaf2c27", "comment": "Malware payload (AveMariaRAT)", "value": "14e2c2799fcb2c2da836df2e78d4a3952469e33bc57654e54906747ff170025f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655504, "uuid": "6a61cee9-bf9d-4010-a753-40fa5b6378ab", "comment": "Malware payload (AveMariaRAT)", "value": "72c4dedc4689ad2a5e37ac878fc298d9cf93cd5b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655504, "uuid": "3bb4cec9-7dbe-4d8b-ad63-e28f4e7bd4f8", "comment": "Malware payload (AveMariaRAT)", "value": "da87843f8a89786d6e91a1c44dcab71b40185efda5700d35f83ff3a59ba3a15fa87574cb49a89d342d108fc3e4817cc4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655504, "uuid": "a675b361-1a4d-4b77-88b1-15aa5eb80ac6", "value": "T1489402B9766DAA37C5AC3CF81915224113F581663682F3CC9ECE71EA05E2BDB85532C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655504, "uuid": "19e74e2f-5d05-4529-8d5c-a0e4fa500a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655504, "uuid": "feed10f2-0012-4d02-bebb-019faaec7865", "value": "12288:oWOhxAuHoA5QfJduSK39qIsPtZhfEALLhWc3RRbAfj:zOh6YoA5G2SK39CnxWch6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639655504, "uuid": "57ea04e5-c211-4039-a142-d508b44b1055", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639655504, "uuid": "3ae3dd39-debe-4a27-9e69-f16be8e7fe4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655504, "uuid": "e3759fd2-6ac3-4621-a031-f4866f0d25c3", "value": "REVISED ORDER #001.2021..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f48d656-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639683725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "30544cb3-70b1-4fdd-ae5c-70ee18839e4d", "comment": "Malware payload (RedLineStealer)", "value": "4d80416b8f78df169bdceb49058141a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "f6d96b51-7a7b-4f1a-ac47-149589fdfa6b", "comment": "Malware payload (RedLineStealer)", "value": "158d30a43656ba2b6d7eec494fad8aa7ae861b0132f24065d2cc42d9396e0ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "00c8da7e-0dd7-48f8-aa74-c1feaa2ca47c", "comment": "Malware payload (RedLineStealer)", "value": "2482747f6feb86522e562b5a291e37a6cc35e8d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "a36ac0a2-19b6-4f14-9722-40a83446fe6f", "comment": "Malware payload (RedLineStealer)", "value": "a3e5b92b8e49e7eb891b376165f91d8b619e4ee87012f1de4422b8a66d4f5ca04b21f5d4d944a8cd1e5538578b984168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683725, "uuid": "36a55ed7-5290-4789-8350-9a876858fd39", "value": "T1C5C45EE0DDD492B3C20B6D3F023278318DEE4D6A970AE2B4978F789D7671785B5C142A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683725, "uuid": "2b74db66-ce3b-4b63-93be-fa2c93421fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683725, "uuid": "794feef9-80c4-4a8c-aa1d-129f35aecb8a", "value": "6144:vqT6mN6hf548pjilcYxLr0vXNQ20AUXYOZ3CTZDfcQB++Bnlq:Cum24ojFYx8Q2LIjZ2zcI++BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683725, "uuid": "be01bab9-d761-4a4c-99df-15c0ea0522ca", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683725, "uuid": "91fd2948-d80e-4f7e-bb04-098805372b90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683725, "uuid": "932f18a2-010c-4bcd-913f-f6e68d33f41f", "value": "4d80416b8f78df169bdceb49058141a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237eea34-5e44-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639640728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640728, "uuid": "aa6e3a4f-6902-4043-a36a-5bffc174d26a", "comment": "Malware payload (RedLineStealer)", "value": "1b8f2898414d0297ab327d9d6e8cb830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640728, "uuid": "cc7ec669-2627-4967-a297-e8663fce3d04", "comment": "Malware payload (RedLineStealer)", "value": "1707a13bc21d91853ce31818e75f0b24523d9ecb8fb2467ffc6fb2a48463e1a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640728, "uuid": "87a5790c-b31e-4983-8035-497547421703", "comment": "Malware payload (RedLineStealer)", "value": "4f32dd31a16b581cfe7a62c934df748a8a40d148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640728, "uuid": "ed4f43d1-58b5-49f2-86ef-954c6e589f15", "comment": "Malware payload (RedLineStealer)", "value": "d0b6490d8bfc251d53d937ce6327b4da22bacd1bd2a19e7a0490d6aa65548ec8c3c0482be11e43b7c58d328059601750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640728, "uuid": "22c8f529-4ee0-420a-95af-28c901aed16c", "value": "T1B0A4CF00E6A2D035F1B312F859B5936CA93F7EA26B2850CF13D52AEA56746E0ED71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640728, "uuid": "dc415c74-e078-4814-b0cc-6d1d3337dd9e", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640728, "uuid": "26f67c88-7b8f-4a0c-b474-a71e1832bc2e", "value": "12288:RieYn2u+Pwu62hWGnSz3vEUBR5Iemb+yE:RJu+Pwu9/Sggqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639640728, "uuid": "6674c6a7-4ec7-4c94-a2d9-1025af448016", "value": 456235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639640728, "uuid": "9d415c71-2657-4c37-86b0-70f9347f2d1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640728, "uuid": "8b2ca7b5-4110-47da-99d9-fb54bd54b0f2", "value": "1b8f2898414d0297ab327d9d6e8cb830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d388b769-5e8b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639671518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671518, "uuid": "29174a48-4e09-4512-bd56-1eda7022d8e1", "comment": "Malware payload (AgentTesla)", "value": "80c488d7d694f1780c86c48eace75a77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671518, "uuid": "1cc5e538-6ca7-4c34-8abd-cf3759be78ef", "comment": "Malware payload (AgentTesla)", "value": "172a4627e1d2a38eaaebe713b79b90ae4aa33466c1eda84ad91b594dc360aafa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671518, "uuid": "56a50b49-0edc-4f04-854c-1bdf622dcb9f", "comment": "Malware payload (AgentTesla)", "value": "dd8d7ac2ea3d1b61065730be4efedf1a931ae8e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671518, "uuid": "2d4a5ad8-f143-402d-ae08-926b7d73c0d7", "comment": "Malware payload (AgentTesla)", "value": "df71a8e606dd0f4e960bfaafa379b00286c0ccbe188f39b08f4d673acf43eb65c3704229be10ede9ef114864dc70ffcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671518, "uuid": "0e9066c2-0619-4081-8bdb-6f124105f420", "value": "T1FC05F1D9C25C31FBC42B6D32C3A707393A7C2D935A60B60B5534DC8ED69EFE6502219A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671518, "uuid": "cbd4eb95-b5ca-4bbf-b29c-0ea1aaf58c7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671518, "uuid": "10db7ad9-95b1-4894-adac-26c1830d8d63", "value": "24576:++yyiqk2lc8nJ290uGkgOpK5wlrhrUIzgVKgwh8UuQvWS5t2ubHiWBj/cuft/ZLx:+Mk029ZLjYXS6v7aJfRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639671518, "uuid": "24054500-89a7-4a3e-8f55-85c1806927b4", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639671518, "uuid": "5326ee55-80b7-470c-85d9-ea1459fd6a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671518, "uuid": "41dc90bb-149a-44be-8d50-7972862cf1dd", "value": "Agreement documents and passport.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7b85fc-5e49-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639642862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642862, "uuid": "b83bc283-95ba-45ac-8511-54b3441a3363", "comment": "Malware payload (RedLineStealer)", "value": "e01c6d406cae001b008d9b0fbc793d2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642862, "uuid": "4fb36713-80a1-4c60-bd7e-f8eae247aa28", "comment": "Malware payload (RedLineStealer)", "value": "179ac8e19b51d5693b0f1ed061873dbe6dfadbe9560fd1636315a5c154f0c2fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642862, "uuid": "7ce55105-83b3-40e8-a194-d908b4c261c0", "comment": "Malware payload (RedLineStealer)", "value": "c0cd1b844d97ae3b2af32b2229b435656f065790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642862, "uuid": "b95020c0-5f19-4971-9bdb-d56942a0d9ef", "comment": "Malware payload (RedLineStealer)", "value": "a49f7df29822eee271fab1d3e14d0ed34ace641287b124638a2846fd663f93e41dd1d8a63ee3da40c875ef03930b7d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642862, "uuid": "f6885ceb-6e96-44f5-92fd-46ce6b9745c6", "value": "T1A8A4BF00E6A1C035F2B352F859B693A9A93F3DA25B3460CF13D51AEA4B346E0ED31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642862, "uuid": "798944a4-ae75-430d-b74d-883d00700cd5", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642862, "uuid": "36c47ac3-8559-46e0-8ea7-b970fd751eb5", "value": "6144:kWZxBUpJozULTyS0ul2+FKd6VMt4ibESIpi1IAtL9CKIGphYpq9gjLNC9U:9CJsE1SyKkt2ETpmIAtL9CvGpapq9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642862, "uuid": "835b3c5a-74eb-429e-9304-f61f76d2bac1", "value": 455710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642862, "uuid": "5d28de4f-3030-4108-9d5e-ba70fb40389a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642862, "uuid": "e5a21d52-1979-416a-b8bb-642f58754c8a", "value": "e01c6d406cae001b008d9b0fbc793d2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f225b8ae-5e1d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639624325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624325, "uuid": "209073e1-ffc5-47e2-aca1-232c55e80860", "comment": "Malware payload (RedLineStealer)", "value": "e06ac446d305e73c4cc52e0b656c50e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624325, "uuid": "8c55100c-ac02-45af-92e1-722adcb38297", "comment": "Malware payload (RedLineStealer)", "value": "17c6d82e97d584797755934064b029e9db305fbd1f3ee947db6625c154787906", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624325, "uuid": "b46e691d-40f1-4504-8dc8-0f864796b56c", "comment": "Malware payload (RedLineStealer)", "value": "a878869487cbe10c50d02fd32f8e8bbe70345a18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624325, "uuid": "f5d394a0-0ae2-4487-a8f9-8a7f833e1581", "comment": "Malware payload (RedLineStealer)", "value": "6bd137b4d0df3ca6e8631de91ff195ffc28e0924d7b67b4ded4cc1a8599148fbe06c7f36e9673702d02638df9dc4ede7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624325, "uuid": "e637f2c2-2e54-4d0e-a6dc-b5cc87c99bf3", "value": "T1F6A4BE00A6A1D035F1F752F84AB6936DAA3F7DB16B2451CF13D126EA4638AE0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624325, "uuid": "0dcc7bab-7f36-409d-807a-dc2ee6abb5bd", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624325, "uuid": "4857495d-a6c7-42f4-a4cd-44ea3eda3fce", "value": "6144:oSN685Kkggs15Si1JPAPLEODlIrhS22z1TEo55DrD0SFwEwZC/R:9hKWK5DYPLXZIrhS22z1Qo5x0SFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639624325, "uuid": "86527c9a-5950-4ee2-acb7-aca773a2b124", "value": 456211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639624325, "uuid": "640edba3-1d8b-40e2-8585-c400b6ffb298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624325, "uuid": "5e3ad402-44f7-49be-9333-b024453010f5", "value": "e06ac446d305e73c4cc52e0b656c50e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e56a626-5e4c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639644370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644370, "uuid": "a7c5bd1f-a31f-4a0a-9e2a-bce2f7f651a9", "comment": "Malware payload (RedLineStealer)", "value": "9a06cb840d642baacd4339c79460feb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644370, "uuid": "417a7e84-4f02-41d9-8a1a-c528492de800", "comment": "Malware payload (RedLineStealer)", "value": "180b1ec126c193842ae6d572f6a85b90f4eaea6d3e64947db42f2cc08b2c1df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644370, "uuid": "3d6a7a63-ea47-423f-ae4b-751b2f85d2ee", "comment": "Malware payload (RedLineStealer)", "value": "a3036610c9a8359d22b6942e64349887a3ad8c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644370, "uuid": "bb80e521-1265-4437-9cc4-16c25891d0bf", "comment": "Malware payload (RedLineStealer)", "value": "68a4f6a18ebea1c6cf409a73c20224198f876a63ab41a35871f97acfbf39a02feb4eea367ed5bd54af7cb52b27049701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644370, "uuid": "0e9f8ccd-64e6-42bf-a3fb-b58793b062f1", "value": "T14FA4BF00E6A1D035F1B312F85AB597ADAA3E3DB16B3860CF03D526DA4A746E1ED30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644370, "uuid": "7335992e-0565-4131-998a-b93a8c2866ca", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644370, "uuid": "c2ea59d0-c7da-4128-ad56-cb420a0025c5", "value": "12288:YQReUiWXD0vcHxmvmWekPoZUlcP/zMhR:YRUNgvcHwmg5sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644370, "uuid": "c2d19201-6138-45ac-a055-6093804b2ebd", "value": 456241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644370, "uuid": "a2dcafc1-4d49-4358-afa2-19b5ef3c37dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644370, "uuid": "25c4ca98-23b5-483d-966c-1684ca3712d4", "value": "9a06cb840d642baacd4339c79460feb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a5b819-5eb6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639689961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689961, "uuid": "7131f9c5-19d4-4b16-bdb8-27c440d6d1bd", "comment": "Malware payload", "value": "a9ee78ca1b129dac55aa610283bedce5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689961, "uuid": "dd448fbe-341d-4a12-b6e9-d89e8f2b12fa", "comment": "Malware payload", "value": "18539d6dfa24399951a8be8f72813ee418524639affe9c50653dee7179e08a59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689961, "uuid": "183019c4-8e5b-4de7-9b55-e63fa8ba694b", "comment": "Malware payload", "value": "5ec2eef3a625b501580cbf91dbee1ef4bae26dc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689961, "uuid": "bfbfdfc2-7d09-4a20-bbbf-20eb320835bc", "comment": "Malware payload", "value": "7ec053a48e177466011b997f969c62298e36764cf8e160940825b85782a07334dd8d3851fcdd3d67011c4d28d4d8768d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689961, "uuid": "f023cd90-ec8e-44ff-974e-d5926628aa93", "value": "T15B05F1006BE0D034F2B316F85A7693B9A53E7AA16B3494CF22D515EE5A347E0EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689961, "uuid": "94770a53-daeb-4f23-86e8-fe96596b2f8f", "value": "9a8dc8c7cdfd1f0f0b247a3b1f86c91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689961, "uuid": "499dcb3f-b1e9-4ef2-9572-98f91009e998", "value": "12288:z/SiIERZKV7g/UpC6G6+9VrxpvFArrS9LuTshbl1nJebqpaQcO7:rSbM4Aw+9Xpud8HJcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639689961, "uuid": "ab899f8a-b570-48d2-9085-0da6cdd19e67", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639689961, "uuid": "bfcd21a3-5719-4888-8127-64093d3ba572", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689961, "uuid": "83728941-bd81-4ac8-b8ad-0b8601770401", "value": "a9ee78ca1b129dac55aa610283bedce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bcdbbf-5eb6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639689909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689909, "uuid": "c55b94f6-c919-450a-b0c7-b28de773d794", "comment": "Malware payload (Mirai)", "value": "93fde4e4094fb9fbc5b8498e2886ca79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689909, "uuid": "d0385fa5-25eb-4bcc-a4f5-b62f2bf68ea0", "comment": "Malware payload (Mirai)", "value": "18b9f80cd55c4b955176d16ad8f8def150ded4d482d0fde6df40c0c5a32af41a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689909, "uuid": "a5752dae-a6d6-49d4-94ee-897082cf91d5", "comment": "Malware payload (Mirai)", "value": "c0d61d2143e53719d20ff5bd8540075275b992a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689909, "uuid": "5cb087c1-4eba-4e24-b203-fae0331b71fe", "comment": "Malware payload (Mirai)", "value": "dfc64a9c3363872e7580a9a856e0ec125b474d8f2ac680892eb8bf7b1a56c60746dce3b5373cd2090dc4d7214c4d0917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689909, "uuid": "953827bb-9a45-4818-9706-3e6463521d85", "value": "T19983285BF8408B01D5C14576BA5E268AB71307FDE3DF7252AE245F30BB828670A3BD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689909, "uuid": "43e276a3-46d7-43bf-8eda-5d710ad2dd2a", "value": "1536:0hnvlirBvsobaAfEa/ScrTIxiXLXEaPGhPMX95QWlLJYkrQMetJ8aw:RBzWAfEaZXEaPuP09V/NrTetJ8aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639689909, "uuid": "3a70c3db-94cc-4b98-87b8-8fa7f44b1aa0", "value": 84676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639689909, "uuid": "bd2a800d-4721-4fea-b513-4e09f0affd29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689909, "uuid": "6b24c13d-b00c-4e3f-9314-86725da075c8", "value": "93fde4e4094fb9fbc5b8498e2886ca79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960f3964-5e8b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639671415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671415, "uuid": "b02bd2fa-1e99-4b90-becc-d52a6ae91a9e", "comment": "Malware payload (AgentTesla)", "value": "eae16980473277a6bc165a18e27b3fe1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671415, "uuid": "0b0613b4-6703-44be-892a-daa642b7bb86", "comment": "Malware payload (AgentTesla)", "value": "1a0ba6c1f9903e480d10aeecea22a688ebb35f9bdbe6b4c13e0f5ddef2f501e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671415, "uuid": "6692808f-8663-409d-86f0-7519251d111c", "comment": "Malware payload (AgentTesla)", "value": "7f39f193eecc8ee25e164a0e8141e79ed781d05a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671415, "uuid": "0f930fc6-9b63-4794-b921-470345363b9b", "comment": "Malware payload (AgentTesla)", "value": "ce44e57680dbf0423a75e33ee7822c496848d4f46f79c6a19228d0b49e53e96c51cc00fa5523cdb8e8b3256a3084a9af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671415, "uuid": "d89e5a39-93ef-4319-91bf-a86c189145c3", "value": "T1C7C4E00D35389997C5AC26F48427B1A803F16D3EE64AE6CB1EC279DF35E2FD0194099B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671415, "uuid": "c60738a7-f75a-489f-9abd-c580cc05b08a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671415, "uuid": "bee44e08-aca6-4201-b100-d16344b77fe8", "value": "12288:m20xQ8PapPapPaauSK3Eg64PKVYV/cCox9RgxL0CUhQjvtmkOr54vd:Z8P8P8PYSK3En4yqcfOL0VhQrns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639671415, "uuid": "ef72d8a0-9ba8-4545-a07f-4816ffe0701d", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639671415, "uuid": "aa25e6e5-7669-4bba-ba25-cfaacb5caf26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671415, "uuid": "300d2047-11b9-400c-8e72-2dbbe122752d", "value": "TT Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7eb258d-5ec6-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1639696919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696919, "uuid": "14bbdc95-f512-4a67-a531-9ff5a3b5b2f0", "comment": "Malware payload (GCleaner)", "value": "a16c9a8e1562e2fdd1842f0214470685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696919, "uuid": "b5c02253-f086-40b6-ba95-4b77543b57b7", "comment": "Malware payload (GCleaner)", "value": "1b5dc11f9124e1ab6feb136dfef1b86b1163ca8acd98bbc26b1f0d39095b3679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696919, "uuid": "b5faa188-e43b-4987-ad70-bc5287f25fb0", "comment": "Malware payload (GCleaner)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696919, "uuid": "a2fcd025-5f77-4f9a-a3df-3350039f8885", "comment": "Malware payload (GCleaner)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639696919, "uuid": "9edaa05d-8a49-45ab-b6f7-83db4cbf8a3b", "value": 11412646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639696919, "uuid": "eae3d90e-e469-4765-90b8-73c17ba6b204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639696919, "uuid": "60a936ff-5f87-464f-b3fa-9d82e5dd30ef", "value": "a16c9a8e1562e2fdd1842f0214470685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6075c56d-5e7d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639665312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665312, "uuid": "db5d2641-28dc-4d5b-b9c7-c9d4b1d29608", "comment": "Malware payload (AgentTesla)", "value": "62d616a1e21fb3c5ebbd577ef6a850f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665312, "uuid": "bd6fd7c3-0ef4-492f-b0a5-20721da34081", "comment": "Malware payload (AgentTesla)", "value": "1c4c74cbfbf8ff3188425f593b6563deace3cfebfffa42527e4b3f51a80c1fee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665312, "uuid": "c797768e-1165-44c2-8c77-3d9fbc77837b", "comment": "Malware payload (AgentTesla)", "value": "f0a69471af9ec794f4290e19331ba212abdb415a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665312, "uuid": "cb67e06a-2736-4af5-b149-fe13a9a44450", "comment": "Malware payload (AgentTesla)", "value": "56b82a130f53584baa61ab178e781b2fbff53c75b3a742f24ca8670cc4b01b56b8db044e623981f4f48a3ed312ab79b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665312, "uuid": "9f672c49-f197-49af-b972-2d664c1c0c6a", "value": "T191B4120037689B27C56D47FD4852650113F1E123B603EF499FD7B2EB17A2B428666ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665312, "uuid": "cad55033-6e45-4258-8876-95d0ab4b51dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665312, "uuid": "2eae7a97-eeab-4053-9006-930aef0cef64", "value": "12288:v+mwuHoA5QfJGRd1oKzcIWVPf3ZiLedwXr8kCRYgdZQHUFZ2bg+YTIHuSK3:iYoA5GiUKoIWVPMisr8kCRfd8c0cTFSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639665312, "uuid": "b712e305-ce51-435a-b915-65cd6c037f99", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639665312, "uuid": "4a2361a5-b97a-423b-8717-843ab11606ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665312, "uuid": "f2e2858d-06ee-4095-a777-b86f920aca1c", "value": "Bank Draft Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8de921d-5eb6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639689968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689968, "uuid": "75ffc5b0-a6b4-4bb4-af92-281f6be5a714", "comment": "Malware payload", "value": "89ef7342084bacafe1bbfc65ffc7f705", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689968, "uuid": "d912dc2c-2464-4360-91d6-08edb57cd68b", "comment": "Malware payload", "value": "1cdb8bfb8075c1e1c1bd93987ec457a83a2e8af4e98e3fb7dfc1d3a25db71037", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689968, "uuid": "582578b9-dd48-45de-b679-57f164063c60", "comment": "Malware payload", "value": "894a63be1c8288603792149dba855fb95c057c75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639689968, "uuid": "b0688132-e9da-484b-afe6-9168b3bc855b", "comment": "Malware payload", "value": "50e896ab6f8d0bb3c5f9310b67ff29ab3e28b87f59d3cd252c09f65fa90dda57657503e28b26b46c3eb69e4f0761274f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689968, "uuid": "3abb6aa6-4698-43b7-b4f0-d1a1dbf05606", "value": "T1CE952310AFA0D434F0F716F4897697A8662F3AA1677560CF51E019EE9A786E1ED3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689968, "uuid": "8d67b159-ab1c-4ccf-890b-69c3fcf17749", "value": "9a8dc8c7cdfd1f0f0b247a3b1f86c91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689968, "uuid": "a8d75fc8-07cf-40dd-8cab-e88c9c9cc055", "value": "49152:7rr3fGRderhBPsTLqxQnVg/tuMwp34FhmYK:7ffgerhgLu/tuMwt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639689968, "uuid": "287f54eb-e252-4cbc-b6d6-6cc178c3cf65", "value": 1924096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639689968, "uuid": "84cf0155-fada-46cd-b920-635fdd988c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639689968, "uuid": "28ec8fd4-4c6e-4998-b82c-f4fcf759ebd2", "value": "89ef7342084bacafe1bbfc65ffc7f705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722f632c-5e53-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639647303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647303, "uuid": "1a5b18c0-57f6-4d12-beb1-e34ba741ae0b", "comment": "Malware payload (Formbook)", "value": "4b61202928df12bf9fd1aa7ae12cc743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647303, "uuid": "30dd2826-1cf4-4a8e-b839-4987733e0c54", "comment": "Malware payload (Formbook)", "value": "1d62ae45c62db87a620725b6ece3a6c5c32495a37a06038634002ff16e5365f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647303, "uuid": "fd09206b-9f91-4f0f-8b4b-76cc91043010", "comment": "Malware payload (Formbook)", "value": "83427d18ce784aa66b509fe9871d6c364558fe48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647303, "uuid": "f6a8340b-9a61-4cff-a01b-2f98e0a44639", "comment": "Malware payload (Formbook)", "value": "138a1dcb0739aeefce4e2b64b883ffa8477d553464586d7fdfaf2fab547653acc7bec81a2eb927e660d44f6179707494", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647303, "uuid": "3d943ed9-ba18-4ee5-8816-7b09dbba9c7c", "value": "T165A42388F7C05C3BE59A45313BB2A97DCF372A50076929AB5B14FF5F6DD6A034D0808A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647303, "uuid": "5bf44850-f6b0-4f26-bc97-b88aded6afe3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647303, "uuid": "be51cd8a-341c-4087-8e81-dba379a31ad3", "value": "12288:rUovpmaI6p2KG1jrrzAzy1ivc4mPF81cLgZ:rncyp01v6y4vRmN81k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639647303, "uuid": "d8d87b33-f988-4b83-8b9f-f60189d40e82", "value": 475079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639647303, "uuid": "ae756833-5545-48ea-96e5-950ff90f733e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647303, "uuid": "c75c322d-c533-4dcc-8872-e053a84a8b4a", "value": "4b61202928df12bf9fd1aa7ae12cc743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284b9dbd-5e89-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639670372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670372, "uuid": "25db71f6-9922-4380-9662-7c6e3172b633", "comment": "Malware payload (SnakeKeylogger)", "value": "2ffdbff06237a3d07000cc399780989a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670372, "uuid": "685acf32-39cc-462b-b7cb-2fc12742d912", "comment": "Malware payload (SnakeKeylogger)", "value": "1dc5e1ebd133ce483936a5f19864a3c79dcd770437d72941e4c7bec1db10715e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670372, "uuid": "35d5c1c5-2cd1-4915-9641-dd6c114faf4f", "comment": "Malware payload (SnakeKeylogger)", "value": "1c56cca6e9376743621023726202687af957f9d3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670372, "uuid": "fe6affc0-f0ae-4c25-abd1-9b93e1ec5c52", "comment": "Malware payload (SnakeKeylogger)", "value": "05af29618993c7a5717c7e05e875176188ffea79189ec5a46442b739b36c60ec7d377ca439730630554d4c24da09887b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670372, "uuid": "1d32dfa5-1590-45dd-bf12-9fef4648048a", "value": "T1F41533657F7699C86220FA1FCF0249CB6C6A093412ED5CDBC272DEE0B93B16177D8191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670372, "uuid": "44cb294a-d9d7-4414-a024-2e0ac954d93b", "value": "24576:54SkpYsUGFtiPgIbL/t7DFaE8g7vUymSZwC1S2z8Aq3d:54S2cciYchQjkvUd9i8Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639670372, "uuid": "af4cf0d1-3074-4e0f-a8f8-c9563e3ee048", "value": 956354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639670372, "uuid": "d2ae9d01-0513-405d-8708-a8a4629f80a6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670372, "uuid": "db2fb6b0-8257-429e-82f0-7510e19e2b5a", "value": "print_01.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7880748e-5e58-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639649461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649461, "uuid": "65de4af5-b5ac-4f9d-9161-6a466cd027f2", "comment": "Malware payload (RedLineStealer)", "value": "2a688c127e47830fef88c5361e949a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649461, "uuid": "989a044d-6965-410f-b800-0f69b1ebb63e", "comment": "Malware payload (RedLineStealer)", "value": "1dfe58c930d347e68d581340323199231607a00f45ae04ba2c0a54a8c6dd122a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649461, "uuid": "dd802821-992c-4a0c-b773-23cefc808266", "comment": "Malware payload (RedLineStealer)", "value": "7002015897cb613396f12d8b98b1edb26262ccc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649461, "uuid": "0e57ca45-e542-44b2-8ace-24160f79269f", "comment": "Malware payload (RedLineStealer)", "value": "3fb5c7196d8c19e4dbf907139a016d850052457b6c3ced601d03605dfa1c783abcf6a6e897d5b7b65bf5d0c2112e9a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649461, "uuid": "5bc7da4a-1f28-4864-a7ba-8f158ecd4453", "value": "T1B9A4BE00E6A1D035F2B312F859B59378AA3F7EA15B3460CF13D426EA46786D5ED3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649461, "uuid": "66c8dba8-d55c-4a26-badd-231afbeb96e1", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649461, "uuid": "7c61755f-00c2-4263-9628-1b63dc44d223", "value": "12288:3thagedRc89jhwN+XmLkfJ9hlt//CQ5m:dhTmRc8fXXzdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649461, "uuid": "95b11365-0785-4845-b327-3c6454526978", "value": 456248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649461, "uuid": "910e5d78-6562-4f73-be94-90711a4d15da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649461, "uuid": "812ad881-e2c1-4b54-82c9-77466337a745", "value": "2a688c127e47830fef88c5361e949a7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5d113c-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650216, "uuid": "86d475a4-ba07-47f3-a472-15474b9cd8aa", "comment": "Malware payload (Gafgyt)", "value": "6f94e7a03a163bdbcebe5b1ae41ff146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650216, "uuid": "2f880187-859b-43d2-a030-8bd1803de4ca", "comment": "Malware payload (Gafgyt)", "value": "21498f371129eb134fbcaf9d619c5512a47259b3334eef0e5862f6b855406117", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650216, "uuid": "8f00e59f-04f9-4c1d-b7df-5d8b2aec009e", "comment": "Malware payload (Gafgyt)", "value": "9a6048b327dd8c3260e9c58ef0a896780c548fe4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650216, "uuid": "4b1080ac-fa38-4cf3-9075-c8cd80577fc7", "comment": "Malware payload (Gafgyt)", "value": "8133298d558e8623ef93247b625c0fb8bc28938736456b46abd285a8e193aeac1fcbcc42da3d041707b65e3ba962239b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650216, "uuid": "8409639f-827f-4cec-9c74-b3b19388788d", "value": "T1D1934AE2AB41C5B3C14306B2129B9B111533F6BB1A4A9E56F36C7CF49F190C97522FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650216, "uuid": "f1a11fc9-2ea0-4425-8ffb-4275eaedc698", "value": "1536:F+HKUEU0jpvSKslhh9zaeIpw7cwJx/wBXT5hN2679l5M/kmIEym2eVo0iiiZf0pu:F+qUEU0jYK0h9ueKkcwP/c5hWEm2eVoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650216, "uuid": "e8800460-d346-45b0-b659-9dd76cc2bf04", "value": 95104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650216, "uuid": "8b462b2a-5fbb-4b0e-b486-cb4e0bb66664", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650216, "uuid": "601f75a8-1216-4650-9659-2f9ca8a1525a", "value": "6f94e7a03a163bdbcebe5b1ae41ff146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0754be7a-5e2d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639630803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639630803, "uuid": "f9506b02-8288-4a61-830d-220085cf2be9", "comment": "Malware payload", "value": "47741b5a2fcb00b2d9eba33c4a416453", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639630803, "uuid": "79bd0a20-a445-4708-b5b7-a8c8c3702497", "comment": "Malware payload", "value": "2164d3b71ded74481833c298bfb368902c3985c2d4bb71588406058d5ba029e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639630803, "uuid": "c5ece094-177a-433f-af36-00ccc84c78e3", "comment": "Malware payload", "value": "bf92746e6125ce5def1271776a60e18d8fd0cd42", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639630803, "uuid": "3f6365ce-177a-4fb5-917f-7d68b9223343", "comment": "Malware payload", "value": "7d504379c1e576387264309966ddb7e4c9d9169f7e1ce144f3700426c4b3221a045ade3d15f34e1892bb9f1c54be7947", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639630803, "uuid": "8de19396-c706-43e8-a0bf-41991b71745f", "value": "T1D006330C239EF4FDA49A493C3B2689B0C9E452F5DC8225F3863815940C3F67D5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639630803, "uuid": "8dab5357-dc43-4958-bf93-2ad4edf4bdfd", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKr:0XSxVJG2fLAqFOfT9sMYNM29r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639630803, "uuid": "88eb2051-1501-4986-b494-3883a0da7db7", "value": 3776512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639630803, "uuid": "c4a28543-2255-47dd-851b-c089fbaf5f96", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639630803, "uuid": "5c1f8132-93a3-4bb6-a96d-c0d5b4b17c6d", "value": "2164d3b71ded74481833c298bfb368902c3985c2d4bb71588406058d5ba029e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec140c2-5e34-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639634224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634224, "uuid": "94549a85-fab9-4a1c-bff9-db38e80c07d0", "comment": "Malware payload (RedLineStealer)", "value": "7cf07d124508734129cfa1cc7b559421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634224, "uuid": "03377869-dfb2-40be-a7dc-1fa28fbb44f7", "comment": "Malware payload (RedLineStealer)", "value": "216a733c391337fa303907a15fa55f01c9aeb128365fb6d6d245f7c7ec774100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634224, "uuid": "da23adcd-87ed-4279-a96b-8afc4aeb6cba", "comment": "Malware payload (RedLineStealer)", "value": "7412cc99a555355bba0b13637964f48d094813eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634224, "uuid": "40844c21-735d-4007-be99-4aad4660cccd", "comment": "Malware payload (RedLineStealer)", "value": "ed6152564e4b517041471f863ef777b2f208701b836e2f98a03a80ea7f60ea57b0a71ae12f883558015383797ebd8559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634224, "uuid": "012a3055-20e2-4bdb-8158-e1ce9bc623ec", "value": "T113051D8FF5C38245EE86177A85E3BB444BB850F9032B07CA8325A5E54BFF56C9B00D96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634224, "uuid": "57d79305-8e7b-4e72-923e-2e276d6419ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634224, "uuid": "7fc3bd0f-6b8a-4c07-a29d-04add169ac2a", "value": "12288:nY4N9LnKGvtm8gJGM3TxnMJGPs+GxTMDBT2/Xm:njVlUJGad+YQxSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639634224, "uuid": "77305d7c-8249-41a2-86c1-b3ef50f179ad", "value": 863624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639634224, "uuid": "2367f3c0-fc1f-4f2e-be6a-0404d7dc29c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634224, "uuid": "c70cd5c3-6631-454a-9bd0-59e773d3d587", "value": "2021_15 (5).scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae3537a-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639646566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646566, "uuid": "74eda831-50a5-4863-ab9f-30d709ea46ce", "comment": "Malware payload (ArkeiStealer)", "value": "d61c53b64265b6c29ad7992aa0228a53", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646566, "uuid": "c50d5557-7e6a-42bf-9df8-2ea59a50cc24", "comment": "Malware payload (ArkeiStealer)", "value": "21a40be3191bbd47b5fc458d5adb4159f1285dfa491acfb10cb34af5be110c0c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646566, "uuid": "88e60d9d-735a-47fc-862a-91bb9d6089e8", "comment": "Malware payload (ArkeiStealer)", "value": "e70986c3656005ccd69a6f5e6072be15e0a38376", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646566, "uuid": "a49eea71-f637-450d-a7fd-a18321e82f1b", "comment": "Malware payload (ArkeiStealer)", "value": "0d4521dc12bdf87e71e37b314fff83a441e20239a1a4c934283af27a64ea78678e3f81797085025b9b10637084517d7d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646566, "uuid": "3b41dab8-e924-4095-89eb-2bad2fc4e466", "value": "T124F4F110A7D1D035F1B612F85971A3A9AA3E39E16B3894CF23D125EA4B74BE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646566, "uuid": "c352f088-c6a3-4881-9077-0dca2cf21f38", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646566, "uuid": "f2fa263b-615d-4420-92d2-3c55573c2b1c", "value": "12288:dU2tB4D5FNm/Tr4EBZjiH1TT77ZLx2KSERyIVUlz2P2VLnj9JQkJ+8y:dU2tBkETdUVHz2KSOVY22wP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646566, "uuid": "f68278b2-a693-46fd-a654-91af8f2c287b", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646566, "uuid": "1bddb4e8-c6ce-4e92-9bdb-bfc1a8e6f317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646566, "uuid": "df0da86b-f6cd-4c84-b9f1-1c7b0c07f78b", "value": "d61c53b64265b6c29ad7992aa0228a53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8068b3-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639615618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615618, "uuid": "b57e2aa9-cb0f-4bd2-a10a-09fb3ea1bff5", "comment": "Malware payload (Gafgyt)", "value": "38dbdfbe7390e3684ea0907c8974674e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615618, "uuid": "a75b0972-fe29-4144-b7cc-e30b5b2403e9", "comment": "Malware payload (Gafgyt)", "value": "221773da548c7681f756111e8543604b09471d25771b28547638beb1430fec90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615618, "uuid": "ea65d9e2-e923-488f-a09f-2c581bc21161", "comment": "Malware payload (Gafgyt)", "value": "4f97fbabc60e2da50f4555dc7ed3cff0116ad467", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615618, "uuid": "e995d6f0-4bd1-4b93-af30-090afdd38ebd", "comment": "Malware payload (Gafgyt)", "value": "c0526421e70c2b0160e436253857c0f20d21e714f82825b583e103886454675f4542f2114c7229c17fbc1b4891f1aae7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615618, "uuid": "366653a3-0234-4930-ada1-844fbdb2faba", "value": "T1A8130212E28458D0ED713FB66999CA8D95171E3CBEC715E7E318A05EDBE2C136A6FC00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615618, "uuid": "d85c6753-bc6f-4565-9211-7f2aa2672f80", "value": "768:KANaqDcHoZNkodsMcKGznhVE9ELz7aBRAwdrNriKYSDJi3U/8IASSJ:oqDc/XM7Ew9ELsHdrNmKYS1H7AnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615618, "uuid": "0f676944-2f02-45cf-a28d-7c4cb60986de", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615618, "uuid": "fa7b51d7-642b-4c41-b6a9-908d0dd5899d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615618, "uuid": "20a257c2-95f2-425a-9c54-6f2b5ec96fc2", "value": "38dbdfbe7390e3684ea0907c8974674e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88da1f4d-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639616847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616847, "uuid": "6d2890bb-84bb-46ef-8400-e70d31f1e094", "comment": "Malware payload (Dridex)", "value": "8c50cc9362742649f423de32e1e812fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616847, "uuid": "7f2ec6c7-a8f7-4dbd-be40-c15d9b5175c6", "comment": "Malware payload (Dridex)", "value": "2277b7c1b0c715b93395bb6f616d99c7bf5ad8a08236a098d50849267043f2bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616847, "uuid": "1bad72b3-ed69-4928-b517-9ec280f17412", "comment": "Malware payload (Dridex)", "value": "0bc2bd4f902f876524dc1d2da007bb823008b339", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616847, "uuid": "1b9aa79b-7489-47bf-8506-9e29f122d0a4", "comment": "Malware payload (Dridex)", "value": "d6a1f694d27c823ed0c265636fef6beae5f250471f1844d437caf7c4cac4aca978529b42017edeb78aedebca6e2c8995", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616847, "uuid": "6c9ef698-426f-46b3-b74c-1929b068bb58", "value": "T106B4C0A33F4B0C6AD4525D3CCABEF7A6082F66454588CF3072A3735AD6F4542A825CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616847, "uuid": "c8f60cd3-8d06-4bb5-93af-73590dc69932", "value": "425f8965b1dafa239bed13744d5413de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616847, "uuid": "e73b2e55-5ecb-4c2a-8902-9338aeaaaf2a", "value": "12288:Aov+2yIUMs4UQ0EysQeu2LzmWMdUJPRXLZvR5xdzkU:97D5MdUiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616847, "uuid": "ea0ce0c9-ce36-46cb-bb20-e0faeacdb9ae", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616847, "uuid": "7172ab03-eab9-4c7f-b6d8-71a8080edc6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616847, "uuid": "e0da13e9-0c0c-4a14-95ae-761b00a9564f", "value": "SecuriteInfo.com.W32.AIDetect.malware2.14847.18441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3e8be2-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690779, "uuid": "8996c9f2-ea5a-4c3a-80dc-e8964d950ddf", "comment": "Malware payload (Mirai)", "value": "cbb870d9c7fd3cae8ca7ef0214a55b82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690779, "uuid": "d3bac422-8d69-4b96-854e-25643ca20caa", "comment": "Malware payload (Mirai)", "value": "227c787c29ff00b5a08037fbb03ad0fd238230bb1de5aafae5a2b5d43e48d48c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690779, "uuid": "d2007581-270e-4548-8305-f0f072d84ac7", "comment": "Malware payload (Mirai)", "value": "b72785771a64d7fa28ca5922f1bc0f3521a471f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690779, "uuid": "5d4aa038-bed2-45d1-82bc-3663c6619da8", "comment": "Malware payload (Mirai)", "value": "a2bd67e990b513f6bbc5016f5e0aa1d3c22fb6c1dbb1da41cb8475969281c39bc073e92e2c1fdbb494cd3d153a96f27b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690779, "uuid": "92effdc2-1f29-4935-b035-9e3ce8e3aced", "value": "T10FF2E99BF8418196C5808AB3339F7B89766363FAD5CE32D3EA640970ED125171B76EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690779, "uuid": "3f026a11-2e4b-4daa-b5b7-9fc2ebe7a928", "value": "384:8OW3udmG5DXwiQCa8sAxfdWp9d7UNhOwZKouZ0nYdnqetJ8aJYP0YK:8tUTHxfE7d7/zMetJ8aaP0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690779, "uuid": "ab43ec7f-da7b-450f-97f4-ad42b6417d8d", "value": 36216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690779, "uuid": "3d9a2179-123c-459c-a29b-9aa37ed339c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690779, "uuid": "25ac07ca-fcde-4924-a8ec-e23e7103b3a7", "value": "cbb870d9c7fd3cae8ca7ef0214a55b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8412e5fd-5e17-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639621563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621563, "uuid": "61bc1b96-da12-4447-971c-9423cd3600b4", "comment": "Malware payload (njrat)", "value": "fd08b4818cca94554574c5e7a3c5a57d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621563, "uuid": "f0ae4f9f-916f-4778-a9d3-567a457e30bb", "comment": "Malware payload (njrat)", "value": "23f046f284a367fc1f2d0444f1f9508602b84a528593d209246d8ec987165d60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621563, "uuid": "f7705655-f789-4294-9ad1-00f0dc287c5c", "comment": "Malware payload (njrat)", "value": "64c66820b0caa0bfda38230c269679bd7dbe66ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621563, "uuid": "7346ab08-77b8-40de-8a11-601477ee5ad8", "comment": "Malware payload (njrat)", "value": "348b469690663777b281b2e6ba6c3a540afb880e0c84e2a0f7fddd33742417fbaeb6558912d95a2858e1375cdd591b8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621563, "uuid": "5041827f-b7d2-4f86-852d-4c1c94cffc99", "value": "T13BF4F51567565F67F07E0EB44A2103944EF45C0AEB1EFA9A2F947A8DA932F01C32F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621563, "uuid": "80b9b73f-499f-4df6-8af1-a57ffcf0b1a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621563, "uuid": "46aa7d57-4194-40a3-8451-78be9466100a", "value": "12288:/E+Jpj1ZcQZK5WLKdurO7aKbzYyh/vH4fOg42UH2USKK8BMe:/5pZZcQ0zD2IzYyxvYB4BlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639621563, "uuid": "21a4309b-1eda-4fec-8713-aecd4d02709a", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639621563, "uuid": "7344e7e6-4bce-43c6-b729-b45bf6118350", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621563, "uuid": "52bd6419-a3d4-47c1-9bd9-dc5a07eeb3db", "value": "fd08b4818cca94554574c5e7a3c5a57d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b78fbe-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641700, "uuid": "c60fd0af-02f2-4800-9e27-6811ef4d7471", "comment": "Malware payload", "value": "fab497d380f3e0e4a32a4dbb308fcec4", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641700, "uuid": "50f068fb-ba5f-4a39-9f2d-35aaf9645020", "comment": "Malware payload", "value": "2433420794d355cedd35679ecb52cc9e0bcb94c926bf01c9cde98d235d4a9630", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641700, "uuid": "cc2710f3-61da-4f4b-8e41-2a19e20ecce4", "comment": "Malware payload", "value": "dce9c94d9efe662ea27e8e62741e813c99039fd8", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641700, "uuid": "f1234308-36cd-4ec5-8a2b-c2b8af356010", "comment": "Malware payload", "value": "af144041ed5966e5466a442178945314784d306f40216804422b74d24854b3d3949e7ef308ad35cd763ed88e9fb257a5", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641700, "uuid": "51dfae5e-8484-4718-9a5e-c740f4044a43", "value": "T1F06412A073DEA3D7F24216F8D5A6853A12BAFCD95F44C026846F338560BB19CC81767E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641700, "uuid": "87b9e728-ab47-4538-8a8c-cef1b5704e05", "value": "6144:NWdTODp78BYX0PQc//06T6FcQoTnFSHCOm1PVmmbZqhvSI6qpDlq/Q2lSN59Igu:NWWpAk0PV/P6FcQoTFInmJVmmbmNJlqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641700, "uuid": "55ce54d1-78f6-4f7d-b8f5-1ea5e6076feb", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641700, "uuid": "a39e699d-d3a5-48e8-8d8d-8b61dca861e2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641700, "uuid": "635c529f-866a-49ae-9111-928ba50b0475", "value": "PO-1128-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05d3c2b-5e89-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639670680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670680, "uuid": "af6c66a6-d127-405a-9829-1ce3c9c4a4de", "comment": "Malware payload (Quakbot)", "value": "f79f51fc334f3083dcc333129602a94c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670680, "uuid": "5ec4eb58-ed0f-4e4d-a589-4bb5a345a3af", "comment": "Malware payload (Quakbot)", "value": "253b5a915f1d7e14804228c862f39df4f8b2a7e7f96d94a863069c1c4d87e4e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670680, "uuid": "aa543f30-b68c-4074-a218-fab480fb793c", "comment": "Malware payload (Quakbot)", "value": "64c1d8025ff605baa94bcb100d864b87e583177a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670680, "uuid": "e4676924-e930-4edf-aeb8-3fd050eafaef", "comment": "Malware payload (Quakbot)", "value": "e3323bc4d3d8d2e0f9ac57380b0f0c83e4c44009c4cff36b1a8c8b0899f72f9bc473db73bfe937b64e0569f26ce9a9d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TLGM ApS", "colour": "#F1F4F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670680, "uuid": "4d7d1de7-a3e0-408d-acc3-ffbd81e74cc5", "value": "T155C49F36B2D04837D1672A788D1B5369D837BE012D38A84E3FE52D4CDF396813A76297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670680, "uuid": "08492621-348d-4164-a2af-c102ebd9c539", "value": "91139ccb2a3b59e812fc4cd4988e2acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670680, "uuid": "385c8f3d-dd66-48b0-8984-7a02d0ff33e7", "value": "12288:1YYoFUdPEUPzWbJf+oMDAAYFVfpAQqtx4Jg01/RZK7NSb6Vk:qpOEEWdfMUPzWQqtxQg01/mgbOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639670680, "uuid": "5176a560-f17d-4f39-9ef7-fabb3879f3fe", "value": 592784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639670680, "uuid": "9bfa9d5b-717e-436d-b412-3a240f696842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670680, "uuid": "451a4e4a-7deb-43b9-a471-76c05e9ba277", "value": "ikwfxydkgnt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c741f2-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639615627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615627, "uuid": "957df6db-95d5-4185-a198-e27504aa1220", "comment": "Malware payload", "value": "f863ce8085b1df6d4abf21df5d42cc5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615627, "uuid": "f65c76ad-48e1-4721-9acc-b2a6be5e4562", "comment": "Malware payload", "value": "25509e323baf7cea9296f0ca124f5677a7dbdd2a93e26d4721d92df2068a94b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615627, "uuid": "6113bbd3-cba7-49e4-a83b-615c3dc6b8c0", "comment": "Malware payload", "value": "50347e4030cb2e323ba0491f572e10a94ca5b015", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615627, "uuid": "166a4c4c-9502-4542-b59a-1182592da83b", "comment": "Malware payload", "value": "322fa6c084b93371ba1c455c8d459a1384479d17ea82f919b9c321349350efe0de29c926ffa49673e9e7cabc9094d3b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615627, "uuid": "941b03ca-4d86-4e21-97ae-2139e62e0691", "value": "T15313F136E965CD5DEFA71EFC49E067D11BA05C0933A149D191B1BEC36FAC8332A60AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615627, "uuid": "3fd4c1f1-abfb-44cb-9035-8843163ffdf6", "value": "768:VXZMY4GCloP1B/7s8RD2TgeUkIjjQaeA/+D9eR8JVaNQEF+uNz8Y2c4uVcqgw02n:VXV6lyJHVvjQi9R8SnF+gx4u+qgw06WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615627, "uuid": "b9fef148-83e2-49c3-8a51-5c14e9e54597", "value": 43452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615627, "uuid": "be7341f9-24b4-4f14-8c62-7e028e3b06c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615627, "uuid": "59d3b52d-ee9d-4c9d-aacd-60ad4f85d462", "value": "f863ce8085b1df6d4abf21df5d42cc5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90439a92-5ea1-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639680854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680854, "uuid": "d3795bc9-070c-41f3-897a-1bf59bfd0b33", "comment": "Malware payload (TrickBot)", "value": "824df92374ab73f4975dc5d4be868a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680854, "uuid": "5cef11b5-7ac8-480c-a272-b7df76f6b522", "comment": "Malware payload (TrickBot)", "value": "2586d4d0fb6798a84320492847b839815b787970c9f279acf1d1436780c40a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680854, "uuid": "73f108cf-e0d0-4264-ae26-e4391dea3e6c", "comment": "Malware payload (TrickBot)", "value": "9523c81f56912db91cb1c477163ef5f54122dbf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680854, "uuid": "e154b38a-da4e-4212-adca-0bc81d6d9dbd", "comment": "Malware payload (TrickBot)", "value": "1e602ace97523ab569951d2b4793b5a3210703ef075403b47e2ea8e34bee27e428c04cbca1e898aaac4b65bad54fe28f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680854, "uuid": "ddd2d5e2-43af-40b3-991e-101cc1af4d5b", "value": "T1B574F1117390D432C4661930547ACEB11A3F7CE6F6648AAB37C43A6E3EF17E119363A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680854, "uuid": "77e10127-2001-498f-8293-83e126f64699", "value": "1e14b9e859467fd4c1b3bb619c1a4550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680854, "uuid": "2c062e2e-e8db-44fd-9568-51fb97077ec7", "value": "6144:+7a7bh89lgMMMMMgMoJMMMMMMdMMMMMMMMMYI1MCQ4UCLgW6uGpofipdZT4kfmA5:+7a+9SJMMMMMMdMMMMMMMMMYI1tbUCLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639680854, "uuid": "49ab6abf-005b-4d37-a8e9-3692ec0518a9", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639680854, "uuid": "ade22186-9488-49f8-990c-3dca39b4fb0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680854, "uuid": "c1bd228a-82ca-4ae7-8497-ec2043a84dd8", "value": "2586d4d0fb6798a84320492847b839815b787970c9f279acf1d1436780c40a3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71d4c95-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690798, "uuid": "796ca57b-2392-4710-9df9-5784ad211994", "comment": "Malware payload (Mirai)", "value": "830a7be58ac3f2175d1ff6ab37864024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690798, "uuid": "438fd575-73df-4611-be2f-6e9608602960", "comment": "Malware payload (Mirai)", "value": "260e103a599941fa3585ed223d3729e3a7854a5e06363e16182e29fa1077bac9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690798, "uuid": "94c12aed-1cac-4e09-bfc4-a8c735a32c37", "comment": "Malware payload (Mirai)", "value": "c1aeef5de4aa4b6132ad1d54bd3856b9e505d6b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690798, "uuid": "8b9e5dcc-b1f2-41fd-ab24-252c9e8fd69b", "comment": "Malware payload (Mirai)", "value": "b305456f8eae6b1f6d50828675aed449d023d97cccda33c3a8c662d18b0a5c50bb5337604f8958ea415cc1e717ba39a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690798, "uuid": "4913ea3d-edd2-4ab6-8fc9-792c406dd17e", "value": "T10B83F91E7D218FEDF268C63117B75B21A79963E622D1A2C1E2ACC5106F3024E156FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690798, "uuid": "30c58fc8-f9f6-4b05-9fe6-5e649b3325ba", "value": "1536:ByLF3lH22amLhms3dy9oevBUBIyzMetJ8aDcT:4LF3B22aqhms30jygetJ8aDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690798, "uuid": "c3ca9153-5c64-4a31-93c9-bf0c2f054949", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690798, "uuid": "dea0a488-80e5-4f65-b2c7-81b621edb642", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690798, "uuid": "70dbaec3-16ab-42aa-a2e0-84439deede60", "value": "830a7be58ac3f2175d1ff6ab37864024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbed3deb-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639613496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613496, "uuid": "9f87c12c-9f80-4ae9-915c-fb4683ac3104", "comment": "Malware payload (TrickBot)", "value": "5a9bd68976925253a93105cf5f27d8e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613496, "uuid": "7ca73387-f597-477f-af5c-091aae046f64", "comment": "Malware payload (TrickBot)", "value": "27298bd1cc024cf7807b22de38b4bf6cc24109dae62a16583e50f7fe65c94590", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613496, "uuid": "44db9968-fbce-43d5-b525-d1d0bbaa2a1b", "comment": "Malware payload (TrickBot)", "value": "886f47c5af62fd0ae5dbfddc68333ac9a59ab0bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613496, "uuid": "09e8c92f-f6c2-4453-a660-78bf0e723bd6", "comment": "Malware payload (TrickBot)", "value": "cee29081d4a6246153e7e350e802114e452aba399b8c157a2061ec43fa46d9e2d89fb0db0007a48e3f27c76cd45c348a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613496, "uuid": "79c8d129-ac0c-47ab-80ab-ba76ee864395", "value": "T15274F1117390D432C4661930547ACEB11A3F7CE6F6648AAB37C43A6E3EF17E119363A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613496, "uuid": "b24c48b5-4cb9-4204-a1d1-99bf73ed35ce", "value": "1e14b9e859467fd4c1b3bb619c1a4550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613496, "uuid": "8d09b8f8-f1ff-4589-b378-2940f1b2ddd0", "value": "6144:+7a7bA89lgMMMMMgMoJMMMMMMdMMMMMMMMMYI1MCQ4UCLgW6uGpofipdZT4kfmA5:+7ah9SJMMMMMMdMMMMMMMMMYI1tbUCLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613496, "uuid": "fa2f0b6f-b385-4118-ad15-a71500e1d233", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613496, "uuid": "904ac21c-f346-4f97-bcba-2f7d25af2d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613496, "uuid": "eaa0b44a-abf8-4e68-a97d-96570d2122d9", "value": "5a9bd68976925253a93105cf5f27d8e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca1066b-5e88-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639670137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670137, "uuid": "ea8578ec-a742-4fa2-83a4-f90b037aded4", "comment": "Malware payload (AgentTesla)", "value": "dcbdefce1a41c56a718c435eba70da83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670137, "uuid": "cbb8838a-fff7-4383-bd1e-82f03461802c", "comment": "Malware payload (AgentTesla)", "value": "274fe8d15a374d802b146606f08d2a65d418df660706a9d117b10c9be038bf00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670137, "uuid": "1d1b0e11-8aa9-46a2-880f-c94fac2ecf80", "comment": "Malware payload (AgentTesla)", "value": "23a46e5ab7393ecbed1fcddd37b36d468121f39b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670137, "uuid": "81b4e5eb-9314-4a3f-89d6-0ada4df5533b", "comment": "Malware payload (AgentTesla)", "value": "9141173c3049af74f99988448ce8228d8cb64ecc9b942c8fb4c83bd3905461ae263163b99b1e50eee18242b711fd301f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670137, "uuid": "0a9054b2-f787-45a4-9463-eec836c5a964", "value": "T11AC4AE5936DCEB98F4BFE7B94CB1204083F5F5C2D211E5CDFED434CA4961B848A26A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670137, "uuid": "521a4605-5c8c-49df-ba9a-4a0af26183cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670137, "uuid": "474c9105-90af-479a-9525-d76a9cde50f6", "value": "12288:ml20cwcouPrDU+5lxeohCpycRp8l2nOCXOu7+k/8xhI/FkZcXcO:mSeM4ycRpvnKuak0xhI/FRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639670137, "uuid": "50388d47-c616-4c73-b559-f6c8c3907b01", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639670137, "uuid": "98b6346f-177e-4bf4-97c1-bf082d54dabf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670137, "uuid": "0dfa50fb-dfbc-494a-9f0d-81c0f4a10b58", "value": "REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06abd60-5e63-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639654279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639654279, "uuid": "db4f8b2d-4402-4325-8447-23c05a660da4", "comment": "Malware payload (RedLineStealer)", "value": "dcee839332b26e11aa52d17c05c6e3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639654279, "uuid": "2162b49a-fb8c-417a-8c3e-35cc59275785", "comment": "Malware payload (RedLineStealer)", "value": "2803855499d5c79b146c5414f54a14fbf771bf7a85d43532e2d0abecc3bf0b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639654279, "uuid": "9e27d239-d40f-4369-8bc2-e81217af80c8", "comment": "Malware payload (RedLineStealer)", "value": "fbc541b160d197d3644ec93d76cff3c1212b2206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639654279, "uuid": "f5e06168-3415-4db8-8b99-f93b20e9cb05", "comment": "Malware payload (RedLineStealer)", "value": "2141b3114be2c4084083817fc1531c85db9463d2bc64df28bc424652973709b992b114db420da0f15b35a5f86a23a236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639654279, "uuid": "460c7cdd-1187-41bb-b502-80759370575e", "value": "T1E4A4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639654279, "uuid": "b586db0d-7b31-4f3d-8ec8-14d5aa05a947", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639654279, "uuid": "af99f644-0872-4bcd-a6d5-35f5570e23ef", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639654279, "uuid": "bafd04c3-601e-4b51-855a-8b029ce7b8dc", "value": 455716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639654279, "uuid": "a91be5ae-178d-4d1b-94ab-9e773a7f334d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639654279, "uuid": "00dfc742-4d2e-4d7e-a941-a9c183b2e20d", "value": "dcee839332b26e11aa52d17c05c6e3cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40536b62-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639646360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646360, "uuid": "289fbdd0-6d90-4ed7-86f4-619ff36772a6", "comment": "Malware payload (AgentTesla)", "value": "98bbbb73105ea39a93e16f3586e2522a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646360, "uuid": "2e916410-3cde-400c-a753-51200fe36318", "comment": "Malware payload (AgentTesla)", "value": "289d6e4a972aefbecea96ccdffa9ecf5cdc57e0a9bfc1688446b3b2cd784d64b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646360, "uuid": "39fc39bf-8a05-4149-b4b9-593bbcf99ab1", "comment": "Malware payload (AgentTesla)", "value": "19606fd66f3b329136f9e7c68c2dca9b0d1ec511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646360, "uuid": "322ecdfd-2562-4c60-b299-4aca520fdf38", "comment": "Malware payload (AgentTesla)", "value": "d673d84c091d10893d56a8cc1e4f5c8209211e4cb9f93b0a0a9471471c72d1dbc06e4ff889abb274a8747f34ba26d8bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646360, "uuid": "fdaf48c0-8178-4cb2-b80c-76ec30b074ce", "value": "T172A423CDC7C5339BC92A077667B0E62DE277C1B501AD860B43954E2D7B9A3839437E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646360, "uuid": "a7ad40da-84e2-4889-8f62-ae3a8ec0063c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646360, "uuid": "2f8573cf-af6c-4e9f-a13f-99c9f471bf0e", "value": "12288:YEGj14iN5JC28jFNwlOcVo+0BO4r6LiEK1BEpYcn5:YEGJL9C28ZQVoDBO4rP1Bkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646360, "uuid": "b83c7412-95b9-488c-9895-4a236fc6aad1", "value": 485910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646360, "uuid": "de897398-e0f8-466d-9bd6-487be635bbbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646360, "uuid": "559ee28b-9661-458b-b741-b9ba5d05e8e8", "value": "98bbbb73105ea39a93e16f3586e2522a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5029fef3-5ea9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639684182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684182, "uuid": "4acdf469-fa70-4ef6-98b2-7c20af256569", "comment": "Malware payload (Mirai)", "value": "f1c4138d81b624034312a1baa02a94cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684182, "uuid": "1506b34a-9ca1-4b96-bc5a-71c8e11d7649", "comment": "Malware payload (Mirai)", "value": "29f4d6396cc538bf4f4a5d0f2901e301711e9c7c4296011346edc2c390430042", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684182, "uuid": "3a0ec7c8-59c6-468f-a04b-c46751d0a289", "comment": "Malware payload (Mirai)", "value": "342338123789fa08fa21daabb2f7ede8832d7d3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684182, "uuid": "b94e79ee-ca76-4bf1-b5c8-0313da0bc04d", "comment": "Malware payload (Mirai)", "value": "17a902a942ddc2a9f9f6d5f72e922bb3941cab482729529d982eadeae5f8781607bc068b6b784b87509511d299e1d027", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684182, "uuid": "e4603a3d-d697-4ff9-98de-e08bf6487479", "value": "T117335A42721C0E1BC0931A70253F4BE18BFBE9D022F4B68965AF9B568975E371486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684182, "uuid": "45a70b24-0414-4bc9-9bd4-fd1188491f58", "value": "768:M2sGdebu0jIU1Otbhj1kf4d1+b8h1HPnA6MYLVlUIKjxX0EgDr6QojGbCTpwb:/s5IUYbJo2eyNA69LVllEQojaCOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684182, "uuid": "b163359d-fabd-4f1e-8858-840ce79067a4", "value": 51268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684182, "uuid": "c6c0b260-0985-4d3a-ab8f-a9c21ce25023", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684182, "uuid": "342705da-f648-4420-b395-3428809286a2", "value": "f1c4138d81b624034312a1baa02a94cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148a46a1-5ea6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639682794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682794, "uuid": "13a3f9ed-1f70-441e-95de-faa188e3d8a8", "comment": "Malware payload (RedLineStealer)", "value": "64e8267d06af8b4cebdbf970d87208bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682794, "uuid": "6ccac4bf-c1f5-49f6-a1ec-9a3406833365", "comment": "Malware payload (RedLineStealer)", "value": "2abc27d9ba5e15325d871a32fb663c66ea39bbff858f4a5caeb0075c607d5f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682794, "uuid": "0788f599-83a7-478a-a5f6-57bcb0f508e3", "comment": "Malware payload (RedLineStealer)", "value": "d6fee5616105da1a8a36a066fc8ace07fd92e49b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682794, "uuid": "37b961fa-0ecd-4082-96be-f835a68e74e8", "comment": "Malware payload (RedLineStealer)", "value": "89d8d7b353659e7858fd4e2b2e3eb45648a0d2035fd8f7efe86ced56014ec2162d706e5f45096bd128c4e9aa7cef3d4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682794, "uuid": "f75e223f-6e80-4263-af1f-8bd777ebdba6", "value": "T1C4A4CF10F7A0C035F2B312F95AB6A36DBA2E3EA1672450CF13D56AEA56346D0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682794, "uuid": "5e984da2-e682-42d8-a1e5-468cb143086b", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682794, "uuid": "d8bcd79f-b2c2-4090-9b0c-d55c73dfd9f8", "value": "6144:dPSZvSSXkjqsf7AOr5gBCVJCjremNXkIV0/n+Vto4XS6QwY:cSSX9sfsYyYVJaemNXkIVOn+Vttow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639682794, "uuid": "773a6d2b-40c8-4090-9eb6-0b74bece84df", "value": 455205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639682794, "uuid": "d7888edf-1eb2-46a3-8339-29556a6b0256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682794, "uuid": "6496b619-6b51-4b59-a39c-896ec371e941", "value": "64e8267d06af8b4cebdbf970d87208bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422ec94b-5ea9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639684159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684159, "uuid": "a6ad1274-e38f-4f92-a748-b8c86179a74b", "comment": "Malware payload (Mirai)", "value": "3d9ead3426f3b572845ffa17e88b75e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684159, "uuid": "c7e3aaf0-9b55-482a-8f9c-c0d4ea9b0618", "comment": "Malware payload (Mirai)", "value": "2ad1c6dadc9977718ad007a7ed15197d66a94cd037902dfd73c9a35d8fc4234f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684159, "uuid": "329c09d1-0101-4f64-adf6-dfbd93015c96", "comment": "Malware payload (Mirai)", "value": "017e6875be6ddbf6a09e093b04e8320094268e7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684159, "uuid": "a8823ca7-dfb3-443e-9bbd-77cc2aa3663d", "comment": "Malware payload (Mirai)", "value": "2e494a4bd5a0ca9dd5cd60ac5c64e6db1cc8d58248c5b46f0aa971c0702bdc4f684e3a0d72e9af27329ff2be149579c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684159, "uuid": "017cdc79-7a97-47cf-a0fd-eaf55f7a33eb", "value": "T1E3332A96F802DD7DF80FE6B954160E08BA7063C111831B3667FBFDA36C721A2AD12D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684159, "uuid": "87ed3abb-61f6-47e9-9b8f-cfa69c46acf4", "value": "1536:iqIbdsaDLP3thcguPQMNl6zYxtvXGlZUgg8AB:iHRyQulMCkXXyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684159, "uuid": "5975ee29-b382-4ccb-b572-e6bb968d134b", "value": 53460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684159, "uuid": "5f5c592f-fb00-4bd8-9734-6f7af9da7fb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684159, "uuid": "cd258a4d-eca9-468d-b575-780a69604f6f", "value": "3d9ead3426f3b572845ffa17e88b75e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557d4f33-5e05-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639613754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613754, "uuid": "73cefdfa-0008-484b-8ee5-01d9deadf7f1", "comment": "Malware payload (RedLineStealer)", "value": "1b30880370bcf71029d1da6c675eff01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613754, "uuid": "eb84450c-85f5-43e5-a06c-2b0d81d9d685", "comment": "Malware payload (RedLineStealer)", "value": "2b128dec9c9f2967e91cbbb3e70d34bac1e1ff4901f99ebf8d6e9dce56171918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613754, "uuid": "15d754e8-8c0f-4a4f-8094-9c2346c1c26b", "comment": "Malware payload (RedLineStealer)", "value": "31607fe6855181fafa2943a1cd47df46fd35e34f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613754, "uuid": "29323eee-d4b5-4c1e-81d4-d95882e96407", "comment": "Malware payload (RedLineStealer)", "value": "58600330810038c5f1b020bc13b11422a7f31f8b4e0cefd5d51dd376e22079c7820c4dd8534a349d036da07d9e9e1f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613754, "uuid": "1f31b848-1486-4160-bc55-a27ef741f68f", "value": "T163F39DC1B9D1C87DC5A609704864DEA00E7FF8715530554B27E82BAE2FB22C07AEE31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613754, "uuid": "d7205ccc-3100-487f-9b5c-24e138e92f78", "value": "2bb4e5a139a2a29d6e02a63c04eada73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613754, "uuid": "f81ccf70-7f34-495f-b40e-bb0647e6c79f", "value": "3072:AcTLWdOKXRoEoZvL8qX7p6X+JkaThs5H8K:AcTLsRoTV9X7paO+x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613754, "uuid": "bdce0f78-72f5-468d-93ed-dc087e0add3a", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613754, "uuid": "4233ebda-fef6-4a6d-9475-5f7ac395aa65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613754, "uuid": "c96c2876-345c-407e-844f-c8efabfdf2f4", "value": "1b30880370bcf71029d1da6c675eff01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fc6cbb-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639683702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "7f35da93-46e9-41d2-972a-bf10923e4c45", "comment": "Malware payload (Mirai)", "value": "f27cee7c1d584d19646c3a5c902cde08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "0863eb79-1a79-44a2-b516-a21e0edde81e", "comment": "Malware payload (Mirai)", "value": "2b391e7b92dcd15188050a58d7c1353a7cd957674da44992ab17f89c6c24aef5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "8399a776-0537-4b8d-9b58-66d7d8b6a385", "comment": "Malware payload (Mirai)", "value": "b7758d6419bf8ac64075ca90454952b2ba298999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "4d00cb81-e071-4887-b446-815df3f01c21", "comment": "Malware payload (Mirai)", "value": "37929c18eee6a6b84bce29adfad564eb3a456e161e6447feb132da6fb432e8ce466b08e1550bafbde34478fae3433e8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683702, "uuid": "e099ff32-9697-49b1-8e09-612a4bb23763", "value": "T103B39D9BF2471591C89247F00BCB4FDE7E2322C2AF1BC4E33D2A653A48790DB5906B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683702, "uuid": "9f9c2ada-22a9-433f-8e86-5e258f085b6e", "value": "1536:nj4Xc1Oh/HHY5DQg9H/wMw0JspQKwvcJVbgIz/LWm:nj4Xc1Oh/H45skfwMlEQKwvUVbgIzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683702, "uuid": "34295ee3-9be2-4ca9-9757-6199d9ee0ab1", "value": 107812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683702, "uuid": "b6e58c94-49d4-470c-980a-286f042c992c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683702, "uuid": "fa863b90-a370-46cc-be7d-92b1e522336b", "value": "f27cee7c1d584d19646c3a5c902cde08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eee1863-5e75-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639661847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661847, "uuid": "1f8be866-2014-4b65-ba4d-39ab8c0f0e2b", "comment": "Malware payload (AgentTesla)", "value": "0a21742965f6f601ba2c7f6dd2c26de8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661847, "uuid": "4e1f890e-5ed9-42d2-8a33-95f6792bb098", "comment": "Malware payload (AgentTesla)", "value": "2cdcd8811358c9157e972b94a6e9874aa38ff6b9201ada5b1a62a118a3367e14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661847, "uuid": "46cd868d-5f45-49e4-8498-5f37076c10aa", "comment": "Malware payload (AgentTesla)", "value": "a5168ccbd823358f549563262f9c690b7dd316e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661847, "uuid": "7ec51645-d654-44c2-80fc-07f469d905ff", "comment": "Malware payload (AgentTesla)", "value": "a22b4e9926f654c62ff4240e8a2017c313ed50f267af7e4c58897042c4c2d5756b9a7a330f90ca0f2b5bf3d5fb2f19e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661847, "uuid": "55f9af0a-6157-4c07-9c0f-aee48b744850", "value": "T108C423C1E9E88593D299963D01FA6D7EE3F747481379179F83A83EB19E393024D045A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661847, "uuid": "fdc28224-fbbc-4325-b033-c41624c36fde", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661847, "uuid": "530c76bf-0825-4999-8a83-f141c7b5f5da", "value": "12288:qiqymug5w+jhFLh96V8owik5j6B4uzQ3OI2brlPz/rdTWYd:qia5wonhUMik5j6jzQ0f5jIYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639661847, "uuid": "61e3cc6e-e1b0-4ede-8874-a83368c98ee6", "value": 549397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639661847, "uuid": "1d4bfbee-4dba-4125-b108-fe010963223d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661847, "uuid": "1bd5403b-0bf5-4730-a94e-1e2fe6799121", "value": "Doc..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a0679c-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690815, "uuid": "0a11dad0-965e-4dae-ad20-8fe6d4e4ab12", "comment": "Malware payload (Mirai)", "value": "8c498d6f148f80e26b04f7248900c803", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690815, "uuid": "daa5682c-9edd-4da3-84ce-b172337bf42c", "comment": "Malware payload (Mirai)", "value": "2d601841af75a2a0c48965c15be577bab145add5c3fa8bf6859af44109ebff41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690815, "uuid": "4c087c54-105b-4f9e-b10e-c4436af76947", "comment": "Malware payload (Mirai)", "value": "71061102c3ef84147801b804a25ff02e696b51fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690815, "uuid": "5371e7ba-c609-42d1-a887-cf3d17ebf5f4", "comment": "Malware payload (Mirai)", "value": "5c1a04a127eb3c40fe9331ff9e5ff41dfaae8b3138691af4a6b98f6fb00423e612fbf8ed77ba5f4cd4542d5bc0fc8e87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690815, "uuid": "74824c5b-266f-4c25-b287-8a9ff5f64f1a", "value": "T16B636B67D8150E00D440C8717076AF355F2793F285CB3EBAA9758A78A853D8FB226FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690815, "uuid": "1c982507-e9fd-4edf-88a3-af2233933af4", "value": "1536:r0I+mk+RTOKUNzIKNrjn4LyADCvzMetJ8a9:II+mUnNrj2DcgetJ8a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690815, "uuid": "7895d7e2-fac4-4583-bfec-934b8ea264cb", "value": 67736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690815, "uuid": "ec306027-649a-4c84-ba0f-6725cd8c84fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690815, "uuid": "cbfc5d91-b23d-4a6d-b0b5-72ebafe8fd7b", "value": "8c498d6f148f80e26b04f7248900c803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5671427-5e83-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639668085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668085, "uuid": "56e5cf9e-3ab3-4622-a05d-bca165e9636e", "comment": "Malware payload (RedLineStealer)", "value": "2edf73f2cc11670b181703cd2e9c8521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668085, "uuid": "ccc257b0-8346-462d-a6e4-93d4f7bf3944", "comment": "Malware payload (RedLineStealer)", "value": "2d787af54231db009e8914bc10f52d4ae9a6ab632126fca2208f8e0201b307de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668085, "uuid": "9754a1b4-6686-4bba-b6b7-a517d995d69a", "comment": "Malware payload (RedLineStealer)", "value": "f49b62d194c262447fb2d160ceed06d869616697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668085, "uuid": "5f091f6a-a0c6-42bc-8416-db902ae0b1f6", "comment": "Malware payload (RedLineStealer)", "value": "5dfa5070472bfb84b0b57bb371ea243f1b8b27823b9452ad27ca946d3404b8c6f3ea93d660ad161e6118716c9e9a3407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668085, "uuid": "d5737063-10e0-4f84-b277-708805f55bbf", "value": "T1B9A4BF00E7A1D034F6B716F859B6936DB93E7DA16B2490CF13D12AEA1A346E1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668085, "uuid": "33eadb0e-5729-4872-b964-b1909204ff58", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668085, "uuid": "79b6f985-bd6e-4955-b6f6-0e8da7976fc4", "value": "6144:jzdQcuKrRosANpXrZMJ2jIT2LfiXhJf1tSdf90LblwNP3zlUR5/+6lQKR:tQ70i9MJ+LfiDdER2LblUP3JUR5/rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639668085, "uuid": "1dbef83e-e5ae-4b1e-9428-8741f6911ec6", "value": 456215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639668085, "uuid": "75592a13-7ed9-4a4a-b22f-1c1951a7f074", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668085, "uuid": "074162c6-b114-4fa4-9069-a18ac2a092bd", "value": "2edf73f2cc11670b181703cd2e9c8521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99db3848-5e1e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639624606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624606, "uuid": "a73c4ffe-78b7-4f37-8082-5a63bd18fa30", "comment": "Malware payload (AgentTesla)", "value": "98f416b4d71268e802d40bacdddbc4f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624606, "uuid": "1a8e2d10-de83-48df-bf68-a58def40928c", "comment": "Malware payload (AgentTesla)", "value": "2eb8f86da6feff854375124799d47284b927b6df00362aa1a669958784fe73e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624606, "uuid": "28840828-5bc3-4ac1-badd-dd6b9c15b8f9", "comment": "Malware payload (AgentTesla)", "value": "6edb0bca6dfeb5c763a12e1a86a48db9f5b6f73c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639624606, "uuid": "f7b05d88-2d40-4ddb-b1eb-0e7f0f87b4e9", "comment": "Malware payload (AgentTesla)", "value": "07954204c26fc31e0650a25de2226a8dec0cd0e1e528097e774c9618452c0ba12e3f23aef51ec4271f9e1e4c7a574a9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624606, "uuid": "c7df5969-1863-41d1-82dc-869a97e28046", "value": "T12A05CF861CCA8591F83BFFB188B026F727A69FE0ED41DADEE48436D5B576B408748431", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624606, "uuid": "38e84466-4d55-4cf6-9e5a-31f96ef2aada", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624606, "uuid": "0d3865ef-e4cc-45d4-889b-0f356cf64b02", "value": "12288:TbYLMExsYyQLp7auULNOi9KWckijhtYvpM8HroOXJE0Pe/:TbYAE6Zw3ULNOi9K/jgpDbJEgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639624606, "uuid": "c0d80c01-eacf-4acd-bb4e-d9768631de35", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639624606, "uuid": "35eb2093-d963-411f-abe7-bbe8ec69c632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639624606, "uuid": "963df942-5fe1-482e-a6aa-a833d80586ee", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b6e1c6-5e9e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639679464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679464, "uuid": "112ac4bf-480f-4234-8234-ef127cbc4f5d", "comment": "Malware payload", "value": "bb9e3c71b3ee3279632905f905ac21c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679464, "uuid": "dfd5a9e8-144e-492a-820a-5f85b9d26b32", "comment": "Malware payload", "value": "2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679464, "uuid": "ad8a6438-d394-4421-8f1a-ba15107654ff", "comment": "Malware payload", "value": "a2b1d81ec6a21b52f555f5ec7e9cf9a73f937971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679464, "uuid": "e230cb99-5e67-42b5-a053-ca41720e7692", "comment": "Malware payload", "value": "1c2c56bb0f7c890a8f13f0d49cf98258491bccbb33dd5418d1d9cc396dfffdc8d89c6050d560385e661fb9f8e835457e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679464, "uuid": "c129f9ec-58e7-4809-9a5f-abc70cb2f610", "value": "T1DB857D0237E84719F2FF1B72E47144159DB2F852AF6ADB5D3008A2AE1B61740DEA2773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679464, "uuid": "385d2122-421e-4e9a-a157-80e6af3b505b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679464, "uuid": "c839e046-9026-4883-93c4-67f312f42fed", "value": "24576:NIoyw5eQDLx+KtZEoXgGZw3uBXTTGSMB92zsUrobb0C4M7l:JfQKXgEw3iTyurFCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639679464, "uuid": "25f2700b-9309-4ce7-b2ba-2f0377f993ee", "value": 1745272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639679464, "uuid": "bac0a8af-1f24-4603-b53b-6a92ca05c53e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679464, "uuid": "ba848a3b-1be2-4944-af86-f2aeb234337a", "value": "2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4eb18f-5e47-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639642243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642243, "uuid": "813bf440-b0ff-46ea-960c-bf674a31c2aa", "comment": "Malware payload (RedLineStealer)", "value": "896ce73ee53b66a5a69252da31125e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642243, "uuid": "c385e3fe-6769-4103-9dc1-d3150eb84a00", "comment": "Malware payload (RedLineStealer)", "value": "2ffbcb2173857e2ace323d359ff3004d99ed864e0710d08bd3d11162a25857eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642243, "uuid": "498f3918-b3cf-4237-b27b-80301beee63d", "comment": "Malware payload (RedLineStealer)", "value": "d12f3b12fbd9196b57f1f1f6c0c02b2a86758335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642243, "uuid": "270e47b4-965e-4719-a19f-34a32860da3b", "comment": "Malware payload (RedLineStealer)", "value": "e8db6da6f1ae20647739227fbb0a733d73bbe16cd7b02e666b4e6981f75e2fa5bf384297f18b60a699a5b5f2a1ac7195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642243, "uuid": "b21123f3-c676-47eb-bd81-ce3d1273d5fd", "value": "T174749D00A6E1D031F1B756F45AB6A3BDB53E7AA16B3590CF13D116EA46786E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642243, "uuid": "c3918a25-8475-4b43-888d-7caa05770cbb", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642243, "uuid": "3477ba01-a672-4c9c-b985-b2fe3d5f02fc", "value": "6144:078aMp8SpmRQWY3QhD8MMCL8mmayOaWuExh:ojMpJERQWY3QhD8VCL7may03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642243, "uuid": "2720ad23-2d50-4a82-8016-5a18378fb0d7", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642243, "uuid": "1abe8e4d-d754-4b40-9684-3dd79fca3eff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642243, "uuid": "3103cd60-2851-406e-9428-63db59e7ab71", "value": "896ce73ee53b66a5a69252da31125e61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e27a07-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639644977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644977, "uuid": "cd8f39eb-d9ed-4cd2-8f98-8b795d8c571a", "comment": "Malware payload (Formbook)", "value": "a09aebfca2a0aaa89074e9dba94f7ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644977, "uuid": "f859ee8b-2ae6-4993-a841-178b3d8a9635", "comment": "Malware payload (Formbook)", "value": "3006eeb75181a2fa43620dc3afde267f2d94d8578dba08906be1ee21e832ae27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644977, "uuid": "dd761a65-b796-42d4-ad58-2c6ded97de14", "comment": "Malware payload (Formbook)", "value": "27481f56014be5b5a1913d33aa4f206fe7564bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644977, "uuid": "0999317e-04c0-40b9-8907-b3bc551e41d6", "comment": "Malware payload (Formbook)", "value": "224f102db21b4e814f7b0725efdcd056a5559c7edcc216c383736dc7e7a502c813ce7bce5de54ccc1b2c212dc8a1aace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644977, "uuid": "bba5add0-f2c3-46fc-9b09-75bc1de2ac3e", "value": "T1D494234E78CBACB7EB41D77C9177F37AD3B592A51120592F07888F1F6DA482384492E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644977, "uuid": "b4c4849f-9b97-40c4-9ea8-e7050aa0b06f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644977, "uuid": "c9ac74f0-d64f-4c7f-8f9e-bb745f062ef7", "value": "6144:rGiQ7iaR+AQCZlC62K+biKq+1bJs5R1Jz6MZAsLGuYMGphmj3FyJJKDfY1JSpEUh:Siar9C6RtKqcSX1J22hYtYjVAUDwJZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644977, "uuid": "acd96fc3-edd2-40e1-a8c4-35452c9ec558", "value": 435847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644977, "uuid": "ef32fda2-ba11-4b25-a6de-381fac1ecbd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644977, "uuid": "2ff432a5-d4f0-4c6c-8697-88253bc324d4", "value": "a09aebfca2a0aaa89074e9dba94f7ada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498879d3-5e85-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639668709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668709, "uuid": "6625f20b-4a1d-4134-9516-a2c290f833ff", "comment": "Malware payload (RedLineStealer)", "value": "35092698585f58fdf69cf2074d8c6095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668709, "uuid": "8c52dd25-f0ea-4274-9c17-9030069ed207", "comment": "Malware payload (RedLineStealer)", "value": "3065b6eb52ffbbd40f1ddae2c4e75b559dc1a7fe34a3c9b67e1e4a44ab1a08e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668709, "uuid": "eb83eee7-1f8a-40ca-9865-940fff04f555", "comment": "Malware payload (RedLineStealer)", "value": "23812c0f2ee3ee61e7b38013f535b8b7541b6e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639668709, "uuid": "e510af71-7188-4478-ac9d-172cb74eb084", "comment": "Malware payload (RedLineStealer)", "value": "cb947c9f2904be900d91be10bf2311e04a79b2624576a048888469189cf9cd9d52c3cc83ad4d8920b56ceeceee0a394b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668709, "uuid": "1dbd9e51-e608-4e30-8974-ab57a340d5d2", "value": "T11DA4BF00E7A1D034F6B716F859B6936DB93E7DA16B2490CF13D12AEA1A346E1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668709, "uuid": "fe2d2c74-f20a-425f-a7fa-c2922836d019", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668709, "uuid": "71a15b9b-0717-4e77-8c82-0d66caf143ab", "value": "6144:jzdQcuKrRosANpXrZMJ2jIT2LfiXhJf1tSdf90LblwNP3zlUR5/+6lQKR:tQ70i9MJ+LfiDdER2LblUP3JUR5/rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639668709, "uuid": "aaf0f992-9a3b-4f32-880d-bcabe8d3a536", "value": 456244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639668709, "uuid": "e539d2af-8a33-434d-90ec-93cca3a4ec34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639668709, "uuid": "6a195ad7-b50a-438b-ad90-3e20e43cc68f", "value": "35092698585f58fdf69cf2074d8c6095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ba8016-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639644592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644592, "uuid": "531d0468-fc06-4e40-ae70-d1179b075bad", "comment": "Malware payload (Smoke Loader)", "value": "028bda2c761bfaf2666e2cc90b09f948", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644592, "uuid": "e438726f-32eb-4a3c-a6c6-778e6f96709f", "comment": "Malware payload (Smoke Loader)", "value": "30a0834cb7fcd0232929e53c63e45fce83704c31fbcf1c32bb5a37db6be84931", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644592, "uuid": "8fdf2745-3f7c-4d4e-9382-81d8bf33fd9c", "comment": "Malware payload (Smoke Loader)", "value": "b41df43848ce4fc86e81ae6b6f4706e09b1da432", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644592, "uuid": "54820dc2-3eec-4d17-b696-b5a352e3d06f", "comment": "Malware payload (Smoke Loader)", "value": "7752549d5a6a368dcc99c2082f5445db809b5f2545cd654592d0bf0aa744968904e237e3efd96ee70b0577e16d6e3236", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644592, "uuid": "31ea08be-2a0d-4959-ab8c-1a3497887c5e", "value": "T117748D006AE1C035F1B752F45AB6A77DA53E3EA16B3490CF13D516EA5A786E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644592, "uuid": "7a4aec2c-dc17-4560-a381-9f57b8a2aefa", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644592, "uuid": "43ba2970-7f17-444f-9166-e4b20cd38194", "value": "6144:E75UX8V/Qajuj/NQ5kC3QhD8MMCL8mmayOaW8EQpw:4EfuYQp3QhD8VCL7may0Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644592, "uuid": "f1a09b34-c63c-42fe-888c-4a923ea6f662", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644592, "uuid": "de042df1-5338-40e7-9ba3-a0ec5356299d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644592, "uuid": "0bb8076f-bff2-42cb-a24e-6e700bf9cc0d", "value": "028bda2c761bfaf2666e2cc90b09f948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57cfc7c-5e8c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1639671924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671924, "uuid": "7be02845-5004-41f3-aeee-8e985a994039", "comment": "Malware payload (Conti)", "value": "ae32496289a4b4e4f670127849517ccf", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671924, "uuid": "5d5a322d-3984-4a66-9cf6-bc0dd76beab0", "comment": "Malware payload (Conti)", "value": "3125aa67fc6e09a00aad39e0eb8024b849d54de353b1a45b5297d4c5d5e87941", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671924, "uuid": "cd48c63f-6d09-4af1-a9b9-f816c1e7fb2b", "comment": "Malware payload (Conti)", "value": "b96d0b726e1a2ff46847db035599291b8423aff4", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671924, "uuid": "edb0ae43-2f33-431b-8481-044a64c1a4b7", "comment": "Malware payload (Conti)", "value": "f1189482d2ccc42b99e0fcaa5b77706f7981544022130117f38cb14c495653ee60f3cd8c9c435221f4a4a67e40ae814a", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671924, "uuid": "ac11bd83-ce75-409c-a461-ae651a2ef6ba", "value": "T19A145B01F64D827DD6AE4D31267A7EB280B89D383B5FCCF7B7DA882816606D06524F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671924, "uuid": "21743a0a-9e53-448e-92fe-cead74920b11", "value": "77679e1e454376d19c1c76600c17ea98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671924, "uuid": "20b8f916-4432-4156-8eba-983c7bf1ea12", "value": "3072:HJkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34oYrxxt:HFcuVqTATicDNxrxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639671924, "uuid": "aa39a488-05eb-4aa8-bb27-0d8cfbdf862b", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639671924, "uuid": "fbb7e5e7-737c-4932-975c-bb3be22663be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671924, "uuid": "621c3d83-7108-4879-b503-ab77ed753c2f", "value": "3125aa67fc6e09a00aad39e0eb8024b849d54de353b1a45b5297d4c5d5e87941.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bc795c-5ea9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639684167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684167, "uuid": "f71e7e33-b5f9-4181-81f5-f845dedd2e2b", "comment": "Malware payload (Mirai)", "value": "c8eed55b8914d9d34eca237a5d049a78", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684167, "uuid": "ab3ea629-4498-4aeb-90ae-f24c0c9d7420", "comment": "Malware payload (Mirai)", "value": "313aa75cfe8e333a0150c518631972a0277c2eebeadb1ff4435b741ae02cf1cc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684167, "uuid": "6722f665-ae02-4428-998f-f1a22c2d711c", "comment": "Malware payload (Mirai)", "value": "5131f804ac42b19df189831ae66a38ae54d40f26", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684167, "uuid": "43356e6c-d2a5-4e15-90a2-72db2774e2c3", "comment": "Malware payload (Mirai)", "value": "70ad166c21336b48fc1d11cf677b29d1869a0ca6d41d636e8d9d115f7c578bbef557596f6e4637f5ca051f1d0e926009", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684167, "uuid": "6bd63734-fb9b-4e79-a01c-68c8cdbff50f", "value": "T1D733F817FAC181FDC04EC174176ABA3EDC2635FE123CB69A37D4BA226D85E210D19C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684167, "uuid": "cd4d20a1-af1d-488a-8444-bc37ed36e66e", "value": "1536:9+NYPPbuNqrTp65+u0N7jRX15k1cWAeh:kYPq4rY5+u+jRX15MAeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684167, "uuid": "37958f02-14a2-468e-a011-ea672fe8be61", "value": 50944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684167, "uuid": "29b63a81-10a6-4124-8884-409a2efa3497", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684167, "uuid": "46d09e06-832a-4121-95fd-be42193a2a76", "value": "c8eed55b8914d9d34eca237a5d049a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c06bdbd-5e5e-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639652044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652044, "uuid": "2ef8ef72-efda-4021-825a-fd8e1894b854", "comment": "Malware payload (CoinMiner)", "value": "a96a738d88eaf69a10518f3699316e1e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652044, "uuid": "b76ebe05-69f7-42eb-a0df-9573db842cc0", "comment": "Malware payload (CoinMiner)", "value": "313db1c8aec4ad9a9ac09a735fe7e272a47c48d02faaaff27499cf2c64194e16", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652044, "uuid": "f24e1370-19c7-47b5-99e4-4504fd08fca6", "comment": "Malware payload (CoinMiner)", "value": "dd38932afdce2248ec64c1ff3c5a19ed3882bca3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652044, "uuid": "70e978fb-3c98-47a6-bbbd-3a44483f0341", "comment": "Malware payload (CoinMiner)", "value": "cc607075759f13e7d91ca10c00d976d86f8c0ed2d3f1630995eacde1d6f457a8b92115da0a6f09d7b0ead195dd497255", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652044, "uuid": "4aa2452a-bfd0-4190-a2b2-0bc51c16075a", "value": "T171D533586DE83C2CC168D33D71BF4F2D6EA07E528458D5876AB43597238BB60181BF2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652044, "uuid": "9293afad-fe21-4dae-9185-b20f0c322ea4", "value": "9bfd2dac39af50555ae9789117b36b66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652044, "uuid": "ab9a4907-6412-4745-ab29-9d4362e707cd", "value": "49152:DuNXqFEJqjzCZ2frDdZRSN0W+ibyTk8MYWFPn+0/:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639652044, "uuid": "df581c3a-d867-45b6-ab4d-48397c7abfa6", "value": 2998784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639652044, "uuid": "bcc8da57-82a8-42b0-a62e-5a377126d69e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652044, "uuid": "ef09c9b7-65b5-4b49-ad63-c3d87c523f9f", "value": "a96a738d88eaf69a10518f3699316e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeea60eb-5e47-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639642251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642251, "uuid": "c7e2f6c0-4eda-415f-bce9-b6f660923115", "comment": "Malware payload (RedLineStealer)", "value": "aa6465f6b67ee67755a54878551d9d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642251, "uuid": "692785b4-8d91-4959-9093-f79b4f6ec26a", "comment": "Malware payload (RedLineStealer)", "value": "3180680426d00add8f59249d118945631e828583f3cc784b1ab40b02c2997bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642251, "uuid": "16f87b66-cd1d-45d4-bd0e-abdc725ae68e", "comment": "Malware payload (RedLineStealer)", "value": "85e7de81e2203dc755c92849fee234accde8f0a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642251, "uuid": "4879785d-a6b9-4f1c-9f95-936953e27d97", "comment": "Malware payload (RedLineStealer)", "value": "836f5e667e5614d7843c14cf6e22800dee56f9f5c10d2163675e52163dadfcac0a504e18ea9fd59cfb2f973c82925bfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642251, "uuid": "a6ec3bf4-cc72-427f-b9e1-a61b38fba6d4", "value": "T1E2A4CF00E6A2D035F1B312F859B5936CA93F7EA26B2850CF13D52AEA56746E0ED71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642251, "uuid": "d3255e37-2fd2-444a-aba0-8da805b368bc", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642251, "uuid": "7f51c473-2c44-44e7-9928-bae673deedcd", "value": "12288:RieYn2u+Pwu62hWGnSz3vEUBR5Iemb+yE:RJu+Pwu9/Sggqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642251, "uuid": "ae4475a7-024d-4e48-b8a9-0c3716140058", "value": 456204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642251, "uuid": "5af39f9b-60fa-416a-bc3f-4a3e35048cb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642251, "uuid": "5f42caa1-697e-430a-b1ce-f8c960379abb", "value": "aa6465f6b67ee67755a54878551d9d8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdbcc2a-5e44-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639641039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641039, "uuid": "1b62aaf3-aebf-45c2-81ed-7e8f4c40c611", "comment": "Malware payload (RedLineStealer)", "value": "49a5d1afdbbdd91a622958b447bb7555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641039, "uuid": "6117680a-f7cb-4579-9811-f826e5d4c663", "comment": "Malware payload (RedLineStealer)", "value": "319c1daf10efbb3733100a1375de1d098ce70213fa563838244e58abe85b1ba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641039, "uuid": "c3501b55-d846-4bde-81b7-962aac82be6b", "comment": "Malware payload (RedLineStealer)", "value": "38586e16f7ac4d3e671c44dbf2475a8c51152f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641039, "uuid": "54e86249-d54b-4a24-83db-4588a53c2c68", "comment": "Malware payload (RedLineStealer)", "value": "6b33b8530959100ef1f02225b35a0096caf07881af087c6212133e8719f70f7cd8fd8849def18a7d50d502016940c14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641039, "uuid": "c6962210-209c-4bd0-ac6e-28f569a82431", "value": "T18FA4BE00A6A1D035F1F752F84AB6936DAA3F7DB16B2451CF13D126EA4638AE0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641039, "uuid": "344935dd-d594-4da5-8860-0d18dfe926e5", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641039, "uuid": "a613d92f-584b-4546-9497-cceed919f267", "value": "6144:oSN685Kkggs15Si1JPAPLEODlIrhS22z1TEo55DrD0SFwEwZC/R:9hKWK5DYPLXZIrhS22z1Qo5x0SFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641039, "uuid": "e4a6c5d9-56ca-4b31-ab17-693a30bec14a", "value": 456232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641039, "uuid": "754f3bda-e080-4a5d-9858-24f7d41b40f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641039, "uuid": "037e68c3-f4a1-4972-aa2a-3e47e9355fb4", "value": "49a5d1afdbbdd91a622958b447bb7555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfff8dd-5e59-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639649817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649817, "uuid": "ad210d79-67ba-49ea-9025-08bb422e2a8f", "comment": "Malware payload (RedLineStealer)", "value": "d6bdba25db6926b491047cbff36a9609", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649817, "uuid": "8943f84f-665a-4209-af38-5989e4c4496c", "comment": "Malware payload (RedLineStealer)", "value": "321f956b4ff6dd900de3cdd9916be43a3dcc6f2c95e44a13fa64beadd1ad78f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649817, "uuid": "f26f6fb2-146b-48f0-92e6-6b8d7bed9efc", "comment": "Malware payload (RedLineStealer)", "value": "8a9a5ab515a9034ea13b0df864d9d9df8d6a8581", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649817, "uuid": "60e2660d-3687-4d50-bf34-c53c4725d8d9", "comment": "Malware payload (RedLineStealer)", "value": "dfb37a65b30a396ab627b6c1d1be7c6013bfd973818406a2e74bb362eaa4560256ad0bbbed29d7bef6610d93865faa9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649817, "uuid": "e706ef91-9736-4be3-a762-b8920aab088d", "value": "T11625B90BEDC28A94EB72077945F7AB144BA550D90F3B13D8A304B7EC4EC926E1FC8965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649817, "uuid": "51067b48-571f-4a10-859e-4b9f57b4612b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649817, "uuid": "f1e5b14f-f145-4497-becb-f4df6bbb4d6a", "value": "12288:8LnKSvywjwdmlQVQ3vqd/eFDi6bBe5l+s7q45liMBHtz:y6TIlQVZ6bBeZ1uMBNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649817, "uuid": "de150596-d6f6-4c0f-bbeb-927718eb2c3a", "value": 984968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649817, "uuid": "638570ea-fcfb-4e20-933d-6c2012a0a942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649817, "uuid": "d60adefa-aa98-4f4e-9e13-d9df7637807b", "value": "d6bdba25db6926b491047cbff36a9609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3cb315-5e86-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639669301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669301, "uuid": "479088a6-5475-4bb5-a5d4-06b18aaea2ee", "comment": "Malware payload (AgentTesla)", "value": "7d4131697fc5e15f6e077bb4c3b6435d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669301, "uuid": "fe73d2fa-bff2-4651-8174-53f805d2c773", "comment": "Malware payload (AgentTesla)", "value": "324ce67b2e6bdefc42294c7c06671bd7de5ce5ae6f1f8c1051eaa4552f5523b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669301, "uuid": "1a92e7ae-bfd0-4cba-a8a0-257f289b1745", "comment": "Malware payload (AgentTesla)", "value": "ed5aedea7b12f3bac6e679597c54bb88fbcac8dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669301, "uuid": "e11d39cd-b4ce-4be9-bc8c-a75d20ab1ad7", "comment": "Malware payload (AgentTesla)", "value": "b3e1ec329a6d69fb9c243b5d740a7bd9c360c5be62b286210db0f8bafd23f0144ad03c710ac49f0b079e2c8e8e73eebb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669301, "uuid": "2f19b4ef-80a4-4180-b4d1-a367065f55de", "value": "T1B9E4DF47B66C4B2ED2A94BF53575023103E69F172941EA947ECAFCEF217178D0A429C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669301, "uuid": "98a658cc-2b3e-4569-9e12-2330f78aba09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669301, "uuid": "edf541e0-4650-4e2d-bcae-c692328cb2f9", "value": "12288:/26IuHoA5QfJoqfHIV1wkwfkJfeiBKcsWxP3uE3BrdNh2uSK3P:ezYoA5GTkwmBpxmE3LVSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639669301, "uuid": "d3347ba7-015e-4d4e-8255-d3ac306401cb", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639669301, "uuid": "dcc8b6c6-d7da-43c6-828b-13c856c2bba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669301, "uuid": "f1d64666-7bc6-4517-a532-07bfdcc13ab5", "value": "Scan_435466_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c480d79-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650272, "uuid": "8f25d751-8daa-4bf0-b8cd-b39cb1dfb163", "comment": "Malware payload (Gafgyt)", "value": "aa0249d3d511409f2636bc431e48879d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650272, "uuid": "eebe3756-ad3e-49ca-bc13-cc35997ae81f", "comment": "Malware payload (Gafgyt)", "value": "327746c4e516092d40fcf0e1313a8d8b4200e542b2b1c8c8c00740e06079258c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650272, "uuid": "b5e1000b-76f6-4009-84db-092ecf46fc23", "comment": "Malware payload (Gafgyt)", "value": "ccd8f9317e3de82987b8e0b2d76bf3b20d006393", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650272, "uuid": "30513e72-6102-49ac-9fa7-44bd74331227", "comment": "Malware payload (Gafgyt)", "value": "d7437c6d9766779297039e4d33732c8fd7679609b8132b3b53436fc86ce4b7e4bbc6d31ad8263a26003c1eccaa5ab571", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650272, "uuid": "c3a79aac-530b-4f4d-a15e-bc3812c73ed6", "value": "T175B32AA3F801DFB2F40A9A7204D74B14BA30BBE20E935666735739A79E721D53827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650272, "uuid": "e818eb0d-b4c5-4ebd-8ff2-c721c30549d6", "value": "3072:4gld4QrS/TNWwxHny4xuJ3Izl1NmmrVoM5oJffBM:4gn4QrS/TFy4EJ3IzRmmrVoaoJffBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650272, "uuid": "e0f4151c-3ae6-473a-9f78-22ccc00f6e42", "value": 112717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650272, "uuid": "1e357844-1b3a-46ff-8b05-9fc9e5486a9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650272, "uuid": "4a33a460-ec9b-486c-80f5-5d89288f22a9", "value": "aa0249d3d511409f2636bc431e48879d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208f3395-5e67-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639655756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655756, "uuid": "e14cb2d6-624d-41dc-b571-38fab67f0b52", "comment": "Malware payload", "value": "1f8aafaa7066d000524d7a5b9f44380c", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655756, "uuid": "58f0c421-18e6-4d19-919b-298e4b92313c", "comment": "Malware payload", "value": "3321e72b105bf45ec576adccf32d96c1e56238e7e8eaa1dfb4b745df318dd801", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655756, "uuid": "d11beb30-7018-442d-9b04-4626e52d601a", "comment": "Malware payload", "value": "20cd7fbaebc83129a097cd230c64c989af59dc29", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655756, "uuid": "5bd48ca5-c124-4dd2-94a4-a829dccacb44", "comment": "Malware payload", "value": "88cb3fb6c974db45e4b90823a7c704750750ef322c6a2b8c188fb4897f99fa6fa50a5d5af48f21c14e5bd7c6cb4d81a7", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655756, "uuid": "4cc6d14b-15ac-45b9-8cf4-29012067f3b6", "value": "T1E692D17EF59B0E48DE86D668064A7BA5024DF51D73C440E237BCDB387A5D81B8B22D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655756, "uuid": "bd377517-b6d4-4e96-a4a1-6a928a8ccbb4", "value": "384:mp9CsvFhCQG9BNPHXn3Gxm7lRnOtUqG9PAx48J1m:mpzvFh5G9v/nWxm7lRGUax48J1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639655756, "uuid": "af6d5b44-9052-4e7e-a34c-38ba32f1bec4", "value": 20926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639655756, "uuid": "259fefb6-a4d0-411b-9113-9631e67e7d7d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655756, "uuid": "26a1c70e-1e03-4001-90c2-cb303b3421b3", "value": "1f8aafaa7066d000524d7a5b9f44380c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe6c726-5e16-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639621019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621019, "uuid": "d54ce727-e12d-4b09-84c2-d9478150d480", "comment": "Malware payload", "value": "8c5d3c16ae8cb907379a21bfab8cbb56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621019, "uuid": "7f3fab63-44bf-4bd2-84c7-4df805ab64b8", "comment": "Malware payload", "value": "3367fd9ef4970f0f5a98b1e431c89dab120c098b8a9bed70b8729864931d274a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621019, "uuid": "52c92506-a61f-4858-bd76-54ad13779aca", "comment": "Malware payload", "value": "c953abf45094625232a4b7a46ad91948e3f97b9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621019, "uuid": "7c875acb-4183-4dca-ba18-03294cb3a13b", "comment": "Malware payload", "value": "988cbcb2727e8be433987a4f8c618d54bd27fde5a4008e4609ba35511c7da0b852b190f03a68bb92046528260b1096bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621019, "uuid": "4d4beb20-8962-4d56-be07-bd2673664bd8", "value": "T182F39C3179ECC872C5A35170C870DAE41AFAF8712524554B32A8232E6F71EDC6AF635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621019, "uuid": "d05a323b-6b24-45d2-a2e4-b7fcd647943e", "value": "594aca90413b48c89195867843c2ace7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621019, "uuid": "cfa10496-cafd-40ae-9abd-49effaf3b753", "value": "3072:mmLbV/qElLJBX70pRCICP2kluJrIYNWrxpzbgqruRt28:mmLkElLJBr0Dbk9YNuzbgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639621019, "uuid": "f27d128a-3da4-4555-9404-acb0f986df1c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639621019, "uuid": "ba9c15f3-4cbf-4f53-97d2-b4a8397ea7db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621019, "uuid": "c88c47b4-883d-43f2-a046-ebd2cee1885e", "value": "8c5d3c16ae8cb907379a21bfab8cbb56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d38bbe1-5e9d-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639678916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678916, "uuid": "252f09a9-8c3d-435b-b2fa-5d570343332c", "comment": "Malware payload (njrat)", "value": "150b81eae8d3fa39ab1fc0ce8f67313b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678916, "uuid": "5a508e92-31ac-4301-96cc-93c4ded3bf29", "comment": "Malware payload (njrat)", "value": "341c330050a34769add19859371459863a6fe4ac14e3cd042d805da7e3619a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678916, "uuid": "647f8f73-f6c7-411c-81c0-b3efaa56063e", "comment": "Malware payload (njrat)", "value": "a5aaa6f12e793f62fd81825746940eb59393be63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639678916, "uuid": "09350bd6-b1c9-4021-8c1d-95e1745e3a69", "comment": "Malware payload (njrat)", "value": "55340dcaf688e6c945e51da5b0b0ac1c9ad2503dc5aaf8c009b483c6a9b6eee267e3c2e45776cce7b3132e478917db6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678916, "uuid": "2a4729e3-384c-422c-9074-6d3f196f6fe0", "value": "T12B5633353722837AF5210E7558CB2E79F1397D196C38AD8A3BE52E1CAC332872E0D655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678916, "uuid": "f9d6118d-9799-4057-8df2-ff754d105ac1", "value": "b8494300a1f7342d4c600a7b12e15925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678916, "uuid": "9aefd39a-681e-4e27-a3d2-4cc08df65989", "value": "98304:AXz+gsf2aSDcUf+ZWb33iykTx7R5UpVtANgEyj68Kxsz0JfnVWnn+7+icHv:oK3fdSrfITjl76VtGCpJGan+7+icP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639678916, "uuid": "a82a2193-8e47-4d4c-9adc-7ada8e582900", "value": 5911421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639678916, "uuid": "12d19488-c128-4c6a-992a-b767611912c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639678916, "uuid": "bf4a16b7-76cf-4174-a022-3037b6a93508", "value": "341C330050A34769ADD19859371459863A6FE4AC14E3C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770c70a4-5e53-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639647311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647311, "uuid": "c694783c-f94a-497c-8af2-55830e966032", "comment": "Malware payload (Formbook)", "value": "2f5c67adb1934539e23d76ca80db30db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647311, "uuid": "15318163-e04a-417f-8728-553605510abe", "comment": "Malware payload (Formbook)", "value": "3442fd19b9e1ee720034c0849d905f81d4211e289a5a758c9239f1422874c9c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647311, "uuid": "65eace46-608e-4b77-9546-b70ef3585e56", "comment": "Malware payload (Formbook)", "value": "a79e64e217a3f65f33e654dcd2ea81a73fe596c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647311, "uuid": "93298444-f0e4-4553-a536-3a739d5f3b23", "comment": "Malware payload (Formbook)", "value": "3c4da7b263e9ed6417b94378d044fd41bfca40d57eb379d55fe9cb36ccd075ca81c1a60daa57297c3bddf92de3cc29fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647311, "uuid": "59353cf5-6e32-4e72-ac94-b645e2a6b17e", "value": "T130A4231E16D0B943FA85877053B1A951FBF4D3D912263A07CB705F3CADA28DB039A19E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647311, "uuid": "4815a9c1-8e19-4f05-abc1-54f58f264fbd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647311, "uuid": "8aa848d1-0772-4013-b22b-75f668818a3b", "value": "12288:+LYv3ZSuMtQNHBktoH4/scdIceoOdwPSt20OGWWf/p:+upwtQNut4FcCcePw6t20OGf/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639647311, "uuid": "9d4401e2-1f3a-4878-a9bf-a8a0aa76d980", "value": 472117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639647311, "uuid": "bb9e75fa-24c9-4fcc-a4ad-e058daba6b93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647311, "uuid": "744266b5-52df-4326-b8c9-69cad2c4f62c", "value": "2f5c67adb1934539e23d76ca80db30db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738e2791-5e7f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639666203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666203, "uuid": "36fa9187-0f83-4805-aa74-18635c3d6e66", "comment": "Malware payload (Mirai)", "value": "26dc151e5b8dc1e19947c6d9c1ac65eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666203, "uuid": "2798f648-24c0-4104-869e-e2ce6bb62b37", "comment": "Malware payload (Mirai)", "value": "3681ebe67b65e4b32356c98e9e3bf288aced586417c10a4631502ad843ebd69e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666203, "uuid": "f228abcb-6848-4d31-8e36-87aa81ca550f", "comment": "Malware payload (Mirai)", "value": "381b04058d16e4af900b9097bf0cb91463c39e05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666203, "uuid": "6ae5815c-36bd-4ee8-9f62-d0cf55043a81", "comment": "Malware payload (Mirai)", "value": "03f41879722eab1a586052c4bc4a4ca6c28076a134c34327edf4c98565377e33d48f232fed34743751ec8eb0bb5dfcd1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666203, "uuid": "7a9970cd-22a6-41a1-903d-1dc13deaa113", "value": "T1DA23F1B3BF4EE861C2E3783FA4F98789712AB768D497375A012555DA87DA3031CF4281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666203, "uuid": "6d2445fe-967e-4782-a2da-8f98da84ff9b", "value": "768:HREMZDod+U7+hzsw9TPICJmKcdFxtta1mnVLYue++ikmknJOCq3UIKCJlIXwB3YF:H+MZD8+U7+hRMCJmhdXe14LpHk7wFKCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639666203, "uuid": "09f2b796-0da0-40a8-a5c2-539cc6df3734", "value": 48616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639666203, "uuid": "edc86c07-cc43-4cf0-bddc-0df2a10addf6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666203, "uuid": "b0b6650e-9c4c-46ec-91ff-4358a61ed69b", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9627f16f-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641350, "uuid": "e3400f1e-ffad-4d5d-ac53-d532bad65c9f", "comment": "Malware payload", "value": "e9924fe30c31ef786180eadb257ace0c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641350, "uuid": "d46061a5-1644-4f60-b595-ea1e3534dd6b", "comment": "Malware payload", "value": "36ab0aba85ef32490da8beb5e29ce0ecd74d4b4d167a5cbf4f6d7b1ba74e746b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641350, "uuid": "8959f970-726d-4115-95cb-8291548c7d00", "comment": "Malware payload", "value": "37283abce53ab875d64f53514613b5f202fa775f", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641350, "uuid": "b8d5445f-1404-476a-87ea-f4da0a52256f", "comment": "Malware payload", "value": "5c0c4b86af40e9223cfa8a3fc7ad96dc7727a12e4f5a9e726877beb004b6d1d1526774fd049351a48092afc73d6f4755", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641350, "uuid": "629fdd95-3f04-4db0-a715-f8d0bb3d2490", "value": "T1A5E3AF513A80D516CA2843710CE6C2FD6B37BC556FBB470B3598F32E2EB37A1990365A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641350, "uuid": "67a7d055-6202-4ed6-8fd2-2a46bd3183de", "value": "3072:LrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAMJhWo1BU3tQ/vdyb721h3vsv9l2pkXJ:PxEtjPOtioVjDGUU1qfDlavx+W2QnACw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641350, "uuid": "4327969a-7aa4-4175-9674-f900bb62f01e", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641350, "uuid": "d7e18ab3-57eb-4bf7-8fe1-914830ff97c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641350, "uuid": "58a10905-91ff-4ff4-a41d-0c33c49f38a8", "value": "Gonderi.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb94dd7-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650298, "uuid": "abeb7288-efb4-44f0-88cc-103450cede86", "comment": "Malware payload (Gafgyt)", "value": "e6fbb618b2438fb4174c5b3c587416c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650298, "uuid": "f1dedd37-1c8f-4d92-b085-2439950a8e12", "comment": "Malware payload (Gafgyt)", "value": "36b3fb7d517c9954f1e9aa1fae0efda7e8fbba364015b27b4988006d815ba6aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650298, "uuid": "a99ab7c6-03a9-4d24-bfc1-ca6997e71b8e", "comment": "Malware payload (Gafgyt)", "value": "6c9add38496bfb62d23c7a600e450ecea0df31ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650298, "uuid": "7f10dee5-f1ee-453f-bde6-1f9a0055fa74", "comment": "Malware payload (Gafgyt)", "value": "bf907668ad36dfe9da568784dea287e672e5a582a252c0d2d0298461582a9a9ea3ec8bd0e73ce9adb1005e73835dc77f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650298, "uuid": "2a3df889-40fa-4f7e-8916-85e679f0a18c", "value": "T101B33C45FC448767C3D327BAE78E438D3B36569457D733016A389EB42BC1B892E39A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650298, "uuid": "7b07afd4-dffb-447d-92b3-a5679cb835b5", "value": "3072:FT6eFIgER4BS5hsK7vymtiqQ6MdzIXJIM:MeFIg4kS5hsK7amtiqQ6ezIXJIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650298, "uuid": "c42ab652-4c2a-492a-99c1-aa1431f197a1", "value": 115115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650298, "uuid": "6a5ab5c8-5bd4-4589-bfbb-00dc8959a4bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650298, "uuid": "904a1f78-8139-4dc5-9c99-8859ab4463f9", "value": "e6fbb618b2438fb4174c5b3c587416c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182330f6-5e42-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639639850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639850, "uuid": "2caca568-fd08-4f7d-95c1-aa162a773f03", "comment": "Malware payload (AsyncRAT)", "value": "53111514af108ce43288e328845b09bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639850, "uuid": "1c4c904e-89e4-4ec3-a679-6b2b44796890", "comment": "Malware payload (AsyncRAT)", "value": "37ffac0d9c009b6fc4b8f138af8ee742d9a1f3b96e31ba78b485b9bb5d72c61a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639850, "uuid": "6d5e4ee7-008b-4e9e-b23f-61408981b5a9", "comment": "Malware payload (AsyncRAT)", "value": "aba30103a3fbcdf2a087f0cb9f80cb575110e662", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639850, "uuid": "724443cc-026d-43a9-bf09-0887c5a259b6", "comment": "Malware payload (AsyncRAT)", "value": "3f93ddef69adf66375e23f224974c98f75fc757eba6c029cc0ea9be9c78b63ba6c76bc53d269c56109049a78086db396", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639850, "uuid": "cb559b34-bb04-49c9-a399-f2000e6f5f85", "value": "T1A2A1537ED1AF00EA2B48D26536D74E31C8A0F2A6C1EDD92471B3C7EA547C2DC09B0119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639850, "uuid": "5665cd4f-7cfc-4b29-b9bd-a997e681239c", "value": "96:lcPNjnEk6cNTOBjBCrskEcToThiUG2hRztgqUGx:lcqk6yTGkE/Th3g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639639850, "uuid": "7b903a0c-e5a4-4c07-afdc-8fbc0da97eab", "value": 5084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639639850, "uuid": "5f26adfd-8c92-4b9b-b8c0-be121db93f0d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639850, "uuid": "518f45e6-2aee-4d38-8e0d-f0f35397d0a7", "value": "932476-7282942348-8923494446322-7123622354234.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f0b86c-5ea6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639682826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682826, "uuid": "2676dc90-5fb4-480a-848f-5f72c437f527", "comment": "Malware payload", "value": "c2bd850b66e7a473597e5c4b6371b1c6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682826, "uuid": "dd8f241a-8891-40ec-a21d-ec15695d3538", "comment": "Malware payload", "value": "38b273a6a852be79e0eaa19b677ae1d04d50867511cae0b59f2f2a1cb3ea0d7b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682826, "uuid": "c5e5e742-e28e-42fd-aed1-d573183769d9", "comment": "Malware payload", "value": "255c981fc9feec2c455743ac5a79e404f99c567d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682826, "uuid": "94bd2d0b-0726-4546-8564-8c4d41af9304", "comment": "Malware payload", "value": "040461a21d4cb97c647b50d981b2f07cefab1a15dda4f5e05cab57c558489f2141ca941af131aa8bb7d35837e47e4956", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682826, "uuid": "695aa797-9687-433b-afaf-b5c2c66b935d", "value": "T17122864FFB953B01C4495B145B9E3DAE8EFC0B97440E49A181F034E75B926A37AF7160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682826, "uuid": "4516401e-735f-471c-8f61-a1c8688c8c62", "value": "192:08qqFpxnXghHQz5uMXi1VLGYU3IUhU0iU364wXz:08qq3xnXgdQFu3SYPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639682826, "uuid": "f633f1d6-58bc-46fe-8c32-75878bbad68c", "value": 10704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639682826, "uuid": "6634544c-a66a-441b-85b5-7630498b6856", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682826, "uuid": "015ac9fe-6a8b-4a7f-af6c-27cd5f983388", "value": "1111.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85580e4-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641918, "uuid": "4d9189a4-ce22-40d8-8799-b45e1909f3ce", "comment": "Malware payload (Formbook)", "value": "ef863cb8d5b405e95dade21f2a396566", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641918, "uuid": "783d7aa8-78de-44d7-a208-011b6dbfed70", "comment": "Malware payload (Formbook)", "value": "39491007904ead8216b0cc5ea0121064f428aa00f2bf67c93af24e715ba09a29", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641918, "uuid": "46a39b2e-fb75-43ed-9ade-4d6d29a7341e", "comment": "Malware payload (Formbook)", "value": "1ef7a9ef01f9b90635b3370348418fd98c8b6409", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641918, "uuid": "0770b0b5-6a86-48f3-ab89-1f9f29e210bd", "comment": "Malware payload (Formbook)", "value": "78306933dd95f98dc4fb5c3cb62d871509c10c155b836a7bf26a5989418a4a50773b277f6db4c03a8b199bafd43a0ba3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641918, "uuid": "d942db45-f192-41ae-9abe-33a0ed17a12e", "value": "T176641274FCD70162D0AB0A3DEC220989B9D1FE694778B6C27D9739FB20743214AB6527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641918, "uuid": "9bbb8d6d-b291-4ef5-b2b5-400712305530", "value": "6144:lYUEMyauGxtSRZ/v7VUWPoOkVKAgNxkKRFsy3hAZLHsl01:lbyavSf/ZAOkV3gHk89YHs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641918, "uuid": "e491d7ae-8ddf-4bbe-a793-bd78db804d3d", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641918, "uuid": "921f3703-2e66-433b-8645-dc7dbd4c0cec", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641918, "uuid": "8b701c01-4b8b-4580-9b4a-e7a9af8073ff", "value": "RFQ - Mopcoms Turkey .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce743fb8-5ea3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639681817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681817, "uuid": "b97237a7-852d-4078-add3-7e5425644d89", "comment": "Malware payload", "value": "9e3c913bea089ba27461211dad73ed87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681817, "uuid": "4c87cb8a-442b-4c8f-86f0-5cd753ee5eba", "comment": "Malware payload", "value": "39ea3b381ab8d8af72b646db1db6c38492b12f6946dd3023cc81dcd49dec3b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681817, "uuid": "04f0364b-08ce-4df6-90b8-7105e9c22a83", "comment": "Malware payload", "value": "7a6aad308dadcfb17a472c8b0cdfd35c78fe713d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681817, "uuid": "9a764a9e-a8a7-423b-b91d-16d5cc3b2532", "comment": "Malware payload", "value": "4f0ef45af80512f90ebecf51b7fad72c3bfb8ee3d233101199295ecb74be16f3486123cce99a06ac82a8b75017195243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681817, "uuid": "6f4f819c-b7fe-4841-af62-31a19a29d050", "value": "T1DE95CF227E92C0B7E2560230552EA7BA4AB9B9325B3044C7F38C2E2D5F755C0A736777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681817, "uuid": "f53875a3-c187-4099-ba98-4a3db1a63bd7", "value": "49152:xc7pALoibvh8Azzx+lNk2CYZVlvFs1inK6pbJ2b:x2K0FXk2C4Vs1iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639681817, "uuid": "31d33a75-5a08-4d6b-aa49-5311dac9a84b", "value": 1913519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639681817, "uuid": "b2ebf658-088b-4f72-bcd0-e1199962f034", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681817, "uuid": "c60c55a2-4390-49ac-aadc-bd9cdb50e81f", "value": "_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98be164-5ea5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639682695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682695, "uuid": "d1f0ef0e-14cf-425c-ac23-48557c0bba4e", "comment": "Malware payload (RedLineStealer)", "value": "340a78afe9380b96fcdb10a3a8f448c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682695, "uuid": "84f05b3b-f666-4b54-b6ee-448f3955d1b0", "comment": "Malware payload (RedLineStealer)", "value": "39efb1f727c8e6cb41904ae3fd8818741505a8a6c2ab8bd0e9ad66ab6b71d6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682695, "uuid": "a0b0b709-281e-45a1-b594-4dee49b41f20", "comment": "Malware payload (RedLineStealer)", "value": "ea3761390205b568feb17e36f32c9df1a293b17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682695, "uuid": "8d7c1fd3-e66f-4a04-978d-403ba0ede95f", "comment": "Malware payload (RedLineStealer)", "value": "7b19be5e7dc2503acf986ef3226579353cb2a0f1b9a5cb79ee29a648213f17946fd4044ee2543b30a390c7c31b05cd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682695, "uuid": "2984ae14-0bc2-4361-b859-67a192472a2d", "value": "T16F65338186D3FC02D68FEFF8AA343402D89B39714D85FA56B34B82567F6D4AED2180D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682695, "uuid": "dc66793f-dbdc-465a-a4df-924ae6e18175", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682695, "uuid": "e47101b3-ec0d-46f5-95a1-3f796a3981ee", "value": "24576:XCnWUkzvDaGhMThoZvR8+0YoqYlocZrUf20Nsh+U+T1X3gNiFf2KtGpiQJUu67hk:XCW9vPum86oqYllcWcv5QQ8KtGs7dNaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639682695, "uuid": "e6b61df7-dc8e-420f-b05c-9509a8cbb3c2", "value": 1438208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639682695, "uuid": "6ea39add-9c97-46ca-901d-e9571cae7a3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682695, "uuid": "f9ff080f-b501-4070-91be-f54818fbd882", "value": "Hypnoz Generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cde3772-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639643938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643938, "uuid": "5c7f6109-ad8b-44b9-90e3-8d0ea870484a", "comment": "Malware payload (OskiStealer)", "value": "64fafbc31b117e43f94b35b3fa39a096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643938, "uuid": "1d15e3aa-6613-44f3-81b9-6911f9148d26", "comment": "Malware payload (OskiStealer)", "value": "3a1643bbeb085792684f579b51b1da8d3adbd40e0e4815ab6d92d30d5c7e1f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643938, "uuid": "a407962a-1ba7-4741-b2af-5997579a47ad", "comment": "Malware payload (OskiStealer)", "value": "2e5f012bff7da3a7da2216127fe45a09905e5966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643938, "uuid": "5211a834-8ab8-4b55-8b77-03b2d8f49995", "comment": "Malware payload (OskiStealer)", "value": "b5ae6460a87a41703ae751df0e2d28abc0c247d59d22d86ec91cfd5d6d2cc30ddab26112491710e48ec3ee286c18eecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643938, "uuid": "47fd015c-250a-4f69-91d4-44600b2138de", "value": "T12135235037F4DA12C35ECF3A26B380901175BA5BA929FB0B6CC4B18D342FB559582B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643938, "uuid": "457a44f1-b51a-4a74-a344-2c15c89634b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643938, "uuid": "fdab2b70-8ec3-48b1-9d70-66c26e08838a", "value": "24576:EserMkkvlq4l23QoHd4FSpAZvnnPEZYJq41vsXrLRxfgkOHZIGG:3Nq+23J4FSp0nn+cPvsX4RSGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643938, "uuid": "17889114-cb29-443a-8dd1-6223f7441e28", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643938, "uuid": "f7746ae8-44aa-4a16-9e32-32ff22a2edde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643938, "uuid": "4958ffa6-4307-461e-8554-6e5075c5dad6", "value": "64fafbc31b117e43f94b35b3fa39a096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c31d1a-5e4f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639645802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645802, "uuid": "9969c50b-cf90-4504-b00d-3026fb23fa8a", "comment": "Malware payload (AgentTesla)", "value": "28fbd9f5c51360438eecbf663f4cead0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645802, "uuid": "7bde0be5-224d-47cf-8b1a-b4388c696e69", "comment": "Malware payload (AgentTesla)", "value": "3a26b280b2801a9b15406c26ca177a30b243c3bc0a632133a17233c303fe01f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645802, "uuid": "eeef57d1-1afa-486c-815d-0424235ae109", "comment": "Malware payload (AgentTesla)", "value": "7a63be570706a85f13eff3f340d20e3c406cb304", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645802, "uuid": "398dbc6b-bbee-4290-927b-33c8a5126562", "comment": "Malware payload (AgentTesla)", "value": "dd5981bb2cea3f8f0152cf01c52cc34e259fec373ad3b280e3d5829224ef9a19365e3212e5aec65808a1c82edb3fb21a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645802, "uuid": "fdad6bc5-c7f9-43f5-994a-099849534a7a", "value": "T166B4120077A88713C52C5BFE6461655183F2A030B293EF98AFD7B1EB17E2B824A519D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645802, "uuid": "609072e4-01a6-4d33-8160-5ddc88e30e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645802, "uuid": "7361b82b-7ed3-4a7a-89ac-7400ae750e17", "value": "12288:OKbh1uHoA5QfJcfFptD+Bzim/q3m6Ivv3A/eAhvxT0SXgEuSK3:3DYoA5GGfFpZaim/WIvv3A/eAnT0vfSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645802, "uuid": "4c06e0ca-1297-45cd-9ad9-a3700705e909", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645802, "uuid": "caea2662-6095-416b-af06-ba40426e7f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645802, "uuid": "84fba5d6-2df5-4ee7-a879-19015b3a5828", "value": "InvoiceDDTN.201LGM4743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a5fa66-5e7a-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639664254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664254, "uuid": "22cadadf-2c38-4248-851c-36c130333c21", "comment": "Malware payload (AgentTesla)", "value": "4805179e370047f8b96ed8950d9bf6e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664254, "uuid": "4068b070-6b72-46d2-8124-94672ff10451", "comment": "Malware payload (AgentTesla)", "value": "3a361c768a1ebfd17d5b44a2d4915301c9f06640720f0644fd9809b48b12c4c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664254, "uuid": "88555d5f-aa7b-4b73-847a-41c8a816daa2", "comment": "Malware payload (AgentTesla)", "value": "c7646e16532dcba244921ed5b0f1efa9e7cb1dbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664254, "uuid": "61b434ee-c533-4a68-9a05-2b2d7ec8b66e", "comment": "Malware payload (AgentTesla)", "value": "726949fbc2aa2171488ba69d7c648b968e76ee36c7cb723e7768222a57a6302177546597ae42e3cc9656c5f0ff0260f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664254, "uuid": "de34a820-7d5d-43d1-acba-687d2b8253ac", "value": "T15DD4E00132A9DB12D4B9ABF88C60A0B407B67C66A57AEB0F1DC17DEF36B4F804550B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664254, "uuid": "f5da1164-4bdb-434c-9b69-5b8740561fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664254, "uuid": "7f94255d-2187-46ac-94a6-78c224314116", "value": "12288:h8PapPapPaVt9uhqOtFI50r/OyqTEr4RIOia+YWjaEfnsGuSK3:h8P8P8Pitwcq/uR/SsdSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664254, "uuid": "8a899680-23b5-4194-be8a-b3cf957a1135", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664254, "uuid": "ff28380b-9515-443a-a35e-6d9b47dfcf17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664254, "uuid": "b04dedd6-7bc3-4c54-b6e1-8744c384d103", "value": "F\u0130YAT TEKL\u0130F\u0130 TALEP RFQ_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f1fbfd-5e15-11ec-96a4-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1639620551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620551, "uuid": "eef3b048-f81e-4588-b140-14056175403f", "comment": "Malware payload (Tofsee)", "value": "90e20bb989d503704c16faf8e852e6b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620551, "uuid": "77c78798-0185-4c3c-abde-3a6cdde0d12f", "comment": "Malware payload (Tofsee)", "value": "3abf5e573cbcc7b375436931ff07be0d9d13085cf6a14f9cde285a83e7ff528e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620551, "uuid": "b936656b-d4cf-4a92-bfeb-17a965304e2b", "comment": "Malware payload (Tofsee)", "value": "1e0461ece662692598fe4281044fa1c0cd7fed31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620551, "uuid": "995c8036-a5da-45b7-b063-3fe0480a79b8", "comment": "Malware payload (Tofsee)", "value": "0bc24eee73e54f7675e4255c4444c7cd70377995fab025075c31a0da508b8441daa41886d9f4f7380292c1e9c7e36c19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620551, "uuid": "ea377c20-c422-4183-ab34-f56c553bd769", "value": "T149748C10A6E1D435F1B312F85AB5A3B9B53F7AA16B3490CF13D416EA56386E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620551, "uuid": "2582f422-fa9c-4c17-815d-adfddb4d49d0", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620551, "uuid": "aed2b2ff-8399-4a41-b044-8f6acc378803", "value": "6144:91XBb8PxF6Oc37cqAibHlD5EDYe2Hg0C:PXyx4Oc37cvib7EDYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639620551, "uuid": "d21e7d5d-13fe-418e-a574-6bc2134c574c", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639620551, "uuid": "97c5b99e-624d-45e3-8488-3d592dd2c988", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620551, "uuid": "7e523501-41b2-485e-bb2b-a9d4b604dfb6", "value": "90e20bb989d503704c16faf8e852e6b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d18928-5e75-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639661851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661851, "uuid": "5d8eeb29-b749-461d-bd37-801501ca5cc5", "comment": "Malware payload (AgentTesla)", "value": "142ca5aad191d16aa8659581d0bb7d89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661851, "uuid": "e35eebb1-56b2-4823-91b6-a4be19041dcd", "comment": "Malware payload (AgentTesla)", "value": "3bc9b5c874c95fcc670bf29708b46334abc58b91251783678e3c384ae04917d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661851, "uuid": "18e6f314-6f33-4abc-8cc6-a9efe86f5253", "comment": "Malware payload (AgentTesla)", "value": "73d6157bd61ec178586e74ac2de2786573fdc4f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661851, "uuid": "5c4d29b4-6351-4346-bdfb-a868c608df8b", "comment": "Malware payload (AgentTesla)", "value": "6542ce21a87b8aadcd8c368afb74c82384cc52a3af02bd73f1b89c7096ae5e9f2f920efbdfd35406f8dd2886a8e64a3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661851, "uuid": "9ea192ea-8502-4153-b1f0-6b4c22dd1e0a", "value": "T149D4122967C4CDABE6895A7084B6FA3EA73AEC4045194FC1B3B53F5B7C7344992802CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661851, "uuid": "ea4f2154-78f2-4fec-8f20-75ff3f2a6d81", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661851, "uuid": "fed1ca68-5f08-47c8-85b2-e1cda8e31f88", "value": "12288:wr+v1O0SKxvuiqJUs77bFi+WiK+GIUTHr7i:a+v1O0jA7peuUTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639661851, "uuid": "7d210566-533b-47c5-9ea2-2e7c2f3d23fb", "value": 604563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639661851, "uuid": "8c107725-576b-4dee-94c5-e5ef92e335c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661851, "uuid": "675713ee-3369-4a30-ad29-19a452077d8b", "value": "EDC Purchase Order3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8a2107-5e81-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639667211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667211, "uuid": "b6a45b31-b02d-43e5-a897-9d20e5d12b68", "comment": "Malware payload (Mirai)", "value": "4710f785df5d314e45cabeab83604d37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667211, "uuid": "15792188-f4aa-4c48-82f7-580bee48a7d6", "comment": "Malware payload (Mirai)", "value": "3c25bce3f89b95cc10d8b79ced354d023c4f2bf928c34e2dccf2209218c461af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667211, "uuid": "b7e891e9-ad50-42c4-825d-175d1d6656b6", "comment": "Malware payload (Mirai)", "value": "492e4d2998e6fded780ffba32cbcbfd175138ed0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667211, "uuid": "9bb326dc-6e75-4227-bbc2-d43dacf472bd", "comment": "Malware payload (Mirai)", "value": "e0ac17f1bf7ccd0da67228a07259be2c66549394777c7f554b053f37f3b5aee778010548bfa503e7f5e555fa49594301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667211, "uuid": "3c80df6e-5aa2-436d-893e-99c4b084cf85", "value": "T1B0338C63C4299D68C0488670F1B99A3417A3F524AA577FF50D8B82659453EFCF2283FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667211, "uuid": "3e7854d5-624e-482c-a052-2c18fdaf5810", "value": "768:hkRqWeAqreLeIeYeDQVnPUX+UM/84RFod1dIistCzKW1:hk4WxyWpBR2pCQdcistCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639667211, "uuid": "d1406c9e-9af5-4493-b184-dc9dd7bf1855", "value": 52192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639667211, "uuid": "5876c349-5b86-4550-9bc8-666cdd58cd00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667211, "uuid": "d0148aa8-5c8e-4e14-a914-5b1685138108", "value": "4710f785df5d314e45cabeab83604d37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92449956-5e9e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639679569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679569, "uuid": "38d1a77c-1f78-4eff-8259-54af7a9053dd", "comment": "Malware payload (AveMariaRAT)", "value": "72c9342d5459887ed9ad062bfeb3508c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679569, "uuid": "8031fa4a-e1ad-4cd3-b3e3-d5871edc0df6", "comment": "Malware payload (AveMariaRAT)", "value": "3c4f9e2ee772689549b460628a78cc6f0c04255d3195e69f5ac9d4e30cf14461", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679569, "uuid": "d099352c-7e98-4f55-b157-d2fb5c6795ed", "comment": "Malware payload (AveMariaRAT)", "value": "fcc2ae1999ad4a07a1fa8b1850f5e894902ddb20", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639679569, "uuid": "e23c7528-5a34-4da7-8744-d031e755250d", "comment": "Malware payload (AveMariaRAT)", "value": "e2e38d291ca6a61af8ff53b645bc16b8c8f1aebf99d35ab7a9d87a16c3940eea37ad2c6a3104a950d5ef93778fb5859a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679569, "uuid": "2aebe5e1-64d6-4361-af37-0422e868d00e", "value": "T1C3B4BD43BACC9AEAD02C4AB84C51F31C67F29C2A6152DE596DC2F0DA167174215F38BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679569, "uuid": "aa9cd5cd-c734-43f6-85e8-709fef2dc844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679569, "uuid": "4d12702d-5739-4897-8421-ec4c7a0b7c29", "value": "6144:YBkpIUUuHoA5QF19zYMIhNXUM6H8MwgcqpP2URhb+Bg/jRPFYyO4F8gDAaubGKEO:YBxpuHoA5QfJWNw+ihHrRWauSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639679569, "uuid": "d0ca9bc6-92ef-4670-ab73-18f03ad6893e", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639679569, "uuid": "f5931ee9-2b37-47bf-b0aa-211c6d7d4111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639679569, "uuid": "a4065f02-f279-4186-91ad-d57bfbb211bf", "value": "PDFW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7b6d56-5e98-11ec-96a4-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1639676980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676980, "uuid": "08e7510d-91e0-43fa-898e-a23c45ef38e7", "comment": "Malware payload (Conti)", "value": "6a97f8afc1151619d5b119407faeb1ad", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676980, "uuid": "28718ea8-4205-4480-980a-4e75cf09df27", "comment": "Malware payload (Conti)", "value": "3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676980, "uuid": "df8af3d2-956b-4064-a5c3-6ffadf8a6059", "comment": "Malware payload (Conti)", "value": "185d65eb755cee888508d07adad60b39e0be2210", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676980, "uuid": "56cb5d2b-722b-432e-8601-1a55ef9ae6f4", "comment": "Malware payload (Conti)", "value": "819682ea8470e54dc7cb3bcae9f7179fdae85bb6c9b060556437890382a870e39f08b614feb0967ff800347ead1d8d96", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676980, "uuid": "5dc2ae37-a4d5-4e24-aa4b-e59649cf0440", "value": "T1A3144B01F24D827DD6AE4D31267A7EB280B99D383B5FCCF7B7DA882816606D06524F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676980, "uuid": "f73c919a-4548-467c-ac51-f78c43696e3b", "value": "77679e1e454376d19c1c76600c17ea98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676980, "uuid": "9b54bbc3-384f-4629-8c9c-4925ce11a163", "value": "3072:HJkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34oDxt:HFcuVqTATicDNkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639676980, "uuid": "70331861-68cb-4d2b-aa7a-b7689acc4221", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639676980, "uuid": "86829ddf-1e0a-47c3-8da8-f7673bda6b28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676980, "uuid": "3b1989a2-0386-4bb2-bb45-7e1f57e7ad24", "value": "3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96d1b33-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639641946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641946, "uuid": "bb2a1044-95cc-4e46-8091-b7f84d8cab12", "comment": "Malware payload (RedLineStealer)", "value": "8f4a7f6a42761bf6c640251e4d4d8d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641946, "uuid": "9e48fde5-2f53-4192-ab26-f244d5388ff0", "comment": "Malware payload (RedLineStealer)", "value": "41835dccbcfaad0f9ffecf68041ba750a29a8f8a6c3056d006b8154119ecf7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641946, "uuid": "b08f5098-c946-4a12-967c-b9646fd523d1", "comment": "Malware payload (RedLineStealer)", "value": "915e3fb011097be9f001bd780b82ddd779caf078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641946, "uuid": "2c87284f-d47e-48af-a941-686f720bde99", "comment": "Malware payload (RedLineStealer)", "value": "bd0f1f12aed513d3c2a99755d694f0e93ec9476309376a1d78b837986e7f911f480595d0f20b20aae56b577b6d73107c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641946, "uuid": "591c7f83-8555-4e25-a014-0df53cb3cbc1", "value": "T10D748C00A6E1D435F5F712F44AB6A3B9A53F7AA16B3550CF13D51AEA16386E0EC7030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641946, "uuid": "e0b1f752-8a37-41dd-8daa-61c9a84b4a8a", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641946, "uuid": "de13f1ef-fdd7-40d9-8ce2-50334530011e", "value": "6144:uj4cJSPMts6ARnc8VnPrxvBUA8bH9T5VJAeJ1vC0iP:uEckPMts6knc8VnPrxvBZ8b7VJAAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641946, "uuid": "78b5697d-b19f-4839-a585-13cb7d0ee585", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641946, "uuid": "b04c2d77-f835-4268-98e9-1e828dd9f398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641946, "uuid": "4ba6f78d-8ef4-4147-987c-901a3196aa54", "value": "8f4a7f6a42761bf6c640251e4d4d8d05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffb8221-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641796, "uuid": "af28f10f-467f-471f-833e-1bed1d837633", "comment": "Malware payload", "value": "74dc04c2f97897edf107be589bc31ce3", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641796, "uuid": "83f7d16a-5a28-42a8-a4c7-3e9ea1908a49", "comment": "Malware payload", "value": "42d821b43472f11c88ccf64e113fb7e80485a59aaf7ab90d254342011b8094f5", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641796, "uuid": "c379a652-bfc8-488e-a910-a8a714b6e55e", "comment": "Malware payload", "value": "4d2f6a88fd19ce9b03cb626cd5e972af2faaf7ef", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641796, "uuid": "1f239eb6-65be-4eb2-a752-c9c3dd546efc", "comment": "Malware payload", "value": "53b0f3f41c5901f7277097023d8cbad158416adfd54395d66ce6a0a7bb41b40ecd76a45d6f1704bd24e51a158766d491", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641796, "uuid": "83e4182b-5f4c-47ef-becc-4ccc048b8cd1", "value": "T1766412CAB5E98767D27A773405E5D6B62490EC7083EEF650F6FAB6071BB2F00204512E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641796, "uuid": "fabcce63-c4fc-464f-991b-75e5f65a89eb", "value": "6144:Yv7h9yPl8tz4esTW8qbjG0NFzPH/5ms+jKp/sKaWlSCBZRtkhRbk:wkl8tz4EbhDe/CBmX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641796, "uuid": "99de1594-272e-4c32-8580-5e25d8bca6ef", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641796, "uuid": "1b918826-4aaf-438b-b9e7-04bca6f0de67", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641796, "uuid": "4f509b66-c550-4704-99cf-92ee6b331cee", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9513e5-5e52-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639646946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646946, "uuid": "22793fd7-6ce1-4b4b-902f-fee919b54867", "comment": "Malware payload (Formbook)", "value": "7fb13d2e98e3805fca5ee6f0f78d4e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646946, "uuid": "3b80ea2a-d1ef-4554-a94f-5ab9e40f32c6", "comment": "Malware payload (Formbook)", "value": "43b262f0fc6657ddbdef489ab15c945a4cec8a34afdf70ffbfa2bae17e60f339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646946, "uuid": "7b431bb2-5df6-435d-ae6d-89b414871b8b", "comment": "Malware payload (Formbook)", "value": "933f89b053c7a6a9e3366cb6b8cc35af05359525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646946, "uuid": "a0d638f1-8a95-407c-90b5-6c32e4758fe9", "comment": "Malware payload (Formbook)", "value": "e0dfe1dd6c06200eb621654a2a71a9402522f476279a3fac32317c83626d742b62f4e7ef74ef45bd9c14d7cc58fb1faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646946, "uuid": "5c7a5bc1-9b26-42c3-9e04-5614d03b7e63", "value": "T1CEA423B5BED04886E87E4D303D33AAB5DBFEF5C80A8B96471F681BDD3E312925106452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646946, "uuid": "a649013d-34fa-4298-8966-74745ed9fac4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646946, "uuid": "91dff169-dedd-4f35-ace0-3e361ac0898a", "value": "12288:RmVgrZIrnT+D86yaIf/QRjpsGZmtoUQhPXEDuTLu3s1Ch:QVgNETMiRA3LZmWUQJ3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646946, "uuid": "21192e19-6af2-4ca1-89f2-aa16cf4dcd23", "value": 487828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646946, "uuid": "2f201769-84dd-43eb-9c23-58fafec09694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646946, "uuid": "deead49a-2a7b-429e-98c5-f902ea23c63f", "value": "7fb13d2e98e3805fca5ee6f0f78d4e69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16cd88c-5e88-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639670199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670199, "uuid": "2df624dc-6427-40f7-84ef-622691927bd7", "comment": "Malware payload (RedLineStealer)", "value": "8692701e0afdc6450fc3ea53dd8d5b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670199, "uuid": "210a61a4-e1dc-478c-b84b-5b35fbc33ab2", "comment": "Malware payload (RedLineStealer)", "value": "446afb36e15f95b73b11b2239ddfab6eeb0edac94f1c7280bffc0dd75ed4c5fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670199, "uuid": "aa712e5d-3e0c-46da-bb65-6a9307f4753e", "comment": "Malware payload (RedLineStealer)", "value": "7fc570efec6c1854ed37a39734c6dcbe4476c498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670199, "uuid": "c2beb14f-113c-4856-98fe-9366f7cd67dd", "comment": "Malware payload (RedLineStealer)", "value": "fdd3cd7cbd628a5e41247f0a4ed7cf2f1f4fe6566ffb8ec5d3d9d0291e1de407702e9633b662d33f7f502708cfd7e9de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670199, "uuid": "4936ae03-05b8-47b3-9b22-1dbea37a2372", "value": "T1B5A4C000E6E1D035F1B716F84ABA92ADBA3E7EA1672490CF13D526EB46346D0ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670199, "uuid": "a8db909e-d4f8-4de0-a4f1-23b45f6700db", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670199, "uuid": "8c47ce9d-b0f1-4460-89db-536c3414bd3a", "value": "12288:pZIEKbCXpYrnzBXjqMTNODhCjTq3tRu5xuSr:puoX6rnzBFNruK5x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639670199, "uuid": "a8f75641-5d59-4cef-bcee-8339468fd993", "value": 456229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639670199, "uuid": "c24b1111-c5e4-4aa2-ac6f-5c59634fc269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670199, "uuid": "cd037a1e-1a0c-4ba9-96fe-d23ce92097ef", "value": "8692701e0afdc6450fc3ea53dd8d5b1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5b5592-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639683725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "48a16f28-f56c-4f5f-a347-e0e4255ced1e", "comment": "Malware payload (Mirai)", "value": "3ba71b41872b8ca4ce0a0e265f331621", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "da4cc4a8-9bc5-4476-9959-1c05001e337d", "comment": "Malware payload (Mirai)", "value": "44e3dfa55fd0bdaab3d9a57f622b2fb9641399bdacd64a878025adf720d82d61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "77ae7de9-b759-4298-95d6-639ecab36f96", "comment": "Malware payload (Mirai)", "value": "d7d3796295c1f7ea491e47ffa67c1334b0d5d16b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683725, "uuid": "06f23b63-31d3-4148-b747-72e4b2045729", "comment": "Malware payload (Mirai)", "value": "e41dcad5a32d8c1127c39aed5afae30da367256c9553499151cc5c95dee865a41789fce1c0688f65e17a0118c862ab9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683725, "uuid": "13fd8870-2499-4431-a5cc-e2c277c82c45", "value": "T1DFC34C46FA418B13C4D61779BAEF42453332A794A3DB73069A285FB43F867AF0D23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683725, "uuid": "f45b3e5c-9b98-4d74-b4ec-4c4321b38287", "value": "3072:q/Xz3xsnt33WR5FQWgQ2HTrL4jq3S2UFwM/9ndAvx:iXz3xst45FQWgQ2HLD3S2UmM/9nKvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683725, "uuid": "01ed832a-d1e5-4f2a-9be3-938f0c28878b", "value": 126988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683725, "uuid": "5609b2e5-e686-42f4-a8bf-90758260eba5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683725, "uuid": "a57b1df1-8825-4cee-807a-f0f8dd005c56", "value": "3ba71b41872b8ca4ce0a0e265f331621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9471bd0f-5e5f-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639652514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652514, "uuid": "0e2a6bca-513d-4985-839a-0a0da2def656", "comment": "Malware payload (RedLineStealer)", "value": "33e37063f7673825305a145517ae65d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652514, "uuid": "80aa0f39-cfd4-4300-ab8d-7df776ec06d3", "comment": "Malware payload (RedLineStealer)", "value": "44e52a3a52e228421028adb9dd53ff86c98fa479d6e49bd4386eeaa4cd3555c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652514, "uuid": "906e942d-5f1c-419b-91f9-375f18b04b9b", "comment": "Malware payload (RedLineStealer)", "value": "f8f3b8618dc055d73499958acd5318ee16c4585a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652514, "uuid": "5729e4b8-b27c-4f82-ae40-098253fd1a2d", "comment": "Malware payload (RedLineStealer)", "value": "11a57dfbb475066d439233514e6806675737d874f35e4dcc9bb994051b87add5a101c2d7184e17e2b8d994dc90a6a293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652514, "uuid": "33961a3b-4823-43fc-8ee8-dc0daa2f36bd", "value": "T1B8A533E2C74A6C28DC3B14F0B5A5BD3BC65798C58987D077F6F2A0C35A8CB0982E4765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652514, "uuid": "155e0d05-07a4-45c9-ae3f-1b1e03da2044", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652514, "uuid": "fd4eacc3-4af2-44e9-871c-66420362a83c", "value": "49152:ETS7EGYkCrSZpYgNI4SkDHNuZmnXEZSNlApwqNaq3Rofj:Em7EOcgN9xHNuMnzGJ3Gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639652514, "uuid": "82a6b22d-bcce-41b2-ac88-f035a5c41f18", "value": 2239488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639652514, "uuid": "49c63323-1f12-40b8-9e18-740a49848825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652514, "uuid": "1c495a2a-a52a-4a14-b2a7-cf732d1734db", "value": "33e37063f7673825305a145517ae65d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891e8d52-5e7b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639664521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664521, "uuid": "10921add-d457-48b3-8b37-1443a0c86b99", "comment": "Malware payload (RedLineStealer)", "value": "2c0f3c89578238db016bceb007793ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664521, "uuid": "91c8586f-79a0-465a-8798-b0f0d03fbd0a", "comment": "Malware payload (RedLineStealer)", "value": "44f8956a62c8c642f21fe5a16dd0114e836ddd97e4d28e37a3bcd710c986462e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664521, "uuid": "6276294d-bd52-4dfd-90b6-159eb9726cc7", "comment": "Malware payload (RedLineStealer)", "value": "e43333b32e5bc63190846f4cd16df3c66961994b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664521, "uuid": "f60a4cec-4ade-4183-8886-76502acdd493", "comment": "Malware payload (RedLineStealer)", "value": "f9969f947d992bef4baced057a057f05b1021060bc9a0d3f06ea2043f7271ef1f5011ba3a08361fcab68e5a14260a58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664521, "uuid": "455f685b-c9be-41bc-bfd2-99650b8984a5", "value": "T139A4BF00E7A1D034F6B716F859B6936DB93E7DA16B2490CF13D12AEA1A346E1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664521, "uuid": "a014ab90-ed3c-4ea8-8190-6670b3577ce6", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664521, "uuid": "a9750362-b32e-43f7-881d-491dbb65cb99", "value": "6144:jzdQcuKrRosANpXrZMJ2jIT2LfiXhJf1tSdf90LblwNP3zlUR5/+6lQKR:tQ70i9MJ+LfiDdER2LblUP3JUR5/rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664521, "uuid": "f3922fca-2759-41f1-b8da-9c4163b2b08d", "value": 456229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664521, "uuid": "1e1c46c7-b6cb-42b1-8f8c-8b6354a995de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664521, "uuid": "7b928e8a-a1d4-4bc2-a018-22c48c8e04e8", "value": "2c0f3c89578238db016bceb007793ecc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6825d3-5e47-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639642248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642248, "uuid": "291fb431-494b-4757-a5fb-bdc9f016510a", "comment": "Malware payload (RedLineStealer)", "value": "a01990478657416b216e713b7b808184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642248, "uuid": "5652d36f-5a6b-4def-abed-265c6ddfe822", "comment": "Malware payload (RedLineStealer)", "value": "452e8b1d49aab5abbde9a1fc8c8172b6d5c04478072989a5ea2d4b86436d97d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642248, "uuid": "d4a32077-fdb1-4c24-84de-342a9cab06fc", "comment": "Malware payload (RedLineStealer)", "value": "09818700415b8a3eee50fc4cc89fc16657aa499b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642248, "uuid": "aa51e9b5-7774-49c4-b605-3d695532db29", "comment": "Malware payload (RedLineStealer)", "value": "647ac70eee1d23bb3c5c3f03802619b33cc6ad2c7f9e6959c29483c1a8161b6f56e05f3f9e35fc1147eb1cc16e48b99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642248, "uuid": "e8604962-2b8b-4deb-9896-4e8b4946a70c", "value": "T17DA4BF00E6A1C035F2B352F859B693A9A93F3DA25B3460CF13D51AEA4B346E0ED31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642248, "uuid": "84ffce9d-961b-4004-9bec-a9295177f8f1", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642248, "uuid": "d2ecb577-b479-4cde-bd73-44634d9e3d11", "value": "6144:kWZxBUpJozULTyS0ul2+FKd6VMt4ibESIpi1IAtL9CKIGphYpq9gjLNC9U:9CJsE1SyKkt2ETpmIAtL9CvGpapq9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642248, "uuid": "d5792d1f-32b4-43ec-b885-30bc8c192a21", "value": 455704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642248, "uuid": "8d7f99eb-378b-466c-8d99-a2887778f947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642248, "uuid": "01a37989-3bd3-4c48-b85d-f654269ab63d", "value": "a01990478657416b216e713b7b808184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301b1d5d-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1639644615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644615, "uuid": "924db303-e536-4834-98da-7bd384bea4aa", "comment": "Malware payload (BazaLoader)", "value": "01fb98c5b81fa6886f937fe56f82f366", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644615, "uuid": "0153d11d-d6c9-4b7a-ad23-33b903b12e9e", "comment": "Malware payload (BazaLoader)", "value": "45b490e6d8cd1c139ba5797aab43a62a9e5b54ccce29a092c5a356fb8b441565", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644615, "uuid": "25662bef-0d27-499b-a967-ebc7c3f9e947", "comment": "Malware payload (BazaLoader)", "value": "7d1d0f03773a8ea3ebc25c65608620a8e4480893", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644615, "uuid": "ef87e55f-31b7-4906-b371-8a6763e0d9c8", "comment": "Malware payload (BazaLoader)", "value": "8bbbfbebbf14e6ae890d05e9f786eb7dbd152805245a32c27164f7eadd3618dc491feb8401371fbac1fc87600fc6f49a", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644615, "uuid": "215e15dc-e173-436f-8785-1c3169e6c59a", "value": "T18D549D78B94818F0D6DA99365AAD7CB9227332635EC7AC8C015CB7C2066F772BF85704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644615, "uuid": "819763b9-1e96-4df5-9a4f-29f373a8f053", "value": "6144:XrUni3GXAw8OjcAgMB8uiUgAJzftxDL48X4l9:giyZcA7NZXJRxD08y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644615, "uuid": "63d1f498-5003-4e82-b684-d8bb5305b22f", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644615, "uuid": "6bca570d-b418-401b-aac7-ba69ab4dfec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644615, "uuid": "95c9116d-aa31-4cab-9bfd-b37acb713697", "value": "01fb98c5b81fa6886f937fe56f82f366.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dad13b5-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641792, "uuid": "9f6c2747-4fab-4a16-a68a-0085d4e63ca6", "comment": "Malware payload (Formbook)", "value": "7c784569d2c7301b55a5fb9a16592288", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641792, "uuid": "3cba5cdf-2846-410a-af01-1ba42542cd55", "comment": "Malware payload (Formbook)", "value": "4668c8435afb17b0fc1f3202ab8ba30517efc0ecabf95ee36a99da64dfcebb81", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641792, "uuid": "46d59865-0847-4a0a-94fc-d44a9e7547ab", "comment": "Malware payload (Formbook)", "value": "730d195620b4c43ce2f545fc7edc1ba7885f23be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641792, "uuid": "140d02f0-ed22-4800-a550-49759baa9479", "comment": "Malware payload (Formbook)", "value": "5f61b588fdcd609ffbfb4de7b756b11f84d8ce0fd9dea7bcbdf439f3042f90801d163308444361de05ed49fbae48fb7e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641792, "uuid": "ada62b80-d17d-4372-a7c1-bf1436d33b47", "value": "T1976422837808EB73E6D3B9314661698F1F39CD46DE246A97037B72275376BB034126B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641792, "uuid": "01fffa11-f2f3-49cc-92ff-ab4aaa6de456", "value": "6144:hLIxHphOkzOj54n63fqgoyHGbRiSuVzK6H2L4JE1gwRKppznz:x+Ot1qgo8S6zB2T/RWlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641792, "uuid": "1c5a1312-985c-47c9-96dc-5c0eeba4d2e1", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641792, "uuid": "79d9e8e8-b517-4970-aa12-fceb268fcc0f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641792, "uuid": "e05dc99b-8820-4c76-9677-cf636624f07c", "value": "Request to send offer . no.ex212304.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb8cdde-5e5c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639651028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651028, "uuid": "3812a7bb-1540-4e27-82d9-c86de6427af5", "comment": "Malware payload (RemcosRAT)", "value": "8d784ce0d3f01a5ba8699daec5014096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651028, "uuid": "ef9c6636-37ba-4a54-9564-053e77b7e0a5", "comment": "Malware payload (RemcosRAT)", "value": "47576aba2a25e4b969ccd69eec27646901c41aa4d9efd6127aac9c5016568048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651028, "uuid": "8a614b7c-01b4-422e-a12b-6af592946bbb", "comment": "Malware payload (RemcosRAT)", "value": "e3e418654b49c589964ee60cb7196ea6d8c22ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651028, "uuid": "341cd71d-1520-4b7a-843f-dc292e0385fd", "comment": "Malware payload (RemcosRAT)", "value": "5c092cd031a31dab8e72499c8a17fdd37bbbb54557d4c37f191da8e1dc511063fde81b93a38ebb1f2e5d853fdcecad57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651028, "uuid": "97d78bbd-e689-4869-b297-3fd67cf5f7c3", "value": "T159D48E62E6B18437C023257DAD5BA76C5439BE317D28DC5A3AE81E0D6F392C3782E147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651028, "uuid": "50a8a39f-7a00-4e4b-b99b-06c931ceff67", "value": "818fefd508faa2dba213d5a222554a22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651028, "uuid": "e6aa7967-4945-4dd5-b807-f7ba16f91208", "value": "12288:pr979FvACpZmNFHYVidVqxql53FgXJrmv+3R+Zyon1PRlR:lp92CpZmNFHYVidVqA5VgXEv+BCN1PHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639651028, "uuid": "4e0b2d81-1efb-412f-9f95-dcb40e58bf99", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639651028, "uuid": "04c6b89c-784f-45de-bc75-8289f7cc3a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651028, "uuid": "7f3df984-3725-4682-a6b8-0f04759ebe27", "value": "\u00d6DEME BELGES\u0130,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f8d6f2-5e91-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639673810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673810, "uuid": "e29c1066-46a1-47f6-8c97-acba86c69678", "comment": "Malware payload (RedLineStealer)", "value": "e4d054e35bb23005dad5de533f9caf3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673810, "uuid": "1e86021b-5d2e-4bdd-b7d8-38edb7c63171", "comment": "Malware payload (RedLineStealer)", "value": "4a501c8e714f7886e3e017d6a64be43bf73b9b6e63dde1ba55ab1b4f6be9e613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673810, "uuid": "3d986bee-0293-4112-81b5-9c3d4708479e", "comment": "Malware payload (RedLineStealer)", "value": "b7d7cf862b38fcc6dd12afca0ed2148eac2b7af1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673810, "uuid": "f0a33970-6340-4d1a-9b8e-9f362fb1be76", "comment": "Malware payload (RedLineStealer)", "value": "5638d4b23d5a0644d513740e53c6efdaa790cb755d32cdab26d816bf1ad0ce658071c61a0c34cdfb3a6e40d018b0c38a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673810, "uuid": "d82f66d0-1c9f-49a2-a22a-7cff69b4cd16", "value": "T149A4C000E7A0D035F1B213F85AB6E3BCAA3E3EA1676450CF12D526EA56346E1ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673810, "uuid": "632843ef-abf5-4436-8b66-95ad0ac5783a", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673810, "uuid": "ba3ba8a9-f007-44c1-bcbf-7c3d8b8c7c6b", "value": "6144:RvY6t6Hqn0YUUWBFboyYSI4HepiYkhUndqouvrV15raVFo7Jz0F:hcKyzBFboiHdYk8dqouvrVHraVF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639673810, "uuid": "a04a68f0-42b9-4aa4-8dd5-345a15b1eb21", "value": 455192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639673810, "uuid": "e860304a-6bab-4c87-bebb-9eea79cdec2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673810, "uuid": "3e4b00d1-173f-4b9c-8a7e-fe43c7f26ecd", "value": "e4d054e35bb23005dad5de533f9caf3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51e3bc9-5e81-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639667199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667199, "uuid": "73985106-60fa-4751-a25b-07d3ff725d86", "comment": "Malware payload (Mirai)", "value": "aecb4918362281f196dad81d80267ba0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667199, "uuid": "26ec57bb-28e7-4f70-89af-ad29c019e830", "comment": "Malware payload (Mirai)", "value": "4b5c85efc7ab905628728b0918cc1f8c2788e7fc2be20723bf50f6adf5a517d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667199, "uuid": "08b0cf5d-9de3-4950-8b93-fe37e38a2cb9", "comment": "Malware payload (Mirai)", "value": "ce22e737130d2995668e99bf2ff955e18adfd01d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667199, "uuid": "ce76649c-f911-41e2-97a3-02dd4964e491", "comment": "Malware payload (Mirai)", "value": "5feec84662c55fcb19b81356b174bf8c92d0299e560e32f7bd5e87d5c2d5bc0c5c7bf8b283cc612e0c23bade79a5377b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667199, "uuid": "f16e0510-f119-494d-9e14-1c4b39ab6a21", "value": "T1A0D2D050DC02B0B2FAB41039FA3944C76ADE1EBAA5F439FF6504C5497F12084F5AB91A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667199, "uuid": "f13fbd76-df42-4ecd-b96a-9c5bede7216c", "value": "768:uDuwlrF/npIwkKW8Y7DsYJ898stJRfq3UIlA:uu6pfSwhY7DsYm9FfW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639667199, "uuid": "d756a090-b2fa-4703-8b66-9c9cc67d944a", "value": 28460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639667199, "uuid": "47ad5006-d062-40ee-bccf-c0ad6e998c32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667199, "uuid": "3341d1e1-fc29-4cad-8428-be269482604a", "value": "aecb4918362281f196dad81d80267ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d886de-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690822, "uuid": "9fefee46-63eb-4398-9aa5-a3d1ef9cc2e6", "comment": "Malware payload (Mirai)", "value": "72643dd1173485e273518b420e9dbb6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690822, "uuid": "f25c07b6-c027-4f1e-bdec-eaa9c98a7484", "comment": "Malware payload (Mirai)", "value": "4b5e1e3eb3f20a1d4eae8fa37ae0e1414e6b863c890bf9c823686a0f36e0a580", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690822, "uuid": "ca33d2dc-ebb7-44ca-af05-3b1d593ad36d", "comment": "Malware payload (Mirai)", "value": "42953b0628e5e0fae99bb707e5b790a4d78c2220", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690822, "uuid": "34c608f2-99c2-439e-aaa3-5ac54646c18a", "comment": "Malware payload (Mirai)", "value": "2da330ff2e98be462de157283a6ef4f0d31b1002aebbe669263d4fe54fe76f8caf7eaaf5f3ae8647442f4d5dd53ae03d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690822, "uuid": "fa1df50c-c61b-404d-9612-c22c084f7fd1", "value": "T1CAF34B47FA408A03C4D21B76B6DF5205332397B5D7DB33069A28AFF43F8269A0E67945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690822, "uuid": "97eb6890-1498-4e23-8f81-e7b062c8ff78", "value": "3072:jheIZt2raXZ6U+zM4B6mLfVU6h2rTetJ8aMImzFHM/9aqcmjwjz5B/MZz:jsrraXZ6UcM4vfVU6SetJ8aMImzxM/9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690822, "uuid": "26ee1375-3475-42c2-adff-a3495badbe6e", "value": 161079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690822, "uuid": "ffbfc837-2977-43c5-92db-529f54a0e588", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690822, "uuid": "103628d9-19b2-4f9b-8743-34edffa93d19", "value": "72643dd1173485e273518b420e9dbb6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b63f5bf-5e7d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639665250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665250, "uuid": "3615266b-eb8f-400c-86aa-4a2f25cfa104", "comment": "Malware payload (AgentTesla)", "value": "3f4564c083afd8c73aee7d9891fdf7e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665250, "uuid": "5eb040a5-7708-4dd1-aed7-5dd0001a1368", "comment": "Malware payload (AgentTesla)", "value": "4b6a1d6c4468ae22a81d09540c7a9b92436a703ffc8bc9ab6d04b59fc1a4301d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665250, "uuid": "bc5e5221-e42c-45e2-b497-3eaaac54f3e6", "comment": "Malware payload (AgentTesla)", "value": "7bc905020b086d0a4eef9cd9d1cc1e93760f8e7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665250, "uuid": "046c1d63-e5b6-4588-a207-6bd9e77c46b3", "comment": "Malware payload (AgentTesla)", "value": "39ce6f4f7077d4b5ad8bce0c9073051e1920320ca3c1c5fb0bd49aec90b28876eeda760fb54b6376fe7ebb26486133d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665250, "uuid": "761f73f2-6560-45bf-9578-e4dfbce076e1", "value": "T1C6941209B76C532BC45E2B7F1071AA346370FAAB70B2D31C6E4490DD5A637905B237A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665250, "uuid": "9f909877-aff8-47d4-b5f4-d11d05ec52a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665250, "uuid": "9de8b6ce-d61d-4e26-b6a3-05832f69b435", "value": "12288:7KHPGFGj8VJ+jpzp7G7Z8z2NlmPTaG/uSK3:evGBVipzp7GdNl0aXSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639665250, "uuid": "5f815501-1545-4025-8616-715e27706df7", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639665250, "uuid": "d63b1ddf-5536-4c53-bee7-114dae81d979", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665250, "uuid": "beab803e-fc7e-464d-ba6e-142ad6d7fc49", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02183b05-5e27-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639628217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639628217, "uuid": "fb8a4b19-933c-4167-95ce-679d739f6e93", "comment": "Malware payload (AgentTesla)", "value": "73ffc9971ac079c61759dcabbff8e731", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639628217, "uuid": "c0e329de-8887-40af-9a98-7635fd3bcac0", "comment": "Malware payload (AgentTesla)", "value": "4b7ebbf2cb82e29b854f646b66e3756b5226910b42996d267fb770eff225954d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639628217, "uuid": "a99cdea2-8d7b-4fc9-8fdf-f1a8055c6fa8", "comment": "Malware payload (AgentTesla)", "value": "da6acb4c862c000c0c9ebea5eddc83fd98553ed7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639628217, "uuid": "5774b2b0-a587-4de7-89a0-396f079f3abc", "comment": "Malware payload (AgentTesla)", "value": "ba3a49dd113106f85c0b9e69c3c1b867c7342871b489c6df3a47697ca23634b0b1b63e9b137516ae7045c6a5cf3425c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639628217, "uuid": "d5ae98a1-fdfd-4cf9-9212-e80be04123df", "value": "T16FB412107AAD5B17C46C5BFD9452700403F05127B663EBDDAFEAB0FB19A2B81CB41A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639628217, "uuid": "be4bf80f-ab16-4458-bc0c-4ef4ae1d7994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639628217, "uuid": "b6740991-c1d3-48ad-bc27-82c48e7224de", "value": "12288:CYbAruHoA5QfJ2ULM4qUkOU1oJj/OJvQHt0D77RNRuSK3:dbkYoA5GlLM46OUqB/OJvE0D77ROSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639628217, "uuid": "de179803-1ab8-4fea-8a16-8c1aa9e95ec2", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639628217, "uuid": "d3c7eeea-e3f9-43ea-84ab-7edaedc43a1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639628217, "uuid": "5f525319-d24b-40ba-8587-9e58a2d56422", "value": "OV2BR2G9XZfQ1M9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565a557a-5e52-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639646827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646827, "uuid": "e1157bc8-d96f-4a3c-96fa-a36a980948d1", "comment": "Malware payload (AgentTesla)", "value": "6979d389f97f72ff28a44b48f847cbb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646827, "uuid": "a772c4b4-6103-4a9d-8aa3-ff284190f9a2", "comment": "Malware payload (AgentTesla)", "value": "4bfa748a871e9b9e6f1defff58eba0046b0b838327845185d6ba6eaa5fc85f73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646827, "uuid": "4184387c-2942-4fc2-9c5c-648efa1684f5", "comment": "Malware payload (AgentTesla)", "value": "c27c09eb0d960539f3949fee85cd9b764fe40767", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646827, "uuid": "5815b1e3-f671-4d11-8acd-30f649a2265d", "comment": "Malware payload (AgentTesla)", "value": "d40aa3dc7874db4d87ddac42ccfb6e6cb4967b0656b2b04cae17c3c236f97b0847d591200afc17976c6b22e20b7358c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646827, "uuid": "94c4175e-5a98-4154-872a-4ef4f921590a", "value": "T1C3C412403FA88717C63D1BFC28A2512103F5A11A7617F7856FD5B2EB27A2F814B81AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646827, "uuid": "f6ef1e40-25cd-4893-9416-39116237e787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646827, "uuid": "515f2aa9-c9f9-4ffd-a3ce-f7647a442060", "value": "12288:A3uuHoA5QfJmLGlFK8Z6W3TmMG473FpHQWe4Vmk+uSK3BtGG:RYoA5GskXx3TXG4hpw14Vmk1SK33GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646827, "uuid": "6fae724b-bef5-4fa0-a8ae-de4f1710a469", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646827, "uuid": "da5f21b5-d76d-4d06-b137-68af83d651e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646827, "uuid": "9d0ce4a5-f828-4965-9dc5-c9904455ea5e", "value": "6979d389f97f72ff28a44b48f847cbb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e2e417-5e5e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639651872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651872, "uuid": "40bc1a51-01e7-4eed-9cb6-e7a0b5c46891", "comment": "Malware payload (RedLineStealer)", "value": "04be4c408e28d88e92605d47ba4ebdb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651872, "uuid": "038e81f9-51fa-4987-8315-b7f593200466", "comment": "Malware payload (RedLineStealer)", "value": "4ccde66f34e62143ccb4b739cc07713cfd97053c0f6a23e2317a82bc4005e7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651872, "uuid": "dcd4d9a8-8d61-4faa-b7e9-a1b05aa19a98", "comment": "Malware payload (RedLineStealer)", "value": "aab2c080d8b7501cbc915e99b0be10bf51703a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651872, "uuid": "192369c1-6657-40a9-99b7-5e642ab174fb", "comment": "Malware payload (RedLineStealer)", "value": "2633f14b619fab7a949be845b119777e8521628d82cf7ddd905a7ed3133ffc9b6c69f35956cd7b11403f352dc9fe3848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651872, "uuid": "886bac33-dfe5-4c03-9f5f-4d325e8da1a2", "value": "T1BCA4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651872, "uuid": "f798e14a-ea59-43a8-996c-204ee042c38b", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651872, "uuid": "80d96181-e010-45e6-874f-5cd000a00156", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639651872, "uuid": "9e3cb442-f9e6-4dd3-9429-ae437f08d550", "value": 455684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639651872, "uuid": "081a060c-5b7d-4e32-bf36-704d3698475a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651872, "uuid": "6a46c37f-4fc0-4fc3-8bf5-a2f28d0f150e", "value": "04be4c408e28d88e92605d47ba4ebdb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca59f2d-5ea9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639684150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684150, "uuid": "f36bb8b0-bcb6-4a0f-ba17-f8e894a31b35", "comment": "Malware payload (Mirai)", "value": "5642aa50b96b515d5322de98894a2771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684150, "uuid": "64278a3c-0cf1-41ff-8dad-f8b6072e554f", "comment": "Malware payload (Mirai)", "value": "4cf4fd0cf62276ee27461f63ab51a358e54fcaec9cb74f277a4968160500b8df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684150, "uuid": "50348504-2c8a-4714-a380-8636c67e4524", "comment": "Malware payload (Mirai)", "value": "323b8f4e4126a6fa66ed8a030c1d8640ab395082", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684150, "uuid": "349742b0-ce67-430d-b5f7-ea36fef6d62e", "comment": "Malware payload (Mirai)", "value": "0cde855202f7ca0d539354cfca319a6499e34e9d50abb5dae324f19fddc69b88ea845a5daa1ca2b3f227937655999ced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684150, "uuid": "1bc5cb9b-0e96-4632-9ff8-b30bf3be5307", "value": "T1C063951ABE268FBDFB99863447B7CE11AA5833C627E1D541E19CDA001D7024E341FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684150, "uuid": "5415ccb0-1864-4e6f-a44d-c1613a6dce41", "value": "768:0S9OFgh7sR5rF/AU/k8ss7HiEKnSNnKjwm4D8MWJ+cCs3wjQPWx/8r7TsVGJi6H1:W27sV/bk9iHGSVWwLLc7TsMWgjpawbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684150, "uuid": "220bb463-6890-4bb2-bf01-78877dc478c1", "value": 67836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684150, "uuid": "cdce6bb8-e940-4b09-8db9-90123ae5e8e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684150, "uuid": "3caea601-6c08-48d5-934d-319dae55a375", "value": "5642aa50b96b515d5322de98894a2771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3492bf-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639641949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641949, "uuid": "a6ea48db-1bb7-4f2e-89bf-1db9dc4c8b65", "comment": "Malware payload (RedLineStealer)", "value": "99cea26ecc5f89a2dc706c796e094635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641949, "uuid": "c097e6bd-cf16-46cb-aaa9-d7fe7c5c71ba", "comment": "Malware payload (RedLineStealer)", "value": "4e1df31bbb0c4718a85819ae1a0622a9465709acaa1c05b1de0b3b8bc89d5df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641949, "uuid": "4766b8a1-77d7-44df-8ca5-b8fa7008dcca", "comment": "Malware payload (RedLineStealer)", "value": "0f94b8bf86c8ffcbf68bcf8c070a522b687c3c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641949, "uuid": "bc0cfcb8-2329-40ca-9de1-ad00672e6e46", "comment": "Malware payload (RedLineStealer)", "value": "0a156e6dc86ca17a61b4f2a57a1c2ac306665c513ddb8abf0125282bdb2aa566ad9e4b4d66ded7a75e72123db618dc42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641949, "uuid": "98c44c18-1214-47c6-a5dd-22dd2f8bad10", "value": "T154A4BF00E6A1C035F2B352F859B693A9A93F3DA25B3460CF13D51AEA4B346E0ED31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641949, "uuid": "0961ea31-7c91-4cf7-b750-ed81fc6db68d", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641949, "uuid": "7999e507-c6df-4b8f-bd15-52df7c4e98fa", "value": "6144:kWZxBUpJozULTyS0ul2+FKd6VMt4ibESIpi1IAtL9CKIGphYpq9gjLNC9U:9CJsE1SyKkt2ETpmIAtL9CvGpapq9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641949, "uuid": "99751359-4b06-415a-a6eb-db936a0e658c", "value": 455693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641949, "uuid": "ad7eb741-a471-4d5c-9e1c-80974e081a07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641949, "uuid": "5221228f-1dce-4586-8ba1-c283296d76aa", "value": "99cea26ecc5f89a2dc706c796e094635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb3a821-5e89-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639670491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670491, "uuid": "48b0401d-f8b6-4190-9b12-d54451cde21d", "comment": "Malware payload (SnakeKeylogger)", "value": "417fabb6436053287e68b87c689c0210", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670491, "uuid": "55e852b4-d1fe-4339-bd9f-c69c71f68cff", "comment": "Malware payload (SnakeKeylogger)", "value": "4ed10c2a7083769911b1de3cc49a0cc6e11ab124d0e3f0682bccdf2810d09a42", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670491, "uuid": "41afe0de-2d19-4f01-9981-e6d37b6c5fcb", "comment": "Malware payload (SnakeKeylogger)", "value": "9795387dd7cbfdc12c95f7714ad8ca18bce461ac", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639670491, "uuid": "5e0128ec-ad81-4e97-b229-c6b213fbb2d1", "comment": "Malware payload (SnakeKeylogger)", "value": "be092d743fc0021005295227b39009dcacf76582e7db87c9ec97e8a3d2d4c1828c1de61408e69c1574337d2d0405378f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670491, "uuid": "7900effb-744f-46da-817f-fd0e8687b497", "value": "T1C41533657F7699C8A220FA1FCF0249CB6C6A093412ED5CDBC272DEE1B93B16177C8191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670491, "uuid": "95ae90b6-7735-4713-850e-4f9c125ee62a", "value": "24576:74SkpYsUGFtiPgIbL/t7DFaE8g7vUymSZwC1S2z8Aq3/:74S2cciYchQjkvUd9i8D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639670491, "uuid": "d9929ff5-98e4-4849-b3dc-64ca12144fa7", "value": 956366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639670491, "uuid": "ed54b2e2-317e-4063-bf88-94eb4ed5ea4e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639670491, "uuid": "ef465243-ec59-4cc5-bc77-17fa1734b622", "value": "shipment docu..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ff3a51-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641907, "uuid": "dc5f3639-5e0f-4dc5-b1ae-775358ab0e62", "comment": "Malware payload (Formbook)", "value": "b0bffebd29c179221c1db187320c93a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641907, "uuid": "0cff334c-f838-4423-86ef-7de732d726ba", "comment": "Malware payload (Formbook)", "value": "4ee32c9113abac2244b8c470453b67a4ed62a313ac856971f4f77c542971fbc5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641907, "uuid": "91c96c25-8197-43ff-b65f-7e4e8fcdcaf7", "comment": "Malware payload (Formbook)", "value": "b488d67ab73197672223208c0d081b37aa2dd5af", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641907, "uuid": "8ce204b5-ea9a-4e5b-a8d7-8d3685e25afc", "comment": "Malware payload (Formbook)", "value": "6173774562087148467c47196c4efc344f8139f0b1b37cb0ebdf28961459ef2a804a24524664a9d52a4da2a7b52a4feb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641907, "uuid": "e10a646e-24f2-4c26-9453-c064e8d8faee", "value": "T1EA6412387BA40A77F1B33BB5BB90046C95EACE152CE614734E27B58E60F9901329167F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641907, "uuid": "489fbbdc-cdc8-4b1a-ba5e-0c7905386902", "value": "6144:GRGoBBl3yQxgz8XXVQ8Sj490yZDCg4V+KxDhaF4wUKJjd0+qFR2hm2:GcSBAQSgXXWrFOCgHeDhbwnjd0+ARj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641907, "uuid": "564b80e4-e6d1-4ce7-a5de-bf31fab7864c", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641907, "uuid": "08cd102a-cc19-4c62-af9b-bd63a20615f6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641907, "uuid": "84e362c8-be40-49dc-a0dc-21d10d060d9c", "value": "Statement Of Account.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a269918-5e0a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639615855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615855, "uuid": "4fc20b1b-002b-464d-baef-ef0cece7b53c", "comment": "Malware payload (RedLineStealer)", "value": "f4d8ea9a4b4c70d21fce34510051ecab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615855, "uuid": "9a4fdd4e-c826-4d4a-aab8-ddbf8a47042d", "comment": "Malware payload (RedLineStealer)", "value": "4f3dd9bba6f1ce59d2eb5f37d4d6cc9da4cbea2fb6643cca3d46d2d06853dbe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615855, "uuid": "79bb1037-6f08-4099-9b70-bb1a3f22d65d", "comment": "Malware payload (RedLineStealer)", "value": "52aad20abf158695fd6e3eea4c11cd949e309a7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615855, "uuid": "79b6097b-e14f-456e-abf8-2dde43eb792c", "comment": "Malware payload (RedLineStealer)", "value": "50b5b4509c32d617faa7d1111f19c7c9a584130f1d030aa990b1e7757d37ed1985add3db01a6f810a54306d5c2907d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615855, "uuid": "5fc5e596-886c-45d6-a87d-c16b9a74624b", "value": "T12BE39D3179DCC872CDA3453084749AE41EBAF8316960514B3768262EEF70EDC6AF935E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615855, "uuid": "51ff309f-b46a-4827-8046-bf267243828f", "value": "fa2a2cc45b8202d88be58a4188cd7ca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615855, "uuid": "2f527fba-745a-4692-ae2f-319ea7ceb0a0", "value": "3072:s+kL7lCFfJjON7FMAt9LsQ+faHZwOaKWrxpzbgqruQlIX70mJd:sfLqfo31gaLaKuzbgwuQl070m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615855, "uuid": "cac1f4c5-45c5-47fa-8349-f143f87ee147", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615855, "uuid": "442fda26-9fff-4472-9415-fc4d3186954a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615855, "uuid": "2978d495-7aa0-48f0-8aef-4475b1da6e12", "value": "f4d8ea9a4b4c70d21fce34510051ecab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81385516-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639616834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616834, "uuid": "5b6ebcb2-8188-4877-b0b3-e1c99d29bc39", "comment": "Malware payload (Dridex)", "value": "9db245fc358087bc7319848fa27750a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616834, "uuid": "dc0a56cd-0767-40ff-ba3f-6c2f42a67e96", "comment": "Malware payload (Dridex)", "value": "4f89bc940e3e26925bd237275e91e979cd3f930ccf7689102ecf74e877f413bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616834, "uuid": "d57135da-bc76-4f5a-aa82-235becb9d121", "comment": "Malware payload (Dridex)", "value": "a54748b77dfacc264ee360ebba7d432cedf41dbc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616834, "uuid": "c42b9a17-70da-4cf9-bfbc-f5939a48c9bb", "comment": "Malware payload (Dridex)", "value": "b971e97e309981e3bcf7e0314912ce781e8d465c5df2cdd0b20291f71287fabcd275f253b3482d0658befebc85d53f45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616834, "uuid": "f135b37f-a198-4799-8654-9235794e5639", "value": "T1F5B4C0A37F4B0C6AD4525D3CCAFEF7A6082F66454588CF3072A3731AD6F4542A825CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616834, "uuid": "5190ba9a-1cd8-4f60-9f01-53603a224f8f", "value": "425f8965b1dafa239bed13744d5413de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616834, "uuid": "fcaee171-4e79-4d32-952d-aefc262bf8f3", "value": "12288:mcv+2yIUMs4UQ0EysQeu2LzmWMdUJPRXLZvR5xdz8U:X7D5MdUKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616834, "uuid": "fb29b3f1-f4e8-4a5b-9de4-480d8cf465d1", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616834, "uuid": "fbd0a604-c42c-4994-a57f-d146c07ab7c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616834, "uuid": "318abac7-1fae-4d7b-a7e4-6e72c0fe3da6", "value": "SecuriteInfo.com.W32.AIDetect.malware2.21816.30714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dfcc56-5e16-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639621244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621244, "uuid": "65976240-7eed-4318-b0a5-3b96b974ca46", "comment": "Malware payload (RedLineStealer)", "value": "64b2cfe0f18217540ae8dc5745789aad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621244, "uuid": "39eda3a6-8641-477e-968a-4c1142ff27d6", "comment": "Malware payload (RedLineStealer)", "value": "4f8c42ee1bd0fd0b402f417446088606e87cb4d7a921447306ae4bb0259aeebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621244, "uuid": "a484586c-9ae9-40ad-9611-059973a30a1a", "comment": "Malware payload (RedLineStealer)", "value": "42971b008f9725fa0b327535f91b84066ab6628a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621244, "uuid": "b7b8dfca-e5f8-4696-b413-8c1d6a286e1d", "comment": "Malware payload (RedLineStealer)", "value": "d7b03770f73ab8834e2909f07cd15c9d7c73ceae21baad6b94e33769d1711fcd768a740fe2a7c3d0c8f8bf70d5ccb148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621244, "uuid": "29231288-7d22-443e-a81d-b7768190dc7f", "value": "T1ADF4F1352793162FF4FDAB317D93950873614D021E3A46CB5BB27FB66B71A80068F09A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621244, "uuid": "52973e49-1cbe-48d4-89b9-229c5c0ce35f", "value": "4f7af468bad2e17aadee7f8efb80ba0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621244, "uuid": "5235186d-11f5-421a-8912-549508ed5e9d", "value": "12288:Gk9W1RukVoHrMlmUjoKnNiF0Ja4wloJsFYiyw93A0rK3:Y6LMcUjoV2a7WJsFYiyw9Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639621244, "uuid": "a94c55f3-da22-4ce7-b696-65bbaf2d2246", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639621244, "uuid": "8aa38db5-cc6f-43ba-acbf-f160ead0556a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621244, "uuid": "b57bbb5a-a9c1-4369-9260-13a0e9b0dfb9", "value": "4f8c42ee1bd0fd0b402f417446088606e87cb4d7a9214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8351f6d5-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639616837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616837, "uuid": "f60e09e8-be55-4f86-ba29-990543359e4f", "comment": "Malware payload (Dridex)", "value": "140b099cf70359038007d7503beafbc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616837, "uuid": "d3ce30ab-f31e-48cd-a387-dce57a3b01c0", "comment": "Malware payload (Dridex)", "value": "4ff524afd1a400a671e67a3cae5d582bf9c1ea927f430b0b5debc73302c4865f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616837, "uuid": "72c2f84d-7950-4f32-aaae-aac4e4bae331", "comment": "Malware payload (Dridex)", "value": "f32422214ed6dff351f867032d5948db17e0838f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616837, "uuid": "13b0b2dc-4401-46d3-860a-836a83f48750", "comment": "Malware payload (Dridex)", "value": "9d31f3d44337adecd4a76a3648d13f11eae0435352ac2628d58400dd2856d45d5dbe745c55a9816e01a9d08468762651", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616837, "uuid": "c3ad25dc-4922-4a3b-8151-28357e3f4ced", "value": "T1EDB4C0A37F4B0C6AD4525D3CCAFEF7A6082F66454588CF3072A3731AD6F4542A825CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616837, "uuid": "3bb368bd-9dad-4d52-81ef-1e0620fa308d", "value": "425f8965b1dafa239bed13744d5413de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616837, "uuid": "83f4571f-a857-4993-8856-989b7153403b", "value": "12288:yTv+2yIUMs4UQ0EysQeu2LzmWMdUJPRXLZvR5xdzdU:w7D5MdUzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616837, "uuid": "31dae297-2a4a-482a-97f6-eb7b813bdc0f", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616837, "uuid": "e63fd2d6-11cf-4fd3-82c8-f879fbc096bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616837, "uuid": "ef415833-6dbd-46ee-8eff-c3074988309a", "value": "SecuriteInfo.com.W32.AIDetect.malware2.14259.25502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68fd750-5eb1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639687790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687790, "uuid": "ba408976-6465-4a0a-884a-8601b51bc515", "comment": "Malware payload (Dridex)", "value": "48599506ed903976a7ad2636c5f24dc8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687790, "uuid": "27f3050c-b4a8-4b9b-9717-ea7843e37c65", "comment": "Malware payload (Dridex)", "value": "50761739346818e0762dfc39da6cf287bef4f58f6b0290f0d450571b26099d12", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687790, "uuid": "3e7a6baf-9b87-4f03-829e-5ebc64ec67cf", "comment": "Malware payload (Dridex)", "value": "53882cc654426a54c7843189e4b6d2573686a2d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687790, "uuid": "1a4780d5-f54b-4348-b9b7-db0cf39db099", "comment": "Malware payload (Dridex)", "value": "3d710b22d3dc1d635d7283429fe13ae3b3a691cbff976c92826ba4ca2ca43bfd187669ef319e49a03be41ffafe1195e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687790, "uuid": "a5c33c86-6821-46dc-a1f4-6cb82e9b9e68", "value": "T14FB4AFE5008B1341E65717BB56925E1FE5269CAE6961FF03F808FA3F702CA68F970706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687790, "uuid": "20baeb12-e16d-494e-9236-e22d68d1d347", "value": "52e2fdaab9e6e0c66f8ede7c1e947cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687790, "uuid": "9346989e-5ea5-4d96-af66-5d3b76d655c9", "value": "12288:qluO7BnvXnZJ1jNPRfQISExuQlQiA/LG1nbKig1GbaJBhfSQYm9Q7JijTp9A9B2/:rQQISEzS/LG1nbKig1GbaJBhfSQYm9Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639687790, "uuid": "4f6ed8b9-7cd8-4798-9469-fcc95d7009b2", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639687790, "uuid": "49adf45a-0157-4bb7-897e-271ec38a8d33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687790, "uuid": "155fdc5e-39b7-4b25-9595-73c2dfe3d5e0", "value": "SecuriteInfo.com.Variant.Zusy.410517.6374.21715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a624b49e-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641806, "uuid": "64e0f57f-68a3-48aa-b01f-aa020bab02c0", "comment": "Malware payload (Formbook)", "value": "7893aa0e6c812e6f113c25abbc5371f1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641806, "uuid": "3fe238c6-2cba-4800-b18a-f2fe113eb3a9", "comment": "Malware payload (Formbook)", "value": "50ebad5fc51570899ab2852ba92e66feb59fc09e33ea51bd1ee0b8710acd2f97", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641806, "uuid": "305de4d4-9867-45e5-8ad8-6478edcebb41", "comment": "Malware payload (Formbook)", "value": "67065bb7c8956e2a7f31e356d53cfc41429d3f2e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641806, "uuid": "de4327ed-0c3c-4356-aa83-1cc987de4bb2", "comment": "Malware payload (Formbook)", "value": "f1c9e255bee6b0f248f1aeb3e1e853d04ec07159f930dd6ce29a85884caf3f41bc9344fba71a18364ea54f23fceba4ee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641806, "uuid": "55b52ed8-d541-427d-9bee-81cc8abce074", "value": "T18F64127B3C9DA3C2E36B2878291B7D019B37EC694795524DC8F17F16C47AA8AC2C4835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641806, "uuid": "c6587fe4-ccdd-4fe9-ba5f-6b487af83abb", "value": "6144:kXl/Y4wevPRNl+Rz0NGMBTrHQGW/jv817cp66Ibl3H6GSgHYhEIKBoxLUr:kV/Yn+EzktRoz814UhabuTW5Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641806, "uuid": "fd4e0a36-a39d-418d-913f-c476ced31df0", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641806, "uuid": "cd0c0b71-fb5e-4883-91da-938b7e275078", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641806, "uuid": "81da1e22-9f95-4b0e-b874-51e08f069e76", "value": "SKM6197534BT New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1442e1a-5e3c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639637530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637530, "uuid": "c9575108-9b6f-4602-9b47-ff582ba3247d", "comment": "Malware payload (AgentTesla)", "value": "01801bcb2c837e5f8b26843588eb0d66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637530, "uuid": "13d4d316-2cb9-4e23-a18e-a9c9530c869d", "comment": "Malware payload (AgentTesla)", "value": "51e303f4c39869638107cfb14797e74be8bdc29656823d64837e4113b09027fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637530, "uuid": "4027fcac-af63-4c8b-917e-5ab8e4157c32", "comment": "Malware payload (AgentTesla)", "value": "2a646078da46cd40d38676279b89590a3387158c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637530, "uuid": "e942abf0-8618-4093-b6d6-295b179c0bb9", "comment": "Malware payload (AgentTesla)", "value": "e86f154d5a87475790df796c30210451bc4fea51b36176faebe593ec86281d54a23a373544785597fdedf54faf213675", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637530, "uuid": "cf835e56-2904-4d71-af05-29ef12d161ff", "value": "T1F805CF8A2CC68591F83BFFB188B026F716B29FE1ED41DADDD48436D9B976B508B44031", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637530, "uuid": "d8fef8b8-4dce-402d-96c8-8332b56fad1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637530, "uuid": "944210ce-5a68-499e-8902-b01c6fb4080b", "value": "12288:W6MMEMsYyQLp7auULNOiuJEIVpMpWX9CtyKjyQmL5yp7Yz9FIPx9:W6DE5Zw3ULNOiuJEIVpR9CUX9HnMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639637530, "uuid": "dc1918c4-0940-4dab-9915-f84ceee6236a", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639637530, "uuid": "e0ccbfde-c383-430b-80b2-c4a1f3b6828b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637530, "uuid": "5adfe90a-6222-44dc-b44e-6cbbb00e7912", "value": "REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e204a44d-5e6e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639659087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659087, "uuid": "f38090b9-9b53-470c-86d9-65955c602b88", "comment": "Malware payload (RedLineStealer)", "value": "ab0a4c30489c4b2b091403c5080addba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659087, "uuid": "dbb3e84b-7581-463b-9cb1-ea6ccfd43780", "comment": "Malware payload (RedLineStealer)", "value": "521fbf4f61ad6a34f0d4f46bf534d99e60d01dfaf1078c6a99c68a47dadb5403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659087, "uuid": "64ec21fe-68c8-495e-826a-2aacd2bc1331", "comment": "Malware payload (RedLineStealer)", "value": "08ef816a6e888b6290b06a97a451937bae33840c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659087, "uuid": "1d95b82a-aebc-487b-9910-277159cdc36f", "comment": "Malware payload (RedLineStealer)", "value": "496dfa8c794b5c200be436b106303766f8965a4052a48362b993d690d7dea5063b2190dd6d7aa23f54fc39c9b60d9c97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659087, "uuid": "f9c5d813-23c2-40bf-b29a-edfd3261dc13", "value": "T144A4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659087, "uuid": "601e6a3c-0b0a-403d-a6cf-266c810c6604", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659087, "uuid": "84fbfdf6-a052-4059-af8d-fe17bed88944", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639659087, "uuid": "8f4d63dd-cf0a-4a02-bd25-e52c91487fb9", "value": 455710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639659087, "uuid": "ed212f25-c2ce-40df-9085-95b765d44316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659087, "uuid": "6f2e7c2d-6f68-4b15-9f4a-feef0c6ec6ae", "value": "ab0a4c30489c4b2b091403c5080addba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11afff51-5e6a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639657019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657019, "uuid": "2d872302-211e-474c-a557-d2b7153f4f77", "comment": "Malware payload (Loki)", "value": "a7f61058a62d209b19c67a196dadbd95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657019, "uuid": "6ff70bf6-ae0d-46bc-b33a-3bae7047c199", "comment": "Malware payload (Loki)", "value": "52736d073e2327fdc4bf42b1dd72c62b02d93eb5d3e5a0b2d3d05cd226019440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657019, "uuid": "8182fd68-539d-4d41-8ac1-e3d91b8b1e88", "comment": "Malware payload (Loki)", "value": "91ae5484a4bf84ce2b879e22b25c6a4996d70cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657019, "uuid": "6a09f528-bd03-4a43-8cc0-bb01641831b5", "comment": "Malware payload (Loki)", "value": "8535f0dfa212f1e428b36f801b7bd0e703e184c147cd01d587064f083d6b54b90ce81c07d776daa06d0c490f9690cd07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657019, "uuid": "49367f42-fd54-4f21-9a65-4cb5aa5bfbfa", "value": "T1FF1522007BE5C10AC36F4F7E2AB2317036397E9A6956E78F5D4AA2CD19297C504C2F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657019, "uuid": "c1cafaa7-e88a-4dd9-b2c0-9b4403d46d88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657019, "uuid": "00fb6186-d188-4a23-ba0b-f3828b2163e2", "value": "24576:6P0cldzxFoQchH1WRn+CkQpTSvYYKWPsgOSGG:4XzxGpyn5rpTSvhsKGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639657019, "uuid": "840c9162-e332-42f2-b88c-196cdad62900", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639657019, "uuid": "70c9e3ae-f8c1-4dd0-b2a8-a6e07077bbf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657019, "uuid": "f44548e5-46f4-43a2-96a5-f518eb5a6694", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ff7a99-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1639643934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643934, "uuid": "4496692c-14e6-4ebb-821a-807c411f66bd", "comment": "Malware payload (Neshta)", "value": "790d2773e6a7ab6c925661e008dc57d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643934, "uuid": "8214d01b-0b90-41c8-b604-7bf67269fc32", "comment": "Malware payload (Neshta)", "value": "528a540044eb5dfab9ecbd301a63c69c930eea01e090eddd57a38e2cccb325ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643934, "uuid": "26d95817-015f-4c1f-bec3-92c4ce27847f", "comment": "Malware payload (Neshta)", "value": "96056d53acef34d5f75d93c86fe38a4027923443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643934, "uuid": "3ab62a72-6391-4efc-8f2d-f9de345a0898", "comment": "Malware payload (Neshta)", "value": "5ae5a6d063d2fad38ceb7f343a56754eb75b6cbbd92add177630548a5bbf1f20970b1b8b7ae5a9f8bad47beb37332213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643934, "uuid": "141a347c-ea56-49ed-9309-aafefb577b2a", "value": "T197C4D0A1BFE4D673F38400B59526E3ACCBB5952C5B43090FF8BA7C6EF2753588819246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643934, "uuid": "04639b54-57f1-406e-87b5-793c00be6fd0", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643934, "uuid": "14a6a1b4-ee45-434a-9c48-db79411cac3f", "value": "12288:bGORocNeuJqQS/+sKlQwbgs18YWZhvbyu:tLTq5Wvg2WZhvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643934, "uuid": "8e173cf1-c49e-4a4d-b3ac-dbe0ab11886b", "value": 569428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643934, "uuid": "3aafd4a1-274c-4df9-8083-7e811400a03f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643934, "uuid": "6d8daeb8-e3d7-48ee-b5e1-f63ad7350ceb", "value": "790d2773e6a7ab6c925661e008dc57d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34731a2-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613482, "uuid": "c82c2232-7c5c-4c08-add3-e8048ffc28b6", "comment": "Malware payload (Mirai)", "value": "8791a41844577f1d4dcb5cca110d8618", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613482, "uuid": "1cf9e5ee-b6c3-4ef5-ba32-0d27ace92cf7", "comment": "Malware payload (Mirai)", "value": "5333e10f966b4c7021b2f166fc69dddabecb25b90d7386a42562df9a6cc3549c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613482, "uuid": "b4a8ee8a-033c-4903-8280-cc3f4197d576", "comment": "Malware payload (Mirai)", "value": "a698ae7d52e3d393dfe3a4b1c4c2cd9cb6691ff7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613482, "uuid": "40eb3d0d-41d0-414d-ab3c-f34c0c63554a", "comment": "Malware payload (Mirai)", "value": "6df9f86e170e1492d679dba14449e725d3686e5aa6700a01b4b73f225ad35260235edd75dff362a8ef0ba1a2eeb5bd59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613482, "uuid": "a870bc5b-bcd4-43ed-8d7f-244302af1efb", "value": "T194E3766E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613482, "uuid": "d30b4022-95bb-4c10-9f96-090d90327e57", "value": "3072:AvtLZpuGPyaT/X5hKWEfSaWURxuZq+1uPNd5R:cQORX5hKWLURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613482, "uuid": "2625706d-110e-4a57-b4ea-303a2e46793e", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613482, "uuid": "a0d2bbe7-38d3-48da-8010-478f2595f2b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613482, "uuid": "81c3669c-f6c8-4139-8be9-3a952430496c", "value": "8791a41844577f1d4dcb5cca110d8618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21f87a1-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639615654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615654, "uuid": "05acb090-da72-42d4-98db-3365fa657cf0", "comment": "Malware payload (Gafgyt)", "value": "49cbc47bda876c292fc51ba630dd9f70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615654, "uuid": "46671b39-fed7-4cc2-ae86-09fcab10f7dd", "comment": "Malware payload (Gafgyt)", "value": "534333c2bd2528f2046982c68f10e2e0328d2975b17f439f0a658cd5de55257d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615654, "uuid": "ae70be91-1690-40e8-aef4-b0b79f3b65dd", "comment": "Malware payload (Gafgyt)", "value": "c268f8ecc14f4f113c997aeae398e519e4c8585f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615654, "uuid": "45994e0b-abf0-4b52-8815-3f23ce479e8c", "comment": "Malware payload (Gafgyt)", "value": "1c477b5a496889d790c551c09de04474599d5f7e666999411ab0c920a4dfb1a0aaef1a6d3e8f6b1a084e1818e1394535", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615654, "uuid": "27d9dd17-369b-4144-820d-279111fb1ebc", "value": "T10D33F2347642A128C2F27CF3CA9EC45150899CE2EDAF3C910733B599C6D7186D5FE826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615654, "uuid": "a49ee088-613d-4efa-98c7-910ccc7b33ba", "value": "1536:INXWs0EMrgOVcF23YE1OQKxwKZj127fzi2D:cXXjyZYEEBKB7fzio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615654, "uuid": "f9386aec-7ebc-4c76-9ceb-69aa553b9233", "value": 52640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615654, "uuid": "afaeb566-d23b-48a6-9386-a0dfbf8ce611", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615654, "uuid": "dce9bcc7-ad2e-436a-8226-69d0debac0bb", "value": "49cbc47bda876c292fc51ba630dd9f70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe37bd2-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1639643964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643964, "uuid": "629fcc7f-be8b-48bd-a596-5a339f7dfa65", "comment": "Malware payload (Gozi)", "value": "3b7d8109b37e996e06ae68144f37a73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643964, "uuid": "d401c0fb-8b39-4271-a228-608996d7dc0c", "comment": "Malware payload (Gozi)", "value": "53f09461a48f10c95f426cd179106cbe94fba81c498fb7414d6a849470ee777e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643964, "uuid": "1ae214c9-49a1-4b43-8540-0f3583be0ce6", "comment": "Malware payload (Gozi)", "value": "9ee1957c39834e9ea87cd72d7f09e9f08e1712d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643964, "uuid": "dc76288b-750d-4a51-b3e1-c3dde4de629f", "comment": "Malware payload (Gozi)", "value": "5e368b386eefc79bbe8d3f999e1f87abae18a326f8f02f8f40d35024d67256e0c62491d76ee49b073f94fdc02c1d2dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643964, "uuid": "81be79b9-741f-4e38-a060-7da9c0a96147", "value": "T12B85F6CD62C1870BE825627C3829D6B697156D472B71413E2E473EFF3A32746A68DE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643964, "uuid": "78c17cd6-748d-4417-a85b-becff2305fcd", "value": "05e4e1045777d757fa17eaf53eecd299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643964, "uuid": "142798bf-8882-418f-8f65-3289166d2eeb", "value": "49152:4W58UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MT8UQw8MO:4O8UQw8MT8UQw8MT8UQw8MT8UQw8MT8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643964, "uuid": "d291c8c9-26d6-4319-8cc4-b2fed4e05c10", "value": 1776800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643964, "uuid": "247f7516-5a1b-410a-9485-0836a9511a2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643964, "uuid": "0b38daf1-b042-457f-a436-3b2e91a3d0de", "value": "3b7d8109b37e996e06ae68144f37a73c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f5b342-5e58-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639649450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649450, "uuid": "108e5edb-6bfb-4023-ac01-ac7ab8a42c19", "comment": "Malware payload (Formbook)", "value": "c6e109c1ec31c940fa2cb4284750484b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649450, "uuid": "d4d3333e-ff6e-4baf-bb61-91eb3d540f1c", "comment": "Malware payload (Formbook)", "value": "53ffa55b36b2ab42fe178fbe282c42ddac520fd478c659fdbc559678a6c2263a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649450, "uuid": "b157a5e2-2279-4e58-8eea-7548463667e3", "comment": "Malware payload (Formbook)", "value": "4ae6b102f29b304d2a927752d7d6c8545bfc2e59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649450, "uuid": "18930b3d-06ff-410a-ae52-73a66d1acd26", "comment": "Malware payload (Formbook)", "value": "7a1ebdcf00e4dda704f764593e328674b6acb8d17bebe87d107c6a7d4f4875804ad50732eec783c6a0a092a4f641d8b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649450, "uuid": "8dab98f7-36b7-4f69-9f5c-d7516c099c32", "value": "T1B5D4481FA9495DA5C143FEF33D299E5021748C4C279D4A2E3249B72EBA32B4D72A31C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649450, "uuid": "0ced2278-3239-467d-80e1-065eed572d25", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649450, "uuid": "f682a493-9f99-4d78-a547-004275e1e102", "value": "6144:2Gi24VSy1AgGmIK3c8zcRULoHci9VzokcvBlcaxjfW3QkBRTYCgVw6LX+xKZNLYH:BMLecEcrxT1kBCCg/rCKNLYLgF7NPZ5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649450, "uuid": "18a2d569-2574-4f14-b1e6-3fd1662435e8", "value": 616450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649450, "uuid": "1ca4fe45-29e0-46ce-8b10-09358a31e330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649450, "uuid": "b0a090f5-31d0-44e0-94e1-64211521ae01", "value": "c6e109c1ec31c940fa2cb4284750484b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bdc039-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639683710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683710, "uuid": "daedb4eb-8fa5-44ca-9cae-ddfd713a5ed6", "comment": "Malware payload (Mirai)", "value": "7060930926fad61adb2d6239be5143f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683710, "uuid": "f3e80829-644c-43b2-ba6a-96efd2b5d946", "comment": "Malware payload (Mirai)", "value": "542e7706023760d635180f16b04c728f8e709529d7c6fcc3b029392d02c66c3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683710, "uuid": "21f6f660-2c5e-4bde-87ff-731da6110af0", "comment": "Malware payload (Mirai)", "value": "e32ebe7b1dbff2ec3d5fdfe3a4db821d169cea36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683710, "uuid": "925088ee-d22e-47c0-a154-2e1d7966b849", "comment": "Malware payload (Mirai)", "value": "ffd4f03a5fa4d17e93f8c0946b60a9fb350b16eaac11dab3f5bdb58925d5a77327413a4f1bfaa6b49e9c8b308a5b1a11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683710, "uuid": "7b9b6086-3c71-44fc-a9d6-18278cc0bce5", "value": "T143332951B8829617C5D41377F6AD428D3B3523E8E2DF7217AE226F103BC681F0D67A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683710, "uuid": "53192be1-1960-4125-9fe3-5d08a975ed82", "value": "768:BM1q9RXWQ/GroNf4ajEUgUZ4RK/KMaEVXD9PxEc22FCaRNMFh4ZW44qw:aq9kQj4j1cK2KMa6XDVxEkAhSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683710, "uuid": "6c76b857-e2c1-4c7e-a051-056be979511a", "value": 54280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683710, "uuid": "59914ff8-aed9-40d3-b0c8-45ad5c06c14f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683710, "uuid": "462b0c23-1db1-4e8c-abd8-66af485bd95d", "value": "7060930926fad61adb2d6239be5143f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a39f10-5e5f-11ec-96a4-42010a9c0029", "comment": "Malware payload (MrBlack)", "timestamp": 1639652508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652508, "uuid": "d8b4564e-86f4-4f42-bc39-b31c89db29d8", "comment": "Malware payload (MrBlack)", "value": "e8adfebaff4958e707b9d841661c16b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "MrBlack", "colour": "#332962", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652508, "uuid": "2d7ef82b-ae1c-46bb-a101-1dc6f04678b8", "comment": "Malware payload (MrBlack)", "value": "54fed4d05e21995a1359e2482d29cc429a7ce470a6f1a438e763852a27c8de37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "MrBlack", "colour": "#332962", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652508, "uuid": "f6ee69c0-64ce-471e-890b-c71be7f74e78", "comment": "Malware payload (MrBlack)", "value": "67547c98e1edbbc2f65002a72e036af0171e0d90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "MrBlack", "colour": "#332962", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652508, "uuid": "9b0bb1e4-fd4a-497d-912c-6bc675228c91", "comment": "Malware payload (MrBlack)", "value": "d43b2e7a2493b3a1d2123e74c108d4b1aaef32dc99957a2a718c813ac950b9c0f68550e8af1ee9f9840f3d79f2e4ccac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "MrBlack", "colour": "#332962", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652508, "uuid": "fd94debd-376c-4a48-8972-7ce8cce83edc", "value": "T161456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652508, "uuid": "7beb89a2-ce6f-4af3-9e2b-4dec6ca04c45", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4M2y1q2rJp0:745vRVJKGtSA0VWeoju9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639652508, "uuid": "2c8850db-f610-4631-ab47-97902de95733", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639652508, "uuid": "9093cd7a-c59e-4aef-8501-bd446b39f9cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652508, "uuid": "e2c3897e-8232-48f0-b185-7525ce459518", "value": "e8adfebaff4958e707b9d841661c16b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6926d61b-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639641704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641704, "uuid": "ef7d2b7c-3173-4de1-8a95-1dbd01aebc45", "comment": "Malware payload (AgentTesla)", "value": "d3c81cb4c062ae5ef1431bb02fbc08a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641704, "uuid": "337b35ce-5ccc-44c0-9688-10b1f3da0b20", "comment": "Malware payload (AgentTesla)", "value": "5579366a43ab54b489d5dea06fbe0dc022f9745418b470b59f00c57df46a08ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641704, "uuid": "81860325-7987-43b8-a2ac-d68bceb460f3", "comment": "Malware payload (AgentTesla)", "value": "c65279361dd9837d3974164ac8471f3876c4574a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641704, "uuid": "ea7c3cd1-e8dc-450a-85ba-8773b76c9dfa", "comment": "Malware payload (AgentTesla)", "value": "fe32fb4848de40a96e296673d40348d1027afd971b85ac789f1928331769fa80703116aac1beef6d4f2df24155082560", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641704, "uuid": "6b463954-0348-4478-a908-6b44def366f3", "value": "T1D86412133D3EA356F66362F749BBD073A6DEFFC40A01A72424723BD6887220475A1997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641704, "uuid": "9663e405-2780-42b7-b6b2-a5f2dd44d501", "value": "6144:w1Mo7lKFmuV30TotCT3xlZ4z7WK4swsUQU:IrlHJotCTbWz64HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641704, "uuid": "1f3b9dfe-db23-4c07-b044-c40eafb4f374", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641704, "uuid": "de7c8829-7b33-4b08-b4f5-a852bb072978", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641704, "uuid": "911d5a73-e5c6-41dd-8a9d-170a020a4bab", "value": "Approved Order List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeb4fc1-5ea1-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639680952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680952, "uuid": "fbc3908b-f184-4769-a848-89dec2ed262a", "comment": "Malware payload (RedLineStealer)", "value": "9b23600c32dfd30578d04506ddbba7db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680952, "uuid": "2c11985a-0c65-4caf-bd72-90c77274c1a8", "comment": "Malware payload (RedLineStealer)", "value": "56c71abadbf6b7b94f179ef6315a820d8fb0bb6c565e282928fce3476470aef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680952, "uuid": "a43009df-79bd-4eb4-a0f8-38ece711b997", "comment": "Malware payload (RedLineStealer)", "value": "9f05710c050f8749670bb74b495327de8d608e05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680952, "uuid": "f4ef5941-6021-4d24-a870-2dc78d06ca4d", "comment": "Malware payload (RedLineStealer)", "value": "fc9a340c9c44a8f7dcc54a9ac2261f543cf492d8ed4f572df18e1198ecbd923420079c6534194c32de09b9d762d94fd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680952, "uuid": "3f2e9ebb-772d-4a2e-8d8c-a4806c3805cf", "value": "T1EFF4A91BA5C28E74F84207F645A3AB304BB550DB736707CBA377A5E28B892E0DB405F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680952, "uuid": "07b1c58e-4485-48d8-972b-0c0eb974f824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680952, "uuid": "2adac81c-4d07-4647-810b-497ee0b795a1", "value": "12288:kYau0HoBoiEwfY23Q3/Tf1L7qWDMOAKgoEJRM:rauLBXEwfY2g3/VnDDWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639680952, "uuid": "583bf668-27eb-4b07-a2eb-5b953f33539f", "value": 756616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639680952, "uuid": "48fa62fb-a521-4a1f-8bd3-a2de327a129c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680952, "uuid": "5bd362d0-5950-47b0-ba6a-8c76987c2451", "value": "9b23600c32dfd30578d04506ddbba7db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd0866b-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690785, "uuid": "18946bfb-0b50-4e71-b620-de08823abcc0", "comment": "Malware payload (Mirai)", "value": "8cd2a7821397d952e42f7585e778487f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690785, "uuid": "9f47fe2b-7a1c-4d0e-a26b-feb26a685f98", "comment": "Malware payload (Mirai)", "value": "571b159b19b30f03de58dbdd4b50010c4da1b11a333302dc9d29d933d7a67612", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690785, "uuid": "916a189b-f457-47d8-bb2a-875c1b1b1b98", "comment": "Malware payload (Mirai)", "value": "9c9306649a29e5236f42d85eee48f30c8afe141c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690785, "uuid": "14d7ea17-b3e8-4a30-b049-73e145ecf2eb", "comment": "Malware payload (Mirai)", "value": "92ebebfccbb269de4de3c55dd44c9807bf4eb766504e63d39577afbc17261f92bef2a3ee8c6d5d9cc567376757b9ac44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690785, "uuid": "b92d3ea5-99d0-464c-946b-d498dedd5e44", "value": "T12793F71AEF510EA7D82BCE3311AD1B4538CC56A722E637767674C928FA1A50B06E3CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690785, "uuid": "d20dd587-0fce-40b0-9d8b-6559c110eff8", "value": "1536:gAPoyp2Bb2Dm4ynBZIVMMFmn3lT1jnc9jszMetJ8a9xKrY:7m4oZ3p17ZgetJ8a9xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690785, "uuid": "556877ee-d45c-42ee-be9e-3451e126e07a", "value": 89064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690785, "uuid": "cb4ea623-6451-4aac-979d-68546cc7b2c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690785, "uuid": "fa727e3f-6cbb-4d1d-8ca0-6e3f72cf8c7f", "value": "8cd2a7821397d952e42f7585e778487f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3c03e1-5e88-11ec-96a4-42010a9c0029", "comment": "Malware payload (Hancitor)", "timestamp": 1639669976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669976, "uuid": "e2774a74-1760-4574-ab77-9a9110e8eff4", "comment": "Malware payload (Hancitor)", "value": "9f09b1dd6235c28b091a7dbc9bcd9482", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669976, "uuid": "5af4464e-1647-4f0e-b81b-0fe3ea76cc66", "comment": "Malware payload (Hancitor)", "value": "571cba0431acea4739c5248de1b1d33e76e995b3c7454f4d88d2785ade6fdf74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669976, "uuid": "084de100-9a78-4829-a59d-9e3402be96e9", "comment": "Malware payload (Hancitor)", "value": "b7ac19b82e2f946e7cc047421875bbade3e880fd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669976, "uuid": "75f5c70e-0d42-429b-be7e-159ee0d984e0", "comment": "Malware payload (Hancitor)", "value": "518f8d63c5370e40e994949d4cec73703d0c56ed3d372c536d65c821b3125e0b82921fe1590ba2d53d5fe3a902fe26bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669976, "uuid": "17b52ca9-fdae-45b0-8f7e-7961775d304f", "value": "T112D4D859735B4EB1EF0B25FE29AF85334935B707E76384D8101229C2BE06E85D121ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669976, "uuid": "e722df9c-0591-4cd3-a071-3607151ce082", "value": "d4ab2133b050761c461c3f153f756828", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669976, "uuid": "927f965f-875f-45f5-8ac3-bd9ce492e20d", "value": "3072:/UGqpuK47koY2Ft2kwJspiJ2B9XStuXAhsXzajIV1ltAzpOPBgQdUpr:/UNpuDp76spiMGMXKscYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639669976, "uuid": "7b0bf77e-b14c-45f8-905a-8a15befa965e", "value": 636712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639669976, "uuid": "16f6432b-3304-4722-9406-0ae8677f5672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669976, "uuid": "f9f0d83b-c38e-43e7-add1-1ab5206a286f", "value": "iff.bin.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4bf653-5e6b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639657737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657737, "uuid": "f6563d4b-52ff-4ecf-a9cd-8d1129dc7f6b", "comment": "Malware payload (Formbook)", "value": "1aebab33dcb37f9e5ff782be3425f753", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657737, "uuid": "c5a040f5-4b26-436a-816b-a6ade674ccd3", "comment": "Malware payload (Formbook)", "value": "57c8d8a165abbf392187483caa19c279ef5e880f9e7715647736d39d2cbb1fcb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657737, "uuid": "f6aeec4e-2ecc-40d4-892a-311328853aa0", "comment": "Malware payload (Formbook)", "value": "234625b0e548f482ff2ad5438c9508a04c1b6620", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657737, "uuid": "d7947f41-b75e-43ca-9af6-9934850e8e8e", "comment": "Malware payload (Formbook)", "value": "2a9bed2d818d82bad4e8228458c1fae07d97126a58ce081dacdb991435e5fdeaebe3ef663a5139d75920b173d7ff2f0d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657737, "uuid": "375c85d2-e41c-45ee-b9c9-334ac8233b90", "value": "T1D3640212E3541873F9208279AB4A509322189DBEBD74ED1503E2350F7B1FBE63E3AE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657737, "uuid": "3fcaab14-3472-409b-8602-bc541dda7d94", "value": "6144:xTpiysu8pjjvFNzKXncVExfEFPNyBhLRAL3Pa3fAFsD2qGzNkv:xTp5MJxN9VExfEbyBhSeizNkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639657737, "uuid": "4c74f06e-d5fa-4f27-a982-8d3d4ad679b3", "value": 316888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639657737, "uuid": "a99bf638-f9cc-4b80-9c8a-a0cfab5272dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657737, "uuid": "04956e7c-c536-42ad-9b1c-2ab2fa354c4d", "value": "MLD2112109.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7b3244-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613475, "uuid": "6e7e4d83-19b5-4b7b-9b10-6cfa11d114c8", "comment": "Malware payload (Mirai)", "value": "42bd2f971c68b8246260fd4a198f7f4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613475, "uuid": "74cf56be-58a3-424c-8bcb-293a8ee74e78", "comment": "Malware payload (Mirai)", "value": "585fb679c13eb7a37d9a47ef1ca6ad560a8b697692f92f19078455f86fb67e36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613475, "uuid": "d62c999b-512a-4c78-85f8-bc01af358a71", "comment": "Malware payload (Mirai)", "value": "9034d163166afd8bb9e7aaec4734bd0076686658", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613475, "uuid": "d667a2d9-00ee-40f1-bf38-8948113c123b", "comment": "Malware payload (Mirai)", "value": "5329e2a0d36737bd04d1d9b3a4b1bc3304b7940689c2f66c32da3a7ef7c41aff75e4c29373ddce447c56b8778177d314", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613475, "uuid": "030d48a5-0cea-4a7a-8bf6-54e81e4aa0fc", "value": "T187C30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613475, "uuid": "dfe645fb-e6b8-4022-a7bc-293ace7debb8", "value": "3072:sJDZ+6lJQTnoo3nKVz3ecxPWi5hLSFuX0wX4eoC9DQlD6ObAF5R:k3eo+i5hLSFuDJoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613475, "uuid": "7ff7a57a-f2db-430e-8fa4-b7228f86168c", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613475, "uuid": "de61cc25-7078-4432-a031-64cf9224c124", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613475, "uuid": "78612d11-dde8-48c0-9fb6-58b10464e085", "value": "42bd2f971c68b8246260fd4a198f7f4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce7119b-5e68-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639656367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656367, "uuid": "a3caef6b-4c75-4afe-a84b-f29c4bd8c639", "comment": "Malware payload (RedLineStealer)", "value": "269ca8e5d267ac08eeaacbabae9d31f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656367, "uuid": "7f4b802c-98a0-4be8-ad67-692c68549195", "comment": "Malware payload (RedLineStealer)", "value": "59c63c722ede3befea8f7632bab92ea6f54e64f73620b3f066e2c182bfedbde8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656367, "uuid": "203046c5-a2af-488d-b962-0ab0838835b4", "comment": "Malware payload (RedLineStealer)", "value": "a3d986749dbf0ea08087acf9be9f18aeea5f99bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656367, "uuid": "243c7d17-4739-4ac7-ad19-4b1e677f61a7", "comment": "Malware payload (RedLineStealer)", "value": "f5271d34566ebf991af44e8ce940a0fc63bd19842a4fd602289a7573d07bf6f315e7f34d8e5e3523f60876dd427aef1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656367, "uuid": "2618d6dc-06c7-4fef-9bfd-a286ee0557e8", "value": "T19EA4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656367, "uuid": "6d3c7a18-83fa-4e72-8232-7ebd410f94b2", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656367, "uuid": "035e073b-8b03-4880-bbdf-601004a4ac57", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639656367, "uuid": "6fd86d0e-7c7b-42ff-8fd3-78a771cba154", "value": 455726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639656367, "uuid": "4953127b-745d-429d-b27e-b7f8fdf3788a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656367, "uuid": "44f29900-efae-460b-ae24-ef051f410bd0", "value": "269ca8e5d267ac08eeaacbabae9d31f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1262fb1-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639643972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643972, "uuid": "a39f3589-1c62-4ef1-8b02-48f199e2c856", "comment": "Malware payload (Formbook)", "value": "37d6fe6c4a5668a8960683f776fcc4aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643972, "uuid": "cb74d54f-8ecb-4349-a267-8eefd9adc3e0", "comment": "Malware payload (Formbook)", "value": "5cf30c00d7d4d16229204e0c969f26a1a0fa2f0067818d518a81d97123e277d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643972, "uuid": "27192fbf-efc0-4e88-b734-8fb525ba749e", "comment": "Malware payload (Formbook)", "value": "fb5ae3d64ca4051c4eaed570f362f80d96d9f7c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643972, "uuid": "a3c85b4d-6c07-429e-93b6-64839caab60a", "comment": "Malware payload (Formbook)", "value": "e5af20a4e483cce48988d5d2854b61d28489aee78f91014062165fa28e8c595bde5c6e27a583a3a907933adad23d111e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643972, "uuid": "58ab4496-3e1c-4019-b853-441fb3ca4f08", "value": "T1A755231255FD2A33C3FE5A3588F5A51B03B625415022E70FB2B52ADFDB03E80A5EB725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643972, "uuid": "c217d7f2-27cb-4d32-93c7-6b40f1ecb2a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643972, "uuid": "0c5d3bf3-1b67-422c-8d2f-72f097a910fd", "value": "6144:r+LivLLga5h2RvVD3XNjxjWfpEmul1NMTUcXBNX6Ysl5R4ADF5xSJafKupJeksC7:0xqEs4D1y4lqLdvbGGoqWpXbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643972, "uuid": "de969ccc-bfc0-4cbf-b20b-56deb6280a39", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643972, "uuid": "7ecbc507-8d6a-42c1-86cd-93a2431f80e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643972, "uuid": "4911f760-32b0-4ea3-8699-100808df3fbc", "value": "37d6fe6c4a5668a8960683f776fcc4aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d3cf72-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641912, "uuid": "97ee8e6f-210f-4c5c-aece-56a5c3a184cc", "comment": "Malware payload", "value": "3a039e2764ab685da24e2ca834c86582", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641912, "uuid": "87190bd0-8cdc-45eb-9bea-224073c5a4c3", "comment": "Malware payload", "value": "5dab1bf6a742873c7313f4a84023b0bd0bbc42b0f880892e08fe09b9825e633c", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641912, "uuid": "7c61a037-7bcb-4a46-84f0-fcc49d65ea65", "comment": "Malware payload", "value": "41f9061abcd8205e66c61746ca86000d07e29a32", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641912, "uuid": "ca706906-8979-4cec-bce6-079eee004a31", "comment": "Malware payload", "value": "7d0bff053b4161b9a1d2bbf4ccd720ce7a04ed75a828961476c74c38b0bfd82d58aa7eeb19466bf7ac42daebfa8f02c4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641912, "uuid": "2c94eba8-dd66-41e3-8a46-bcfbdf834854", "value": "T16664125B3B629527F3EB0630203DDD9442168F1A18DB91B0ED33BB6764F6A7080D6E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641912, "uuid": "e4792bb9-ccb3-44d3-be15-6b7d9ed13c9e", "value": "6144:8gfKZ2sdj3XDFPUhLJqYn2E4KLRjrQpHV3ITzUYKSmH2YwkjJGe:0Z2sdjn5PUhf2ZQBrQpIoYKTWIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641912, "uuid": "ec04caa5-28f4-4136-a497-79fd77271da9", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641912, "uuid": "8a2a635c-4829-47e7-b204-2e8d89aa977d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641912, "uuid": "c8318fe9-9b22-40f9-84af-af1a990ca435", "value": "Order Confirmation nr. 2021O1274.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adc4475-5e8b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1639671208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671208, "uuid": "4aee0aee-a201-4bea-bd4c-b212b60ce43f", "comment": "Malware payload (SilentBuilder)", "value": "25c49a2d3df43e919df3dbd27cd07745", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671208, "uuid": "30a701fe-7679-40d1-9758-766054b27cfd", "comment": "Malware payload (SilentBuilder)", "value": "5de9a2fb4b9a65e5b48d78ed6a09e6cbdca07d30e917b5777be56d7c2e7acc0e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671208, "uuid": "af2b1d05-ed5c-4998-bb65-4c311388c111", "comment": "Malware payload (SilentBuilder)", "value": "f5997183101be768c68d53f078ad4a192201a0eb", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671208, "uuid": "19e8e8d3-1434-4550-b8c7-09c824ae2791", "comment": "Malware payload (SilentBuilder)", "value": "009d4d7808756e99e8625ec2eb6b88a8fb1e7bbaf9e38175c82219251be99460a72873802ef9e541463c5d0671443747", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671208, "uuid": "63c355a3-e6c4-4673-9c24-fcfcf1defdf4", "value": "T1A5E305F4A354CAE9CB62E9758DCF2F905699CE46895DAFC32D1C2029BB24378CC4E0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671208, "uuid": "06f956c2-b518-4d17-b8e3-8c4c1511e92f", "value": "1536:cxYdYLLjWqBpZRP9yAVSBK4vEf4CAuDScpMP:cxYWLRPhgK4vYJ5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639671208, "uuid": "16ebeaee-5e1a-4a17-a038-cfc8e5e8ba49", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639671208, "uuid": "8bc8a680-1dfb-450e-9e21-9c9836468c92", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671208, "uuid": "753ea376-747e-4948-b601-740d5e7e063a", "value": "NewRegulations.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae7b798-5e7e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639665625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665625, "uuid": "6b90cd70-cb6d-4650-a200-febb6e0770f4", "comment": "Malware payload (Quakbot)", "value": "d757af1d4e8cae5d7aa5fb03fd2b03e5", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665625, "uuid": "a2bb03de-4b70-4dc8-bdbe-d5b8891684d2", "comment": "Malware payload (Quakbot)", "value": "5e73e8c9b885e1d052cbc46c1e8c94c9fe70b0b507450333ceaef3841624bf76", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665625, "uuid": "41377da8-a0a6-4d1f-ae60-3a05db60a902", "comment": "Malware payload (Quakbot)", "value": "669e51112dd4fe4656d56234ef0858030c644f59", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665625, "uuid": "b78c2015-be76-457e-bab3-54c850dfabc6", "comment": "Malware payload (Quakbot)", "value": "05b0da9e7651fa66cead18d03b5b62561c8f07aac93fd742c0ff71ab17109ebaa64064e884a78f9dbea0c75844aa1d6b", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665625, "uuid": "6387c22a-498d-4f5f-a92e-4da1b4ac6061", "value": "T141D39D47ED090A43D8648BB8FD0B1D3CBB2D192DA9E123FD14260DCB6EA52675D9F04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665625, "uuid": "44d1cc59-2202-4e4b-becb-b7fd4fba59ce", "value": "3072:iGowZK/FGOztQNL0cBLJUq1dJZvPpz7+fp7KG:gwQ/0OzSNLJNUydJZvPZC1KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639665625, "uuid": "639b0e7a-98c7-47f6-bacd-f8f296d6dad3", "value": 138856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639665625, "uuid": "ef9d840f-36c6-4110-a6e3-ede7064ddd78", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665625, "uuid": "66dfee2f-c299-4c39-b1d0-9ab57a5d9f21", "value": "UT-2088742299.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2b5854-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639615649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615649, "uuid": "4cab0561-bbcd-4c2e-ad38-a038f122e58b", "comment": "Malware payload (Gafgyt)", "value": "c2c43e652b4dd54cc927fff31a52285d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615649, "uuid": "8a19211d-d086-4f19-ba30-e75ea5e9b9d7", "comment": "Malware payload (Gafgyt)", "value": "5ea81f0dde62a2b0eb356a6221bd2c2a8ebfb7d84c2e3f3ce5596a20676160fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615649, "uuid": "b3f6ebda-188d-4eb7-958d-0feb0920cf86", "comment": "Malware payload (Gafgyt)", "value": "600d60e902b3c8ffb2291ea44dfb1f6e9cfdee13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615649, "uuid": "9c69eadd-381b-4cc2-bcfa-551cc4c11f25", "comment": "Malware payload (Gafgyt)", "value": "e02467db4055df19ffbf5c43704238acee54fa16ed2b5f8e913555db8ad6e63e5d13df7173069cc383db3af13de6645b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615649, "uuid": "a9c6da03-c864-49ee-9fb9-06acafc55811", "value": "T11E13F2FF5104759BE0BE94B71AAB6443B452232E16B805FDF75E328C98BA7702854363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615649, "uuid": "a2c660c2-5e69-4f13-ae0a-5082befc4f28", "value": "768:pD99wogUDZz4WeEXkhnutwq4veaVjf+o2wHUohAnbcuyD7UWyqm7nj5mtfs1:pDYUPeNhutKvHlUounouy8NqcnT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615649, "uuid": "2a88db67-7a18-47b0-8082-a8b59c066c1f", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615649, "uuid": "384b6529-7116-4c16-af40-2f0e40b4ab86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615649, "uuid": "7b132d0c-a375-49be-a62c-6a8e3301e5be", "value": "c2c43e652b4dd54cc927fff31a52285d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dc1e6e-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613439, "uuid": "e835ee3e-dce6-4afc-a9d9-ac792d7a79f8", "comment": "Malware payload (Mirai)", "value": "a8178fb3e925c1a62b020d183375f73d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613439, "uuid": "481454bd-2563-4c70-84ce-2df9daf3937e", "comment": "Malware payload (Mirai)", "value": "5f1ad084574befaf1c9ce689a7ecb7227253d2d4952bc5cc1e2b70f2eca76273", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613439, "uuid": "7d75fe0b-9e7e-4b20-add5-b4c3d0318ce6", "comment": "Malware payload (Mirai)", "value": "c3c5e500d3eb5cf3717992db92b84c2e908e41d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613439, "uuid": "42d125df-5439-4865-809b-801072dca8bc", "comment": "Malware payload (Mirai)", "value": "e053a042669877547bb27b6d2300320b2696a506ee109581a1b9b2fef52e734010156ff6373a9b3488a66c67980ef14f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613439, "uuid": "76d11ade-3863-4def-a346-59be96e72943", "value": "T156D33B05D8509767C6D227BAF79E428D73236B68A7D733115A28AFB42FC1B9D1E3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613439, "uuid": "b016cf43-8d07-4d9e-9747-5518dfb7b2e1", "value": "3072:4VfyQ+d+pceQGfBbPTa+jthWOiwzte6XY45hLEDyh3O46dZBjUmydQCYMhEFg:CbPTa+jthoEXz5hLE+3C3gmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613439, "uuid": "82b106a3-e3d1-43b2-add5-b74d6c36ae5c", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613439, "uuid": "953d354c-e08e-46af-9801-9a524cf6e4ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613439, "uuid": "076d3c52-70a9-4230-8af3-c6a4139a3354", "value": "a8178fb3e925c1a62b020d183375f73d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7ace89-5e80-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639666756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666756, "uuid": "74f155b8-6330-44ab-91f6-571a2103e7c1", "comment": "Malware payload (Mirai)", "value": "81504bc316acd1b185664c6bac2a0319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666756, "uuid": "55d94d1a-5602-4525-88ad-33c6f385dbff", "comment": "Malware payload (Mirai)", "value": "5f5c0843e37497cb11ce82ea8d07fd16417e1f210c66755cc02d6d3e91bd4ab4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666756, "uuid": "5c3199ff-4a83-47c1-9719-50cc9d0b7887", "comment": "Malware payload (Mirai)", "value": "68dcf4a3607861f065adb9d92145c4a3acc738ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666756, "uuid": "7ead1694-c9cb-4eac-bea6-0268b9d04e8b", "comment": "Malware payload (Mirai)", "value": "6383db1c71aae819f98e20e18c367d145da1330442d642c42ddfb12d4cd4b2f6b8e3ac8fa0dfff93562876afee78c4e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666756, "uuid": "e61ec304-fe5d-4467-bf74-afd20d368cb1", "value": "T11592D03113463170CFF10EB2656F8286BB45B97964DB31D227B81AE829E705B1FA9583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666756, "uuid": "30df15b1-a201-46b3-b448-f5c41225de65", "value": "384:1jFaXOCRDEMQNbUlaGxVbqlW/o4keoUT3+B23B+CmxsMqDmdGU5E0j:ra+CRl0QlHql14GUr+B23B+MD3U3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639666756, "uuid": "9b2ad286-5a99-41a8-bd7c-2fad28320952", "value": 19992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639666756, "uuid": "3f29603d-6216-445c-b82e-663f82b33429", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666756, "uuid": "86e0f111-ce0b-44c4-9006-835dafaccc50", "value": "81504bc316acd1b185664c6bac2a0319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a2b59a-5e2a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639629854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639629854, "uuid": "35984934-4943-4cd2-8b44-b7564328e223", "comment": "Malware payload", "value": "070a11f480e1e7c4e0f44d20dc2ecf0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639629854, "uuid": "362ee4f9-6f9f-4573-baa1-8eb7dc959074", "comment": "Malware payload", "value": "603c232982eca43e9b1fe65138fdf6c3c45d011e243be01102f052ee53ddee66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639629854, "uuid": "709bdb37-348b-464f-a758-006662c7a3bb", "comment": "Malware payload", "value": "d2b0da688fa1a5b1e951866ea831978c272ce384", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639629854, "uuid": "ae02884f-42f5-455e-9215-0785c69b2eff", "comment": "Malware payload", "value": "f89c2e569477347bb8feb9e4ad5fd36f4bd884df8592494b46111e967307e5bcaa620d3b9e276297e1e101c9158b7069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639629854, "uuid": "f57a3cae-d1b9-4eb9-a6fa-d49552d910d1", "value": "T1E66533A6DE40E61CDD138AB43B77CE2C79563074DDC4E82719ABDC7974480D2EA680AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639629854, "uuid": "ef6c3907-32ab-47ba-9960-22e13e6badd3", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639629854, "uuid": "3cdb19b6-18ff-4fcb-863f-77e07e27d096", "value": "24576:Eb+AKVVwtMqgUl56w0fWkqHsy3dLTPyC3j5RBtgOg5blJQrSeoOSo+7kEaHNYK3+:y+DVVMq1tflq9d31rg5bYrSeoJo+7Na0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639629854, "uuid": "5f665e2b-99f1-45a3-867e-f6eac6e96f24", "value": 1543984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639629854, "uuid": "07706112-8038-4245-a84a-c271ad417ee9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639629854, "uuid": "f87555e4-9b7e-4b23-8bce-07c185512412", "value": "070a11f480e1e7c4e0f44d20dc2ecf0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ebeee9-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639646526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646526, "uuid": "f5141cbc-4b20-49b4-ab49-e874702c8975", "comment": "Malware payload (AgentTesla)", "value": "5ba8a575a34b8bd40e8225c3465d2f36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646526, "uuid": "bd2477a9-0d30-4d06-b3ba-7748c8b27d9a", "comment": "Malware payload (AgentTesla)", "value": "60faed019bac43fdd939a5f909f7f69921007a2929144d8e58901d9411963fab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646526, "uuid": "dd33ca21-be26-4b33-8784-1c4a745f8eea", "comment": "Malware payload (AgentTesla)", "value": "14e001420229dd6eb92af032ae34e38fd517f181", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646526, "uuid": "e3a52051-5a6a-4840-baf6-889cbb9f0342", "comment": "Malware payload (AgentTesla)", "value": "9b96fdc9eaaacb5387561c8a2db63b3086ea3c3afa5be6c9bb07fc2e81f274a03a72677feddf60f05cad00bff7845a8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646526, "uuid": "5f30d590-2af6-480f-9c4c-77ae0fac44a8", "value": "T17ED4D190F285DCD7E84319B6483B9D3060B7BAAD94B45A1E241E77295AF3343206FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646526, "uuid": "6aeb35bd-e85b-4b29-94e3-2d251c7acbf7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646526, "uuid": "eaca2e35-f98e-486e-9127-f200eb541b1d", "value": "12288:teAJzOVrDI07fSd0zrAHDoKFux8lkX6gslCVv4laHiDT81:HzOhDjqd0zr+Lux8lkX6DlllaHA81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646526, "uuid": "4c3d1a13-3c4e-4807-b3d0-64619480711d", "value": 604073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646526, "uuid": "28c842a6-e672-42ea-8ad0-d5f5d3311c0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646526, "uuid": "ece7718c-d8c4-4e50-8d5f-0598948862f9", "value": "DHL Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5070f699-5e59-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639649823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649823, "uuid": "14a5c376-0a90-4b85-b527-26a5a33e495a", "comment": "Malware payload (AgentTesla)", "value": "da9ea781c61697da744844c3cd119370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649823, "uuid": "e2488432-8548-413c-b078-a08982bbe09e", "comment": "Malware payload (AgentTesla)", "value": "61fa826e2a8be73469c71b0b162d644272d9c51c469ec6031f6caa2fe731d212", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649823, "uuid": "1714c2b1-0dca-4c4a-8660-450624cd961c", "comment": "Malware payload (AgentTesla)", "value": "b2ca7c472b07b05bed6c3f89f1e164e18ab8b39e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649823, "uuid": "5bbc0aab-2197-4af4-a68b-04f413d4d923", "comment": "Malware payload (AgentTesla)", "value": "b78543ccb799eb4f81faeed9bf795eb18f6d54f43ffa5bc9690b17f09d2ae5b2a82a5c553e6810a3425760e20622c1a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649823, "uuid": "2d06499d-a168-4ea6-a880-45fed91fdd44", "value": "T17AB412407BB89B27C13C67FD6492220183F261377A53EB895EC270EB1BE3B458562D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649823, "uuid": "070914ed-876b-4868-b2bb-805b10b8fc6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649823, "uuid": "77c8aa42-ff22-4115-9aeb-9f2d8946ff95", "value": "12288:cURpuHoA5QfJFroFNkv2X4lv0Ki6hF2cU3ACWE01gszH4uSK3:lpYoA5Gb2jgi66cYRcSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649823, "uuid": "57963a5c-ff20-40a4-ba06-cbdbdd82d535", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649823, "uuid": "d5dbce88-5235-46d9-9db7-d8251a43ae02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649823, "uuid": "ce8f3ba0-2e9f-4e1d-9007-c19e737da48e", "value": "da9ea781c61697da744844c3cd119370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c8d1c0-5e08-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639615152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615152, "uuid": "12098fcf-063f-489b-93b1-6238532dc9b6", "comment": "Malware payload (Gafgyt)", "value": "4c8b32cf16a302e536066b8193efe52b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615152, "uuid": "a3734fcd-0eea-4217-907b-c9b0fa29ca5a", "comment": "Malware payload (Gafgyt)", "value": "629327538410978e2d0767c7c1d033b48a5790217aa724ba7855ab97687db917", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615152, "uuid": "5593fe59-aca0-49a9-bea6-2a3445ce5dc8", "comment": "Malware payload (Gafgyt)", "value": "950980564279f9db8fadbbfa14445b1767f1b10e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615152, "uuid": "03649088-fe07-45c7-941e-5c6bbfde8100", "comment": "Malware payload (Gafgyt)", "value": "8942061031c8a0f2bb43f35740b3704d2ecadb359bc860ab2f1f653c6150238545943220f583267678b9d5956aa79282", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615152, "uuid": "db78eb08-009f-4f5c-8e60-f952eac3d2f5", "value": "T1C7D3073B7B230E33C0CA507102E71332AAB5D79934F953D7A9D06D6C6F16A883466BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615152, "uuid": "6168e5fc-0ff8-4b2e-9d22-a216c9afea9f", "value": "3072:6Ue4f/kyrThNPMuHphadb0LlVrsL7eed3aBeTz7NV:6Uec/t9lhphadbcoL7eed3aBeTz7NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615152, "uuid": "8d8738cf-6f48-4fd1-8383-f9f23ddd1be7", "value": 140543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615152, "uuid": "1f18069f-e2c8-44b4-a39c-87a9eed4ef50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615152, "uuid": "dd116686-3d1e-493d-b698-2e214515bde3", "value": "4c8b32cf16a302e536066b8193efe52b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7208602-5ea2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639681376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681376, "uuid": "a7a6bfdb-0eaf-4c2d-aa85-67d1417204d3", "comment": "Malware payload (RedLineStealer)", "value": "7b98740fc81e6a5de1b741d68bf246e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681376, "uuid": "bbf0cb17-9014-43c9-82da-fa55e04085ae", "comment": "Malware payload (RedLineStealer)", "value": "62c294f6084d81cdac6be310763bf8ae12f9f8ac1454fc24c69b839885b89252", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681376, "uuid": "a0d1d3ca-a4a1-4f86-a12c-b30d81c7d0c4", "comment": "Malware payload (RedLineStealer)", "value": "a4d41274504abe6a5d14d6e4f3ead26c1bdc6206", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681376, "uuid": "80fb54c3-9286-4f69-b340-1768c9e5c64c", "comment": "Malware payload (RedLineStealer)", "value": "898b844e18b17e36a4347b250514d6b6979cff9471a339394b4419d439b5e2faeb48e7b42f72511dcfcd453a968e4f1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681376, "uuid": "0480db9d-48cf-4fb9-a528-730716e4e2a7", "value": "T1D855337325D0492ED5888EF83FFA545B42B238963AA1D799D18A338F5BF8037745C1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681376, "uuid": "4f7ee780-11bf-4bdc-888c-2af274d7408e", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681376, "uuid": "7783fed0-c07c-46d4-92f1-eb57f6360d35", "value": "24576:bnMkpcKiJapZ+IJY123cxm3kKUP8HlmjWgI2TfxtueQCnkEaHNYK3bZxkI9:zpcKW4+I2o9UB8Fm5IKZtu3cNaJZxk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639681376, "uuid": "97d894f5-4934-4c57-9452-838217ded2b2", "value": 1397952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639681376, "uuid": "acff6d6e-3117-4a8b-b9c5-3b29d9621488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681376, "uuid": "01e552b0-db17-40a4-8245-6f02a5aaace7", "value": "7b98740fc81e6a5de1b741d68bf246e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bd6148-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639644811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644811, "uuid": "9f9ef049-e2e0-4e95-a74a-fd9a21ab2b92", "comment": "Malware payload (Formbook)", "value": "590e7bdf2208710154fbb9a4c905cbca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644811, "uuid": "6fa82c55-c575-4b1b-9da1-44ffe0951d51", "comment": "Malware payload (Formbook)", "value": "63af99e8a19debed050e3c5797d9ca523cfbe8dc0da94c6f9d0514691b1ccfd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644811, "uuid": "3cbed6c8-7087-498e-8f12-c08b87185ec9", "comment": "Malware payload (Formbook)", "value": "899dee1351e308838d124a05d481053ebda44e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644811, "uuid": "408db884-5b6b-4404-9629-d7a348030eb0", "comment": "Malware payload (Formbook)", "value": "c392b96d36525119d8b8d6781d8a69383644956d17bef5e37f904454e4718ca4f94c909cc89889161a0bcd6844b06239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644811, "uuid": "3fa7552f-64cf-4345-91f0-7e190dcd05b9", "value": "T1AED4E1936B810766D3FA6D70D0964A328292EF2C47105C579AFA3DAB3FFD093C81561E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644811, "uuid": "ba9d00b9-6440-43fd-9bf2-9c6f3b5aa36b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644811, "uuid": "ab052343-1431-461b-b2f4-1db3f6300d01", "value": "12288:4ZaPMC8YQ69dtXnCWTjUuK5vMBAFB8Bjlc/YLhR7g38AB:IQn0uK5Xy6wLhR7g38AB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644811, "uuid": "ae66591d-c692-4c4c-9b60-023d40d51368", "value": 608685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644811, "uuid": "47f001b0-e53b-4d49-b311-cadcdacafa90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644811, "uuid": "9e2099d3-76d3-4b94-93a8-79c4991c48ed", "value": "590e7bdf2208710154fbb9a4c905cbca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd3f9b3-5e93-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639674703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639674703, "uuid": "fc0c4ef0-1aee-4b6f-bf8b-6a4b26b4494e", "comment": "Malware payload (RedLineStealer)", "value": "ab4bc9b167325a5fc2bc360009d9fed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639674703, "uuid": "d976a409-c4b8-4243-b812-bc7ebb0618de", "comment": "Malware payload (RedLineStealer)", "value": "63ce7a660a0292e950dcc4c8ef00616ef93016ad1c9c1b8cb602dc4a45ff3cb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639674703, "uuid": "0665ed74-f51a-4fae-b022-5bc62904743a", "comment": "Malware payload (RedLineStealer)", "value": "d5feb370e7ccd4c713a38e2cc321975426ad8b5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639674703, "uuid": "085fbd58-4882-47ae-81b0-0c0d203018b2", "comment": "Malware payload (RedLineStealer)", "value": "144591348b09eef487e66e56eb42d2b1ea759f14afb43be432eb6d930ac0ec3708cd650c49ee984bd094f5245f13e6b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639674703, "uuid": "d93b0bee-664f-449c-ab26-cabe1cac7096", "value": "T125A4C000E7A0D035F1B213F85AB6E3BCAA3E3EA1676450CF12D526EA56346E1ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639674703, "uuid": "a2f25596-254d-48dd-8db1-7130694ef8f1", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639674703, "uuid": "d0630d3d-ada9-459a-ad24-1dcce36036c8", "value": "6144:RvY6t6Hqn0YUUWBFboyYSI4HepiYkhUndqouvrV15raVFo7Jz0F:hcKyzBFboiHdYk8dqouvrVHraVF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639674703, "uuid": "a7ff7adc-6496-4a38-82f7-dab0089f5962", "value": 455205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639674703, "uuid": "641142e0-0114-4821-bd89-deaaef465dbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639674703, "uuid": "13b25692-76ab-4c48-99b3-c909e45c1e6f", "value": "ab4bc9b167325a5fc2bc360009d9fed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15d8f6b-5e6a-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639657287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657287, "uuid": "356660b6-2495-403b-a82b-1926f333e687", "comment": "Malware payload (njrat)", "value": "ad24b1319a3a895d8b83a0deae7eac57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657287, "uuid": "47cef106-8ecf-4418-868d-c0affa7910d0", "comment": "Malware payload (njrat)", "value": "63d4943fbc9e572db52df96729327f29c0342f7b7f192d823dc7a322116f033d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657287, "uuid": "cead0405-6dea-4645-abb5-1cfb2013a83c", "comment": "Malware payload (njrat)", "value": "81f2908cbb43a41fac8208a9805c06521331f512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657287, "uuid": "2dd2c3f5-bbb7-4475-82ff-a530af760223", "comment": "Malware payload (njrat)", "value": "e1415fe251571e6235f1bf2ac8500446764dd02fc4ca3df902d4929c118ad0c76d003f92069e8f4c5326888836948ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657287, "uuid": "855b8f49-f61a-4283-bdc8-e22df19cd683", "value": "T14A733A4877F54A12D1BF0DB5897292220B35FC075E26F76D09D174AA5FB36C08A09FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657287, "uuid": "ba3de7ef-4104-4574-b6b4-6310ca415bc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657287, "uuid": "8e75ddaa-253d-4fd1-828a-03016fc99bac", "value": "1536:2tD+6Y9yhU1uDppS5wpOk3JCK6pFooXd6fOpd/9nEh9TGQJHR:ghU1AQwpOk5CK6iO/9ESQJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639657287, "uuid": "d31a03cd-ac6a-4187-86eb-b999d30ccd87", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639657287, "uuid": "f132141b-ff5a-4f7a-969b-49538d3a295e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657287, "uuid": "96d06bd1-a422-43d8-94f4-91c565e34b38", "value": "ad24b1319a3a895d8b83a0deae7eac57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4328f924-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639683731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683731, "uuid": "1a29c077-49cc-4cb5-8ffd-62070feb6952", "comment": "Malware payload (Socelars)", "value": "b978804439f084bdddf8cd2082f3d13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683731, "uuid": "beca8327-8a63-4ec9-9cd7-400ed1aa2869", "comment": "Malware payload (Socelars)", "value": "6407fadfaebc58d33379616de02ad1d430004a09b18d66cb009154bc954fec71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683731, "uuid": "0f70c1ec-004a-4f89-a949-d6236c302e51", "comment": "Malware payload (Socelars)", "value": "3e337465f3badd98b211335d2cef17c1a0badf5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683731, "uuid": "77f2d121-f944-4c64-bf8d-33e73ec88cb5", "comment": "Malware payload (Socelars)", "value": "da8dd55bbae8b8e5f38f4dc89d3c6d9d2cee9820d646c70062be9b6637abf2a76fc8f75e946cbca92e655fb487d6f57d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683731, "uuid": "d7ec1753-5dbe-4061-9285-91e687e586b7", "value": "T1AA559F11F642A036ECE300B282FF4AFE9D687621031854D7E3C45D695E619F37A37A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683731, "uuid": "71a04fdc-74e8-4f99-8571-c190bceafccc", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683731, "uuid": "395469a3-8faa-4fd8-8b9f-d25829fa8e64", "value": "24576:laApxEmUociWVxvX2LfeEyS2ZTU2xbVJbpNyn0iNSpdFg:VpLfvjilVbyn0iNSpTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683731, "uuid": "1f97bd14-0227-4382-9769-7f1657614ccc", "value": 1345107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683731, "uuid": "cd01b281-afcc-4883-a00c-da515b413d04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683731, "uuid": "722d45c4-9072-4095-b559-c9d2eb1b5402", "value": "b978804439f084bdddf8cd2082f3d13b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf04d0ef-5e5d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639651753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651753, "uuid": "3e5288e0-e11c-41a3-b2d9-1c668e634f05", "comment": "Malware payload", "value": "18e3a07538404565935f2a3b47de7c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651753, "uuid": "36f089d3-c5df-4ede-b6a8-45a5789eb345", "comment": "Malware payload", "value": "640fee8437e46c9ccd7ffa3b170e2bde1b5f1bcf4b13fdb5a7c67098814ff0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651753, "uuid": "57a680e4-da97-431b-ad6a-2234cdfe7cc2", "comment": "Malware payload", "value": "a5dfba440ac7a220d9b37992965dce7fec37cc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639651753, "uuid": "fd45e19f-a05a-4927-baf4-6bd4566c4e38", "comment": "Malware payload", "value": "530280066a5cf65c2de6f30dbba4b409eff70007c6a2ae1c47526f38ca001a4d5eb4442379ec872784069c80867c5198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651753, "uuid": "57b694ee-2d2a-46e0-860c-108d4cfd0720", "value": "T1DED48E32F7A08837C123157DAD1B92AC68397E793D24D8477BE52D4C6F38683782A257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651753, "uuid": "ebc4e463-bd31-4b9b-95e4-5d47123fa199", "value": "818fefd508faa2dba213d5a222554a22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651753, "uuid": "a67bc057-0df1-4137-91e2-fe3807eccb77", "value": "12288:pr979FvACpZmNFHYVidVqxql53FgXJrmv+3R+Z+on1PRlR:lp92CpZmNFHYVidVqA5VgXEv+BCx1PHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639651753, "uuid": "60fef067-c6e3-4592-8d78-fc2a63532870", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639651753, "uuid": "8f3723e8-8ade-4f82-8e94-71b94ee356ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639651753, "uuid": "c87db727-b6c7-450a-ab15-cd6c36a23a9c", "value": "Enquiry Number TRD-ENQ-54-1204-25-SIS.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5f38f9-5e24-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639627130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627130, "uuid": "37480934-e105-4e4d-9028-9771f16567a2", "comment": "Malware payload (RedLineStealer)", "value": "09196bdf093c3d2026a0e1061743cb35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627130, "uuid": "b3b8cdcd-a66f-4e7b-9ad0-9e84424ffeee", "comment": "Malware payload (RedLineStealer)", "value": "6467af2474360133a3d9fd753097c250d5673f5a6a8b58fd5ac773486cd1ae7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627130, "uuid": "745f6b7c-33ac-41f0-9716-916b34c31a92", "comment": "Malware payload (RedLineStealer)", "value": "13e8e376f1477539127d654c81f4b25e2bb7bbd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627130, "uuid": "700a3cdd-c162-426a-81e8-79452bba3bc2", "comment": "Malware payload (RedLineStealer)", "value": "d0ee5d4e5be272e93e5d1332d679c19f27759db6a6d3bde6e5e0238ee78ea5e3d9664e1a6060465a0c0b1e05ee9d7b74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639627130, "uuid": "092728f5-2a47-44fe-af01-45b40368b936", "value": "T11125DD1FEDC2AA94E942077655F3BFC04B7C90F94F2B33D89704B5E18AC95A22B03959", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639627130, "uuid": "b76909ad-5baf-48e1-a0d8-a38e7d498330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639627130, "uuid": "0b5a38bb-969d-4489-800a-cbf73caf36ac", "value": "12288:TJm4ZF0kNNEKvUEQ4M+3ilp2hpwTpC/nyqxjFDRy6DEUUa8dm6:RtUB49S47nFxqg0a8dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639627130, "uuid": "6b737865-6785-4626-9bcd-4a9d79eb74c1", "value": 995720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639627130, "uuid": "d4dce431-63c1-42a8-b095-16f7c5bfdac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639627130, "uuid": "2bd1c615-478b-47e0-8e86-a605928c2e5e", "value": "09196bdf093c3d2026a0e1061743cb35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba410cc0-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690803, "uuid": "d33f149e-2b06-4d0a-bea2-12f450f8da98", "comment": "Malware payload (Mirai)", "value": "b88cb4d80992df89a99024fb23c4bf18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690803, "uuid": "c074fc2d-cd6d-4109-8425-3eead1ef13d3", "comment": "Malware payload (Mirai)", "value": "647287be84874816ce869ae3396fcab0b824090a7f42aceb1aeff84b5cf25c9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690803, "uuid": "998364a5-e937-4cb2-8107-504e5183abe7", "comment": "Malware payload (Mirai)", "value": "4838decd1c41b1b237202db136476b9f05c39223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690803, "uuid": "09ad9188-1239-4fd6-a9d2-944d73fd39f3", "comment": "Malware payload (Mirai)", "value": "969b016e4b5d008c9b33c15211e590564c0ba4c68f643700ce79f5c5690845d684f5192699d014360a950a0bbde8b35a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690803, "uuid": "8ca54bb5-be77-41d5-9c22-27bab9bcccb6", "value": "T1E9635A47B60C0843D1635EB0363F3BD1EB6BA3F221DAA185AA1E4E55E571D3312A7EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690803, "uuid": "d7238d97-0b49-4c53-9b8e-bdc5e71d6ce3", "value": "1536:sxgU68GvDHTn19z/8ApZMbOTzMetJ8aVDa:sJcrz19z/86lgetJ8aV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690803, "uuid": "f187456d-1fb8-4eda-b642-458eae5b6ed1", "value": 72768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690803, "uuid": "4e1438b0-309d-4820-b4a4-41a21f7b3622", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690803, "uuid": "8ddb9ef7-5b07-4ea1-a2c0-f3a4b20df090", "value": "b88cb4d80992df89a99024fb23c4bf18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2a6a81-5e4c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639644316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644316, "uuid": "1889c25e-f048-4613-8fa0-19f639ae99b4", "comment": "Malware payload (AgentTesla)", "value": "033304a9a935c4d0d64769245abfe3ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644316, "uuid": "2a7bf5a7-9381-4986-8392-604e3b5a9aa7", "comment": "Malware payload (AgentTesla)", "value": "6500927c19e228cc116484a103ba594fdeadccf06159332ead8cc9b3d9da83db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644316, "uuid": "b35826f0-da16-46f8-939d-6e5b6d662e72", "comment": "Malware payload (AgentTesla)", "value": "ebe539aeb57b78a3ad8085fe61dcc5ce3bfb6fd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644316, "uuid": "5612f1ab-826f-4708-874f-1d3ef92eb48d", "comment": "Malware payload (AgentTesla)", "value": "7674d2055061efce0d0783137a378d4a31cc29be6068e9520c82a27eb49d261f08d1906ab3fe75da844d641333cfa82c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644316, "uuid": "b53ba2e8-b1a1-4825-ad8f-e5abbe78de5f", "value": "T1D5740286B7E0C9B7C1180378CD6ADFF58377BA92692A0A9327742D8FFC747835508166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644316, "uuid": "0a2efd26-5477-4a42-94ec-d4d63de829e3", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644316, "uuid": "31524d48-7ffd-4ecb-b4c0-ddc94b46025d", "value": "6144:k9WoOGMVW8hHvdzORdUvpI8+Kolq185x0gqJkmqzcx7BMAqgc5X8GibuI:PGY+My8hnufTxm7xl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644316, "uuid": "df2a1f8c-d1e1-485e-befd-42401bd3823b", "value": 359131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644316, "uuid": "edad73b0-d99b-4c4e-a353-be6ca30fe80a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644316, "uuid": "dd9aa343-3644-4849-807f-59aa656a4f72", "value": "033304a9a935c4d0d64769245abfe3ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286a7d5b-5e3c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639637301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637301, "uuid": "ea93e399-04d3-4ec6-972c-873f0b7bea58", "comment": "Malware payload (RedLineStealer)", "value": "341421a698de1e06bf7ed0e4267aad7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637301, "uuid": "a48a078e-e0af-4418-b7ee-b258d54ee02b", "comment": "Malware payload (RedLineStealer)", "value": "65adfc3bf941d83b96e22bd0a59bdbe8ca76eb3aa460622d15fdba6d512565dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637301, "uuid": "f07e3ce6-52a1-41fe-a2e6-dcea185061a2", "comment": "Malware payload (RedLineStealer)", "value": "dcffcd8d10b79c8e1f1406121f00f5122835182c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637301, "uuid": "d21a39b8-9763-42a5-b330-6b0e3df36df5", "comment": "Malware payload (RedLineStealer)", "value": "af53b9830f04fee2fbc165f3e9a3ad63a02c096ef140b16351b065c5cecf1619a4c739acd3cd89ede539c14c51264384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637301, "uuid": "e49830be-bcec-47a3-93d9-e2a4c4dd229b", "value": "T13EA4CF00E6A2D035F1B312F859B5936CA93F7EA26B2850CF13D52AEA56746E0ED71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637301, "uuid": "9c35270a-1d2f-4de5-ac2a-1157a504b955", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637301, "uuid": "5c05f4ad-3918-4bdb-bf31-cc42c8a87744", "value": "12288:RieYn2u+Pwu62hWGnSz3vEUBR5Iemb+yE:RJu+Pwu9/Sggqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639637301, "uuid": "21927ff4-89e9-48ae-a1f3-ebfc093149c3", "value": 456220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639637301, "uuid": "2b2b560b-de47-4ca1-9ce8-ef62bcc994f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637301, "uuid": "69d5ed74-cda1-4ba8-b8f3-f15abc64632b", "value": "SecuriteInfo.com.W32.AIDetect.malware1.671.20287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899108ef-5e52-11ec-96a4-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1639646912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646912, "uuid": "6e7c7b22-e51b-4a7b-8f04-8e2172cde5a4", "comment": "Malware payload (BazaLoader)", "value": "cf9d9aa2a35ea5f159916210cd9ecb77", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646912, "uuid": "f96ad893-aa9d-46de-9a1a-76615dabe2e5", "comment": "Malware payload (BazaLoader)", "value": "65cef336fae2eac93b5966f02d48e118ee8e2e084392135e96f02e7713e99611", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646912, "uuid": "ef0d7075-a3b9-4a7b-8ecf-01511b888990", "comment": "Malware payload (BazaLoader)", "value": "4edff0256811f04dff9d633fb9be3fd2c5a0e427", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646912, "uuid": "1b6d2e77-8fab-449b-967d-2239bbaef222", "comment": "Malware payload (BazaLoader)", "value": "c3efed1df4885223c36fe7bfb52c0e301f50a59d86eeb783f088db5c71abfbadf946920e145a9f4f276d85c32fb54c9f", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646912, "uuid": "4bc4d79c-131c-4cc4-9430-ec82d9b7e8f3", "value": "T108549E78B94819F0D6DA89365AAD7CB9227332635ECB9CCC015CB7C2066F762BF85704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646912, "uuid": "0160e643-57da-4e05-85c7-555ff4f580a8", "value": "6144:ybni3GXAw8OjcAgMB8uiUgAJzftxDL48X4l9:SiyZcA7NZXJRxD08y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646912, "uuid": "ec3d7ff3-58f9-4d02-a69f-49cc09595b54", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646912, "uuid": "8c3fe2ea-77d9-4d65-876d-f50fab360ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646912, "uuid": "f9d6eb70-ddc9-43fa-bc72-e020eaaa18cc", "value": "cf9d9aa2a35ea5f159916210cd9ecb77.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e39366e-5e23-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639626707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626707, "uuid": "87e2f50c-2669-44fd-979c-420facbd4876", "comment": "Malware payload (Formbook)", "value": "f5e23bf213a4fbbc33bb921573dd89d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626707, "uuid": "c6d3fb8e-527f-49aa-8beb-8e4f4448044d", "comment": "Malware payload (Formbook)", "value": "65e72e73312c4f4b1b721cc8a2ffea2e473bb4c225918e545183bce15f6662d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626707, "uuid": "c3c70ad0-7929-474f-af12-f18c87d5277a", "comment": "Malware payload (Formbook)", "value": "969f51abb7a74b366877c1ad7d2963b070e79af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626707, "uuid": "867bacec-032f-44db-b6e7-d86e71a21846", "comment": "Malware payload (Formbook)", "value": "2366fb9b7d304392fefd1eb714587a21473485d5e701a8498cc4e05ce1b718f90bbaf314c6d31c970cb2c2bf0b7cad04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626707, "uuid": "d901d709-d24a-4d75-b59a-f884cd65fd43", "value": "T1F0A4024477AD9B27D13C9BFE5551A05043F1A037A113EB9CAFC670EB2BB2F418142AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626707, "uuid": "9dd0473f-9b41-42fa-a6a9-ae6150f3e73d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626707, "uuid": "e86cf620-2fa0-474f-a58f-559e6ddab5d7", "value": "12288:fEw5uHoA5QfJoQP4v8jvMQCzgwx099YQ5pWFGTTgJ9sRENuSK3:TYoA5GdP40gQZwirYwWFPWSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639626707, "uuid": "1c35acfb-b9b5-4edb-afb6-837371d46080", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639626707, "uuid": "0014597c-6ef6-42fd-90cf-651e4974b3e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626707, "uuid": "2b3ecdd2-98f6-400d-aeef-06fc1f6392ff", "value": "new order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee93bb96-5ea1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639681012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681012, "uuid": "3526dbca-2ba8-472a-afc3-44bc8bfc36c0", "comment": "Malware payload", "value": "25f136d93eb7d06ea2600ab9096635a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681012, "uuid": "f23bff99-382c-4e70-9e5a-dc0b68921410", "comment": "Malware payload", "value": "664f8066fd251774b833cacf149b9fb0b820db6c500e9f8c1590be3f5f330796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681012, "uuid": "c404ee51-da15-4b62-a94b-c85fddfdee98", "comment": "Malware payload", "value": "85f7a70853840fc70e15a1d2d62e3c883bb007b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681012, "uuid": "ab074d94-99de-46e0-be6c-0d073314750a", "comment": "Malware payload", "value": "5df34980aeb9f17ef2d52f5120e798b59e9a4a2b17e0f616ab8779dd631cda6ec37c4dc4ca0ccb735e7e37eaaf156602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681012, "uuid": "f614cef9-9fb8-406b-b191-e0186b7d119c", "value": "T1A105CF1FBB129249F998CB71DEB32F200664E5E6DEA2835BF3481E2D843E7761844753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681012, "uuid": "a020e360-0eb7-43e6-9307-d4b2fd3ddb95", "value": "12288:pZIsGNg9k581no/1WWVEKd2N+2GpQSvOAXrdwTBX9JHoO52VEfjsVAtObdvs52Ky:EnKw81BPlNZGpQSbJo9PrskObRs52T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639681012, "uuid": "bb9ea480-1083-4309-b81b-b37ec59fbd79", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639681012, "uuid": "9e372a5d-94c4-4f3e-ac75-8a68a3a30d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681012, "uuid": "7f9bc975-5ea7-4370-a2c3-25a313ba0618", "value": "PO# IP0022442 SCHENKER 214795379 SWB ARKAS DEME PLANLAMA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e0ad0c-5e61-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639653397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653397, "uuid": "42e7a4a4-6f54-4762-910c-723577257930", "comment": "Malware payload (RedLineStealer)", "value": "ab30bb947e01c244a019178e7f3c91f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653397, "uuid": "a736d2fc-48d1-4bce-809f-161a530144d1", "comment": "Malware payload (RedLineStealer)", "value": "665d4b7c4bec54b430a47f22608d377f3a96775cf5edfee297265e385461266e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653397, "uuid": "f547474b-e176-4bbb-b2dd-415a23102380", "comment": "Malware payload (RedLineStealer)", "value": "53a269707333b61b5729f6a69a64658463a9404c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653397, "uuid": "c670ddf7-3671-46ef-b9a7-2bee44df7a21", "comment": "Malware payload (RedLineStealer)", "value": "1ff61fd8463314305ba9c747cf53fc26fe885394564b9964a1c5ad45436202a8445737ba8e9715a3d3288b9c4fc33a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653397, "uuid": "89440074-f27b-4c0e-a7cd-153c5c27e036", "value": "T1C6B633887A0490F9DE5BE13F114CAEF7A6BE83418263ACF75350C0805BBEA41E5BF556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653397, "uuid": "5e266128-9cd2-4abe-b3ac-78e2f0eb8305", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653397, "uuid": "7938517d-d776-4fb0-8d69-0d0642c05d6a", "value": "196608:xWLUCgTM/EYJ78bfGmXz8NPWpUR+0BPKC6kroR/dC8jA5OuKsUVUOJwl6z:x+dgQ/XiGAKqV0Rh6kM/dCyA5xKzAl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639653397, "uuid": "9eacfcba-a927-40df-9eed-009617ef427c", "value": 11183010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639653397, "uuid": "85f1ced9-559b-4651-a712-7c067c9aaaf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653397, "uuid": "4994ce41-1a5d-4763-a04c-bf21343d2bc4", "value": "ab30bb947e01c244a019178e7f3c91f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a8ebda-5ec3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639695231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695231, "uuid": "49a0fd18-8c30-47ed-9ff1-c5118b0bdc6c", "comment": "Malware payload", "value": "f94af679d7eb132f6d0438382848ee7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695231, "uuid": "2aa0b163-695d-4c20-8a9a-7b6b707f892b", "comment": "Malware payload", "value": "673863162674d9787f890c093aa2b5c96e708fda0626ce8d5e1d2f6d9ca6811c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695231, "uuid": "62f59eee-cd1a-4203-97e8-9314d70422e2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695231, "uuid": "39ecd4ec-36cf-4dc2-ad8f-358c77538f2b", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639695231, "uuid": "3f7ee456-909e-4715-9070-267c9a5664ce", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639695231, "uuid": "2c28ee67-ffde-4b81-821d-fcc934bd16d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639695231, "uuid": "077c6cfb-3865-4ee7-b92d-cd493e218ecb", "value": "ZDQf3gLGE1GPIjK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce2ceb9-5e87-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639669628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669628, "uuid": "425ddffa-3dc2-4a3a-b810-75349605a138", "comment": "Malware payload (AgentTesla)", "value": "dbabb25e78d13b1838b8e20745877e87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669628, "uuid": "f9343363-c387-4e64-8acc-e4dedc4f37e7", "comment": "Malware payload (AgentTesla)", "value": "680b5dc05ccf8e090f143fc8ea58fabddbeeb770dcee5c7033142d77f774eb02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669628, "uuid": "09bf5b0c-b4d8-4986-bde4-b1a02d32e14b", "comment": "Malware payload (AgentTesla)", "value": "afde60c92d8a7894acc4c5f287807d24e607f8cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669628, "uuid": "e404695d-7087-4314-a32a-42b16a8290ff", "comment": "Malware payload (AgentTesla)", "value": "7ae5c6abd6bbdc3b01f785138684cd6415b32b340663fdd4fc58ea4757ef1943e1d57372e40a11c33ef9efddcafd29c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669628, "uuid": "269199f2-2c86-4492-bab5-3372e772ff0e", "value": "T1A9A4236B9C23B2814CD9A910CA53F109E5240597F65D5EFDF1ACF07118BC39EBE8229E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669628, "uuid": "15427fe6-4a23-4741-a28d-c8a84b537651", "value": "12288:s0pkQZcLE6SUkWi1GfvpOVvQPdwD17RRhukjaeZ:yLE6iWi8XpOVvYwD17RKuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639669628, "uuid": "7dc5ec03-5bbc-4ab2-97e1-7805c6c39df5", "value": 483127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639669628, "uuid": "439b318d-1eef-4651-ae1b-b638f39ebea4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669628, "uuid": "662fab47-987a-41b3-aee5-43c523690c31", "value": "OV2BR2G9XZfQ1M9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa991fb-5e21-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639625762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625762, "uuid": "6c0d5358-1543-42c4-b634-90cf525e7eb7", "comment": "Malware payload (RedLineStealer)", "value": "a1024cec45a49b3380c5512819caa803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625762, "uuid": "dd7acb24-9fc4-44af-b5fe-65a27ebdc5d7", "comment": "Malware payload (RedLineStealer)", "value": "6920b2901614a04fd897daad64cd85d7c45a49bff016ce42e1278e40eb5c9d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625762, "uuid": "77da670d-c88f-47b8-9c57-040521c9c1c3", "comment": "Malware payload (RedLineStealer)", "value": "e53b247df8a1fcd6cd8abb20c8d84b34050d6abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639625762, "uuid": "abcf167b-1823-42bd-8c29-7b9671a07972", "comment": "Malware payload (RedLineStealer)", "value": "e80066856e7e0c0fd1918b612acddc181593af840e6b9d87a0b5432e399d405c35a559523e9dbfbd06a8f325a8ca369b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639625762, "uuid": "33f9a0aa-ed58-41d4-a4d5-9a244eb7c2f6", "value": "T18FA35D20679C9F19EAFD1B75B4B2011043F0E08A9091FB4B4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639625762, "uuid": "ea903638-84ce-4246-acc5-19dd0689ad04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639625762, "uuid": "cf41a507-2701-4d86-aab3-24ce51d4fcd7", "value": "1536:9HqsIEq76ElbG6jejoigIY43Ywzi0Zb78ivombfexv0ujXyyed263tmulgS6pM:91d+68YY+zi0ZbYe1g0ujyzdQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639625762, "uuid": "d36d800a-8b52-426c-906c-1293b28d2140", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639625762, "uuid": "3cb10f15-273f-479a-88dc-657ac5d099d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639625762, "uuid": "5c6e30d1-6c0c-4062-bf3d-4cc70245e0c4", "value": "a1024cec45a49b3380c5512819caa803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8694d965-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643901, "uuid": "4e586fec-b695-4fb6-87a3-b7de234ea675", "comment": "Malware payload (RedLineStealer)", "value": "4c7f08f269dddc382b818288e48eea09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643901, "uuid": "a8aa82ab-3bbe-45c6-9550-67b3ac354a64", "comment": "Malware payload (RedLineStealer)", "value": "69af0241c14a497c3e92472fb3e8372d51a68a97348ed0a930bc4ddfffc9688b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643901, "uuid": "b0ac077a-488b-4eb4-9d93-9f09132ee36b", "comment": "Malware payload (RedLineStealer)", "value": "ff555e92df696109a9c1258f487a3babde515dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643901, "uuid": "e73d39d4-b014-4fd1-9fe1-78d737ea3881", "comment": "Malware payload (RedLineStealer)", "value": "8683f84e30ed012fb4337c29dfb0157d97ba85ab3c0f4db4c3984c7c6b9a31f0f64be1fee6b032e3b1f0611bb682406e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643901, "uuid": "db8a12b6-b63a-4216-a64e-3cb2608dcad3", "value": "T1EDC41205F481F732D0A6997481359AA49EFBB2B01A75420F379817BE3B727902E36377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643901, "uuid": "348cbfca-b7d4-4672-9102-d2f915c28c47", "value": "d585c3f2ae16ed9e33c9881499e84cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643901, "uuid": "191dbbbe-d779-40a1-8e65-c885de3a101b", "value": "12288:cZzRyai0kOXvFqFZDTQpvC3TvAY4xbkV2LKbcKTR:cZzkCqFhT6vCApxjecKTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643901, "uuid": "54e838ee-55cb-4e9e-9e16-22f6459a21e7", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643901, "uuid": "355157c0-a526-4947-81f3-9eb3d9aa4173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643901, "uuid": "1499f56c-1dfd-416b-a4a1-d3d3fbfcacea", "value": "4c7f08f269dddc382b818288e48eea09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86265e7e-5ea0-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639680408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680408, "uuid": "022209f3-f128-4455-b97c-2fd804a47f2d", "comment": "Malware payload (RedLineStealer)", "value": "c04b84d96097b266b6096ffda9439b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680408, "uuid": "fc90cf4a-9bf6-4853-ad84-c9fca1955270", "comment": "Malware payload (RedLineStealer)", "value": "69d91c55617eceb7afc97e4dbba2421df5be256ef9a3ebc913a1d5148e8e26e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680408, "uuid": "ce6ac035-d9c3-4e30-9da9-2c2972c685f0", "comment": "Malware payload (RedLineStealer)", "value": "586c64821856c124c22d8da8b0f04e4edd616ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639680408, "uuid": "fdc6c73e-0fda-4670-a2cc-bf0aac299730", "comment": "Malware payload (RedLineStealer)", "value": "c794f5180f68f495f6229ffbf29bd455fe58426dbf4817b5bedb2251423966c13736082f83c8c8c92fbebff8edc6823d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680408, "uuid": "8b67a273-efbf-4817-a3e9-dfb7de2739d0", "value": "T159A4C000E7A0D035F1B213F85AB6E3BCAA3E3EA1676450CF12D526EA56346E1ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680408, "uuid": "cd6a83ed-5bdd-44b2-af3b-6e2b377325eb", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680408, "uuid": "6e892005-76a9-4473-9190-a74a73748459", "value": "6144:RvY6t6Hqn0YUUWBFboyYSI4HepiYkhUndqouvrV15raVFo7Jz0F:hcKyzBFboiHdYk8dqouvrVHraVF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639680408, "uuid": "48baaaf5-1967-4d98-8260-c227a18749ea", "value": 455244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639680408, "uuid": "35bca955-869b-4a00-8aa5-22868309416b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639680408, "uuid": "788b9218-84bd-40a5-a7a7-bfb535bd0778", "value": "c04b84d96097b266b6096ffda9439b7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab87228-5ea9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639684173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684173, "uuid": "a1b69581-9985-443b-bc77-102da822ed35", "comment": "Malware payload (Mirai)", "value": "d32b78a4b06ca90de2c11ed35aab03cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684173, "uuid": "c60bf8e1-07f3-4aa6-9da9-235cfc1bd9bc", "comment": "Malware payload (Mirai)", "value": "6b37950ea9d6eabf56841f8ce36760b7228eb3392c9c92759b198784eb5c3419", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684173, "uuid": "599aaa5b-87b8-4c9f-9404-19db26acc922", "comment": "Malware payload (Mirai)", "value": "320e2490f1cfe982fc151139d77a14f8ed0869ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684173, "uuid": "dca92da3-48f7-4394-a1dd-65379d424faf", "comment": "Malware payload (Mirai)", "value": "5acf94c2bb5e92b496a346764d982cb618816499145d3ad42fc559e10c13e5a2cadc45008be06b0404060a92cdfe4be5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684173, "uuid": "ed5a925e-f731-494c-8f86-fe70e13e42aa", "value": "T16B434B21BA761E17C0D1A47E62FB4B14B6E116DE36E8C61E3D730E4EFF616806503AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684173, "uuid": "21df9e7f-faa3-40cb-8c5e-6b0c0b25bdec", "value": "768:Btoh1A9F5xWwByPZJjLvBbINgzfjDr+CpqbK7G9O+USX2w6r:BtIA9XxVByPZJjLvdIGXqCUVNUs6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684173, "uuid": "730ca886-0bc3-4ef8-af88-14a3aff2c9e9", "value": 55904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684173, "uuid": "daaab78b-a008-476b-bb24-f9fbd72c2df7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684173, "uuid": "4fc94518-67de-49ad-9c85-b48302675218", "value": "d32b78a4b06ca90de2c11ed35aab03cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554eb924-5e83-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639667870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667870, "uuid": "e4dd7771-ca9e-49c7-a390-72058859edac", "comment": "Malware payload (Heodo)", "value": "726e17f535e97b4c118318fd1d6056c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667870, "uuid": "e0a7617a-fde2-4f2b-a404-cb572115678d", "comment": "Malware payload (Heodo)", "value": "6b551bdf380455c627f4ef3bf70fbb4ec3c12f6d41ce27dcf22bbf6c713be230", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667870, "uuid": "3036cc49-ff1b-4afb-bdb5-5224833b5748", "comment": "Malware payload (Heodo)", "value": "6742f071ecd348196f8c56f7289484282aaf5be5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667870, "uuid": "eefed944-a7f1-409b-9586-0ce219e38467", "comment": "Malware payload (Heodo)", "value": "a0999fb200cc2b78b23775e77afd10aa43f971b045425569e870b9b7576e789d4eebbe96b4cf1c1b97a31e6e1b1ef09c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667870, "uuid": "4101d919-dbb1-4a14-ad7a-6bf9603dbea3", "value": "T18BE4AE107291C036D46E063A0979E75906ADBE608FE4C6EB6FD46BBF2EB11C16D3035E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667870, "uuid": "7198a480-1674-4055-81dc-6f761fd0aa21", "value": "71ce66c8bba9a47db5e9322b567b56d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667870, "uuid": "dfd87320-e60e-40b8-b359-b01a43bb5214", "value": "12288:WQ2d86q0VSN6LcZ5Fl9EAWT4pvFQFQIBl+5UZF/imMG:Jj0Va6LCF7ErT4pxZkom5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639667870, "uuid": "17842ab6-50eb-436f-839e-afc2006705db", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639667870, "uuid": "4061da8d-dc73-4d0c-8357-ef745ca01620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667870, "uuid": "d7f0ab54-00f9-4493-851c-a2b049d3fe4f", "value": "emotet_exe_e5_058543f0c6dd08aab08da25ed6b9ed991bffdc158d70a94c4322ab95a906f109_2021-12-16__151744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94d13dc-5e75-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639662025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639662025, "uuid": "0ee098f0-6990-4b69-b0b2-5a57fbecaf8c", "comment": "Malware payload", "value": "1fbad72568621a7c56462f7224bbe96a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639662025, "uuid": "8d2a2628-8657-489d-a633-ef0c4672e01f", "comment": "Malware payload", "value": "6ccdd5ff9c58604dc665daffe7e159a6e2175a4aa372e58a03450758a7f1b060", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639662025, "uuid": "fa64759c-ee6e-4a74-a06e-3972eb8d8ede", "comment": "Malware payload", "value": "d9bb2589509cbdde941ce7aab71c5f58c86a5dfc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639662025, "uuid": "d0e79afb-dc7b-4a3b-b734-171cc6591fae", "comment": "Malware payload", "value": "277c1303a6d3b96d29d0946b1c908e071c92267a7fb5cda7a13c67777ded7f34da23f744a4c8ce6da21062c6fbdedbd1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639662025, "uuid": "ebe0bd6e-3021-43b7-b8ed-1200c5257b51", "value": "T11B357C00E740A037E9E710B685FB96B9997C7730176099CF16C85BF9AB256C0BE31B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639662025, "uuid": "73554517-7cdf-4886-8633-e05e7206fbc4", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639662025, "uuid": "27e8f268-9c0a-4617-aaf2-dea86cc4fca5", "value": "12288:KCyc2HEaYTXWT/Im4/DfQNXyeObyu9xj/Y4GbOXwR0bg6Cut0v8vH2/mXxcR70uz:K39iTmT/+f+4RY4GbOXwRDh/+cNeTpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639662025, "uuid": "b4500d98-0c61-44d9-91d1-446ddc05d2f3", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639662025, "uuid": "3cd486a0-66d3-4e6a-8940-88f71d7c69cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639662025, "uuid": "146ed0e6-ab2d-4958-89c4-7095ff11b9a5", "value": "emotet_exe_e4_6ccdd5ff9c58604dc665daffe7e159a6e2175a4aa372e58a03450758a7f1b060_2021-12-16__134020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7284ee-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639644793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644793, "uuid": "1c7a4d5a-ba9c-4920-a82d-ef29747ece39", "comment": "Malware payload", "value": "4ae6d852bea9dd22b528626c138c8edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644793, "uuid": "ce26a796-2c98-47c1-a25f-d2b1e4fbded0", "comment": "Malware payload", "value": "6cd5ce2622fc900bb5ff56696c106ffe19c1dee841b8f58bd65dce14eda0b0de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644793, "uuid": "2aba32e3-e02c-41b7-9b73-1de983b86464", "comment": "Malware payload", "value": "db72f6bc68b7f7650d7b93b757f50ddc4e4f8441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644793, "uuid": "ed632e88-552c-4276-a4f4-3e5382311154", "comment": "Malware payload", "value": "1ca54542853111569f323720645f070bc356120706b9cc83554c694f939c8fc774a28acde01d0f05d33c4a29c3efca7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644793, "uuid": "d70f6e3c-8fa0-4bca-a741-64d6a90de1c0", "value": "T1262633C298960111D5E10972A5367EFCE3B28DC106FCEA57F2167BEECB72B151C4235A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644793, "uuid": "07df22ff-f82d-466d-8a9b-02a771bdd251", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644793, "uuid": "5ee24dcd-f5e6-4111-a55e-542e1061c5da", "value": "98304:5ZDqoO6OZ0plGhbood4x7uAIVJKJmqdgsAGdw01Jg:5hO6QOuK1AJKA4aiJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644793, "uuid": "91bf04fb-7a0a-4854-a243-71b0149a98bd", "value": 4720200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644793, "uuid": "1eaca3bc-742e-4d94-b15e-e0fc9e9a1889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644793, "uuid": "31d7317b-1f07-494a-a7d0-ec2afa4bb9dd", "value": "4ae6d852bea9dd22b528626c138c8edc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5bf6ab-5e7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639664845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664845, "uuid": "30f8e972-01f0-4396-b662-c97213348660", "comment": "Malware payload (Moobot)", "value": "79b7a5dad9f2f681a387c3bf79023b5b", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664845, "uuid": "e91439a5-1f2d-4fce-a6e9-a025420c4d86", "comment": "Malware payload (Moobot)", "value": "6fffe6eb76f923ef50f88e832f1bfbb1e12b665ad8db0feca51cb612881dcc24", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664845, "uuid": "bbb271f5-f340-4b3e-8ff6-7de8b4d1edab", "comment": "Malware payload (Moobot)", "value": "b63a6f2b6cf0b535be4ab259b648ecd0bfc3b74a", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664845, "uuid": "5161d33b-b46e-4918-abfc-eb9600115c10", "comment": "Malware payload (Moobot)", "value": "e6452d5249edfdbd9d7cfc709ce82e3bc9b84b35487e0655b11137db44f08914f05e323b89d3e78024a5a1580d61244f", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664845, "uuid": "d8843020-c694-4a49-aab1-678f8d8067fd", "value": "T125D2E744BE869D07C5C84377FB4E028D376523C8F2EEB213DD163F56E68E527099A0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664845, "uuid": "d635b310-6952-40c8-98cb-665ff07a6130", "value": "384:0ju92lifJdzBqSP/yFf1vgTuQqXnPT0PMJ4aZyXRi37vIzuICv7z4vKBzsMIcPTZ:0jiZz8tf1LBTTJbzwRwFzbR49jwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664845, "uuid": "e80a8901-1711-43d2-aee7-4bfad0009415", "value": 30464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664845, "uuid": "46454cf4-7e85-42a7-b095-8408dd294748", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664845, "uuid": "509e65fc-ef23-4675-bf6d-c06bcaf5ba63", "value": "la.bot.arm5-20211216-1427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb826d64-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639641440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641440, "uuid": "1e8ce1be-69c1-4f86-bde3-459e4607663e", "comment": "Malware payload (SnakeKeylogger)", "value": "251822bfe8dc65c62be7cc4271c18701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641440, "uuid": "ace91ea2-cb5b-4ad2-9abf-524d08b797b0", "comment": "Malware payload (SnakeKeylogger)", "value": "703cb8e9deb97402bf8f621f17e16b765d2a3584b383af7808c8b1b6d2d163a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641440, "uuid": "69283bd1-8203-4737-9e1e-d9c35d69e7ce", "comment": "Malware payload (SnakeKeylogger)", "value": "98abc3aa1c360314502cc2f0ed995c71bdc73850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641440, "uuid": "2176219c-85e4-429a-91c4-7bbfb1b46c17", "comment": "Malware payload (SnakeKeylogger)", "value": "789d4e1fd25940b1f1fe8c47cc866ff7a02a93a42a268e46cc11fbf8ae051e851bae34d5cfcceafd4141a6ff203fb033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641440, "uuid": "886482c7-12c2-44ee-9f78-8d754bc5baaa", "value": "T11C94024036EC4F2BD92D5BFD55926A0003F6A436B753FB88AFD270EB2A62B014551EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641440, "uuid": "d06fcb43-3739-4455-926f-bc21ead58aeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641440, "uuid": "6cdc97b2-8661-4ef0-9525-16f3392afcdd", "value": "12288:/9Oe5uHoA5QfJq6iX5JSwDtqpCAr10YC846JsiuSK3:FnYoA5GZiDApjR0Yi6JshSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641440, "uuid": "5a3a7368-0766-4ada-9013-d417dafe3b38", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641440, "uuid": "7f107ca7-92e9-44c3-b5ef-223057480603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641440, "uuid": "957dc4aa-9139-4a38-8dd4-447cc748f7a6", "value": "Invioce #4576453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755cd567-5e98-11ec-96a4-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1639676943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676943, "uuid": "8d40abc8-8a84-4bfc-b5a3-be4da6e865b2", "comment": "Malware payload (Conti)", "value": "755c55ec8829d54cb435266fc993e080", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676943, "uuid": "4456c409-e813-448f-90fb-eaa27cd065fd", "comment": "Malware payload (Conti)", "value": "704b1f34ab455aa0fdb51d742b887842cdd1f35e9f59f04f236d48aaec56abfc", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676943, "uuid": "525077d7-5fe3-4334-9c4b-0f248a643ea0", "comment": "Malware payload (Conti)", "value": "7e03d21e5b3af7667671fde872bfcae1b9bb88e3", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676943, "uuid": "4e2683b4-0254-4a73-afb2-59609d93ff51", "comment": "Malware payload (Conti)", "value": "6f2a71750987cd6d245680210b0b28d14e55db458b60bd103df6dd27c0bc3f07fd9ca3c80a67259a132fcc8ece96d3e8", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676943, "uuid": "dd497c90-a26e-4bf4-a40e-32082d0ab92a", "value": "T126D45A01F24D827DD6AE4D31267A7EB240B99D343B5FCDFBB3DA88281A606C06525F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676943, "uuid": "03ea622d-8a6d-4c03-ad7e-efaf09c71db9", "value": "3072:HJkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK8Dj8Qa34oyZ+wxtqssssxUk2:HFcuVqTATicDLDZ+wb6D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639676943, "uuid": "cabd4a09-3bcd-47e5-b8fa-1886a9a4bdae", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639676943, "uuid": "0c3fc739-7ee8-45b3-9991-d190f82ed727", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676943, "uuid": "799cac67-9d40-4de3-938a-96c9b631cd2f", "value": "704b1f34ab455aa0fdb51d742b887842cdd1f35e9f59f04f236d48aaec56abfc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c761b6e9-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613515, "uuid": "126b37a8-3af7-42f8-a463-b412c2a0b8c5", "comment": "Malware payload (Mirai)", "value": "80d5f7f8577333ee9e7c9c6fc2fb9c53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613515, "uuid": "88e76159-92aa-49da-8cfd-4a86120469a5", "comment": "Malware payload (Mirai)", "value": "7155511ea47042599f62c14b91d936c609e2c3f3854f2edf0cb0dff8450f1d35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613515, "uuid": "27ff9f19-cf46-4189-9b28-19053d0da8c0", "comment": "Malware payload (Mirai)", "value": "312236488267b617d100df79b741ffef0d44b906", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613515, "uuid": "cff954a8-9baf-4a01-b404-7aac59978526", "comment": "Malware payload (Mirai)", "value": "f71b2d01990ab774ba6bd03259144a8b7f39dc2860a29e8b45172ede0178e8ab2bec365dbec9dcf1bd6302ad105f73f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613515, "uuid": "f987fe07-b280-4e02-a381-39086b4ebc4e", "value": "T1DEC32A97F800DE66F40AAA3605D70B25B630FB720E531A76735739A79E362E07827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613515, "uuid": "ae399acf-fe2c-4543-a93e-9a2052e4fb9f", "value": "3072:R5Hqrx3sVoe9wwp/qoh96UGy4mvJ3HPOlx+mvI0PDGnSQNER:R5Hqrh5e9wwMy40J3vex+mvI0PDGnSQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613515, "uuid": "eec30923-4239-45d3-b4fb-1e5532aa291b", "value": 118314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613515, "uuid": "ed390694-6e99-4aaa-b442-fdcc2e27a1c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613515, "uuid": "e8dc7301-b5ff-43c4-b620-5ee99dc99be9", "value": "80d5f7f8577333ee9e7c9c6fc2fb9c53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f05d76-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641695, "uuid": "f0eb4327-6457-4e28-8bd0-e334200d636c", "comment": "Malware payload (Formbook)", "value": "eeca35d41f7bc931ed47bc2d2c8761f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641695, "uuid": "9c37adbd-904a-4658-a445-a082af11d419", "comment": "Malware payload (Formbook)", "value": "7279432c2b818b8a3352655d0e22e16976d9607551b1d9aad4d6fccaf9bb3e57", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641695, "uuid": "b0c6f761-e407-46f1-a39b-73d47245f90d", "comment": "Malware payload (Formbook)", "value": "acc3a6f90a5c99b4a88a3e037b4996080faa3949", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641695, "uuid": "3fe858fe-45b9-4a6f-bc16-4d236fb89183", "comment": "Malware payload (Formbook)", "value": "71007e49576a7620852be5d1d38783615a1d167d0d8a2479b39707a61ea31c7f06ff0019869fc74b25092066099a7d95", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641695, "uuid": "11f30b54-af1d-42ec-8cd7-3377f263dc98", "value": "T14264127AB97E6B4FD0B394B7D159970C900BCF08AE09E3132195304F15779A78AEB328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641695, "uuid": "cbb4ccc0-63d8-4f54-baa4-704469ceff8d", "value": "6144:+GPsKjWTniQgWC0xcdup7VC4XGxNa11jmBJ+0kpKsCYwvhFaz:+GXWu90xkuR4dxtBJ+tpKsFwvTaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641695, "uuid": "6c936a0c-4bf8-452e-818c-a55b8245d5d5", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641695, "uuid": "50c76a0c-c35e-4448-ba91-9f805c9accf7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641695, "uuid": "a4177608-c3cb-4238-ba7f-111c839e1601", "value": "20002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fef3e1-5ec0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639694280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694280, "uuid": "34bc778a-2cbe-4697-8b4c-da3ec08dbb9f", "comment": "Malware payload", "value": "1213d3dc3507ebadaf65ce7282c0b098", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694280, "uuid": "d68cd609-f749-4c3f-b998-c12100918212", "comment": "Malware payload", "value": "733b4d5174669caab2bbcc9bfe51606a13346b70af59fccea4f479d1fde7b5d7", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694280, "uuid": "2df0d81c-c622-429e-8aa8-05689693a412", "comment": "Malware payload", "value": "b7a97e9ed1660af79e7aca677704ef4928bc6c21", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694280, "uuid": "13bf0472-da89-4408-83ee-30d1f7526c8f", "comment": "Malware payload", "value": "972f09b62974c05ab2170b039ef83a0b1c577fd745a46a3ee09a8ac156e42fa6aae860b6cca1ab5cb1c532f8d45d6890", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694280, "uuid": "fb750e8b-97ed-4c3b-b1ff-e234aeff165d", "value": "T1BEB44A4AF76488F5E067C139C5538A8AD7B27C568B30D38B0255E77E6F332A15D3A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694280, "uuid": "297790c6-a08f-4824-968c-506c34487960", "value": "1ebdc7576cc45757ebcc5fd5b7f9f989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694280, "uuid": "2340ba93-3614-4b3a-a430-cd7b3cd7cafa", "value": "12288:1swdpZi4V5bpiRuHrHHofQrRAGlqpf20:1sw/ZVnb3cfcAAOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639694280, "uuid": "06db4e45-c5ad-43b3-93a4-e01b519d29f6", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639694280, "uuid": "1c92c3ab-e91d-4fae-bb1a-263c620523cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694280, "uuid": "7e9c86b8-68da-4cb2-888a-747cbd60e6e6", "value": "733b4d5174669caab2bbcc9bfe51606a13346b70af59fccea4f479d1fde7b5d7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad4227f-5e4f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639645760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645760, "uuid": "da58699b-ecb5-4dbc-afe8-2a9a1d32b816", "comment": "Malware payload (AgentTesla)", "value": "871ddb1ffa2e0a3b408d8a4c8ece2745", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645760, "uuid": "4b7e9a10-77cb-4740-825d-3350de8f0304", "comment": "Malware payload (AgentTesla)", "value": "75192544859f839f55c0e881ce3db98fad7d0da5c1fc7c4ab5650c36426a1350", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645760, "uuid": "bbe0882c-4b99-4cd8-a995-af953998dd4f", "comment": "Malware payload (AgentTesla)", "value": "66644a7fe852e637b4fe7351e3eda3d53f7cb173", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645760, "uuid": "2a9b83df-41fc-4cde-bdcb-b626665ff1ab", "comment": "Malware payload (AgentTesla)", "value": "53413c107665c79adb2d193ce5cea429dfc7fa23016557d592e6c46e410582cec62f74a536ce744ffc61e1f79766ce39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645760, "uuid": "bd1f90cc-26d8-4091-bea4-99a18eeb27ce", "value": "T1F1A4239953DF18CBFD192EFDD1E891B29C2B584B357AC3A72C740024BD65C14EBB8A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645760, "uuid": "5b551a6e-5347-4a61-8356-cad1c1c98b46", "value": "12288:yVbZBKwDF4gBUfwHOT43T93dsK/PqobrdyNk5R5:yVb7DlUfwAmFaobrQNkL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645760, "uuid": "2f27c4e3-067e-42d9-b48a-c7da4a4c05bb", "value": 490468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645760, "uuid": "2c0b4ca2-f26a-4d19-9a5c-8327b4f46b6d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645760, "uuid": "c6ec941e-e306-4d42-b855-7ca5744b38cd", "value": "InvoiceDDTN.201LGM4743.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294ced74-5e67-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639655770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655770, "uuid": "967624d2-bf34-4be1-ae79-d0b92136b49d", "comment": "Malware payload (RedLineStealer)", "value": "81f288c1202cbc4f84c7e7978d3612c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655770, "uuid": "c4c5d593-3801-4f8e-9b1d-787c7925dd15", "comment": "Malware payload (RedLineStealer)", "value": "752315a8cd369c0570ea34e3a94b56894cf273feb74dc06b8c3cbddd356a0cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655770, "uuid": "553482fa-faa0-4dcb-a5bb-16261e5e033f", "comment": "Malware payload (RedLineStealer)", "value": "249655127143c9aa10543f564d65e9fd0a6a7e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655770, "uuid": "97cba0cd-f1f4-4962-8767-3a5f7ba2724b", "comment": "Malware payload (RedLineStealer)", "value": "1ea7dd1c4c9148aae3f9fb88132cffefa290b65ccbc82b0bc8eae3da7ca54ce82c399f9ac514c65cc9f07717389275c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655770, "uuid": "2f9fe981-dea1-47fc-8863-0fc5900ad057", "value": "T194A4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655770, "uuid": "c59e71d4-5977-4537-9d58-44e995dc3c5f", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655770, "uuid": "9781b39e-89da-49c4-a09e-ccd957002a35", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639655770, "uuid": "dc8420b7-f5b1-40ed-8818-43980bcc4c86", "value": 455701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639655770, "uuid": "f39b7566-2057-42fb-a905-9bf8c43e84b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655770, "uuid": "94789e0b-849d-4391-bdc4-8e048fae615a", "value": "81f288c1202cbc4f84c7e7978d3612c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a71e311-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650243, "uuid": "dd290200-9a31-4b52-a474-a7691cd1383d", "comment": "Malware payload (Gafgyt)", "value": "ca0ed5ca425f33730e6cff756b70d520", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650243, "uuid": "5842de8f-967f-4ca7-848b-d1ba9ccea8e3", "comment": "Malware payload (Gafgyt)", "value": "7533df32dece2c7c9e71797460b02596a7a2233be9bdfbbb1690e525c1c358ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650243, "uuid": "254100ac-e4e9-49f4-be62-4560400916c7", "comment": "Malware payload (Gafgyt)", "value": "85b2f0ed7b2c143168a2b5ea1f2f1ec5eeb4b3a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650243, "uuid": "273603e6-a3a3-4131-9cbf-c9cf0cd8836b", "comment": "Malware payload (Gafgyt)", "value": "070eb455c201740d773dd5787154822101e50dedfd66da29e2bf22269583ed4eadd9a9ce4a37452c483e8581d76aafaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650243, "uuid": "5d7226d6-ffda-484f-854a-d39efcd4a372", "value": "T136A35CC2E743C6B3C8430AB6028FAB664932F57B4A6A8E45F32C7CB49F124D57515F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650243, "uuid": "d2e3c345-e935-4240-b278-11d2fd798a91", "value": "3072:5YZCnUPK1TTS5dwXSedFZ5hUExF6jB6m2eVo0iJZf0pu:5lnnBdFZ5hUo7m2eVoJJZf0pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650243, "uuid": "75ee1f56-f4d2-4a6a-b0ea-8d36c4603ea8", "value": 98720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650243, "uuid": "2b7989f5-f5e9-45ef-86e6-f545adab29a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650243, "uuid": "3ab2c9c1-c0e9-46fb-bc88-67f79ce215ba", "value": "ca0ed5ca425f33730e6cff756b70d520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a2d8f9-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639644899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644899, "uuid": "4adfff45-6281-429a-8c06-95593f34facf", "comment": "Malware payload (Formbook)", "value": "66d0afb38339002f2157a704f5ff7bd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644899, "uuid": "ade6c066-7528-4982-8abd-9d997375ebf4", "comment": "Malware payload (Formbook)", "value": "754d0c2b1277e1c89a1220f33cdb795900b882bfb5b0fc003b1880e55c4fbec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644899, "uuid": "4c3ea67f-0313-441b-82bc-07e0664375c6", "comment": "Malware payload (Formbook)", "value": "8d0253a21fac63fd22754294a557374bfab61313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644899, "uuid": "d7aef78d-99a0-4d4e-a76e-c7e4ac0e5506", "comment": "Malware payload (Formbook)", "value": "d08d3e8a797608bcccfb8f39feb2a250757eb3621000c7d5d07231857396e5d30be7ff3b9ee36c51d5f239b00250f042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644899, "uuid": "5cb9dfe4-79e3-4bfa-98d9-6cd0e13b5e04", "value": "T1743523007BDDC80ADBA94F770722B0602630FA5F6662D39EBD8C52DE747B3854191B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644899, "uuid": "3047c7a8-4889-49f5-94e1-006bf4694b15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644899, "uuid": "65d613db-fc33-4405-abb0-17941d73112b", "value": "24576:ZHLt3mKwgMv11z0p83692V0WDK8V31finopRKKCfkLGG:H3mKwgMv1m8qK0W76opRKzIGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644899, "uuid": "d74aa5a7-6d8f-4b2c-936c-690e75f5e261", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644899, "uuid": "30fd273b-2c50-4205-a057-1dd7eea00892", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644899, "uuid": "c29e644f-e16f-4225-a8d8-ca71a3bd2744", "value": "66d0afb38339002f2157a704f5ff7bd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6c2494-5ec2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639695018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695018, "uuid": "4c591a3e-74cd-4723-91b4-6341e7ac3da6", "comment": "Malware payload", "value": "0f9563735c6d5ef00ec93c67255b4aa5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695018, "uuid": "4b31400f-9b04-41c3-9d9d-1d913d2895bc", "comment": "Malware payload", "value": "75c011f9b3573845b4a39599d433530ee9915ad39c443a299f142b919df1ee82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695018, "uuid": "41a760d9-5222-4b74-87d5-eaa8f53a19ff", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639695018, "uuid": "444ba3c1-f360-4135-8301-bd3c8475cb63", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639695018, "uuid": "dd900840-18b6-4f3a-b4bb-80857dde1cdc", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639695018, "uuid": "41dc3cdb-d05b-4366-b52a-f6d7123a99ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639695018, "uuid": "ac23a0a5-e6db-4a41-a5ec-bb8a617dc171", "value": "Address verification process.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f5ad09-5e7e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639665613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665613, "uuid": "717e60fa-66b6-4593-a447-c060aea03760", "comment": "Malware payload (Quakbot)", "value": "f6fb7a8f6c2c5f45385d93bf489296b2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665613, "uuid": "128cfb90-336d-41b6-9e45-dc2c434628aa", "comment": "Malware payload (Quakbot)", "value": "76bac667effce42b08ca228acbeb9d3c4671c3e53c8cbb8df99d415037b2bc55", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665613, "uuid": "b439aa0b-1c00-493e-88be-2f089d7a246a", "comment": "Malware payload (Quakbot)", "value": "adc7dda7e8add9c015629810aabf6eaf970ce7d7", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665613, "uuid": "655a31d3-b18d-48af-8689-186362be9118", "comment": "Malware payload (Quakbot)", "value": "e9de41b845898a6b4dd2fa37cfda9a41820749878136a37cdd6a80415f4f7d146bd032f298cc556637156310be28a8dc", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665613, "uuid": "8dbb4e92-a7f2-4eee-bdd9-3f4b6cc1de4b", "value": "T11FD39D47ED090A43D8648BB8FD0B1D3CBB2D192DA9E123FD14260DCB6EA52675D9F04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665613, "uuid": "688e83ce-30eb-424c-afde-7daa64863dd8", "value": "3072:GGowZK/FGOztQNL0cBLJUq1dJZvPpz7+fp7KG:swQ/0OzSNLJNUydJZvPZC1KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639665613, "uuid": "468bb193-4602-4024-a124-15f2bb18e3a0", "value": 138856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639665613, "uuid": "ee3ab31a-f881-42d8-862b-6719658d1e67", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665613, "uuid": "77b29cb3-e910-4d95-8c0e-c2b5d6d95863", "value": "UT-2086720438.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1db5394-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639642685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642685, "uuid": "ecf62f4d-466e-4098-9d25-07d5f819888d", "comment": "Malware payload (Formbook)", "value": "32f19f5d8d3311c70b173a8c270b125a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642685, "uuid": "9eeeef88-31dd-4002-8dc7-496f9903666f", "comment": "Malware payload (Formbook)", "value": "76d706eb9fd6535561780e9b27911e8998333c700d258072003d06e70cd4db52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642685, "uuid": "64f0644c-0072-461c-954c-cacf5b7cdb37", "comment": "Malware payload (Formbook)", "value": "007b57eab44d3be9eec05e46cc48d7fec61bdb7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642685, "uuid": "81e55a60-508c-4955-ae8f-ce67670b564c", "comment": "Malware payload (Formbook)", "value": "b83210288e014772f96d03767f7cc4dcd2d83bb5f192dd60d9e56808a6ae1c0377b76c66cb3faa083811a61c1c8c0e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642685, "uuid": "d928cf66-c349-4a71-83bc-dd51455d67f9", "value": "T1E69423237ED48427E752073106BF972DEF7EC29929524C530B252A6B38A39F766C24F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642685, "uuid": "bd7664be-4374-41fa-ad66-54b69357b537", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642685, "uuid": "c9341d86-21aa-4da3-bd2e-9abbb00dcacd", "value": "12288:/vzcyq/6XkxSG+ZAyYi5xn0WnZZiQRyp46:3zcyqSdzYiL7iQRypB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642685, "uuid": "aa086d8b-884d-47b3-91a3-9330cca58e02", "value": 433909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642685, "uuid": "ce54587b-f1ba-4833-abd9-8016d73029d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642685, "uuid": "d9df8607-4280-4efe-8461-83fe37daa439", "value": "Sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b5bcbc-5e87-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639669637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669637, "uuid": "83bb4ab6-c23a-452d-8248-998017045f82", "comment": "Malware payload (DCRat)", "value": "80ae09068490ffc783d75026b345f8db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669637, "uuid": "12b56de0-a011-45e7-b34d-c8aaadcc29a3", "comment": "Malware payload (DCRat)", "value": "76fbd6dbf2d6ff05e54a6a0e7eb8dce158d94a468e80e1c12844e2af2e951d0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669637, "uuid": "50797964-da55-4e73-95f4-a42decd45800", "comment": "Malware payload (DCRat)", "value": "9678b2ac5b6bbf002b64de2c224c03c566c576f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669637, "uuid": "45379a27-c0ab-46e0-afff-6601f9a28258", "comment": "Malware payload (DCRat)", "value": "36857b84c588a985198d41ba65ce07a5d754156240cc54c338676fc1385cbcd2010ec965e04ba79bf29a2979c4b94c2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669637, "uuid": "66d73f4a-9fa4-4b1a-85b5-5c07a035f258", "value": "T1DD956BDFE7308D6EFD80023D5A8D5E679A475E50815BF2CAD52BF2326BB9B680C11432", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669637, "uuid": "0922ad66-03a2-4b7e-8522-0bdb71ee51a1", "value": "bfe0b60630c0b253d72c98f2b93f728c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669637, "uuid": "3031f879-28b3-435e-a3cf-7ad2f6301c36", "value": "49152:kACilDsS3I95pp1zFMknZPXYlXSjzBpbgITKBkBg0Fl5WwvBC+aamJ33Kg:Cp8VJ0FzxkamJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639669637, "uuid": "7a95f1b5-0d94-45b3-a41b-e6d9aa88508b", "value": 2039728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639669637, "uuid": "09523af9-500a-4449-afa0-1747dafed6c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669637, "uuid": "067d1e8e-1b8a-424c-8413-50b66c93a491", "value": "80ae09068490ffc783d75026b345f8db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ddaa72-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639644816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644816, "uuid": "56de26fb-7353-4cb8-90d2-5e6b322bd6db", "comment": "Malware payload", "value": "3af4e1834fd56ba2695222ca62e24c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644816, "uuid": "f02a0a3b-70c4-4c45-97c9-947b7e2a26b1", "comment": "Malware payload", "value": "77887f838da82288ad30f603090b546173397d31f225740a0716207530f9b7ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644816, "uuid": "fadaf741-11c3-4912-8148-ff33fbdcc8d0", "comment": "Malware payload", "value": "a6a002ef9a6c1ccaef1e43d81683ca6c3b9c959d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644816, "uuid": "22cdb6ca-4023-4d1e-ba3d-823ecd0265ec", "comment": "Malware payload", "value": "87571086f6cf15e5df8fa2c64150a4fc4354b2203c22e1b4e963328347c5d02e0dae93da8a460b08ad4316b801a59ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644816, "uuid": "cf270b5d-908b-4e3e-9eab-644f8f3b6d97", "value": "T1CE4533666948C07EEBB220F12DBD66E1E05384CA74EDC8C2FF3B50D4441A6C29ECD768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644816, "uuid": "28511ab6-94c4-493a-9cd2-b1825486456c", "value": "24576:0yEG7Sa7r5EGFht1qsq79w9TS3Y+/CNP48W7K9:0y37D79N0B+E7K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644816, "uuid": "4d34bc22-b21c-4033-b277-e6ea5b03c646", "value": 1211207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644816, "uuid": "fc5d4451-1f23-4120-a5e3-1d3210c989bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644816, "uuid": "a979f1af-a6c9-4965-9c62-03823ed5ae05", "value": "3af4e1834fd56ba2695222ca62e24c7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f86829b-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639646466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646466, "uuid": "2c5e7342-c8b0-4e17-8899-fe804801221a", "comment": "Malware payload (AveMariaRAT)", "value": "959e47481e10d7c00070be79dca6976b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646466, "uuid": "046ab728-bce8-4c64-90dc-7e3b5000024f", "comment": "Malware payload (AveMariaRAT)", "value": "77926072f88d93ef8a5540eeffa9a370f836d3a58de75ebe550b4ed71051863a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646466, "uuid": "81e8437b-90c2-4059-a093-7af0839f7643", "comment": "Malware payload (AveMariaRAT)", "value": "4c6fc59e01eb453e92de0451d0d4d8c22a21a72f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646466, "uuid": "4de7c696-2a20-4994-a5b4-a1375a5cfe1f", "comment": "Malware payload (AveMariaRAT)", "value": "ba3a79f672ae8376093b8499b470cc81c6aea9c681a7b990e04b529a39f0fc0d59d69f24961ce681853e0e731e35c1a9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646466, "uuid": "6d32ebbb-8673-4810-88e7-7785af5e8917", "value": "T1D0B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646466, "uuid": "c4d04a87-eada-47a5-a141-fe18e60984af", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646466, "uuid": "9b041eed-4f05-4c00-bf8d-d7656fbecdcf", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01/:K1VmhaH8EFvW+0OVE0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646466, "uuid": "b95b3714-cce9-4311-9ec9-2e70280c1187", "value": 112338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646466, "uuid": "2a488a2f-a206-4832-ad5a-d88019f73ccc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646466, "uuid": "0e060804-ec7e-496d-9bc2-74722d66e722", "value": "959e47481e10d7c00070be79dca6976b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefe0402-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639642734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642734, "uuid": "0b513f1b-d82e-4d46-a687-a2baac498562", "comment": "Malware payload (Vjw0rm)", "value": "085113cb8916d7a3a31640f56e1cf857", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642734, "uuid": "9419cba4-661c-4885-8b64-7ac10ba9c8b2", "comment": "Malware payload (Vjw0rm)", "value": "77fb77cd4b1780a5d28c3aac47572f51c7e6ca4c729a21b2ce19810b9933a382", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642734, "uuid": "9ea56b28-3803-4e60-a9e9-49613a58a4bf", "comment": "Malware payload (Vjw0rm)", "value": "32c0250d89f8c632fd2df14e056b74826a258752", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642734, "uuid": "52e34108-e1ad-423c-9901-b1457224f532", "comment": "Malware payload (Vjw0rm)", "value": "80a19647518235f922663a68aa47b59a4186de446a2df9d392d0b5da8cd0d1689af49e6954bcf57a4f9abbd0356a7d4a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642734, "uuid": "1a67ca3e-dbda-43e2-83ce-8eba181e1db9", "value": "T1F4F4AE60A7C466BAAE8919E7D476061F16F65317F10160CCF6917A233BFEFC8421BD0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642734, "uuid": "15a08f08-ab11-4779-be3a-909996dff43f", "value": "6144:Dg1OEuAXg3XfHTTTzedXkJdcuaxgINQYCzC2dTHUT/NL+y8W/tyaRuRY/uPPg6BH:eqWs6kPg6B1Q96RaKZyQ3896L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642734, "uuid": "a1ebfc51-2cc7-4018-8f2a-c5d0037c6b85", "value": 747204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642734, "uuid": "c06f3db1-e6f2-48bf-acf3-259ed056f7cf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642734, "uuid": "0b881821-78ee-4081-a520-b4c4106bd746", "value": "PAYMENT SLIP.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1b7f5c-5e7e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639665979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665979, "uuid": "e6cdfc75-61c5-48cf-b64e-45b1695bdba6", "comment": "Malware payload (RedLineStealer)", "value": "f30a0a88411f575cf8e60d75c52b90a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665979, "uuid": "37b8d9ab-670f-4dfb-972f-ce768fecb248", "comment": "Malware payload (RedLineStealer)", "value": "793c0e265a52baeed95acaf87485cbd4715c8dab77e36ccc6d17a8197c7ec2a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665979, "uuid": "e3b30bfb-3c3b-4615-9766-7ba89c3bcc49", "comment": "Malware payload (RedLineStealer)", "value": "5a01a971fbc1bb238c1f742485c2087a2db23842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665979, "uuid": "01a5f45d-041f-46d7-9396-854e088bef35", "comment": "Malware payload (RedLineStealer)", "value": "48c1edd62630817824b2295015530481faef978ed3c9d049525aaf7a237a8ca705504d6eb583932ac955cb66d9bd7c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665979, "uuid": "ea87cd13-198c-464f-98d6-1be88b4b3e8c", "value": "T151A4BF00E7A1D034F6B716F859B6936DB93E7DA16B2490CF13D12AEA1A346E1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665979, "uuid": "f681c1bd-625b-4d44-a3f1-5c0faad559e7", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665979, "uuid": "300810c2-6e87-41f0-b9d6-6f52e06f8dda", "value": "6144:jzdQcuKrRosANpXrZMJ2jIT2LfiXhJf1tSdf90LblwNP3zlUR5/+6lQKR:tQ70i9MJ+LfiDdER2LblUP3JUR5/rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639665979, "uuid": "87d7a8d4-e76c-49ee-87da-ae844de2c8f6", "value": 456214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639665979, "uuid": "3c5e7349-f02f-47aa-8582-0319399ae516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665979, "uuid": "e5a349a1-b74b-4404-891b-650fa66f4b28", "value": "f30a0a88411f575cf8e60d75c52b90a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada4d4c6-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639646544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646544, "uuid": "02ce92e1-055a-40e8-bbab-19a92518fbb7", "comment": "Malware payload", "value": "c03b2b8302fd9c5ca1bf10aeebe506c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646544, "uuid": "69beb22c-c971-4c3b-93de-ce560d60a33c", "comment": "Malware payload", "value": "79566bb3c1421220ae07285c74add2c31f5bb79c91cd5c7cea90e98edbe13c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646544, "uuid": "be7138ef-a33d-4855-8c2c-181c6e3db8ba", "comment": "Malware payload", "value": "a92789b5fcc9802a910ba3973ebcb26e1273c809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646544, "uuid": "a0af9c79-0365-4dc4-ab97-13620b98b5ab", "comment": "Malware payload", "value": "56cbad2272c3b5281e872c42371c6eecaf6785b3f6d9675a7edff9145e2152cf02f43447e9d6c3141e95648e8ff1cf05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646544, "uuid": "f80938e9-991e-4550-b624-f6e56b2981ac", "value": "T106459F319561E01BD98741F6FBAF8AACE44E5C40874811D76A38A9BB01391F0EEF7E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646544, "uuid": "863767ff-d329-4efe-8681-031173abd2a9", "value": "5094bd6be83536db48f1eec7300c4330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646544, "uuid": "ddd2c933-e804-4adc-b686-11bf67143cd8", "value": "6144:PerZbU7CP5hDeK1GoFpiTB4iSP2Re8J2xiSP2Re8J2xiSP2Re8J2xiSP2Re8J2:m5U7CPHik7piTBFk8k8k8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646544, "uuid": "ee425ed2-2d77-49b2-8506-cc3aa35e8d73", "value": 1168021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646544, "uuid": "601e058a-82d0-4ccb-8fbd-51078df88002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646544, "uuid": "3b43b95c-561e-4d92-8e0f-b545b1bbb676", "value": "c03b2b8302fd9c5ca1bf10aeebe506c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10caf866-5e06-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639614068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614068, "uuid": "544f8b2f-31fd-4a74-9cc0-c9436c66927e", "comment": "Malware payload (RedLineStealer)", "value": "22ccf91eee2c0bd1279b7c4ab0c4ac76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614068, "uuid": "d2433244-4da3-4ad0-ae23-2411356d10b1", "comment": "Malware payload (RedLineStealer)", "value": "7a345bdaacb572be9699cccdfe7adfbaa1add6f7f4aa2552b8bd91f9c417398e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614068, "uuid": "2bdb6913-f999-4ebd-902e-47b7c8843002", "comment": "Malware payload (RedLineStealer)", "value": "db93765de6e64c6ba81052de8aab04b0847dd969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614068, "uuid": "6b4cff4a-fd5e-4ff3-99b0-d182de5e648a", "comment": "Malware payload (RedLineStealer)", "value": "aafe177509d1a046642375598a6daa9b7c0aca5ba75798b1a2d9099a5a3a648d0e7f4017033ac55221d220262d2e7648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614068, "uuid": "c8771f8e-090a-4386-93f5-3505ffec97fd", "value": "T134F39C01B9D2D872C4A60A708860CBE51EBFFC715630455B7BA83BAE6F723C09A75753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614068, "uuid": "b8f66cc6-ca9a-4785-bfed-836633660245", "value": "2bb4e5a139a2a29d6e02a63c04eada73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614068, "uuid": "24f224c3-2d6a-4c50-b7e5-91d2bc6480a4", "value": "3072:0sTLWNOKXRXKwG/QpYaD7sbHX+Ika/hsNb:0sTLcRXKwItaMb3LCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639614068, "uuid": "c2187f8d-e756-4ef2-94f8-393628b007b5", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639614068, "uuid": "4ba975c3-7d0d-4cfc-bc62-373bb2eb3a81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614068, "uuid": "279c06c5-da21-49a3-a9c5-fd89362f2b0d", "value": "22ccf91eee2c0bd1279b7c4ab0c4ac76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e4da51-5e1c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639623893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623893, "uuid": "bb47e618-f263-4902-8a69-a89ecf0ce160", "comment": "Malware payload (Mirai)", "value": "98082933fc7432d88795b4ec3db33d13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623893, "uuid": "bb11b3d4-cd51-4d03-aa09-38912b049043", "comment": "Malware payload (Mirai)", "value": "7a4ca57ac85c17092b07b91da7449f6b53fe0a9777f7f167d529573a06ddad61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623893, "uuid": "ae725e9b-81d7-4e96-87d2-18c2f4d81653", "comment": "Malware payload (Mirai)", "value": "b66fddaa297b4ec94947570fbabd373d7e12ec78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623893, "uuid": "71cd6c1a-4f01-4592-ace1-8e0806b6c0e6", "comment": "Malware payload (Mirai)", "value": "68ef7d2ea22ecb680d25bec4ed08494ba3c8342dd5e8d6c3e0ed588c47abd25993c01149643b4b52b123370542f5d31d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623893, "uuid": "dcf2e898-9b7d-46dd-9e5b-0e5a1c445647", "value": "T16AF35D46FA414B13C4D6177ABAAF428933229B94D3DB730799285FB43F87A5F0D13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623893, "uuid": "ac358c79-21be-4f83-930e-249e7854234e", "value": "3072:/3j9XBDP2+p5oKemWoaaxDfB0SgOn5kSiPJM/9PaIMLS1ni:/31BDP2+p3eboaaxDfBHgKkSiBM/9yIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639623893, "uuid": "49574c82-5f28-44ba-8b4a-dc2e4fefd32c", "value": 157854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639623893, "uuid": "2b231a6c-a222-4be5-b5a6-fa6c8be4318e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623893, "uuid": "32a496b0-a60d-4f6a-bf2b-6fae1b60797b", "value": "98082933fc7432d88795b4ec3db33d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dddfee-5e75-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639661798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661798, "uuid": "dad57972-73b5-49b3-9924-5bebe420b41c", "comment": "Malware payload (RedLineStealer)", "value": "1e0d8009a6f43fd5a4ecb80954b14101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661798, "uuid": "48184419-8a4e-4e29-b7fa-38a00df63464", "comment": "Malware payload (RedLineStealer)", "value": "7b74f179752f8257f971573bf2d76abbd79d377cc11d3d42a4869910dcdcc38d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661798, "uuid": "8be8f34c-1fb5-483e-b38c-290f9f90c063", "comment": "Malware payload (RedLineStealer)", "value": "23799bcceddca9208e106a4750b3771ca8f58fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661798, "uuid": "a5963eb2-a91a-4c4d-82d3-58f14e60808f", "comment": "Malware payload (RedLineStealer)", "value": "94cbda959384b3dca781b5a49b0d2c8ecc676b1107593e6ca24f1fdea2169639518cbbf361f153fa4c98b1c30fa86c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661798, "uuid": "7bf30667-a87d-4574-aa8f-3387396b43f6", "value": "T13BA4BF00E7A1D034F6B716F859B6936DB93E7DA16B2490CF13D12AEA1A346E1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661798, "uuid": "02e21883-f012-4576-a34e-1ee336a96b60", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661798, "uuid": "a38a0b3d-b212-4f01-9bea-740e49b4cd93", "value": "6144:jzdQcuKrRosANpXrZMJ2jIT2LfiXhJf1tSdf90LblwNP3zlUR5/+6lQKR:tQ70i9MJ+LfiDdER2LblUP3JUR5/rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639661798, "uuid": "042a6ef6-cb95-4fce-8ad0-6c088e04f0cf", "value": 456236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639661798, "uuid": "8a9e18da-b3c7-4ade-8c01-bb44c327dcd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661798, "uuid": "e4918efc-b345-41bd-b99d-7e4aff34d179", "value": "1e0d8009a6f43fd5a4ecb80954b14101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9619ab71-5ea9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639684300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684300, "uuid": "8f6ec21e-d7c4-4095-a8ac-ce66c7f0e1d4", "comment": "Malware payload (RedLineStealer)", "value": "8e022669f90154f129dae4edd08f80e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684300, "uuid": "324bee19-e4e3-4aeb-b64b-5876e6b2fc93", "comment": "Malware payload (RedLineStealer)", "value": "7ba3db48923845b9998da9279df811d3df4f74297b6d8b2ef06ac984c9fd73eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684300, "uuid": "362eed45-2f94-422a-a387-62930da587d5", "comment": "Malware payload (RedLineStealer)", "value": "dcd61794c9dfd747553359488ccca33f89aa587e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684300, "uuid": "dacca4e4-6f72-4ba5-ae38-959a3b4d37ea", "comment": "Malware payload (RedLineStealer)", "value": "940dac056b1c55a2828370af89ec28826479b7130c13abeee2d5ed1c337964848f7c3b0c632b59d77a09b31c3b68050c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684300, "uuid": "b4dea6d5-b0fa-42b4-b72e-14f8751225cc", "value": "T10DA4CF10F7A0C035F2B312F95AB6A36DBA2E3EA1672450CF13D56AEA56346D0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684300, "uuid": "2b418a7f-8309-4631-a8b1-6ba1a95102ed", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684300, "uuid": "7112fe04-a8ce-4583-a5b7-05400c931409", "value": "6144:dPSZvSSXkjqsf7AOr5gBCVJCjremNXkIV0/n+Vto4XS6QwY:cSSX9sfsYyYVJaemNXkIVOn+Vttow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684300, "uuid": "9125702f-4410-46dd-8524-a535f109df33", "value": 455216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684300, "uuid": "90640f7c-741a-4f9b-b8b4-d6e66b0af239", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684300, "uuid": "4f966483-11e3-4596-b908-dc4159709c0e", "value": "8e022669f90154f129dae4edd08f80e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d6c79f-5e44-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639640731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640731, "uuid": "ebe6be4f-8ee4-47e0-b23e-98057706275e", "comment": "Malware payload (RedLineStealer)", "value": "33d78ea778d54d344a6c762a3372112f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640731, "uuid": "ef4bc098-c909-489b-bbdb-bc627be876c8", "comment": "Malware payload (RedLineStealer)", "value": "7c8b300a4da391bae99137772646f27ae07ac88b0bf22b2343bc6cf30d31943d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640731, "uuid": "c7ab83cd-7562-493d-8b21-fe07b240cea5", "comment": "Malware payload (RedLineStealer)", "value": "0dcc03b8ea19effb136a9b1fbbf012f8dc21ba92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639640731, "uuid": "3a162fd1-41ed-4289-9f0d-9a4f388c67cf", "comment": "Malware payload (RedLineStealer)", "value": "522a89f8644b000069ee4c8ae7134eb5f84e486ed46b439669db81bb9c0c0709a395fe898892b5a7d6507ee78c0e72f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640731, "uuid": "6b28f75c-e077-4c7a-aa4d-a1fff2ba4f12", "value": "T1F6A4CF00E6A2D035F1B312F859B5936CA93F7EA26B2850CF13D52AEA56746E0ED71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640731, "uuid": "ec5b41c8-9c0d-4a54-8188-2e63f890bcb6", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640731, "uuid": "d9870c80-f933-4b9b-a735-46e179c970df", "value": "12288:RieYn2u+Pwu62hWGnSz3vEUBR5Iemb+yE:RJu+Pwu9/Sggqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639640731, "uuid": "ebfd158d-454f-4ac6-b7c2-67d3ad5caa55", "value": 456225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639640731, "uuid": "49430079-13c7-4f34-8896-39bf61671724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639640731, "uuid": "3d0f0d1f-4c25-4adb-aeef-3a9c5b9f42fc", "value": "33d78ea778d54d344a6c762a3372112f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee226bb-5e58-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639649472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649472, "uuid": "4d120f36-5a22-40a2-b290-48fc3475708e", "comment": "Malware payload (Formbook)", "value": "b85c005de5b04c0ba376f72cc932f26b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649472, "uuid": "35bfe6db-953c-4bf3-862e-d379145fc532", "comment": "Malware payload (Formbook)", "value": "7dfac85dbd9ce80d656f5cd2b657705975023c370a3f9ddd4fd63cb244862c40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649472, "uuid": "a322299f-1678-4cf3-b810-532a33d7cb13", "comment": "Malware payload (Formbook)", "value": "04441b6a52530284bdeaa3c4ac4504d71c14101c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649472, "uuid": "b0207aaf-d662-4739-b637-1ad6b859ed02", "comment": "Malware payload (Formbook)", "value": "facfdf78e5c3a9b457ac7ca25f24b1462fdff19935b5f149c00b1832a5569829b2c2e0ef7594590c5572eaee137a0a6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649472, "uuid": "87705021-8af0-40d3-9a2a-95479ced1a1d", "value": "T18D156D3CAFEFF90FC0E368F467A6D55DC85915680D290D23E76B683860B46EA739D240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649472, "uuid": "a534c2ca-84bf-4c20-8d2e-6135a787ce38", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649472, "uuid": "2a5f8241-a9ba-4be6-8328-d06ae650eb0b", "value": "12288:ufJ8iuXxfprfmx1Vyxgyh0WPkpt0wKPx7j2gWLYhw2mJRGUlX2TFsiWWEd5t:aJ8iufrOcxgR2WShjxthZHUlX2RuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649472, "uuid": "68629024-c46e-4d63-8bc1-be38e78e2393", "value": 920383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649472, "uuid": "613143bb-f06d-4eee-9576-e4891be0a7c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649472, "uuid": "0c26222b-ad92-404f-a199-e03a4a1b901d", "value": "b85c005de5b04c0ba376f72cc932f26b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa92cc69-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639644955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644955, "uuid": "f81ae935-4800-4b90-9cab-08185fd1627a", "comment": "Malware payload", "value": "98a443ce3c2538fe1b9839cf65bd0407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644955, "uuid": "a01434da-7faf-4d2b-9181-417485912483", "comment": "Malware payload", "value": "7e7fd605de6d3d6aa4dc413baa57e8045470e809cf5fd61b80b4b3c51ee39ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644955, "uuid": "c121ca7f-bfaf-44b8-bc0f-a6ecd35eccc6", "comment": "Malware payload", "value": "ce4ac716712fe673c77e2863f395c3dd7951c624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644955, "uuid": "925c7be0-bd85-4f0c-93b8-7ea4af5ca908", "comment": "Malware payload", "value": "6303f992f195389c94fb21e74e03cbeb99847e1b94892d7b8f2c61ed140de7b3cc22da95dc68fac28e8ce0c6e45ba003", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644955, "uuid": "891edb35-c309-48be-bd6b-8e02783f6ed7", "value": "T1585633B270D39432E57790B0C9766364DD75D978B2819A2FBB912B397431BCB932320B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644955, "uuid": "2c6fe5c4-265d-4052-924d-8f3f7ae5cd37", "value": "9d1f0da408c33eebb70b9bfa17b7fddc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644955, "uuid": "5284dd34-3399-48b1-9750-c642c8aa5307", "value": "196608:Q0K98VZ0nQqJ46Rn45RbHQGF9zoFJAEUAVqBauoNt:A98bEQqMRzQi9zYJARA47oNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644955, "uuid": "2db265f9-96d5-477a-8b7e-fa052e033ca1", "value": 6434804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644955, "uuid": "81b17956-059f-4c61-8831-44ff6d6561e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644955, "uuid": "55827e91-1a69-4749-aa04-7c1f0005b8f7", "value": "98a443ce3c2538fe1b9839cf65bd0407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b66491c-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639683718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683718, "uuid": "cbab5ee1-329a-4dcd-8640-9895c72467f8", "comment": "Malware payload (Mirai)", "value": "76d64207722072e6c8ec0b1aa6f523f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683718, "uuid": "ee215627-5210-4b4b-9320-8f0e37afab37", "comment": "Malware payload (Mirai)", "value": "7ef917ae4c33d8aa634479bd8409035c6b5708aeb86d59d158ebfc90c2157c66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683718, "uuid": "53e0c97c-12db-4978-aa22-8fe43be0703c", "comment": "Malware payload (Mirai)", "value": "eef8c4d1295d2d889a4a5fd3abc1d9a101b7869d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683718, "uuid": "5cc3096a-05f7-4fb5-b935-8511e8229fc3", "comment": "Malware payload (Mirai)", "value": "c658033e808592b637dac32079e57975fcb875404b4d83c67a0708c066506694b23348f2e327b9991b81b7203e48cd50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683718, "uuid": "fb8edd83-127a-43dd-a9bd-39c689806ec7", "value": "T10A13F756B882962BC2D4137AF6AE5A8D332073E9D2CF72279D215B113BC911F0D77E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683718, "uuid": "4b1a540c-06c5-4168-a1a2-fef2d45a7961", "value": "768:6hOp+Lz73Z4HbblF4Z1cwUl3VYwjXpGYF31uZV1qKQTxQD0T7Q2ecNSwY:PO73sbSajrnF31uL1zQT6D0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683718, "uuid": "fc93332d-2f6a-4ca1-8d87-4e3a4b61194e", "value": 45016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683718, "uuid": "83679636-60db-410b-8345-20267f3acfb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683718, "uuid": "efd1f40c-8f04-4bda-b491-956d822b535f", "value": "76d64207722072e6c8ec0b1aa6f523f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f93adc-5e49-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adwind)", "timestamp": 1639642887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642887, "uuid": "84cc6803-830b-4d4a-b67e-332c05f182d8", "comment": "Malware payload (Adwind)", "value": "9c1a2f41fe43a30d20283faf269a3631", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642887, "uuid": "c8e620d0-2acf-4c46-adf2-30f1f0c4d584", "comment": "Malware payload (Adwind)", "value": "7f136e1cd060898875fff2b2ceeba46e849576b33f1cc559828d102fdc29c86a", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642887, "uuid": "dd29a692-f4a3-4768-aefa-6ae054671712", "comment": "Malware payload (Adwind)", "value": "fd4cc11482721298abd64a8fd0c0634f689f4636", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642887, "uuid": "55d9a243-e7b2-4639-8462-c600e0914c48", "comment": "Malware payload (Adwind)", "value": "299173ea54654f01a9f2379292257869e17fc969edbd60c843edadf05cd38a3e412f948e314f411f84038512e5b55bc0", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642887, "uuid": "dd54d1c1-aca0-4d03-9c62-02695f5a5adb", "value": "T147D423842ACD2A2708995CAB80A373655665F5333B4BDAC0B4C58CF007F9D466C96EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642887, "uuid": "354463ad-9784-48da-bff0-7692e2ec3070", "value": "12288:SQwpq9OPf0y7byU+bQTW2Ldiv53D2KizK4SR5Pzv2/7PpSAkaRnHeMq+EJ+owbIv:SQWey7WnbQtBaB2KNnT2zkaRn+Mq+0+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642887, "uuid": "c4526735-38af-4064-a670-511f01831e24", "value": 647744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642887, "uuid": "78e45278-9872-4d11-a67e-f49e4b57848d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642887, "uuid": "1e30ab82-b6ca-4c15-95f7-268e66e10f6e", "value": "L2992-PR03660.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67187125-5e52-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639646855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646855, "uuid": "6480e1d0-2b15-4d29-9803-76ada7561ef3", "comment": "Malware payload (Formbook)", "value": "ff59ad3b72e60b61f36287a4f11b36c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646855, "uuid": "bff8f007-d301-4dd2-b397-4e1735c7be24", "comment": "Malware payload (Formbook)", "value": "7f4888239060a411b5a521d19e88bb1158189634f764383c2c2fc0bb84e01169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646855, "uuid": "f9ba44b5-0ffe-493e-a487-bbc4d2698aa7", "comment": "Malware payload (Formbook)", "value": "0235abecb63572501c39156bae7c3fa5dd451309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646855, "uuid": "bb90eff5-58dc-42c1-af38-f74d4b6843b3", "comment": "Malware payload (Formbook)", "value": "c1230c03981aa71d49daf4e45f4b746069cc639e4d28428db097b2e0dff1381ee679a24f0963c94081cb0eab5b14085d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646855, "uuid": "533e7f22-25bd-4c62-84dc-c2dcecfb68d1", "value": "T1F7A401003AB89B07D5BC43FD0865214413F291376547FB89BFD6B1EF1AA3B92895289B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646855, "uuid": "78315691-1127-458a-b7b0-4c317a4eb84f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646855, "uuid": "97a3ab40-1e2b-4a8f-b173-672cda463944", "value": "12288:wVxuHoA5QfJucv5ldsRNHEgfKDaaz/S+nz5jaamWauSK3:sYoA5G7vPdsRugfKWazZnzdZSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646855, "uuid": "8f8d8f00-11a7-44e5-8bcd-a502057effdd", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646855, "uuid": "cf7ec0be-4794-4680-8e99-aafb4595c0f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646855, "uuid": "65e88922-f459-4c64-8ebb-cefdb0149ec8", "value": "ff59ad3b72e60b61f36287a4f11b36c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421e5f37-5e59-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639649799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649799, "uuid": "01096540-cafa-4f95-83b1-18af00ba0bd8", "comment": "Malware payload (Formbook)", "value": "7822fb98e269ac46bec826639a713c07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649799, "uuid": "8bf78299-8fd3-4007-9e43-e038eb83838c", "comment": "Malware payload (Formbook)", "value": "7fe0a610fcbcddb5d954efaf23d8d6c9eccf24b841b35ffa2956f4370ec106a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649799, "uuid": "fadf1551-d1fd-49fc-bdf0-0a4c0ee6a662", "comment": "Malware payload (Formbook)", "value": "6ca2d880f732e3ba28efe8e5ac0f2a3c505e12a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649799, "uuid": "06241f85-35bd-406f-ba62-d68fe62c1300", "comment": "Malware payload (Formbook)", "value": "01a6e98c7901cf59197e25973547ae21067dcf79fb1cfd3053be9079964163cd5f533dd2b84386c6815f4e16865a1d00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649799, "uuid": "2af4ddfb-30c1-4e12-acd3-073cd07b5f89", "value": "T1C2A423C76DC5B87BDA3165F408E62A7BE132C174973246674F8D8B8B3E31892E94C543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649799, "uuid": "7ef21d09-114f-4e79-be81-1fb89992400e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649799, "uuid": "0ffebaa2-b91c-4067-9393-618ead41172f", "value": "12288:A78YLz7BtC5jxaC/6RsvAiW2n2blozuDqpY+bTzP6p:oJLuvh/6AAUPKDqpYgzP6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649799, "uuid": "314924a6-6ec6-40e0-b3be-b83c9ffbe9cd", "value": 485210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649799, "uuid": "6a81918f-a10e-4218-9103-94db2e4c393c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649799, "uuid": "cfed6c24-4e51-4796-b618-83e63f2cb5d8", "value": "7822fb98e269ac46bec826639a713c07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04df2ebd-5e4f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639645401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645401, "uuid": "fb6cb349-abd6-487f-918d-a6d41ab52c36", "comment": "Malware payload (Formbook)", "value": "458bf58868999464dfd6da55f423990c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645401, "uuid": "a9110e1f-9335-4eb0-a6e7-d400fac702c4", "comment": "Malware payload (Formbook)", "value": "8222a77425ba4d977f585c49714d452b943f698bd0a1b188a05992e2042c5c58", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645401, "uuid": "4e28c3e3-895d-482c-b8a8-b781cf951fdc", "comment": "Malware payload (Formbook)", "value": "f53d456e2e335ed8f23d319a8197964921150d7e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645401, "uuid": "4c385804-c6e6-4284-83a6-692e50257a6d", "comment": "Malware payload (Formbook)", "value": "18b529afcbacbc3daf157c299b0c793822abe79a972fb777cc9e4989f0996057bb777826976f0e2a3498875ef9fde182", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645401, "uuid": "0c1d8dcd-55bb-4520-a0f8-82b534e6dc09", "value": "T197D42312E7921C1F6A0F34570D3E202169FF269BDB996251C0D4D8BD05F6286DB2FE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645401, "uuid": "8d2d1193-7e9f-4ed4-952f-672e4c6f98b6", "value": "12288:+3SVvqM6jL4lwGPh6oL6ifAa8w3ookNXSY0zaBKnXxOFcWp:t6LTih6oLZfAa5/k94GI07p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645401, "uuid": "ab1d64c5-2ee2-4158-ba39-5b2472e21a8b", "value": 648625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645401, "uuid": "0501d2fd-d936-4a9c-abbc-d226d3a8c81d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645401, "uuid": "ed4b0e0d-5380-4e7e-87a3-bdbad39c7c2c", "value": "E-Invoice No 11073490.eml.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74295d87-5e7f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639666204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666204, "uuid": "16963b9b-2707-4405-8b90-65004078ad7c", "comment": "Malware payload (Mirai)", "value": "05bf48017a65beac008e7d012b794c24", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666204, "uuid": "f82ea004-600f-41f1-8015-5aaa8eb80126", "comment": "Malware payload (Mirai)", "value": "835eccba78a8a09b518ff75f849c2035e07bebb779dbb06c5163911f9d63f5d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666204, "uuid": "103f35a2-d6b1-4369-9cbc-99814e0d82c6", "comment": "Malware payload (Mirai)", "value": "1ddca2fb3f0c487ef6f4f64b2f83b68e5c83a564", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666204, "uuid": "88eb50b5-9568-4c52-abf7-5ee8d05a0652", "comment": "Malware payload (Mirai)", "value": "d0b5a885b7bf2c5a74d7212414d8e3885d2dc325c6a9763e004f330f80e6da40dade7166f6a6382d425d79d8d1be2267", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666204, "uuid": "56f3a051-cbd0-4c39-90d0-304afcf9c7ac", "value": "T18EB2E05350934A2DF1ACA27AF35E6AEF90900DAD9F325210CB0C87F231A7729131E772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666204, "uuid": "caf135e0-55b6-498f-88eb-771af131153a", "value": "384:MeD7o0n3BmSAFTwjLlozmGgqAJa6LMC2OKJYYGC6E/FFybjq1YSGKN:9bxJvLlozmnErGYV6uGq+xKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639666204, "uuid": "03b7a113-57cb-4b07-b4e4-bbc4d223d786", "value": 23496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639666204, "uuid": "77760488-c24d-4a8a-ba7d-74851fded05a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666204, "uuid": "4348d2d1-f904-4854-82ea-3ca52fc4e383", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5ae1c9-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639615644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615644, "uuid": "708cca12-00fc-4c26-b9fb-ff2aa9f50a61", "comment": "Malware payload (Gafgyt)", "value": "fbf3ba6abd30cdb5d4556b7bf26d9585", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615644, "uuid": "a7995cee-5204-4869-b09c-21de825c6552", "comment": "Malware payload (Gafgyt)", "value": "845696248d80f5c230ee1310439b2e4961901110ac94780a2948e657e43d4f8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615644, "uuid": "ff8426f1-0e83-437b-935f-eb65fb31b7a1", "comment": "Malware payload (Gafgyt)", "value": "d97d450fe7ac453b70cf07a19029d501068ca98d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615644, "uuid": "c963082d-eede-48a3-b86a-63f05a23d2ad", "comment": "Malware payload (Gafgyt)", "value": "02fa4a845084b5642564b64e673bb78c86dbeeb90c3c4fb38c0c162f4611a9273ef24a38eae5f2ce6c407996becddfc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615644, "uuid": "81080a7b-78fd-4e5a-8ac0-c169d1cc47f1", "value": "T1FDC35B4BA4615FB3C046AAB229BB5E300716B9A11F5F1A96743C96F0478F4CE740FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615644, "uuid": "c4bef39c-4999-40b7-a6d1-37f2dc85cf56", "value": "3072:DgNrHMEH5nhwOXGobdwoN865hBHcTFT9t3rqwTh5NR:DgN4EH5nh6CHN865htcTFT9t3rqwTh5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615644, "uuid": "6d69e43c-6fcf-4d53-9ded-f070bfce68de", "value": 121481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615644, "uuid": "1271910e-6fbe-4122-bf99-92f7451cc6ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615644, "uuid": "7632badb-caad-4ed8-8134-de0749d00a46", "value": "fbf3ba6abd30cdb5d4556b7bf26d9585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae5a2ac-5e34-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639633922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639633922, "uuid": "54ba1630-0bdd-481f-93ae-a06ece94a34f", "comment": "Malware payload (AgentTesla)", "value": "2a6e5cb6f9b8a84ecbd250e5e1d6017a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639633922, "uuid": "b42482fd-817b-4837-84ad-0b2d041137ca", "comment": "Malware payload (AgentTesla)", "value": "84d922762882efeb1b414eb759d043264a2689c2347ee82a86298f87abcfae9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639633922, "uuid": "94919d97-6e77-4b67-9e41-aef4a1e74147", "comment": "Malware payload (AgentTesla)", "value": "394ed72fe51e26191fe5a7f7df45e03a6c13df30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639633922, "uuid": "4fe7e07f-c059-4a97-bc57-00e6c9059e69", "comment": "Malware payload (AgentTesla)", "value": "2f3819ade199cec5cf52cb5cc44e1cc9430167024a5842e029f639c604e1a4e744fdc6f315ae057401dcec2681941513", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639633922, "uuid": "a831ca64-9b82-4f92-afec-d5695f1a639e", "value": "T18625339BC5B06148736E7DF4D4E2D3A3E463536342990B2E3F12C39B244C9666B38ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639633922, "uuid": "1cfad178-cc26-49ec-8b3f-c0e5b295f8a6", "value": "24576:4h5mRSIuM2RClSQ3mlzmPUYE2erULH0MHLZAwkemY/VAXulRQ:mVFQlx8YEgfvRm4VAelRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639633922, "uuid": "50e3ee50-218c-425d-8a11-8ddaa8149e6f", "value": 1050474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639633922, "uuid": "82cdb587-f449-4a81-99e2-ac93188164bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639633922, "uuid": "f69238a2-3514-455d-a70c-3e4c94ed5d33", "value": "Statement as at DEC 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4736bc68-5e62-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639653673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653673, "uuid": "bdf3a75f-e5bb-4d22-a2e2-99d5c605da4a", "comment": "Malware payload (RedLineStealer)", "value": "378a3d9acf1ce9b0f56c6eb0a2a505af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653673, "uuid": "d47d775a-a700-40e7-9604-49ab082a520e", "comment": "Malware payload (RedLineStealer)", "value": "85acb1273562b42e61136efc5966163b1d19d2a265a8747eb361577678666057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653673, "uuid": "c249755a-9fdf-47b0-8670-52345719407d", "comment": "Malware payload (RedLineStealer)", "value": "f6f05cd4943abf5a443b654bcf528cde6700382b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639653673, "uuid": "487f34ae-b7f3-47dc-85ba-0dc2e7026ef4", "comment": "Malware payload (RedLineStealer)", "value": "572d2aab8a85dfb13a023d487841d1159669157052c52f065ce13f72a1b5eb0ec3dc302d372b04ed5bb31dfd45a7f336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653673, "uuid": "0db6d203-b425-4203-ae52-e7686bab1a6c", "value": "T1FCA4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653673, "uuid": "73a7701a-bc76-4e37-a64b-fe25ee903723", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653673, "uuid": "f67aae56-3f3b-4ca4-92c5-74ff3119a6d4", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639653673, "uuid": "d194a4dd-c85e-44e2-b830-898beb03daaf", "value": 455746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639653673, "uuid": "0af3d023-cb06-4dc6-a8d0-09c29f9d95a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639653673, "uuid": "768225a9-20cc-42db-8ddf-1014a8039aa2", "value": "378a3d9acf1ce9b0f56c6eb0a2a505af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d60117-5e08-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639614957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614957, "uuid": "ef79f7ee-884f-4d89-96fc-a798a64e6c83", "comment": "Malware payload (RedLineStealer)", "value": "b4e51c917f07ca4a777465485638f12c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614957, "uuid": "4634d937-69d2-4980-b341-6ee535d7ed37", "comment": "Malware payload (RedLineStealer)", "value": "85da720c061bcf1a4be2a15b4e51274cb604a4ef75da0183db2bf1c4134a0dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614957, "uuid": "d2cdcd02-7097-4406-9444-d2d8610c1a7a", "comment": "Malware payload (RedLineStealer)", "value": "24e8759c5009c26d442b122f3aa7ea7230db2930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614957, "uuid": "27941bbf-7d1e-4d36-be7c-71a0b40c949d", "comment": "Malware payload (RedLineStealer)", "value": "e996756ea5a6e48b6a166a6d48e7dc24c4c375bf1333de4cc07050a66064c13f0fe7aa57660b4c0922571db7ded8eb48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614957, "uuid": "bf7b6101-d460-4892-8b64-910fcb5fc041", "value": "T19404AE1175D2C4B1C6D219709870CBE41E7BF871A674446B73AB3BAFAF722D04A76322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614957, "uuid": "9467d062-e99e-44a5-bffc-813173a9e045", "value": "86448523176a55715540b63ea9446eba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614957, "uuid": "576bd3fd-8cf2-41f9-82b3-0f2aaed50b63", "value": "3072:GKeZBBVc9h9zUl6tot20PH6dB2ug9Xa2BOWhsHV3z/F:GK1h9AQtR0PH6PKopHVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639614957, "uuid": "8f9c1b45-9184-4f69-b449-081548efa873", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639614957, "uuid": "f412204b-c2a2-4e25-9e07-09c6a412e747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614957, "uuid": "846ad2f4-afd5-4c10-ac91-05bd2f21cf06", "value": "b4e51c917f07ca4a777465485638f12c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f2f76b-5e3b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639637107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637107, "uuid": "723c5789-a8d1-44c6-9421-cdc2ba35d6e7", "comment": "Malware payload (AgentTesla)", "value": "95bcac4c66ed0b255f1aad30b0206886", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637107, "uuid": "ea17c786-ced5-4ae8-8ebb-dbfe208ed9d9", "comment": "Malware payload (AgentTesla)", "value": "868a234549cdea90ac328cb48cf80a15e46895528ee49ea900df95e15757fc41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637107, "uuid": "a85b5b45-109a-4aa6-a87e-230959bdc4dd", "comment": "Malware payload (AgentTesla)", "value": "bfbee5d4e8ce63fc0ca76766e8f283294ed1ce32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639637107, "uuid": "c84e6a8f-3293-41ba-8600-9fa9cf2067be", "comment": "Malware payload (AgentTesla)", "value": "7a44e2f747e47fe656e5c0dd49a0a9a98b153f4cc5a7d1ac1b22d11fd27ee8d8491864240a43a93c095a8cfe0fddee2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637107, "uuid": "138a1c35-b97d-49ed-b175-c9b5d3958303", "value": "T17DB4120036AC4B1BC57D1BF95461650283F2A4367653EB8C2FD6B0EF13A2B864763E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637107, "uuid": "2cd68f6e-f766-4135-ad0c-8a4e698961eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637107, "uuid": "de687b10-42cf-477b-a631-564ce3695812", "value": "12288:xNdQAuHoA5QfJLLXAZk9QAyBetawDGRczPWRC/WQ/uSK3:HdvYoA5G5XV9/wKaC2IPSC/KSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639637107, "uuid": "a77893c6-148f-4fb9-8819-36303707290d", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639637107, "uuid": "ce14501e-8b3c-4944-a247-1cd8ce30029f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639637107, "uuid": "b102cbe1-e003-4c23-96a5-433b20203316", "value": "AWB 00577566664315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e7c7a3-5eca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639698265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639698265, "uuid": "269ac79c-2381-4043-81d4-b44bcd536608", "comment": "Malware payload", "value": "d68c9e927b3ebee0f2c927d1a4a8a945", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639698265, "uuid": "ec6e0ef8-778e-40ab-be02-38b13d99bd4f", "comment": "Malware payload", "value": "87ea5b44c32c9e73e8c3184acc98d9a5bd0f00870fd98e15d93abf08ef1135b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639698265, "uuid": "6534e838-b83f-42df-9207-6df42f216e85", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639698265, "uuid": "9325b429-0fd3-480c-b047-de7d98f7b0ff", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639698265, "uuid": "75f0fe95-8ffe-4065-86ce-bd790bf6dcc6", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639698265, "uuid": "8718ac5e-c288-450a-8a56-a8a563985b37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639698265, "uuid": "53850020-7275-4f53-86a1-7211c81ebb22", "value": "d68c9e927b3ebee0f2c927d1a4a8a945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5105a7e-5e80-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639666742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666742, "uuid": "814de1e6-c2ca-49dc-a766-cd8c1a8f82b7", "comment": "Malware payload (Mirai)", "value": "40e571172fa2153532204b2f4bc99647", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666742, "uuid": "f4f1bef9-e926-4d75-bf60-8141754defd6", "comment": "Malware payload (Mirai)", "value": "8804c26b43933a904b2fbf5b5a3e38b3a9b643b6f6a1472d4a9e50ecb9861cfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666742, "uuid": "fcc08f47-a465-4300-8aec-16c97d34609e", "comment": "Malware payload (Mirai)", "value": "542d949be0ad09d023a21c9dd2cdb7cbb850b74a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666742, "uuid": "c7786c7d-bef4-4b0c-bdb5-3a516ec8b2b5", "comment": "Malware payload (Mirai)", "value": "9faebc1d4c21b2757251a28cc1d0c8ed8f7befb395ed81c67d2b7e7e961deb944fe7933f671983805cb162dbcedb69ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666742, "uuid": "af866354-d742-45ac-9920-f89ceda0cdf9", "value": "T159C2E198370255F6C9B280F31AD95B1036D25EEDE903ACAA7349D527ED4BDB8F003AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666742, "uuid": "aca1aa31-15c3-49c7-ae3d-91005829f65b", "value": "768:x4omZ6lmRl2cjO37Q3CcroKGJgGlzDpUYsy:iomol+2cjO38ycElVqYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639666742, "uuid": "5710bb6f-50d4-4648-a37c-8710e9cc3443", "value": 26364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639666742, "uuid": "0de0595b-f6b1-4817-930b-4ed8f1ae1ff6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666742, "uuid": "e0fe3f07-9fc0-4c6a-8ec8-b66171c7a8ee", "value": "40e571172fa2153532204b2f4bc99647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca147d8-5e15-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639620611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620611, "uuid": "55820607-6ce6-4e22-8547-3440a05ef540", "comment": "Malware payload (RedLineStealer)", "value": "4f7acfaa11b4e05b833fc3617918abe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620611, "uuid": "4a73216d-2d3d-49a5-8517-9083d5579e34", "comment": "Malware payload (RedLineStealer)", "value": "888435e250cde8421a631a999bcfaa5c2166923fa6c0f2d65ab9d03c33362e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620611, "uuid": "aaa9f711-91ad-4f25-8789-2ee2694c4884", "comment": "Malware payload (RedLineStealer)", "value": "7bbe11181fc01306c8deef01e6d25b0e9e90df55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620611, "uuid": "fdbbeca9-72f0-4880-aaab-ef7c2b27d350", "comment": "Malware payload (RedLineStealer)", "value": "d4f7a3747cdd5ec7f923f0a7f645e95ce837d3cea87197af471ab80281ebe25486cff38a3549dc1c14986f59ccbc1120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620611, "uuid": "ffef3ede-ef00-40c0-a3de-36cc943c5041", "value": "T1ED653314A0D53E25DE858E783CBC3549DB8D41B0908DE4447739AF452068FFAAFABE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620611, "uuid": "80cd1d2e-fc47-49d3-9d1e-894a60a0f4e9", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620611, "uuid": "e6c954aa-d47f-4f73-8afe-780b286a69b7", "value": "24576:i/lNgD9a/SrX2I/M4+tzu7lwMr/t5291MyFMMvAAvIldkEaHNYK3DVNrEho:i/lNm3rv/F+u54MyCM/wbNalwho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639620611, "uuid": "ef7d2857-88e2-4b07-a408-c3b4b999135b", "value": 1415392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639620611, "uuid": "568ad53d-5cf0-4f91-aa81-ebb4864d6d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620611, "uuid": "f953f241-04e4-446d-aa20-1c80e471e720", "value": "4f7acfaa11b4e05b833fc3617918abe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b08fca-5e50-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639645857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645857, "uuid": "d4f4d2c5-3da4-4790-b1ca-7a8a6d02c848", "comment": "Malware payload (RedLineStealer)", "value": "5044807e5fbb61ee2732fdfba364752c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645857, "uuid": "30014617-edd8-4f07-b32e-598acf8e2efc", "comment": "Malware payload (RedLineStealer)", "value": "89df57db7560d65ce97121c93e051d19c7da73b1bbf3df3cefd4017e07d9a1ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645857, "uuid": "5c4ff142-535c-4794-a984-4ecf01556c8b", "comment": "Malware payload (RedLineStealer)", "value": "26f72b7d7c9b4dd611aaee10fde69744e969e42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645857, "uuid": "0081d7c2-4879-4141-8d99-f89dd0ee2219", "comment": "Malware payload (RedLineStealer)", "value": "707e284baff41351a45380b2cb014faf04b5d010fc36ff230811dee4001080f8357577167c23c7fdcc88e9d32eef598b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645857, "uuid": "66ad7c85-f88f-431e-95b0-a14b2ac03c49", "value": "T14AA4BE00E6A1D035F2B312F859B59378AA3F7EA15B3460CF13D426EA46786D5ED3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645857, "uuid": "a278c479-7cde-4a85-8b98-8f4ec069738b", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645857, "uuid": "0b7160ad-9578-43fc-9ec5-d2ad83c7b12c", "value": "12288:3thagedRc89jhwN+XmLkfJ9hlt//CQ5m:dhTmRc8fXXzdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645857, "uuid": "61f09546-c770-43ea-95ff-ab6a556b74d5", "value": 456200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645857, "uuid": "5adffe0c-b545-4333-9adb-2f099293f096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645857, "uuid": "4c8a6cb8-e7d8-48bd-a3a8-ce3ef1d1b175", "value": "5044807e5fbb61ee2732fdfba364752c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93882f8c-5e4a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643493, "uuid": "62ec07cb-3728-44fc-893e-ff342ca5202b", "comment": "Malware payload (RedLineStealer)", "value": "64f6fb8227bcad44219fe5780378b1cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643493, "uuid": "0de8db7b-7693-4d12-b9a3-34270571a360", "comment": "Malware payload (RedLineStealer)", "value": "8a6b85587a7c87d3f2da53fd4570b961a8a3d606ba2f337bbe0ebe6b07c97989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643493, "uuid": "25ed1e0b-2e2d-46f9-aed0-890c2c4427fd", "comment": "Malware payload (RedLineStealer)", "value": "313f61fff4f4bade616bb343e94f73aaa0218819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643493, "uuid": "0f6e95e1-ddcc-40fc-8d51-b5e97b233967", "comment": "Malware payload (RedLineStealer)", "value": "ccbbbc03418036d269a319a79b69b5941c62f8f6777de1bc63f3232741b50ac84663d70585d0e92c722ce9c19f48811e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643493, "uuid": "1503ff9f-762d-4ca8-aa22-0530955353f2", "value": "T1D8A4BF00A6E2D035F1F712F8597A93B9AA3F3DA1673450CB13D52AEA5A346D0ED3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643493, "uuid": "bca53280-6f09-48d9-bb26-f3c64eaa85b3", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643493, "uuid": "e4506088-6dd0-485e-ac81-f00eff773e35", "value": "12288:7u60CHpRV0AjI+yMPHSn9/krpm5YJmoTE:7u60CHCAjI7uHSiq3oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643493, "uuid": "1c1cebd8-e903-44ac-84f6-7b0b127468a6", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643493, "uuid": "73d7a244-90f0-422b-b5d8-b220602ae982", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643493, "uuid": "57bdcb50-97c3-4ed5-8f3c-1532250af98c", "value": "8a6b85587a7c87d3f2da53fd4570b961a8a3d606ba2f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c345088-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643749, "uuid": "c4c38504-db0e-4c5c-a966-3cbdfb63d516", "comment": "Malware payload (RedLineStealer)", "value": "31740fe8c0082099b46b0fee853cf2c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643749, "uuid": "c23896c0-a0dd-4222-b433-ad596d93e1eb", "comment": "Malware payload (RedLineStealer)", "value": "8b4cd3466446034e108610bb5e14a9a8628d880a957c3c396c68bb920eccea90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643749, "uuid": "2813c4fb-4c5c-42f9-9bf3-5e90704dbea7", "comment": "Malware payload (RedLineStealer)", "value": "df02b57cd2c9cebc57b041a7c2b6fdf1dfd72788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643749, "uuid": "2f0ea3e8-685d-4ded-8fbf-fa0972e8d4cb", "comment": "Malware payload (RedLineStealer)", "value": "2d957b4871470b0849199a46fe9c632b09e74f477f101f9f14936cb0593a342b43f4c84cc90816cc21739814a64cd877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643749, "uuid": "8b1f918f-4da0-4f1e-b066-f7cb5db6417b", "value": "T1A2057C433148F8B1F07126303376DA97528898DD5FFC9A9A15A361258D6C723F2FB6B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643749, "uuid": "0561750b-9762-4171-8872-ac3c0dae89c2", "value": "de4c31d1012bc76ae6a781335c7edea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643749, "uuid": "447bdb73-00cc-49bd-8f04-4a8a2edfe736", "value": "12288:I1risg9oqsHUO2ceOv3r5PFxPlNlFelVmFxEw/tbZDrnsz:Iri79pO/eOT5dxPlNlFcVMEw19Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643749, "uuid": "c5039bc1-89ee-4f2c-818b-33ad425b3ca7", "value": 814176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643749, "uuid": "54e81596-ad06-46a1-b5c2-56ed9e48794f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643749, "uuid": "cd3ceaed-48c7-41cd-9a9e-dc07c2c704c5", "value": "31740fe8c0082099b46b0fee853cf2c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a819ef6-5e4c-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639644310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644310, "uuid": "d9515a6c-24bb-41d5-83ef-5cd192d82799", "comment": "Malware payload (ArkeiStealer)", "value": "2f9f909423170ded900e3974b7cb69a3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644310, "uuid": "0e4b7d2b-6bfe-4d7e-909f-95d6c0e20029", "comment": "Malware payload (ArkeiStealer)", "value": "8b5160d4fb02a7e9fa686ea4261e5bbb3fd0c7223d8aff3963713083df01f5ea", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644310, "uuid": "0d2faba5-992a-460f-ae0c-e8dacee142d5", "comment": "Malware payload (ArkeiStealer)", "value": "9c4536c9e8ce05a6797cc022d349973a989b9084", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644310, "uuid": "2f503326-c081-424c-8e1b-cdf9ab350004", "comment": "Malware payload (ArkeiStealer)", "value": "fa52d1cb3db4915d6464a7e653cedeba7666de5787029060f0d540d12cb7af2652205ea17542b614eb1294f4a2ed043d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644310, "uuid": "4b764d8a-8b84-4cdc-ac32-e37c1380139e", "value": "T13A24BE16F5B3D472C5A3097054B4CAA15E7FB8727E30504F37A42BEE2F62A900A76376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644310, "uuid": "d5fe3c3b-7c73-49f1-a0a8-bf6d71597f24", "value": "d585c3f2ae16ed9e33c9881499e84cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644310, "uuid": "ca4bbba5-6231-429e-8f78-c6374d12310b", "value": "3072:vJ9Q1MkpKQrPYrjYOwq6ItTkaNXzRYa9pATUX2oZE3hsxEKkTZ9b:BUKQrCjpwqhk6Xia9CTQAaxEVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644310, "uuid": "ccf6c83d-c0cc-40ac-924e-1acfb9c16698", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644310, "uuid": "4c9e9a7a-2a01-43d8-8ed4-a8f744cd5323", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644310, "uuid": "25257574-30de-4ebf-baba-5be28552a73c", "value": "2f9f909423170ded900e3974b7cb69a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03636a9-5e06-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639614443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614443, "uuid": "507a1d60-2af8-4a5d-8393-788e5dd29755", "comment": "Malware payload (Mirai)", "value": "d35e3dcc12841a9605eb2f8784d60e02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614443, "uuid": "f441ac3e-d5f0-4cbb-b909-075d8d66dfff", "comment": "Malware payload (Mirai)", "value": "8c27df4ebc7d5ad70f77fedfb406598d1440df3bedd66cfff4cc5714c0aeb92b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614443, "uuid": "c2528ab8-8501-4054-8c76-26881a7295c1", "comment": "Malware payload (Mirai)", "value": "1927eda2037a60a598fb05e8a57bfc59eef1ca26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639614443, "uuid": "cba23c87-0197-4ccb-99ce-b5a11bcbdfbc", "comment": "Malware payload (Mirai)", "value": "bcbab441301dcc9626000bcea1a92153742ced87946d318a91b050cf64a73aefded5d33b6c68f7bc90122562ca4fc5a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614443, "uuid": "b729fded-769d-4315-ae73-fab72696caee", "value": "T10BB33A0798615F77C045ADB529AB5530072BBA120F8F1F99B57CAAF4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614443, "uuid": "9d8fc622-4f11-4201-9ada-6020609af39f", "value": "3072:btTQn622oNI8zpUU5hLwtOCwLkY0Px9gQNfR:btc6Vs/UU5hLwtOLLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639614443, "uuid": "0897ce8a-56df-4d08-b25f-3aedfa236f93", "value": 108415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639614443, "uuid": "883a83f6-d4d7-440b-9ac8-f3db7ab5dcf3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639614443, "uuid": "aa926d7d-64f7-4a2c-90a7-4fa52731d361", "value": "d35e3dcc12841a9605eb2f8784d60e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2b7523-5e55-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639648316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648316, "uuid": "32738e17-609f-481a-9732-03ab56e6c6dd", "comment": "Malware payload (Formbook)", "value": "7b6f2b185ef5e8590575cde569b72d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648316, "uuid": "3a949870-ab12-4551-8494-4e3023085815", "comment": "Malware payload (Formbook)", "value": "8cddcd3c0eb180cf36f9e6353cdadabed0eafeb569e6195a00a0fd3df60ac88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648316, "uuid": "7b1691fa-0e02-49f0-a958-b51b1f4d8606", "comment": "Malware payload (Formbook)", "value": "c4ea1fc9015ee4714acc91ed302b1d1b22ee6a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648316, "uuid": "5115ed11-7f55-440e-8e79-fdf1f9f827e6", "comment": "Malware payload (Formbook)", "value": "0fdfbfe1a0cc059174f996bed232670fdb84b382b6e86cf8a0831cd9136ce311f35ebadd955234b90497a7664e9e0e36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648316, "uuid": "935e499a-4bbc-4df5-ba81-70091d351126", "value": "T131A42316FAE21CAFF6615831087BD6626A72D3CC0E3C6D93B3E41F6B78123038659176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648316, "uuid": "f3b313f5-24af-4848-9c20-d7698b933a7b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648316, "uuid": "1ac854d1-eb8d-472b-90f8-8e9773281fae", "value": "12288:9czi7DwUu7VN9Ez9aWwIla0uTbmc/E5h82YJu:uzioUuBN93WhEwh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639648316, "uuid": "f60360c3-3a60-4dde-91fe-6e234eccc648", "value": 488070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639648316, "uuid": "03316132-05e0-4c95-a5ef-ff2430434c90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648316, "uuid": "a1cdf389-92f1-4492-b85e-78f0bf2b522f", "value": "7084_00_WPG,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c448ba8-5e8f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639673036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673036, "uuid": "59f7c48d-e326-44ef-91fa-ae4bd77f7320", "comment": "Malware payload (AgentTesla)", "value": "f8ef9c274e3d4b23e2b8bbf2220c2789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673036, "uuid": "4295e28e-4277-4456-ae95-52887b6d19ac", "comment": "Malware payload (AgentTesla)", "value": "8cef98761d99141693fba696c8cad2b0b8711c7dd6ca1095b2c328141237c84e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673036, "uuid": "57c36c0c-f51f-4b73-a2b7-e0cd8012e530", "comment": "Malware payload (AgentTesla)", "value": "22c51c99da3acaa02e1016e52046e7294f3f05cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673036, "uuid": "57a7b663-fc35-4a8d-a7e6-631561a4b179", "comment": "Malware payload (AgentTesla)", "value": "74007d9bcbbe302289c0ca2615d98baee822210ad172432702aa214a0c88479fe05c2dc98bfb1f4bd3b97ae44c6ba62e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673036, "uuid": "f54f61f7-e98b-4821-beef-e2f3997caa73", "value": "T162C4EF0032A99B12C4B8ABF88874A5B003F57C96E979E70F1DC17DEB75B9F804690B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673036, "uuid": "0774c097-93db-43ba-aa88-88055a523bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673036, "uuid": "41df69e2-f796-427e-8f24-ce2d8fd96c82", "value": "12288:w8PapPapPahZyRPhVhU3IkQQNdPqcPzxcBCI+xhCQFmimS2uSK3:w8P8P8PRpoLnPqDUxxQ3OSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639673036, "uuid": "1983f394-ae68-4d43-8653-f03806f1f6a7", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639673036, "uuid": "34f02683-e307-4c5f-9a12-d7866312f64c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673036, "uuid": "e12b80ea-aaf3-4c6d-b56d-01f6377042e9", "value": "SecuriteInfo.com.MachineLearning.Anomalous.94.3600.24202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2d9235-5e54-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639647967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647967, "uuid": "cff69017-8923-4da0-91f2-b7e066180889", "comment": "Malware payload (RedLineStealer)", "value": "57afb0dc0fb62e9b2ef5b4c7d2bba6d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647967, "uuid": "f1f94363-ae75-46ed-a343-3a1394827675", "comment": "Malware payload (RedLineStealer)", "value": "8d897b7cdbabac07b9bd47d3e84e6b8bc627321acaabed7aa3c86482a69c5a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647967, "uuid": "911ac5a1-7b7b-4fea-ab48-e7f843402f65", "comment": "Malware payload (RedLineStealer)", "value": "46dbbb9692c4e6a4fc408550fce08181cc7f9785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647967, "uuid": "835d39d1-afb9-4dcb-9773-03402167809e", "comment": "Malware payload (RedLineStealer)", "value": "8753bcdfc96a5f17dec9e73d0815f5ba08cd59ffd15c67492a92e650b43abe5b5086faba0b53f9164dc2ea83aee78348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647967, "uuid": "0a2f912c-557e-4540-b176-889adbb64327", "value": "T1E9A4BE00E6A1D035F2B312F859B59378AA3F7EA15B3460CF13D426EA46786D5ED3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647967, "uuid": "7a0c13a9-3999-44a9-a92a-f0416a5c7315", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647967, "uuid": "6cdf5b9c-a1e0-470c-98e5-65d31c5214e6", "value": "12288:3thagedRc89jhwN+XmLkfJ9hlt//CQ5m:dhTmRc8fXXzdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639647967, "uuid": "50b0dba7-50e3-408c-bcc0-97c86cb1ad7a", "value": 456209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639647967, "uuid": "f2a7b991-5aaa-4390-a12a-236ec715626d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647967, "uuid": "1427e256-c7b9-42ec-aac6-28fd18f1a134", "value": "57afb0dc0fb62e9b2ef5b4c7d2bba6d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9555aaea-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613431, "uuid": "29add8da-0e2f-4059-962e-e7f8f42e500c", "comment": "Malware payload (Mirai)", "value": "e17beec4d1af56142d314b73b196ee1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613431, "uuid": "deee3223-9ed0-4e0b-bd27-6205b13481a7", "comment": "Malware payload (Mirai)", "value": "8f1b5b8886c71f5733752d2cabf79c2a29034a69b36dea7fa2b4d23108bd9464", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613431, "uuid": "c7b907ec-eecd-49b0-884e-ce9b8d75d6a0", "comment": "Malware payload (Mirai)", "value": "b014df8da90014233429814ebbb5db608c4d925d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613431, "uuid": "04265fc2-0829-4641-8f19-0fd91ce224ef", "comment": "Malware payload (Mirai)", "value": "0d8d92cf9519e93eab1f43eed6a46ddf59e57caea2db31c2195bf678df070b1076d909e08446518fad5e1247ce3ae8fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613431, "uuid": "b7c02ed7-f916-41b7-9e38-76e753513ecd", "value": "T1C0E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613431, "uuid": "5b2a19bd-75fa-424f-a012-9f99465e9c21", "value": "3072:C2ttgUm6Oq+lozF5hdCNzhsURxuZq+1uPNd5R:C2ttgxq++zF5hdC8URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613431, "uuid": "74b36bdf-7973-4b3d-bc40-665189677493", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613431, "uuid": "5b521281-97b8-4dd4-89cb-4f04357227ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613431, "uuid": "cff2165e-97f2-402a-94e1-5af852385ace", "value": "e17beec4d1af56142d314b73b196ee1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9bb438-5e82-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639667587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667587, "uuid": "1b5c9c7b-6a73-46a2-bc0f-cc132052659d", "comment": "Malware payload (Quakbot)", "value": "9081c569be99d616d2853693e00a6b0b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667587, "uuid": "b140d08c-3d78-485c-bcab-00502645d9fc", "comment": "Malware payload (Quakbot)", "value": "9069c3730cb0bc2f5e37c03accc8f584892d29537e35067ee0e08b9611967d49", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667587, "uuid": "b3b7078c-f613-421b-8627-d9501680f0e6", "comment": "Malware payload (Quakbot)", "value": "a427c97e92b3f2867bcbd2e48d97152555ae5abc", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667587, "uuid": "cc0576b6-d7cb-48ef-a43c-5965aa7e7771", "comment": "Malware payload (Quakbot)", "value": "e935130e67e46f94b09894d495822b59ec030be66d46d41fcea36eb2ccdfbd36b1407f568ddc33dd05596795032afec7", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667587, "uuid": "c51099b9-6d93-4a8f-a2d4-5477af2dce5f", "value": "T1651412097C3CE8CECB1B15329609BFEB821B50609DC27C2DA9C93C5D9945EBD7A8D48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667587, "uuid": "14329339-671d-47f4-bb1e-512c5ed8721c", "value": "3072:PccfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZE80:kcfEw6R9537k5WSOeME6rGj/m/58DD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639667587, "uuid": "01dc8d01-d3e4-433e-8dcf-1eebd263e6f7", "value": 204541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639667587, "uuid": "4e0006bd-06cb-4c62-81fe-7b2afc71ae2a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667587, "uuid": "5eb479b0-e02d-42ca-8c31-2eb9a7bc0f30", "value": "LO-1072497069.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd72d423-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639684044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684044, "uuid": "6f4c001c-b58c-4c01-bc1f-9c7dda85e869", "comment": "Malware payload (Guildma)", "value": "a887a0fe5a6cf41956e090d51714b6a2", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684044, "uuid": "e84a9495-3a39-42fc-9830-48e5188c8496", "comment": "Malware payload (Guildma)", "value": "9233da098f6c171c69589dca2cb848c60c68de2f6720e4ac82ecd5feaedcfeed", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684044, "uuid": "f1c96e92-c130-4090-8ca7-ae08902ee05c", "comment": "Malware payload (Guildma)", "value": "bf186bbfff2cdbc24c6b525296223020d6556d45", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684044, "uuid": "c5338ac8-eb28-4147-82e9-a8a139b5f32a", "comment": "Malware payload (Guildma)", "value": "942db20ca1a0a8e674233361376089799613c4041de7bc8543d37ee5526059852fbdbe29a096b40eeec37c0a5d4d6ea9", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684044, "uuid": "f677bfa2-cbe7-4e58-8e17-8ad18b5f3d98", "value": "T1EC447B513BC9C13AD2AE163785BA976A263A7D751B30D0CF77903D6C5E306D2EA39302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684044, "uuid": "745dc796-a17c-4486-bc63-eb35854c9fc9", "value": "6144:1uYtOIiRQYpgjpjew5LLyGx1qo86HnuJ:1uYtMRQ+gjpjegLyo8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684044, "uuid": "489457e9-883d-4702-9a84-de35545f5800", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684044, "uuid": "6d47d891-b23b-4e10-89a6-e8551464f501", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684044, "uuid": "4f552f5e-0c3d-464b-ac95-44f49ca88651", "value": "a887a0fe5a6cf41956e090d51714b6a2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8301781-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613490, "uuid": "01213e6b-3288-4f2b-b2fb-1e9d4d3d28f1", "comment": "Malware payload (Mirai)", "value": "089c96f3880165fa6a3cf609d5fa303d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613490, "uuid": "4b3571aa-e459-4a1f-bc86-f7bc9f7fc650", "comment": "Malware payload (Mirai)", "value": "959246aa2a72267895ef271e7b28f269fe135363e40033593e973ffdf1490203", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613490, "uuid": "dfb6a424-68d5-4230-b6c9-cc2d38b4cb2d", "comment": "Malware payload (Mirai)", "value": "900a21e6058b42cb171087fc6b58ea74a2090e97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613490, "uuid": "cd7f1e4a-121f-4ce0-be2d-4313aeb0b91e", "comment": "Malware payload (Mirai)", "value": "9a4cc4172128f200fa9a2815fde4c2a63daacd55aaada512369652acbdd012f13a3861e2f1ba43b6d6aec361aaa862e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613490, "uuid": "4a85a27c-cbfe-4c14-80ec-a2f13fa05335", "value": "T1E7A35C82D742C6F3C4430AF1029F965A0532FB3A8A3B8EA6F75D7CF4AB129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613490, "uuid": "0e432545-403e-480e-b7df-599cee0a0f6d", "value": "3072:nfKKKPQP39VjGWXF8T7pV7EGytVv5hgTwIDbFXnf0OzTyoQQub:naQP39VjGWXZ9tVv5hsnFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613490, "uuid": "f0fe66d2-3bfa-4214-883b-1e286903768b", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613490, "uuid": "c05f6b9c-cab2-42dc-a6ed-ca3420841cdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613490, "uuid": "49e1d4b7-ee16-4c7e-8f41-c77a65a2cdd3", "value": "089c96f3880165fa6a3cf609d5fa303d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32113d0-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641452, "uuid": "aa87355f-ddbd-4f29-a8ea-2ead3f22e02e", "comment": "Malware payload", "value": "9cd6102b5e173679cf220dd4b4bb2f86", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641452, "uuid": "aa011a26-7856-450d-8201-f90ffec807a2", "comment": "Malware payload", "value": "9671f57a9268f737a911b8672e7c09a26c5be2d9f7d3442a8efc1cb8d4b1232b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641452, "uuid": "5304ab26-4583-4d84-9ad3-febd794ada19", "comment": "Malware payload", "value": "01af87fb06a72984f99bf83270b913c74dc2932a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641452, "uuid": "0f92a168-aded-4415-b977-d9eb780347ea", "comment": "Malware payload", "value": "bee934303e21c280e5bcbd8a101d30c018633059dd49865055f55e50a0a22be1569bc4d96525d82c44531cab27223ace", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641452, "uuid": "66a26224-a14f-4773-8a22-4b6a97c34a33", "value": "T1AF56232372968135C4FDC578192B7FE631F51624C7A280FB22D95ECA3AB19D09763E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641452, "uuid": "a4c49b41-87de-41a9-a700-365b47de45e8", "value": "98304:yYseCAXsCn3jH/uHfs6dGYnDeSSNUX/ji9iP+6bpy8aNnu/x7JNfVJi7sJ3p4:XsUjHt6AYDxSNOKidkhaxPVJiIJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641452, "uuid": "99b576aa-41e3-4593-9660-a13862c52f4c", "value": 6328832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641452, "uuid": "f4b66a68-839c-4154-9191-555aecae08b6", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641452, "uuid": "d77b9eb0-5e0d-499b-9b9c-bf689b99587d", "value": "9cd6102b5e173679cf220dd4b4bb2f86.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e588c307-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639642772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642772, "uuid": "288ab571-34f0-4be2-84c6-f0473eeea5f6", "comment": "Malware payload (AgentTesla)", "value": "0c3ebcd677b70feb2d91b1d660e7c51d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642772, "uuid": "589007ad-8832-4a96-b167-8f4bb5e863bd", "comment": "Malware payload (AgentTesla)", "value": "97d50f64214b9dc1bc4fddbb9927288ee1664b9ba504b5c83d2392082856f6ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642772, "uuid": "3c8d2198-d3a7-4783-90c6-8d40752ac5b9", "comment": "Malware payload (AgentTesla)", "value": "0da9569fce775bfd298de3a7b7dfb4506ecd5c37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642772, "uuid": "cbf30b2d-0cc1-4178-afe8-e9c203aa2ab3", "comment": "Malware payload (AgentTesla)", "value": "61a1e59e6d373cea361e5d721e7ba32063ab26bcc3225449bcd43615fcdbdae18eb28120262fd7905e9fb3579ec4cb4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642772, "uuid": "1d77969a-1f45-437e-857e-c03d883376dc", "value": "T106F533318B92BDDD1E7C6A04F0163BF67D515E835620A6CAE6D428C738EE7148F1B8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642772, "uuid": "9410dace-a0f2-4124-ad93-0b5e4414a8a0", "value": "49152:G0o5MUJpjfCYL/ppckyQg5g+EjyBqCYrRsK6:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642772, "uuid": "b343a238-6e44-49d5-aa3c-059aef7c92aa", "value": 3591796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642772, "uuid": "11709a6a-f9a7-4948-84c2-83dcfb740455", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642772, "uuid": "b4e8f507-4f93-4d08-9a98-7b30ad8f0547", "value": "Copies of documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5b98b6-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639642538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642538, "uuid": "5f29cf32-e1bf-4a50-8a5e-24d1b3e1baf3", "comment": "Malware payload (RedLineStealer)", "value": "9ae2f6691e6b374e5f62ed55bfe337da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642538, "uuid": "b2234560-b3d1-4f61-baec-b082db394f43", "comment": "Malware payload (RedLineStealer)", "value": "98f7ccf797a73ecbb4a03a97e4e7e00d0f313a5048c61d6c331987d9ec516b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642538, "uuid": "236ad067-b42f-4f52-b252-a0fa673de438", "comment": "Malware payload (RedLineStealer)", "value": "846e8dd8e01b9698bbe70743d7d20616c5dbea98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642538, "uuid": "285991b5-bcf9-407c-978e-a0aa03258485", "comment": "Malware payload (RedLineStealer)", "value": "4c56e9342ad9af2e236ba6aba198ea923b5101e0fdfed4fe29a921e43b1030058b7a1fd6c4c882b33a528d75d6ea4ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642538, "uuid": "7840faa7-389a-4eb8-b724-52771d7eec45", "value": "T134A4BF00E6A1C035F2B352F859B693A9A93F3DA25B3460CF13D51AEA4B346E0ED31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642538, "uuid": "be727421-3607-4421-b49d-8bd291c183a8", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642538, "uuid": "6c11f1b6-b9aa-4bc9-ac5e-9f23945382d2", "value": "6144:kWZxBUpJozULTyS0ul2+FKd6VMt4ibESIpi1IAtL9CKIGphYpq9gjLNC9U:9CJsE1SyKkt2ETpmIAtL9CvGpapq9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642538, "uuid": "03004619-6d36-42b5-b7c3-7021be68e3a6", "value": 455709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642538, "uuid": "dbc96f2f-9aa6-4b21-9b66-45876d1b13ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642538, "uuid": "feb70f4a-290f-4034-9458-0e1c644501c9", "value": "9ae2f6691e6b374e5f62ed55bfe337da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f9c6a5-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650280, "uuid": "3492a7eb-e627-4e77-b0fa-4a8942eab912", "comment": "Malware payload (Gafgyt)", "value": "a7d84cc253dee6a95fe482c5ab5d6943", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650280, "uuid": "3133ae55-6d63-4832-b4c9-4927fc63af59", "comment": "Malware payload (Gafgyt)", "value": "990a80be2af3fc01e181d8646a3b00fcf7d500d6a98d25e85a5c31173db5bd3e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650280, "uuid": "70383134-3884-4b8a-935e-acd8541a9cca", "comment": "Malware payload (Gafgyt)", "value": "5671457f1047ca3748f69fcf4a228233f0ca4c5d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650280, "uuid": "513dc6a2-8311-4a3a-af1a-5e13b7e0afe4", "comment": "Malware payload (Gafgyt)", "value": "e57fcfa5d6708e3d58e3f1959486c4e180de26bc770372b60f3a53f81fd0f51187bb08eda12da1a3ece50a2fc97ecbec", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650280, "uuid": "8fa8986b-4458-45de-bb77-bc86918296f5", "value": "T138B34B23B662C57AC08752B027DB9AB19863F4B90BB2325B33D47DB02B11CD61E5EF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650280, "uuid": "a989673d-4e3f-4e8c-bdb2-7c18d7a69399", "value": "3072:ym/K8pu6wjp/aQPAw98PmdsphaMWeIMRmveuoQ5orZYPM:S8pq8QPAWmphaRh0mveuoeorZYPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650280, "uuid": "3a6b94b6-8981-47e1-9e37-244cb0c59b93", "value": 110555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650280, "uuid": "3dcc291f-cf46-4a28-b38f-936834a4ea57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650280, "uuid": "308d7fb6-2124-4728-bf2e-43d9669c876a", "value": "a7d84cc253dee6a95fe482c5ab5d6943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adbd725-5e69-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1639656605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656605, "uuid": "51a0467a-9566-450e-bdbd-d3118a38c7be", "comment": "Malware payload (GuLoader)", "value": "1823b507e96d8138bada7c65d424abcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656605, "uuid": "55d45d8f-ef6c-47fe-83af-62bc07e9ed08", "comment": "Malware payload (GuLoader)", "value": "99b81b452d173986229ed512383e05214f35c819aa9da4c2a972bb05c880d536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656605, "uuid": "38efb16f-6424-4aa3-a483-7a174284f613", "comment": "Malware payload (GuLoader)", "value": "e5d7884da7d17ba0ae592ff787e84ae665e21c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639656605, "uuid": "2d0467ab-831b-41cb-9f7e-0e6b8d9cb0c0", "comment": "Malware payload (GuLoader)", "value": "0ab7e9c65d121098b0114279bdedf16123298154fd52cd6e80f77a5d0a1f0a1fafa62b94e37e4c25028d7bd3881359ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656605, "uuid": "aef7281f-c224-40ce-8e3c-6850212b9a6a", "value": "T128E33AB06058EA53E618D4F08414D6FF2BA55CA5C038442769E3FEA7F6BB6C13D8538E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656605, "uuid": "2bf8298a-8a46-4482-827c-b464746459c7", "value": "7d340e80350d9e6231e6392a24967d10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656605, "uuid": "b322bd21-1267-439b-80e8-3844c15b8bc6", "value": "3072:U4PvIBPPFoSfth9WGq8Av35lbUTv9/alVVPx:U4PAsGU5+BaxPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639656605, "uuid": "14bf5bde-872e-415b-8ea8-d9eb4c6f1010", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639656605, "uuid": "7adc171d-dff1-464a-818b-a7bcc90ced28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639656605, "uuid": "44398f2a-011f-4e78-a7ba-270bc54a0926", "value": "PKO_TRANS_DETAILS_20211216_0809521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6170d8-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613522, "uuid": "0b428d9e-1025-48bb-aab5-f024187a5e54", "comment": "Malware payload (Mirai)", "value": "4f6ccfefb7ca54d10d9d8a4323fe8b93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613522, "uuid": "f51f481e-3103-43da-af2d-8369b184d670", "comment": "Malware payload (Mirai)", "value": "9ca1c4fe6058c0fcd19a7bb837ca6a512b0fea8acdbbd6e8a325fe3e0da7f450", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613522, "uuid": "4c147f44-aa16-4fee-a493-773868cdd0fc", "comment": "Malware payload (Mirai)", "value": "dd0fd6109a0678d96dd130cf762c2e5d87f76c00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613522, "uuid": "9ff2c6e7-8752-4427-a2b3-0ac04e0b36af", "comment": "Malware payload (Mirai)", "value": "5f9c1673c38c3462833cb6237eeab5f47dc82035e970c72d23cefab842df239d7a57a95e48ba01e1c9592577375dfeeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613522, "uuid": "8ee64664-964b-41d5-9742-c082c9baf776", "value": "T1AEC32B2B3B271E23C0C9547102E31331BAB9CB6938B953D7F9D06D9C2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613522, "uuid": "d77eab54-736b-45fc-9672-9cc38f8a2010", "value": "1536:yEsksTuVY80FkbkgcQBkrBN95rxtgKR83tcpphak2yEmsEt9/skYEP/UDjSQrD/R:nFgrBNProKpphak2Mr9/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613522, "uuid": "5477a1cd-eead-477a-82e1-4a6f66b9dd21", "value": 126937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613522, "uuid": "7c6aa912-1cc7-416f-9362-e33708218c4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613522, "uuid": "2e6cbd95-7cae-45c4-a61d-59afb2b2d2b2", "value": "4f6ccfefb7ca54d10d9d8a4323fe8b93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8e3c47-5ea5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639682512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682512, "uuid": "4193b882-961e-4497-80a5-dd52b2ba7253", "comment": "Malware payload (RedLineStealer)", "value": "5033c91b19d830abf389168499252cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682512, "uuid": "349c2bd0-e976-454e-8adb-6c5c5e740e63", "comment": "Malware payload (RedLineStealer)", "value": "a02f8265e7db4674fc7838b92abcbb738b47ff19569bdec918f79b2f73ed0e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682512, "uuid": "a1412a56-0327-4f90-9c2b-851e90bb9101", "comment": "Malware payload (RedLineStealer)", "value": "3f6e41212f6bfc51433c022532b13e074a3814ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682512, "uuid": "664e95fe-c97b-4a73-9ee9-942d4e89de43", "comment": "Malware payload (RedLineStealer)", "value": "e9d6c880bd66d1fe750c46558215d5dc7d33f3602b63014537fc4c158d120e52cda4b012cad2693fd7b4e107e82c1506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682512, "uuid": "2cc6db33-0156-49ea-962b-1d99fe64f533", "value": "T1AFA4CF10F7A0C035F2B312F95AB6A36DBA2E3EA1672450CF13D56AEA56346D0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682512, "uuid": "7687f0a7-3337-4e62-9df9-ecd367acc0b8", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682512, "uuid": "9a7d478e-435b-454c-8312-08824b26b30b", "value": "6144:dPSZvSSXkjqsf7AOr5gBCVJCjremNXkIV0/n+Vto4XS6QwY:cSSX9sfsYyYVJaemNXkIVOn+Vttow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639682512, "uuid": "4f185b19-6965-4e52-9503-fc447b3f948d", "value": 455171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639682512, "uuid": "00c3e495-87df-4d38-835a-298726459f83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682512, "uuid": "4bbfe5c7-d735-4375-93f5-2184343708c5", "value": "5033c91b19d830abf389168499252cd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fff94c6-5e91-11ec-96a4-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1639673874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673874, "uuid": "96085103-4c6a-4a00-9700-8b14f1d61e60", "comment": "Malware payload (Conti)", "value": "ee328adf516df520ebe7dc79bd9d027e", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673874, "uuid": "83c79786-9808-4fa2-9ebe-6966c86a68fb", "comment": "Malware payload (Conti)", "value": "a05c8129e607c6d0976d79f69c6a020d15767a9ef3a9c9f1570c5193a7b5b76b", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673874, "uuid": "95ed91ff-1d90-44c3-b332-3cb8d3bd0fda", "comment": "Malware payload (Conti)", "value": "75e3e543001895354dc556b413cb3a4a440bb3ad", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673874, "uuid": "36899577-b5a8-4370-8dec-b86e3e360a6a", "comment": "Malware payload (Conti)", "value": "a97057b7a3b6f140731c6ec0f96e8e82b8365f0a145ea871d0202942f139f0238fb8aaf617a1fb2f437fc2e0712631d2", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673874, "uuid": "74e7a916-0c64-4fb8-81fa-9a3b1b6fbe5d", "value": "T18A144A01F64D827DD6AE4D31267A7EB280B99D383B5FCCF7B3DA882816606D06524F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673874, "uuid": "73e166a0-54b9-48eb-82ec-a9953ed37740", "value": "77679e1e454376d19c1c76600c17ea98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673874, "uuid": "823b3958-fe90-4e0c-99d0-f07af25a99cb", "value": "3072:HJkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34oMxt:HFcuVqTATicDN7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639673874, "uuid": "3925fb58-ee51-4390-b521-337f1a665165", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639673874, "uuid": "e0a5729a-d9dd-4a80-b270-67ccd0b468c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673874, "uuid": "508d3dfd-e558-4ccd-b3f3-e89331dc6aaf", "value": "a05c8129e607c6d0976d79f69c6a020d15767a9ef3a9c9f1570c5193a7b5b76b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280291f3-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639683686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683686, "uuid": "2dd666be-bc21-42a3-bd6e-ed05fa7d297b", "comment": "Malware payload (Mirai)", "value": "3aa9d69f11a457eb91bca10ae0a28d53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683686, "uuid": "ca5200f0-64a1-4e8f-b04a-20eff51364fb", "comment": "Malware payload (Mirai)", "value": "a182bd4627391c8c2f74477fb5a04c5ffbdcd8ca52bf0fdd4f782675d940b487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683686, "uuid": "fcafb89b-5901-45e4-be1e-be86682dd7d1", "comment": "Malware payload (Mirai)", "value": "2831fc6e152c9da3c3e00944950497726cf3c0b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683686, "uuid": "d6f7e5a8-31e9-489e-9266-f395419c2d2a", "comment": "Malware payload (Mirai)", "value": "f2702bcb5444c09e96162bfc81ecabe257d98a459058958ed7f9867cb31e1fca72fdc2c2c4bd24bbc17848a32ef0b4ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683686, "uuid": "c808c4fa-414b-4abf-a1b7-210d4f1000d6", "value": "T1FF530996F8818A11C5D5137AF92D128E372227F8E3DEB2139E215F243B8696F0D37D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683686, "uuid": "0e53f6cd-7ba1-49d7-a7bd-9db68821c7ce", "value": "1536:0LKnT/bLmLEVr6W4HncPXT+KW9VnzF5IOiZFWQu18:hL8EVr6WqnUXT82FWQu18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683686, "uuid": "1cd0e859-78f1-4f0a-8dd9-ae9cd72f7d03", "value": 63576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683686, "uuid": "511e40c1-2133-4272-a4b9-c859168190cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683686, "uuid": "4a2db329-0fcf-41c4-a93d-da08a84437c5", "value": "3aa9d69f11a457eb91bca10ae0a28d53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fce1c4-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650290, "uuid": "c4bb468f-1db6-451b-8b83-75e44b7dace4", "comment": "Malware payload (Gafgyt)", "value": "08e1a3b86f10db92d8d01af0b894d141", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650290, "uuid": "6f06c99e-cc2a-4e2b-87f4-145290c8c570", "comment": "Malware payload (Gafgyt)", "value": "a1c4aa422a701f50216c644f86bb23261c4b285362f0d903ca419ce774f9dce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650290, "uuid": "84ad29bc-28a4-4d76-8807-c4e3b0a8b145", "comment": "Malware payload (Gafgyt)", "value": "515c1fbadc127f2f4b151592d750f19255c31f28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650290, "uuid": "0979de69-165a-4fb7-abef-359c73712f74", "comment": "Malware payload (Gafgyt)", "value": "edd9eafbc10dba93301ead6cc0b431b3c808c45cf29ef3b8cb4bf2b7bbc9ca02e93f982515d990d709ec6430209ba1d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650290, "uuid": "a5c844f3-f611-4fdc-b9ec-ca400f347eb4", "value": "T1C7E3953E3E22ABBEE169863107F75F70C79521E237A19381E1ACD6185EB124D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650290, "uuid": "3a2f38a4-12f0-4beb-81dc-289e01a70c4b", "value": "3072:tWZZtqexonphsKQZH4JP0riLcqgs8kkGPg1r58OjQyD5h0Tui3EUmkmgF/kKOMbM:o/ne/idFsyD5h0T7EUmkmgF/kKOMbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650290, "uuid": "239fcc7d-9c00-4790-aeec-27ace83b507b", "value": 143726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650290, "uuid": "47252df9-9c17-481d-91ee-79adabbdcfe3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650290, "uuid": "fc323dc5-e74f-44dc-9757-34297e1fbeaf", "value": "08e1a3b86f10db92d8d01af0b894d141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81422dea-5e98-11ec-96a4-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1639676963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676963, "uuid": "dfc15d35-f0c1-4c61-91f8-ee1cd3dbac0a", "comment": "Malware payload (Conti)", "value": "b1df6d854a85cc516b17c297e52961c7", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676963, "uuid": "e759da35-24ea-45e5-9090-7c6436cf115a", "comment": "Malware payload (Conti)", "value": "a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676963, "uuid": "9f97a8b9-9816-493a-800a-46d561fc4106", "comment": "Malware payload (Conti)", "value": "b63cca38c6d715f7614f4bce1dcca60585e90731", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676963, "uuid": "f36749e9-810f-4d87-9fbf-63303a3e26a5", "comment": "Malware payload (Conti)", "value": "57fed9187c82c425b3b0d876d60c0a32a248f49fff2ae75a4a04d4e83b498c7d89f6f0cac8cd606c225a9261e6fc62bd", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676963, "uuid": "fe7a7525-24b4-451c-bb1d-90aaa46490a2", "value": "T1EB145B01F64D827DD6AE5D31267A7EB280B89C383B5FCCF7B7DA882816606D06524F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676963, "uuid": "f7032b7b-3f4d-4f56-9ea1-429377c7e9e3", "value": "77679e1e454376d19c1c76600c17ea98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676963, "uuid": "7a38c07d-9a1e-4e87-9b97-475ca4531bc8", "value": "3072:HJkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34oRxt:HFcuVqTATicDNOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639676963, "uuid": "8c0a146d-6069-49aa-ae7a-9f50e0e02d4b", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639676963, "uuid": "04f94bb9-41f4-45fe-a407-315b2c704f53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676963, "uuid": "23ea6ca3-05dc-4cd8-8e26-36351da30014", "value": "a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4537a3e-5e7a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639664191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664191, "uuid": "32d65c75-6fb9-4672-9579-e26a2ebbdbce", "comment": "Malware payload (RedLineStealer)", "value": "c73c38e25a546bcebc24d562c2e306d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664191, "uuid": "901c7daf-e077-41fa-a06d-a23430a5c815", "comment": "Malware payload (RedLineStealer)", "value": "a4a13ade9ca250ae434ee125b21e22ea9937f98a66d6c2e9747bda28ddf3c279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664191, "uuid": "9d1ed99d-5d0c-42ed-9ebc-c07467f9fef6", "comment": "Malware payload (RedLineStealer)", "value": "8e546c9aba5a49e52c2ea72507861bbbdae77536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664191, "uuid": "c6150492-f9f3-4fae-8a3a-f1fcff57f37a", "comment": "Malware payload (RedLineStealer)", "value": "45cea5b54b8c9fb2687d4eab027be921618abedb64f05b61a69a390cf85c713767683c70b43c44e51a8586eff913a3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664191, "uuid": "59f1cfe0-d870-4e7b-b2bd-894c4a327f71", "value": "T129A4BF00E7A1D034F6B716F859B6936DB93E7DA16B2490CF13D12AEA1A346E1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664191, "uuid": "f9a19e4f-186f-4da6-a406-cb4a6cccc21c", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664191, "uuid": "da6b1c49-2e39-4409-8cf0-cc896b21e6ad", "value": "6144:jzdQcuKrRosANpXrZMJ2jIT2LfiXhJf1tSdf90LblwNP3zlUR5/+6lQKR:tQ70i9MJ+LfiDdER2LblUP3JUR5/rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664191, "uuid": "d40a1d04-2af6-40f5-a063-26394cadeccc", "value": 456249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664191, "uuid": "6b5869ad-53df-481c-aa1a-7167e1bb0908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664191, "uuid": "dba3237a-c8e8-4479-a622-5a37fb3dcd7e", "value": "c73c38e25a546bcebc24d562c2e306d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca93f0f1-5ec8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639697702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697702, "uuid": "2f9bf562-47e8-4791-8d3f-278eb93fe613", "comment": "Malware payload", "value": "5aa5bddaeaead5ad575cc2d46e8bbd59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697702, "uuid": "034cd478-3561-4ad4-be25-0e63f6e5e566", "comment": "Malware payload", "value": "a51ddfebbff6f4599a904655a5bac8e51234c4f7e9c3d2faa4cbc24f1f94ec3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697702, "uuid": "8a9fd5e1-1382-45c3-94f1-ade8130785bf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697702, "uuid": "0ea6882d-9c35-4a3f-baea-24fae0249acd", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639697702, "uuid": "48b66802-b575-456e-aef4-c22f9e3642d0", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639697702, "uuid": "07f18387-1c52-43b4-9682-0edc5a4fd14c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639697702, "uuid": "e6d5e816-054e-4295-a12a-6be264045006", "value": "5aa5bddaeaead5ad575cc2d46e8bbd59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b879a92f-5e96-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639676197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676197, "uuid": "97a541fc-1ee9-487c-8839-5eba2dc583b4", "comment": "Malware payload (RedLineStealer)", "value": "e0ae13198c9cdbe32c867c67e459a79c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676197, "uuid": "0ba57b09-d528-499c-b5f9-470ce33c53af", "comment": "Malware payload (RedLineStealer)", "value": "a84b7f066dd21bd87e015cdb0142344ea06eca4799c01d3bc839c6d8f04e79bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676197, "uuid": "1d9bebe8-ded3-4772-b41f-25c4ec01ca90", "comment": "Malware payload (RedLineStealer)", "value": "ec59afb8f37eeac1c3b47c74666d4f70920879b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676197, "uuid": "98c0e679-b1be-4e12-8526-d9478ec5da82", "comment": "Malware payload (RedLineStealer)", "value": "26a30f1bf76e02c16b9549a5bfc45b86b8ff892eab089124e5dc40df8c3ebc775503dd132d7a09646374f692863d938c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676197, "uuid": "75ec194b-b92c-4264-a33f-f56855a55abb", "value": "T1BBA4C000E7A0D035F1B213F85AB6E3BCAA3E3EA1676450CF12D526EA56346E1ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676197, "uuid": "05ab672b-433c-4932-8312-78749dbd2d59", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676197, "uuid": "65fc3e07-bbb8-4b0a-bd74-de060ffa6f5a", "value": "6144:RvY6t6Hqn0YUUWBFboyYSI4HepiYkhUndqouvrV15raVFo7Jz0F:hcKyzBFboiHdYk8dqouvrVHraVF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639676197, "uuid": "8b1d679c-d3b8-4b1c-bb0e-a91c5d11b28a", "value": 455254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639676197, "uuid": "48dad040-7583-4de2-b0ff-43caa2987e1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676197, "uuid": "00f803a5-724f-4e27-8239-94fca7c3c9d1", "value": "e0ae13198c9cdbe32c867c67e459a79c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a017764c-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1639643944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643944, "uuid": "5692a639-4361-40c5-b495-18c1085a3241", "comment": "Malware payload (Neshta)", "value": "81b76350a44f6356246271612e6f23f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643944, "uuid": "c76ad55c-18e1-4f56-94c8-d344c9640c8a", "comment": "Malware payload (Neshta)", "value": "a9704735e10e7b769bebf6b33f8fd17d8a1f2d97ef774bf2f8d3ff3694ccf6d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643944, "uuid": "f86b436d-001b-4156-a540-8e15ee262a05", "comment": "Malware payload (Neshta)", "value": "bfafb16fcc983399191cf2596d700aa03ee6f75c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643944, "uuid": "7dec9f92-d34a-40aa-a3d7-9df69ebe975c", "comment": "Malware payload (Neshta)", "value": "5c02cd33844a0b93721ad3be42f468b3166e186ece53cea449c62ac079771a6229127895b40be35f967b3114bb2b8379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643944, "uuid": "b5274a79-e8c7-475b-bfea-ccd4696e3fd8", "value": "T1B5A4E0057AD4C535C33A9FB4E861A2E01A35BE27F963D3D779E0BE6E3876352180170A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643944, "uuid": "8d3cbbc6-09e8-4b34-a01a-70a1d5be4b24", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643944, "uuid": "67df20f1-f84a-4317-9b76-ccb7f43cf15a", "value": "12288:SX6jY/c1dmtUw6A5F4janSAhszj7UTN0lT:MItRFA5FoaSae/UTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643944, "uuid": "73469493-8e91-40cf-8871-deca990d50a4", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643944, "uuid": "2ead3e84-59fb-471a-ac2e-4619b8b36707", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643944, "uuid": "12c5f9e1-527b-41e5-90ca-2b18cfb8c6a5", "value": "81b76350a44f6356246271612e6f23f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be0e327-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639641709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641709, "uuid": "25e07393-a659-44e1-919b-9a16ce30c998", "comment": "Malware payload (Loki)", "value": "8d543a8050ee8cb5aaaf441e6723c719", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641709, "uuid": "88f3d010-0f60-405c-9d8a-bed486288dfd", "comment": "Malware payload (Loki)", "value": "a9fedd960e1cb5c991c1e575d8ccc3abdef1573031470afa37a6d2ae65e34979", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641709, "uuid": "371c641e-d0a0-494c-b507-22cfa81bba8d", "comment": "Malware payload (Loki)", "value": "5c043f8252335ac2a8c2b942a04d54a66207b688", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641709, "uuid": "8a91fb89-506d-4125-84dd-6e7d522146b0", "comment": "Malware payload (Loki)", "value": "858be3f5a01501c92806acf3120833af5f878e5b781192366835bd2726d87b048d250a146d2d1e60a1699dc8845b2525", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641709, "uuid": "31161231-e509-4344-922a-527431fa307f", "value": "T1686412467324F2FFDB4A8ABA9C0B884579EBDC258B5B47308465B7AEFD7C7811042631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641709, "uuid": "b1577255-cfef-4ed4-a96c-b71e7b525220", "value": "6144:BFpJjcDKTUqRc7qBw9l84gvDo2NN+Xkcg1OPEpP+vq+iLJvjAn1TG1yDCjY3swgU:lJjcDIc74w9JODtiy1OMpP+piLJvKuyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641709, "uuid": "42f7653c-2901-46e1-b900-67fb38919d6f", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641709, "uuid": "a4401908-3081-4d7a-ac6f-0547ebb1b728", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641709, "uuid": "4b487f78-27b9-4f6d-bae8-365a62687e6e", "value": "swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30113bf4-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643756, "uuid": "6c2e17c7-e677-4816-9823-b7c99c857c7a", "comment": "Malware payload (RedLineStealer)", "value": "5c9b134cf7cfc4ebae5309364babc694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643756, "uuid": "c9bb5bf6-b936-4391-b13f-eaff6581cfdc", "comment": "Malware payload (RedLineStealer)", "value": "aafbadbbd1c3bdb87cf200beb3a318eaabdb706933958248106ae3d295883384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643756, "uuid": "38113b49-e8c2-4c8c-9efb-5bd755bd12db", "comment": "Malware payload (RedLineStealer)", "value": "0ee5939f287240f6f48c62ff81ea977efa13a236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643756, "uuid": "aaf0bc3d-2a0e-4ed4-b6e1-ef3a75b68d00", "comment": "Malware payload (RedLineStealer)", "value": "7db4e1669b86a6565d614594a4850727bb0777e0df697d6282f03c539bcde0294182d53e0b62121892f6a5fb6295bb69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643756, "uuid": "553b36d2-81bd-4e1c-bb4b-d437f7b964ae", "value": "T1B9A4BE00A6A1D035F1F752F84AB6936DAA3F7DB16B2451CF13D126EA4638AE0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643756, "uuid": "00ac3690-39f7-4f42-a5ce-530b6af86301", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643756, "uuid": "10860827-f4f4-4cde-a545-f23c0785f9e4", "value": "6144:oSN685Kkggs15Si1JPAPLEODlIrhS22z1TEo55DrD0SFwEwZC/R:9hKWK5DYPLXZIrhS22z1Qo5x0SFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643756, "uuid": "247eb142-da2e-47a8-9c0d-8a49a83c2f39", "value": 456226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643756, "uuid": "d0c53da7-e1fb-4d34-99f3-2fc8d46b6728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643756, "uuid": "dce115cc-2a6a-401b-a729-53eb51216f52", "value": "aafbadbbd1c3bdb87cf200beb3a318eaabdb706933958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd8e5e-5e94-11ec-96a4-42010a9c0029", "comment": "Malware payload (Hancitor)", "timestamp": 1639675216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639675216, "uuid": "b376afd2-3581-4eb3-83c5-beb88559fea4", "comment": "Malware payload (Hancitor)", "value": "25aa698dd41b00af0a6b49b76ae6b24b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639675216, "uuid": "36338096-9f15-4799-af4e-b50652548535", "comment": "Malware payload (Hancitor)", "value": "ab1b6a130a72a8fe71e6c3e9e650dffa907b6f33e99ef667c6dc7c30cbe15ef0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639675216, "uuid": "16079209-5ba7-4c74-a9b4-90c1b267c000", "comment": "Malware payload (Hancitor)", "value": "e4d5962d6b9eef2a136a4e2630a464aafdf05e85", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639675216, "uuid": "ee1d7954-2600-41c2-8a43-3399324d517e", "comment": "Malware payload (Hancitor)", "value": "98dcac7ca3eb615f1e1f93e6573916f8d9cf4b10ba8b0da8dffa29b36e259290a4980ef1e622ce800911168ee1a8e1da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639675216, "uuid": "1378b26c-eed2-49e7-94d7-a046c46cf832", "value": "T11014DF17B25ACE53E519CBB5BF86C6C87B2ABE499E01B2DB35403F1E3FB85508D10618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639675216, "uuid": "2222ce6e-a8d9-48bf-905a-f9f27478effc", "value": "3072:yeMiYqWxXdUx4htbWf707Ah51uTIk5eq5+p1YM/aVZ2TmZTtX6NAkvJlB:UiYqWVGq7bqwG51u785oTtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639675216, "uuid": "5f1dd8d3-a06b-4963-8ba8-bac8856ef7f6", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639675216, "uuid": "43d8504f-fb34-4037-9915-198ba0f15de3", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639675216, "uuid": "4c919e8e-49f3-493a-9679-3a39a5911394", "value": "25aa698dd41b00af0a6b49b76ae6b24b.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa819fd9-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641814, "uuid": "4af3ddb6-795d-4189-989d-f8554bd3b978", "comment": "Malware payload (Formbook)", "value": "538bdbae2c32d899af9a4bc40767e14b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641814, "uuid": "683f7c34-d075-4d5a-a4c8-d57d61590575", "comment": "Malware payload (Formbook)", "value": "aba2eb67f79087c5e7cc125933d59e7d2b44fee3ea8a50fb6f5b4520b0c196ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641814, "uuid": "e83bf9f6-7fda-4f36-afb5-b6c8a347796d", "comment": "Malware payload (Formbook)", "value": "e208398487e9622bf718833968f327da8c70f4c8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641814, "uuid": "43b354f8-b625-4ae0-a094-1c51d5f362f4", "comment": "Malware payload (Formbook)", "value": "5edf9e12355adb50d2f4004da31066321755e90fca81bb50b2dd81bb415ec94df094e9e228ec93a3cb5629a61f7b41d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641814, "uuid": "52c4cd55-12d8-45fe-9385-07a964eb2e77", "value": "T1CA052365FFE69B03EB9D53F439C2621B929A8D85870CD28820667C55593E230AFF609C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641814, "uuid": "4c834004-fcd7-47ec-91b9-52d27fbd0d19", "value": "24576:a5+whe5i4JGiScA888YH3Lc7IPKKaiQvs:ABYPSct893Vbadvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641814, "uuid": "d1c67aef-c341-4a89-9796-0cf0591b1f0b", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641814, "uuid": "e2c34e3a-c245-4494-a4b3-b8d77faf683e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641814, "uuid": "40991103-aa9a-48c0-8fcd-1c3f96c4a6a8", "value": "Order Confirmation nr. 2021O1274.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b48e137-5e5b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650647, "uuid": "5e90202e-0ffb-4dcd-ad26-aabd477b472c", "comment": "Malware payload (Gafgyt)", "value": "eeccc0ee8da28ea2d2f54a021ac3839b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650647, "uuid": "301b2324-953a-40aa-b2b2-897b226f5cb9", "comment": "Malware payload (Gafgyt)", "value": "ac0bf6e23a25ea38aff693a7abf0c2fd0f025f78844ca0c7480ae3d026070fa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650647, "uuid": "7e8f04e9-abb6-4579-a08a-8f0f861c73f2", "comment": "Malware payload (Gafgyt)", "value": "8ada73fd1d82a0a1ad01b09f04e8eb31ada4aa72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650647, "uuid": "2b08ce57-cd37-4164-9799-76fb76f6b13d", "comment": "Malware payload (Gafgyt)", "value": "16d76fd59d07dd859480376f93820c79f0e0ae8138e97db80001c27da3ce4e795c29bc6267e5f73c21dcf8a5b5aeaba0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650647, "uuid": "e14f90b1-5a73-4e21-b290-6ab6f684e10b", "value": "T181E3B51ABB619EB7DC0ECE3305AA4602118DD19612E97F6BB6B4C52CE74BC4F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650647, "uuid": "2b1da02c-4fb4-48f4-aa02-001a2e1e7d0c", "value": "1536:nhXeTT6r9UIxFMpZPo79UhI7jQlXB5hrG679l5MrLgRUmkmgF/kDOOMbM:nhTFaP2jC5h48RUmkmgF/kKOMbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650647, "uuid": "dbebb836-6a70-4c49-8b4a-ff062a6c8ac2", "value": 143822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650647, "uuid": "121ba684-0619-4ca9-92b3-2127165962f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650647, "uuid": "8c24ada3-46e4-4ded-ac05-aa8fb3d9af75", "value": "eeccc0ee8da28ea2d2f54a021ac3839b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37217f2a-5ea9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639684140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684140, "uuid": "ea6de278-68e8-4037-8d88-480b6c4d92ca", "comment": "Malware payload (Mirai)", "value": "bd101abf67de97d9a0934a4d3a00ba9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684140, "uuid": "6fbe9734-f67d-4404-a506-5a91b3bc4f7e", "comment": "Malware payload (Mirai)", "value": "ac200f584c780797804888d1aacd86c62d14fd7c65cce9b54110850ccf4a2a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684140, "uuid": "77342586-873d-4b1c-bf41-4bcf68d2138e", "comment": "Malware payload (Mirai)", "value": "5f66247df695f5632f7cac8fbc9ef28a582c417c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684140, "uuid": "787ee22d-a7f3-47ec-a3b0-c86ac043d50e", "comment": "Malware payload (Mirai)", "value": "4fe06d971e09d2f1010a5e9ed0fde830a37c3661230474e8172240bb6c6348553b7a9125bb009010e5a581150c24bee6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684140, "uuid": "79aebc4c-2f00-409c-add5-5619c6bbacbb", "value": "T12E233AC4F543DAF9DC0B05702176EF33AF72F1E61158DA97D7A49A23AC92A12D40A9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684140, "uuid": "99f759e0-a717-4185-8196-fb7c81210878", "value": "768:9YJYlhTfL7/XWFlO2YrlseT1eXDTFiCl6g2tonwWQ15fz81s:eJsTff/XZ9bO1r2eQ1Rz86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684140, "uuid": "eaf68e15-3463-4b9b-a2ad-c3911e4ca9f7", "value": 46384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684140, "uuid": "a5deb601-da31-4650-8d61-580d321d1f2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684140, "uuid": "58eeac4b-085a-4f94-b753-0adec4c46d89", "value": "bd101abf67de97d9a0934a4d3a00ba9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f704e2d-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641688, "uuid": "74ee81b7-37fa-43a4-a67c-e404bb31ce72", "comment": "Malware payload", "value": "96c07e0b14f6c2a9df4a9275a95f84d6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641688, "uuid": "112e7832-d2ad-4bd1-affd-798c4ec6729e", "comment": "Malware payload", "value": "ac468635590308647c7c186bad0faf44abd8fd371d6ef8dbfa0605b7bacad49b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641688, "uuid": "37ea7844-e94b-4694-a5ea-1ef2b9b73876", "comment": "Malware payload", "value": "d05b5eada7b659527bc1883cb76c9865433bdfca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641688, "uuid": "f8cd16ab-d554-4293-a55d-5da47da73e36", "comment": "Malware payload", "value": "3a2119cea8acd5c9de1ca25c00f357d092e5aa6e74e8ef99b34befe5e98b16ed622422fe8ef16a7575a956c953e463db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641688, "uuid": "3a6e3192-e484-4406-93cf-ef8a4123a07f", "value": "T15A72FBBCC45702A88F86A3F8671B6F49008CB61EF7999273727C9B7457E6D7A401283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641688, "uuid": "0cadb789-b494-4382-8229-ba8e334d8127", "value": "384:Fqf51gcfNsWs9fOYr/8s3HPnzlm6maOJ23D9ZrDa:W/IfRL0a5Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641688, "uuid": "fa667d65-4225-4daf-a909-b9c41f4600e3", "value": 17335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641688, "uuid": "1a966cc2-63ee-4490-ab13-b4a688fd5463", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641688, "uuid": "3001e82e-a6b1-48ed-8223-d5a7b5a7373c", "value": "Invoice9998798.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15593ae3-5e42-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639639846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639846, "uuid": "dbb73b9a-2193-4863-be30-2bbe3b41ce08", "comment": "Malware payload (AsyncRAT)", "value": "823f5a90491d98ae5129b10a777fb247", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639846, "uuid": "58fc0f38-ddec-4cfc-be19-1d72373de51b", "comment": "Malware payload (AsyncRAT)", "value": "ac6ff436075886c4a58ef900c453b12fdd17464e6d803ddd7c4745ac224e0c1f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639846, "uuid": "1fadc86d-9483-4a86-8a5e-faa7750180c9", "comment": "Malware payload (AsyncRAT)", "value": "4e6ce90f306faf6956db4010e4fd87db4f7e3fc9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639846, "uuid": "daa22f66-a7af-4f18-9481-6dafb1f73d6c", "comment": "Malware payload (AsyncRAT)", "value": "ad2322fc9605e9aae09b64b0b7cb5939cd6d3be764069a6f1a4d8f7ba4755cce05db16243721cf08d047b58ee0dcba40", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639846, "uuid": "4bf909b3-b241-482f-a00c-a9222ced7413", "value": "T1E064F14036AC5F27D53D4BFD5466250213F5903B7213FF882ED6B1EF26A2B428A12E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639846, "uuid": "edf2522a-7a72-44cd-8a97-f5e1115e0ef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639846, "uuid": "a592177f-a021-4919-a27b-a9c6eb29ac36", "value": "6144:emqHdSAGuHoA5QF19zjZxMLQTeA57ph4Kl4JVHozdIubGKEyX:emvPuHoA5QfJjZMvAJfrmTIzdIuSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639639846, "uuid": "ee7e92a5-7507-4377-838b-98cd1164b7c1", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639639846, "uuid": "a5260bbf-df22-4f0a-9c50-affa40721cb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639846, "uuid": "f889f780-9e01-43c8-8bb4-501c8dbd5a5c", "value": "Confirmation transfer Ref#0012134253.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb0c4f2-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613447, "uuid": "0325c8c1-15b9-495c-8b8a-c4b35db8c107", "comment": "Malware payload (Mirai)", "value": "bc9929cb5e4d9ec6dede5ad6c09639e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613447, "uuid": "0794099a-2aef-4524-b177-f18f9210d95e", "comment": "Malware payload (Mirai)", "value": "acec2ae58d4b00ca366e7f41e207894aaee2d168890376a08419421943f72a9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613447, "uuid": "14da49a2-b156-4c2c-bfdd-5e680cc641c5", "comment": "Malware payload (Mirai)", "value": "020891774660b2140cf0c8bc6356d71ff456cdc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613447, "uuid": "b0504d6f-820e-4c50-9738-32093987a90f", "comment": "Malware payload (Mirai)", "value": "cf405bb4c28209a59c30dd40f5c638b56e9ec7f4b66915d8f66e4b1741556fd2e4d698872c82a2e5b18a40215528913e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613447, "uuid": "484e2182-9c30-4b72-8d83-72898bfaa413", "value": "T1B0B33A57671C0B43C58B5AF12C7B37F187ADEA7112E225C5A40EBFC01B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613447, "uuid": "82c3fab3-c2a7-4cef-b53b-9970601c52b2", "value": "3072:JHXrsU7PNZMHNrONBbsQ15hkqu4CK2QnI0PDG4gQNcR:J3LTMHNrOwQ15hkqH2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613447, "uuid": "bb37ed30-3635-4821-8201-50070787d1b9", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613447, "uuid": "1dc834e1-f94b-4e10-a99e-93fc3107c060", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613447, "uuid": "4ba7b1da-e0d7-4ab2-a885-ea8bbfb8fb2b", "value": "bc9929cb5e4d9ec6dede5ad6c09639e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6960e5e7-5e52-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639646858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646858, "uuid": "38ea50b5-8c7d-4164-8a7b-52c7d0c5b5e7", "comment": "Malware payload (AgentTesla)", "value": "fd23fbdaceffea98e53b10f2215970dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646858, "uuid": "c51923a9-5cbb-4262-be86-3b0b71cdfa64", "comment": "Malware payload (AgentTesla)", "value": "ad0d9b3afa924be48034b82b1f3d7d55e47c4831ee6486bc96496209d492515c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646858, "uuid": "77221f83-8a3c-4706-bbb6-97b8507294ce", "comment": "Malware payload (AgentTesla)", "value": "58179e1513babca27caf922eacf545eac7922352", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646858, "uuid": "2f893cce-0bd6-4775-a576-6d284e0b6748", "comment": "Malware payload (AgentTesla)", "value": "f12ef745e6b5498490e502d37e61e157bed887632df13b29a1f5d87c39d50354047ea2a2a0e3c82b667d1c17f9aa1e6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646858, "uuid": "00f11d47-9b1d-4767-af55-445d8b24421a", "value": "T1296523477F690577D7F5373898BF9B1A0772AA021A76F8CAF7D62648C806F0A9431708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646858, "uuid": "e5a6babe-142a-4e80-990b-9dff31d6fa16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646858, "uuid": "8b46285c-a363-499a-be8e-0e839eec170c", "value": "6144:TZ5FAaUFvV66yoPq7DH8dPNK/Cjd90xatYcx7ATp+K5oFD4oivXoUfw7evkolvn3:NbdzJjFMYt834Z6GmP1dfKUXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646858, "uuid": "783c5670-9908-42d9-9bc8-96c190828de3", "value": 1506816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646858, "uuid": "962a017e-d1a9-4c53-b542-3f9058fc07dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646858, "uuid": "79f62454-6aab-4f9a-b30a-45ef14e61e18", "value": "fd23fbdaceffea98e53b10f2215970dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa39a2b-5e58-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639649464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649464, "uuid": "17831652-77ba-4829-95dc-7cf04caa3edd", "comment": "Malware payload (AgentTesla)", "value": "beeddc8310c196db53ed3dda3c8a7907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649464, "uuid": "39a4d9d9-007f-41ac-855b-d564ef3a418e", "comment": "Malware payload (AgentTesla)", "value": "adb50f97f23cdb78915ab7be4703c3790110792473f32d040e08115f760c4f66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649464, "uuid": "1caed4a3-eba6-44bf-8c41-9994d70e9792", "comment": "Malware payload (AgentTesla)", "value": "722f8998202ca59a22a7222ee2548fc3e8103d09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649464, "uuid": "9dcea432-5344-4bc0-92d9-e2c43570071a", "comment": "Malware payload (AgentTesla)", "value": "d0131f5520b87a1001c513de64b076276a55e012cef4bf7c9cd4f8fdafa2437b8bedc106e288e152e1ac96045645588f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649464, "uuid": "0fdbf2e2-f07b-430f-ad0f-f7379ed4b89b", "value": "T150E49D212A008BF1D83CF774D1331540A3E76D6A9F11EE8DBDE936DA09B1F45C6A3A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649464, "uuid": "db4bf453-c957-404f-9f6e-bbad1a474aae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649464, "uuid": "6ecffa4e-f19c-44fd-b348-421b5cc40e57", "value": "12288:8/RQOPxUdXry9Ir1d1sDtoFF/wq7hQunFuSC0y5xMT86BwOSSA:8pQO5UZry5OFF/wq7hQunFuZBgvK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649464, "uuid": "44d67161-fb1b-4649-9e0f-e07cdc80d10a", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649464, "uuid": "005f159e-2011-4745-9149-3b84a785d9c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649464, "uuid": "70208821-309d-4952-be78-223d40252508", "value": "beeddc8310c196db53ed3dda3c8a7907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad6ed8c-5e44-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639641036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641036, "uuid": "9288593b-c69a-457a-ba50-cff990632c31", "comment": "Malware payload (RedLineStealer)", "value": "4011bf24bc1cae6f741d6cccfb4b5d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641036, "uuid": "e0bdc7f3-ba20-416f-bf3b-2e0d641ddd75", "comment": "Malware payload (RedLineStealer)", "value": "af33c38728e6510029f859764ecfad0524cb0cb6b895436f2cdb79cfd3669481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641036, "uuid": "c4c08a6b-d3c6-4963-b127-191f57d337e8", "comment": "Malware payload (RedLineStealer)", "value": "2d057b4d4fc202e6529f264daf4c0bfbb1092b5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641036, "uuid": "44edb485-2c6e-46b2-8422-35becc29b3fb", "comment": "Malware payload (RedLineStealer)", "value": "fb9c04c303e8bf88d043a952485959ed7413d54cd80c508c56e42a18256e2f7f498d896cdbadd9957860143be55c2768", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641036, "uuid": "bb48d084-0cd1-4f1f-aa24-e3ba2ef34ada", "value": "T186A4BF00E6A1C035F2B352F859B693A9A93F3DA25B3460CF13D51AEA4B346E0ED31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641036, "uuid": "6eca5ef7-5ba5-48a3-b921-232e693f7c71", "value": "4dbb8565a3af7ad0eaed683cddb0f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641036, "uuid": "b93410ee-7150-41e4-a25b-d65db229442d", "value": "6144:kWZxBUpJozULTyS0ul2+FKd6VMt4ibESIpi1IAtL9CKIGphYpq9gjLNC9U:9CJsE1SyKkt2ETpmIAtL9CvGpapq9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641036, "uuid": "eb945b49-867b-4621-9353-d1804f20d034", "value": 455737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641036, "uuid": "b1dbac43-fa3c-413f-abd9-cc7692aef30d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641036, "uuid": "a4221dfc-f6a1-4808-8e3d-0b475d0512e1", "value": "4011bf24bc1cae6f741d6cccfb4b5d11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73c5127-5eb1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639687791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687791, "uuid": "922aa79b-4bd6-463c-be7b-6ee5ae002da4", "comment": "Malware payload (Dridex)", "value": "bb84035876ade695788729a307e7b72c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687791, "uuid": "539b538e-4bb5-45ac-a8a6-be2b1315055f", "comment": "Malware payload (Dridex)", "value": "af8fda4ee7c3a1a2fa35e6feb4416de3d9ff6b1869df2b1550557f96c49c45e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687791, "uuid": "1ec3223e-413f-4f57-9363-3a3a6094b2c5", "comment": "Malware payload (Dridex)", "value": "9b2f4a3941a9cf48254987c63fa17e2a0bf4917e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687791, "uuid": "32747abd-740b-4a51-806b-453142cb79a6", "comment": "Malware payload (Dridex)", "value": "ef5ec18b9ad4ec98541227a8e2eeea6819f0e89c918123783432ae2fdc3704d3fc5db7882ce2715496d01b6a5575cb7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687791, "uuid": "ed309e88-945a-4bd0-98b8-974c456cc707", "value": "T1B7B4AFE5008B1341E65717BB56925E1FE5269CAE6961FF03F808FA3F702CA68F970706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687791, "uuid": "2d276277-65a5-4b67-b1e2-c0b741924015", "value": "52e2fdaab9e6e0c66f8ede7c1e947cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687791, "uuid": "3bf14244-1168-4767-8c44-b2d442e2bcbd", "value": "12288:qcuO7BnvXnZJ1jNPRfQISExuQlQMA/LG1nbKig1GbaJBhfSQYm9Q7JijTp9A9B2/:KQQISEzA/LG1nbKig1GbaJBhfSQYm9Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639687791, "uuid": "d9c44287-6219-4e21-b7b9-f70d0f23fcaa", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639687791, "uuid": "1b839772-e226-46fe-9dc8-5862c960acc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687791, "uuid": "7b62f44c-42f9-42ba-820b-56766e71ac4e", "value": "SecuriteInfo.com.Variant.Zusy.410517.7.1613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d93a286-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639645040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645040, "uuid": "cdedb369-917e-4b19-9268-fc40e400beb5", "comment": "Malware payload (CoinMiner)", "value": "d71ce21e02a71be69df86872f682c7ff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645040, "uuid": "1d0c978c-c631-481b-a783-b31d28521e92", "comment": "Malware payload (CoinMiner)", "value": "b0df018beb357b81921623def7a06de9a7101422f3df4c42b9d4c5617dffc4e0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645040, "uuid": "591c6181-5311-4be7-a95a-e95dd4f39966", "comment": "Malware payload (CoinMiner)", "value": "eac0980b2a8339193a2918bd38c27bbceeb12915", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645040, "uuid": "3dfa18dc-0d15-437e-ac68-6d43f419cb02", "comment": "Malware payload (CoinMiner)", "value": "bea9c047e931937d0faeae299e6046206825c6e7bbdd8cf7a34442e6ab8f0ed97cc801ee58ce1db905485631e2d107fb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645040, "uuid": "dc74022a-d131-4d9a-a145-3f6f65824905", "value": "T15FE53397F46F8FFEC1458872992239348F2B69721EE35525826D4B0B60E397A07CFB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645040, "uuid": "e422212a-48a3-4e60-b299-e1e1dae7ba77", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645040, "uuid": "bc8dc665-b173-4b39-9fa9-7fb42ba6a491", "value": "98304:YtIF0ZtauDn3HCxocnlMHyaUoHx0SUYjtk6fgSeqKB:YHcuD3HmlMSaUoRPPmegSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645040, "uuid": "288390f2-4b96-431a-9815-36ab3b74882a", "value": 3228672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645040, "uuid": "4f934706-cfc9-4c7a-80f2-5739ef9f396d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645040, "uuid": "8d27f092-ec18-445d-8135-e734ab204717", "value": "d71ce21e02a71be69df86872f682c7ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530d469a-5e59-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639649828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649828, "uuid": "3c6fe1df-4e4b-4912-a06d-6ed45b49de7c", "comment": "Malware payload (Formbook)", "value": "36cc982cc5ac0f3ef0508df043108661", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649828, "uuid": "76cfc0ce-9cf5-499a-9312-5f8b85ac68c6", "comment": "Malware payload (Formbook)", "value": "b21bb739e3596952c4a2c91442e5e3e2785c0be27c59e452ff3d6f2565e318e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649828, "uuid": "36af638d-4213-4a69-a1f8-cee622f3a6ee", "comment": "Malware payload (Formbook)", "value": "e8a0c609480ba3253a5aed904b5bad6e47ad2ebb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649828, "uuid": "c9d54ce5-1c18-485a-8bfb-b244711594e0", "comment": "Malware payload (Formbook)", "value": "93a720f76c50bf79c800fb4533b6cfbc69de0c7679e3d427acb6f42fb53f41ad0755e57cd705671fdb4826500d2cdd4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649828, "uuid": "2c928f99-ff9c-414d-9991-5eb08b37c3c6", "value": "T166A42357B1C28867F9FE03B58673DBA7E3BBE6D546D1B90323404DF9AF31205A542482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649828, "uuid": "c3ca9465-507d-43c5-8316-3b20cb95a3b7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649828, "uuid": "9c924091-7977-4f4b-a98a-7e577ae9f54f", "value": "12288:0UPMspLxgccxYy5rMsxucIfIQRjppGZmtKlD0JjJws:lPMAg3xYyGsQDj3UZm8D0Jjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649828, "uuid": "81576b5c-c2e4-40df-8008-ccc12b156f69", "value": 487840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649828, "uuid": "852122a9-5362-40f4-a624-a19af913e55e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649828, "uuid": "d92cf3b0-66d4-434f-b4a2-8109e8767f18", "value": "36cc982cc5ac0f3ef0508df043108661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708db79a-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641717, "uuid": "6fbd63ef-60a4-4e80-8bcb-f20f210a1a77", "comment": "Malware payload (Formbook)", "value": "68b11f590647acfc98506f35ad14c42c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641717, "uuid": "eedeaa9a-43d5-466c-9984-68ab56837f9d", "comment": "Malware payload (Formbook)", "value": "b2d3d00d3ecd3da76faffcb670f7b18cd70e56c0570e365141202c51d40261e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641717, "uuid": "87060068-9246-4d7f-a8d5-e189c4f50564", "comment": "Malware payload (Formbook)", "value": "637fe6eb5fdf187a2de3cc3a41a4697584e80ce2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641717, "uuid": "842391f6-dd67-466f-a687-072273e7adf2", "comment": "Malware payload (Formbook)", "value": "695f53027cb50e45811a921a77f42db87354b50270c1322ff24addd1b4c5768f0dcab8b5653173d692529225f6edbe28", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641717, "uuid": "4ebbc784-fa3d-4fb3-af1a-a50b69290a02", "value": "T12D64238A23776F8BC1138274AB8063BB512CDC1D0E6064E326D6F63683B659C9DD3B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641717, "uuid": "c36135b7-2e94-4cc1-831e-a3c554cef947", "value": "6144:raB/PRltrwDkpwPz/jHaIurJpFrFb4aS+k0m3glcLIM44D170v3ztpBJTRWqB:uB/PRl6Dkpwbr6bpFr2aZiZ0M4k0LbBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641717, "uuid": "be0d8d3b-8b47-43b8-816e-94fa498a12e7", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641717, "uuid": "bc8d77b7-4dfa-4fd0-9b35-06b626bafa86", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641717, "uuid": "d28eb649-017a-4643-b103-681f3ecff5c8", "value": "Price_List_January_22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cae4a4-5e58-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639649456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649456, "uuid": "72234668-d7e0-42d4-acc9-29db3e578116", "comment": "Malware payload (Formbook)", "value": "9efa07355a0a2991a87c20fbfde15227", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649456, "uuid": "d87c68de-1e13-4a39-86b9-eda48bdc1095", "comment": "Malware payload (Formbook)", "value": "b36e3385713986536d6e45ce45e17efb7f5adb295fe01934c69af535ba5dff10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649456, "uuid": "93055e2a-87de-4bd7-89d4-4118a343ae02", "comment": "Malware payload (Formbook)", "value": "2008d83f63f7f74b425f89e44bdbc2d2d89d87ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649456, "uuid": "e300dfa5-89dc-4f19-acb2-69118f452127", "comment": "Malware payload (Formbook)", "value": "51961c47f8f2055bed7e1a452bd981a1b95e7e5bbce05879eed9f7aa87c30c188f981dc020cea6f5dd7cd90c3bce2835", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649456, "uuid": "d5f5315a-2014-45b4-89fa-8dff0138db36", "value": "T19AA4237E71E0C8F3EE5285B025BBA2BA9BB98595D2D52E83CF482FF17C905065408978", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649456, "uuid": "83f18978-7506-4d34-8fe3-b195f6044d77", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649456, "uuid": "bac6caa5-d0ed-4083-a7ba-b9d991241272", "value": "12288:8PucYdvzaPT5PTYsMaP2iBwnGfTJd4niB:8PWZzaPTqsBOiNr4nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649456, "uuid": "b1952ede-862d-4819-8305-8fdab57088c1", "value": 485029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649456, "uuid": "3f5e1b80-70c8-420f-bfd2-00b51710dda9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649456, "uuid": "2f0d5680-9c57-43a8-a5b5-3c416c6e7a5e", "value": "9efa07355a0a2991a87c20fbfde15227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f265f9fe-5e70-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639659973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659973, "uuid": "baeb5f50-5ddc-4be5-8cba-3f9d9abdd2f7", "comment": "Malware payload (RedLineStealer)", "value": "61279c3db6f0453ab574800cfc50b5c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659973, "uuid": "d85d1d78-da9b-4ec1-b15a-91ef80b4e01d", "comment": "Malware payload (RedLineStealer)", "value": "b45226d089171ddc5d34e642e2a1fa3b9f8f45ae9fb68b8deee5f91a68c9cff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659973, "uuid": "bf604ae5-6b16-4a7c-bf96-7c4347d4cf12", "comment": "Malware payload (RedLineStealer)", "value": "98bdce20160de0ba508a872f5073cd1db2e84444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659973, "uuid": "60c115bd-a0a8-4ea4-b1e6-d3e8d96516c6", "comment": "Malware payload (RedLineStealer)", "value": "efa019d677caff15ec6f72abb4b349c2ef3dd2d8d1d92e009d54a10f782a196a1826eb9c1ec962a0c2ca26d59bf2647a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659973, "uuid": "cb942af9-437d-4c78-bd67-4eee6e5dc160", "value": "T199A4B000E7E0D035F1B652F85976A3BCB93E7DA16B2591CF12D12AEA5634AD0ED3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659973, "uuid": "5ff205bb-039f-40e4-92ac-04728346c495", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659973, "uuid": "aeb81191-20d0-4f1d-aad0-3d7853d517e2", "value": "6144:Kl0lqPY5O5kTt6196AvXlyQFSWXLGIz78B/0h5chg+rQWKO:FlFO5A6eAflyQdXLGIzoB/s5chgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639659973, "uuid": "633776a7-120d-4e8c-8cf7-ee2de4396e5b", "value": 455748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639659973, "uuid": "09a024c7-8b77-4130-8e02-febcc7d5bed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659973, "uuid": "0cbdc549-2c12-4d86-8012-ba91e832dde6", "value": "61279c3db6f0453ab574800cfc50b5c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52073bf-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639642744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642744, "uuid": "0a98132c-b41d-4774-870c-1295d642ac3f", "comment": "Malware payload (Vjw0rm)", "value": "68dd5417687b71ef0bdee8c19baf4dcf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642744, "uuid": "3150d72c-f620-402e-9b09-258414e603ba", "comment": "Malware payload (Vjw0rm)", "value": "b59c919fbd22d951a44903cd83648ed4d26558c7a4b1f803af893bfb16cdb7bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642744, "uuid": "fa893732-41fe-4ab9-a605-5b10c4ef5b3d", "comment": "Malware payload (Vjw0rm)", "value": "11c068485541aeaaa5d04af692971e15f075f380", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642744, "uuid": "ea27f37c-13a8-43dc-9579-70a27a6f3244", "comment": "Malware payload (Vjw0rm)", "value": "7d3feb6745e7df81f4d7c814f5dece6f338a93479871ae5bd8095638f08d76a4de3407da0d8b0150476813f379aed1fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642744, "uuid": "2bf6a81f-65d7-42a8-93e8-6b2615e70483", "value": "T1C84366C07BC2FC85534B5B77BB1670F1EA2E5D9831C44DAAE044B8A0F0ED919E9E56B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642744, "uuid": "6d9b5bca-7d32-4eb9-b632-01fb5cdc33ef", "value": "1536:A7Nn9uR2s2UsZB6MJUULBpmh6JW9pFciTBn:GV9uR2yRITW9nTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642744, "uuid": "76e604f2-2312-4edb-bd3d-561ce3633c36", "value": 57428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642744, "uuid": "b8ad72e8-5f85-4a30-bf6c-40971858eb24", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642744, "uuid": "e84a7e9b-ee9a-4d47-a8f6-61fae514f76a", "value": "#007704.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cd63af-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639642792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642792, "uuid": "1aee4cae-487d-4181-b15b-0d3b95537923", "comment": "Malware payload", "value": "cc652ad0e57431f496b361edfd3b03f1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642792, "uuid": "23a5db14-3bd0-4cb0-af25-90469694abaa", "comment": "Malware payload", "value": "b63292daf6ef92eb5b81395eddb99d9c266692d6b4bbae2f52de7b6aa6f36958", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642792, "uuid": "f2fea272-0559-4c0a-8979-8fad06e25efe", "comment": "Malware payload", "value": "bda6e3e580aaf0700c5fa3484a024251bb32abd4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642792, "uuid": "75c7c2e6-0288-4933-8263-596a67e2a501", "comment": "Malware payload", "value": "eb55d8a395ac1b55f98d730177b5b46f135db266c4785235eeadecf6aacf5c7b20291533dddb8088f5bfc18e280f5475", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642792, "uuid": "41dba4ec-232e-4d28-83ac-95989638b829", "value": "T12E4164F51533C8C2221D16870DA4353DCF5CE293634BAE19DE5E68147F8D8B6B4C0769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642792, "uuid": "29bcd314-0a0a-471f-95ae-645e4785d488", "value": "48:SMhZ2rqlBR2ueHp50riBREYX0yW6eRW5BtU8T0vEZb5:SEZDMuenhdT0u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642792, "uuid": "9494ff6f-ae91-44d9-bd1b-5ccc781a5aef", "value": 2213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642792, "uuid": "6a044b55-5467-41dd-a975-73996b46e22d", "value": "application/csv", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642792, "uuid": "343762c9-772b-43e9-8860-adbbd63f9ef0", "value": "QWMSOP29HJVBSGD.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd949cf0-5e8f-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639673199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673199, "uuid": "44dd50fc-6c08-4b46-a0c0-c3344e3f5743", "comment": "Malware payload (RedLineStealer)", "value": "6aee4c27c12473da1ade949a6dc82a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673199, "uuid": "f1120da5-4bd6-4440-b197-8a816bac735d", "comment": "Malware payload (RedLineStealer)", "value": "b6f75316e6082c8ea8bf892bb90741dc7cac4776b8b394568eb57a6114c03518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673199, "uuid": "72668b67-68d0-4fd6-bd7b-88988399f1d9", "comment": "Malware payload (RedLineStealer)", "value": "8a4a96371c1afe4d916ffa58cc8b27fce7a55670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639673199, "uuid": "b2532617-a301-4712-aa23-d90215b40cb5", "comment": "Malware payload (RedLineStealer)", "value": "d224c2c0b8751e4ca4e865e96ac2ca34b23c7b7d0639814a2f43815148b48bedfe336b7e7103d338b8c0d7948ddb3299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673199, "uuid": "4bc7f039-3734-407d-9170-c511923f43c4", "value": "T15AA4C000E6E1D035F1B716F84ABA92ADBA3E7EA1672490CF13D526EB46346D0ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673199, "uuid": "6ab296a2-fdc0-442a-8a8e-f898e17f3443", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673199, "uuid": "4a126589-12f3-417c-84a7-5868d149638e", "value": "12288:pZIEKbCXpYrnzBXjqMTNODhCjTq3tRu5xuSr:puoX6rnzBFNruK5x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639673199, "uuid": "32853818-87da-4c5d-845c-518ae0b74245", "value": 456271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639673199, "uuid": "6f50bc20-7f03-4de5-a372-513e34647e1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639673199, "uuid": "0515dddc-59da-4069-acfa-887db320d83f", "value": "6aee4c27c12473da1ade949a6dc82a65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e8102f-5eb1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639687796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687796, "uuid": "06df27b9-b819-4f5c-a10c-01f46af05e72", "comment": "Malware payload", "value": "2f1b05a2e8d597bf81d4cd8068715932", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687796, "uuid": "39b13ab2-6075-4f64-998b-a4c00ab6769a", "comment": "Malware payload", "value": "b86731e235e2e628d9ddfda63dfd59df5266b069531e81e8a67e56ee3798190f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687796, "uuid": "2d237f2e-837b-4338-9c73-b25bead07964", "comment": "Malware payload", "value": "31333a74875e85a4b09c84d3c58ce7dfa9981e47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687796, "uuid": "ec3eacea-b9d2-4aa7-88c5-ac52f1f9af38", "comment": "Malware payload", "value": "5564427ec7deeaad26625744e290f7851428eeda147ce1654c501be4fb3361e5dc5082e837f3d6215a8e261dcc6f4ae4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687796, "uuid": "6b093c36-8bba-4405-b6f6-38a147363891", "value": "T130B4AFAC6FCF93D0E12627B95D2C4076DA1DA728B760FBFA75314E6784D4B6230D2122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687796, "uuid": "c49288aa-22b2-4e84-b646-e1ef5247c766", "value": "2a48248992aa49f57391a72b3d033ef5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687796, "uuid": "088643fe-af21-42b2-9973-b4ef67459c8b", "value": "6144:5jYzZ7WCw5bkTSCUBRWvFLCwenfKFk74BnYwd2kquSmsmQqQWyWQ+WcQUS+wOQm2:Re+kYWzenfUksBYkhrN/DZ/VFHXV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639687796, "uuid": "d4dda93c-e038-455e-95b6-20fd9aa7606c", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639687796, "uuid": "2e4a2b22-a03e-4989-bd9a-e0d02224520b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687796, "uuid": "9d84f0c1-8c71-4439-a997-8a01bb1d2e08", "value": "SecuriteInfo.com.Variant.Lazy.89658.9069.29835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8477a8-5e5f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639652501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652501, "uuid": "b9b9719d-4e43-40a3-b19c-434289866d3e", "comment": "Malware payload (AsyncRAT)", "value": "31ba77f5bb16f9816ac0c591035e8484", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652501, "uuid": "99eaa78a-1914-401d-815b-b3c3e425b4de", "comment": "Malware payload (AsyncRAT)", "value": "b9548f24f2d0048e0e3acaf9bf97cb15a84c87ff6aa83d5e49317c33fe1cc3a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652501, "uuid": "bf780909-8360-4b8e-9c2b-76ff9922d8e1", "comment": "Malware payload (AsyncRAT)", "value": "b9b44e545fe6e4d06fe4c70723bf87a379aa817e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652501, "uuid": "8dbd4a94-6d27-4ad3-b312-a0f8ea95d68f", "comment": "Malware payload (AsyncRAT)", "value": "7130cf75daf1457305e09a9b1016989495703172a2cecd60891a2f2e0b0bfb72cd708706ec1e51c8b924d462287be4c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652501, "uuid": "0a990b04-4ea8-4335-87ef-d279e91f7bad", "value": "T13CE4BD8A2CC685A1F83FFFB1886026F717B69FE4E981DADED4C036D5B976A508744031", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652501, "uuid": "518a1dd0-05d0-4e45-a463-15c548e5c14f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652501, "uuid": "1089dbf7-5b5d-4b58-aa1d-45179308f92c", "value": "12288:ZVEMERP3izKSZMF9bPHgKqJpLqosYyQLp7auULNOiuJEIPXh:ZVrE13IwV4ZzeVZw3ULNOiuJEMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639652501, "uuid": "458fdabf-9d4b-4fea-acee-faed9ad8adac", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639652501, "uuid": "6c927038-03ac-42a6-8e11-537b9a99a127", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652501, "uuid": "ed376686-9c44-4029-a88e-c8e1a5d07650", "value": "31ba77f5bb16f9816ac0c591035e8484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8077aea1-5e4a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643461, "uuid": "35d2390e-021a-4ba5-907f-5db73059d40e", "comment": "Malware payload (RedLineStealer)", "value": "11e5708c8f5b25aa9292a3182d981500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643461, "uuid": "1e259dc2-6915-4c6d-883e-1fb8c6a08cba", "comment": "Malware payload (RedLineStealer)", "value": "b9909027425ef1940bc2763ac406a88db04e347629def5d17f63af3a2cc9bbed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643461, "uuid": "2fd4152c-7b36-4f1c-8409-f5b8585151af", "comment": "Malware payload (RedLineStealer)", "value": "9288a59411bed55b04504a4f99ded91b864339fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643461, "uuid": "90e32185-3511-4e3b-b852-2775bfa9d9d0", "comment": "Malware payload (RedLineStealer)", "value": "e40ade03b1666563daf8ecfc090fc65cec8d54f4a8bac15a1e199e22b0c78856673435b2f47c04483a7b0ccaeafc913f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643461, "uuid": "c5b22dc7-3761-42d3-89c7-a5d1f5fbbf00", "value": "T1CD748D00ABE1D434F1B312F85AB593B9B93E7AA16B3890CF13D516EA56786D0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643461, "uuid": "233c1248-2545-42b8-b186-0bb0be466a71", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643461, "uuid": "64c97432-2b3e-4321-8226-c80b553ad35f", "value": "6144:A0g09HVXybZ20LAoVoTRcYNQFMwn8owd/O7uaqEUFRV:seHkbZyoVgRcYNQ2wn9wd/Vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643461, "uuid": "373431e8-f5d8-41f6-9a62-3be332038cc9", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643461, "uuid": "12be1ec1-332d-4b69-aa89-073f358cdf9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643461, "uuid": "0c633701-7374-4790-97fc-e0741eda621b", "value": "11e5708c8f5b25aa9292a3182d981500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4066dadc-5e36-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639634764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634764, "uuid": "6540217c-cd38-4a19-8b4a-65ef61a37002", "comment": "Malware payload (RedLineStealer)", "value": "54446447726fbe67ad95db99b4bc1dac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634764, "uuid": "228b935c-beda-4278-90d6-5d2002896842", "comment": "Malware payload (RedLineStealer)", "value": "b9a61677710393131de90e7029543728a56a9b4115cfddba3cf36604af85e110", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634764, "uuid": "fa81bb85-05e3-4e49-bafe-eac92a67c1dd", "comment": "Malware payload (RedLineStealer)", "value": "42be4c2a5e4da8c91a1915d7605a5c1357ba86a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634764, "uuid": "b6d1e35a-b58e-4961-888c-ae84971b3d5b", "comment": "Malware payload (RedLineStealer)", "value": "57e40494ed62088610a6dd863b3d30500ae97b978f44e0297321e04bb575a6468db59209e56f30e419eccdba635d48eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634764, "uuid": "b55d236a-4d87-4f02-af25-093584e9b1b8", "value": "T11994CF00B7E0C034F2B702F45D7593ADB92E7EE16B24A5CB22D025EA5A75AE1DC7035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634764, "uuid": "611613fa-7ef6-4227-95e8-14b039d488e2", "value": "fa0d97a230fe11fa07527833b096cd58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634764, "uuid": "55a9946f-0d19-4dfa-87a3-59070d643e75", "value": "6144:oCWg3jEdHy+tc+sLcVxZoYLQwT2PRk9fEX1uIxjdAwCu/pv:5TEVmQZoMQY2POfEYgjdOap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639634764, "uuid": "0f7cee2a-54d3-4b39-aee7-d2f50299d862", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639634764, "uuid": "455cf1fe-d45f-4365-9e8f-bbabb27f88d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634764, "uuid": "197a1179-cb07-4e3c-89be-cae6fca3a44a", "value": "54446447726fbe67ad95db99b4bc1dac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a66b8ee-5e74-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639661517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661517, "uuid": "49c76fb2-009a-44ce-9aa2-0c8223b26ac5", "comment": "Malware payload", "value": "f6606332008aa1e35e291929e4548fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661517, "uuid": "c2ce663a-9480-43f3-b088-5daec5e779c1", "comment": "Malware payload", "value": "baa63e16c2b531daf3f328af5eda6ded0e4adb8d0c0fefe57178311b8759ea1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661517, "uuid": "b8e75af2-89a2-4267-9f25-a901557fd1c1", "comment": "Malware payload", "value": "e017247822536a662c6ffd73f08bd62a008206a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639661517, "uuid": "8afd13f4-1f37-4135-a873-893f29471b14", "comment": "Malware payload", "value": "7ebe5b2a1208c1365977a0b3012aec7f304201245855aaede0751ca65cd4f111a7dae091a0cc2330485fdb4727e7b9f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661517, "uuid": "1c6ccc14-41d6-4b7d-b607-2894ddeebbd5", "value": "T17182CEA171A64056D55B65F19F8E8B6020EB79EDC8F5D30D718FAB1E87C3342208B36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661517, "uuid": "2ccdc78b-381f-4a0b-828d-cec63bf8007f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661517, "uuid": "d47bd096-0605-4caf-a632-b13740ce8887", "value": "384:CEFbaF/Z5mrLiL2Fn7+R2G7O7CwyAi/H:yFBse+6ZAi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639661517, "uuid": "bfd07788-a8fa-472e-b595-695bdf8473c3", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639661517, "uuid": "88cad58b-90f8-4b8e-b12b-11a46015912a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639661517, "uuid": "9d189ae9-2947-48bb-aefb-7820b0bb4fb5", "value": "mixfive_20211216-123239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a699cd24-5e4a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639643525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643525, "uuid": "0ebbe426-e108-4c44-93c3-1abe62ad4005", "comment": "Malware payload (Formbook)", "value": "3df60fa9cf10c41e9a56f004f3f13de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643525, "uuid": "f999d712-ca68-4518-81a9-b19f8a167834", "comment": "Malware payload (Formbook)", "value": "bada1121774aa2f95cba11aee3fb48c38c1a30f6995e9540eacfdaf400dbbd07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643525, "uuid": "f287b41a-ac05-4422-a574-01cd40a34a90", "comment": "Malware payload (Formbook)", "value": "76711f15ddfd7e938123f78616e6362f97c6427b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643525, "uuid": "f639007d-0d80-4eb7-b3d5-165848e7ec12", "comment": "Malware payload (Formbook)", "value": "000eda6cb6ce44e812bac35b0fa43ce05a586ae9ef56e2bec3a85ac81efc0bedd7387269f8f9f188fbf444345c591e6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643525, "uuid": "49f1ce32-f4bd-425d-82c0-6856fcccea80", "value": "T165942356FBD09E8EE0D11E7853BCB727EFAE124A8162210B0F0A4F5F3635167015B3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643525, "uuid": "c54d47fc-f885-4e94-ab42-3c33418b50d5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643525, "uuid": "bcc948ef-df63-48fd-91cb-5c7554ac34ec", "value": "6144:rGihgh/H+uNphjMyNwaSWM/y38vdV+DNrDnA7hMhj/RXif5oKfhb/24NsO4Uk9xW:I/e8hjMySx3/gGQAkTRChsO4BOowXnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643525, "uuid": "05b99672-2ef3-48f6-953a-c9d426af9981", "value": 433420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643525, "uuid": "e44d5e43-f176-49e6-b14f-92fea05b3ea9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643525, "uuid": "7e7eff76-b42c-4fa9-ac0d-5574cce45077", "value": "3df60fa9cf10c41e9a56f004f3f13de5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cb91b1-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613506, "uuid": "5d66dc84-b3c3-4644-b88a-b12f14399bd5", "comment": "Malware payload (Mirai)", "value": "9002e4b0352352e0c6797e3e629da989", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613506, "uuid": "480978b7-85f9-4e08-adb2-da05ec0f60d1", "comment": "Malware payload (Mirai)", "value": "bc2da8674f30a68655814cd7fb5f9dbc2a1ecbc0b481962c1374c597f74564d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613506, "uuid": "adf0778c-b130-432b-8393-1fd1b3416d82", "comment": "Malware payload (Mirai)", "value": "cbd3d8c44bab84e00c04e790d6cd19d229858936", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613506, "uuid": "ca3072a4-6571-4a42-a415-378d892517b6", "comment": "Malware payload (Mirai)", "value": "a4d5cdbb0755f239e0eae3ff29dfa2d6dddd5cf29bbd4a904d97bad87a76925652c21fde8f9014508a841c10a7ce33bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613506, "uuid": "ea1883b3-c294-428e-80bb-ac26d802a9dc", "value": "T12DD33B05D8909767C6D227BAF79A428D73236B68A7D733115A28AFF02FC1B9D1D7D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613506, "uuid": "288b587e-9c51-4a98-b01e-cf28cd9768b8", "value": "3072:oVfyQ+d+pceQGfabRVIaZzdhWOiwztem3V45hLtQ3t4WtZxDkmydQCYMhEFg:5bRVIaZzdhoo325hLtQ3bHQmydQCYMhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613506, "uuid": "5cb39416-0c21-4ee8-a25d-73b16e741129", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613506, "uuid": "92010407-bf6e-4596-ab4e-b43bd7759e7a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613506, "uuid": "96475fb6-5f51-43e4-8d04-479137d6eb09", "value": "9002e4b0352352e0c6797e3e629da989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b6e596-5e59-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639649805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649805, "uuid": "795e6e76-3d20-4bc3-97ab-f07c0f451bd7", "comment": "Malware payload (Formbook)", "value": "4264cf96c4354a225036078ac1b06473", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649805, "uuid": "582d94bb-4d7d-43bd-a4ae-e77150b025af", "comment": "Malware payload (Formbook)", "value": "bc83ad76bf99cf257e381272a7db0e07e7faac33aad6de6f2d12460e9022ff4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649805, "uuid": "705d5bba-5a8d-4477-8003-84900444ba7b", "comment": "Malware payload (Formbook)", "value": "46cb611a2ce10e1a484334a2bbf32f8d6800fef3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649805, "uuid": "74ee7236-f1a8-4ca5-922d-89a882326a81", "comment": "Malware payload (Formbook)", "value": "7ec4bb5813ed178be089cff08c9e93e2411402ce95f2318b0239f5ef6019bf608a279d0e4a25a59d2226adc54d5d8f87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649805, "uuid": "95554953-b2c8-4a0e-a566-13e63c5e405d", "value": "T16694234E92D31FE2C6F34370B267233CF67A93F85006B90387C15F667D945862A4A697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649805, "uuid": "92bef3e7-dce5-43f6-9536-b80d57bf6ccb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649805, "uuid": "5648da12-d923-4842-b2ba-e356db51e6a1", "value": "6144:rGidz2QNCGdFwKiNHDPVLobxwL/aXPsu6ZaS8gvJ24Nlwh4rEqzEY51yldHavHhS:BqQWlPLOXku6AMv7NC4Ul9+HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649805, "uuid": "7e1d6170-e07f-42e7-882e-2f8b9662a7e9", "value": 436344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649805, "uuid": "362b17bf-7aad-402c-a4ad-a917cdec3743", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649805, "uuid": "b6185f9b-400d-47db-afad-3c6354ec9a9a", "value": "4264cf96c4354a225036078ac1b06473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce357ad1-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641444, "uuid": "39bdbd0f-9011-46da-9e3a-288ab8c0f841", "comment": "Malware payload", "value": "10e1dca88c9c912f228215b2d97da31f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641444, "uuid": "b3b290d6-0d5a-447a-be83-0c3e948167e5", "comment": "Malware payload", "value": "bd343be370251ba352331a8a11e61255c0b45ac71f45dc93a0b0c38cf3de8107", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641444, "uuid": "8845a25e-06b3-40b9-bde7-5df1197ce1f1", "comment": "Malware payload", "value": "1b94913585fdba6eb55419d64e0dd961071b1ac9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641444, "uuid": "3e28da7f-4592-4f77-8f64-6eb337265089", "comment": "Malware payload", "value": "44816942f67627c400e1ca08a66bed85217a1fe03bb047007e8f0fea3d9e2183bdad35eb1f62fcebdf77071692d12d38", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641444, "uuid": "7af48bde-0007-4e9a-a20f-26ed02191782", "value": "T1BDA56C22B2C18537D0776E3CDD6B63689829BD601D28D81B7BE40E4C5F397817A2E2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641444, "uuid": "69d8e39c-9e29-4318-a43e-1411924bcae6", "value": "24576:paaES1ivWJzW5AxmWFy9swrH6l64I6JSY6IrleBP8L5rXCOPUibbbnWQW4y5Vhmn:patVb0y1racPPiB/MHTP1BIldOYLEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641444, "uuid": "c2f1fa3f-25ba-43ed-a26c-6e4f2f932184", "value": 2215936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641444, "uuid": "a87309b6-fe69-445b-a10e-800cab2b6788", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641444, "uuid": "57eec5ea-eaf9-4d57-99c4-a8177c5635dd", "value": "FacturEndesa.Archivo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed9c2fa-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639683697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683697, "uuid": "9dc7d98a-2ccf-4997-a9c0-e981cc31c75d", "comment": "Malware payload (RedLineStealer)", "value": "d03871965dd088a4d16199f81c9d0a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683697, "uuid": "3f8e1be6-fef3-49db-9faa-2f6d0ac50eef", "comment": "Malware payload (RedLineStealer)", "value": "bdd33d222232f5eb32219e52233605c9550d764833861d92eb4230d745a338f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683697, "uuid": "e7b8dc5d-5cb4-4bf3-9f8f-494be469c667", "comment": "Malware payload (RedLineStealer)", "value": "3775c54bbf9a3bec96d6539f135212ac87a86b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683697, "uuid": "e1086aa6-c46b-48e0-9dcf-aa58c3d23124", "comment": "Malware payload (RedLineStealer)", "value": "beb84cfb5f83b0b20d27671e8bffb00cc678a5adc5089b5d8c002bf777a2deb07643a7b805a68b13ffd88d026d86cafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683697, "uuid": "dade4ae2-d13e-40e1-9c49-f7b289dc72c5", "value": "T124748D10A7E0D435E1F752F85AB693BDB93E7AA1673490CF12D52AEA56346D0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683697, "uuid": "183432e1-89d7-4aa2-a254-fd0747cf4689", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683697, "uuid": "97e6af26-d65c-4bd3-b5a7-593812d54503", "value": "6144:iRQGMRVvwLK/k73M8Rxrv3yTuFwwVq2fyq0tV5:rRUK+88Rxz3yTqwwVqNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683697, "uuid": "4c5a36a3-d318-4a9b-8286-4dd5c5fa45ff", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683697, "uuid": "1bf4ee1c-63be-4de7-bdba-8e834f3dde1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683697, "uuid": "b2a4936e-f0d1-4219-98a7-f34ce97f67f2", "value": "d03871965dd088a4d16199f81c9d0a39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493b1d86-5e82-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639667420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667420, "uuid": "9fa21bd5-20b2-4c36-9f50-593e63790192", "comment": "Malware payload (RemcosRAT)", "value": "05a9489b62092749eded521674b62435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667420, "uuid": "79586a3b-0917-49bf-942b-42075a62640c", "comment": "Malware payload (RemcosRAT)", "value": "be518dfc7bbd3b6b298897a86dde6242a186f613e9930f2c49f6704de37ac4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667420, "uuid": "b9c337e8-b0ca-4815-897b-0359c2cedab6", "comment": "Malware payload (RemcosRAT)", "value": "adbf0ef199e0556f4832814fd3901ca11b5f4332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667420, "uuid": "316dbc10-6419-47e6-9344-f1afc9e9fef2", "comment": "Malware payload (RemcosRAT)", "value": "2c40c0185528aa1b8608265d4fd60952d4ca725617cfd2759531ce4c816305976b21ad6c07e40ef18e1b530c99d66dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667420, "uuid": "9b0e73e8-ad90-4f82-85f7-8e98ff2112f5", "value": "T12AD49E62E6B18937C023167DDC1B966C943A7E313D24E84727E42F4CAF39393692E257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667420, "uuid": "faeb2eb0-dd43-4fc7-b6ea-8f5bd7e6911a", "value": "818fefd508faa2dba213d5a222554a22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667420, "uuid": "08ff1c1e-81d8-4680-9f62-ca91046cec1b", "value": "12288:pr979FvACpZmNFHYVidVqxql53FgXJrmv+3R+Zwon1PRlR:lp92CpZmNFHYVidVqA5VgXEv+BC/1PHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639667420, "uuid": "d94a0932-e296-426a-a722-116c0f8ace78", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639667420, "uuid": "d1dedeb3-d9cf-4c1d-bee3-260b4d69c46b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667420, "uuid": "449a7c1f-cdbf-457e-8335-c5539221ac6b", "value": "PO NUMAFA dec534244516876562,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9733c53e-5e23-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639626749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626749, "uuid": "4adee730-3785-40e7-81ac-4382ad049104", "comment": "Malware payload (RedLineStealer)", "value": "58207b48eff6b6632ea3aefdf15cab1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626749, "uuid": "89c08b5d-564d-4690-82b1-8d56288a4394", "comment": "Malware payload (RedLineStealer)", "value": "bfeb4ebae3d8222ffc815abd885c5bb58de9b239c1621e5f417b39e3b814ad1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626749, "uuid": "ceeb40d6-6993-4751-b0d0-86852bed1b96", "comment": "Malware payload (RedLineStealer)", "value": "31b60dcddf7685f15cf81ad69a63556e23a366e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626749, "uuid": "1523c6a6-1ebf-4204-b2d1-6fc7f85fd1bc", "comment": "Malware payload (RedLineStealer)", "value": "c63b5a03a8adeeca84c3b12ab0cd040ade2a5fa67c144e2efbccc373ac4df86089bab45b5e1bcfc8751b018c22d107c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626749, "uuid": "4503f551-6b20-44b3-b7b2-a9ca9608226f", "value": "T1F2A4CF00E6A2D035F1B312F859B5936CA93F7EA26B2850CF13D52AEA56746E0ED71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626749, "uuid": "50025daa-f3ae-47d5-90ca-80b4d0119c93", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626749, "uuid": "c046681e-5129-4849-8ae7-ca814806fcbb", "value": "12288:RieYn2u+Pwu62hWGnSz3vEUBR5Iemb+yE:RJu+Pwu9/Sggqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639626749, "uuid": "dd0432d5-a0bc-4d87-822f-172f01d426b5", "value": 456205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639626749, "uuid": "4a89afbd-78d9-455c-a91d-6754fe2ad13b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626749, "uuid": "66a9dc3d-4ff6-4ca6-8c93-32ef65bb58cf", "value": "58207b48eff6b6632ea3aefdf15cab1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5596d0a-5e1c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639623901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623901, "uuid": "e2754771-e267-45f6-95bb-35557d28efd2", "comment": "Malware payload (RedLineStealer)", "value": "60dfee98062065fc63059a37948b6986", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623901, "uuid": "baee217d-8025-4883-b6a4-1cef812753f6", "comment": "Malware payload (RedLineStealer)", "value": "c26d408bac28da7f4e5abd9d6e3ccfa0b5c544163c546829d5922bb85fddd93a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623901, "uuid": "648db841-20fc-4237-b70a-cd1925b31942", "comment": "Malware payload (RedLineStealer)", "value": "d8c2f39ca35d4e2e80fe7b4891e5b6070f8a4c0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623901, "uuid": "317b6f1f-c20a-4c55-a350-aaeea7334dfb", "comment": "Malware payload (RedLineStealer)", "value": "9643afc245a4eac1c248d021b820504fc0e72d5fa90f1ab1b4211584dc594ecf18ea97aa7b595ae2fdf2adb5f8d3ba94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623901, "uuid": "2fb5be72-474e-4377-b0f1-10481816194e", "value": "T1EFB533C6E120922FC6F6C0B6964B932CBB5198F9D331B89BE5371909FA5C0D1F2617B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623901, "uuid": "0cb03022-3b41-4548-af4e-59432bb84ab7", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623901, "uuid": "3b69fa1e-149b-483b-8fdb-19c19cbaadf3", "value": "49152:B/x7oCEnGZ8OAXSwIeQO1tuXrSzuVlD3+O/g56zAWsStgyiCpR/wGG04O+4te9e1:B/Vot0hwIG1tswuVF3N1AW7Z/R/wGv4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639623901, "uuid": "8e156ba6-5617-4103-8ea6-514605eb6c02", "value": 2331136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639623901, "uuid": "c2520e91-f90e-40bc-a282-3a2d2dd85732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623901, "uuid": "dafed4ac-8593-42e2-b7b4-0c9dae3b929a", "value": "60dfee98062065fc63059a37948b6986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8f8c96-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639643883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643883, "uuid": "054ada06-cad2-4497-ae27-aa8df8b82844", "comment": "Malware payload (AgentTesla)", "value": "a9d5a77d874c6eb9b5615c49acd20217", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643883, "uuid": "667f2b50-a3cd-49a0-8f4e-f78135468f9a", "comment": "Malware payload (AgentTesla)", "value": "c27e0ec6e98ba30b9cbf31d4f8a6c2108d61203fcf1b3e5d56b367905418eb82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643883, "uuid": "68cc08b3-9ddd-44a0-989a-2e34bafa7d8e", "comment": "Malware payload (AgentTesla)", "value": "a2649e016fe049ae16a7b77a3d2be56e3d2555ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643883, "uuid": "69b997bd-02fe-40a5-abed-4c544ad9d20a", "comment": "Malware payload (AgentTesla)", "value": "695f9e3976fb3c9ab6cf7d088f856e81938c648f4b5f329df3590f60ec79b249f66e797865f033f3c2cfab861e7d8225", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643883, "uuid": "80eaed9c-df61-4223-b1d3-bfa47d7dccf7", "value": "T1D9D423726DDD05F1F730C1C2C0E1867FB783AE526A955C1AE09DE45B160BBE28930EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643883, "uuid": "d1068baf-345a-490c-b5df-0f8c1a6d0170", "value": "12288:cpc7Aj+pGeIerCFsWKAwkijht2vHMEHroOBcBi1aVymu:c6KNeElKrjiHBKBi1Mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643883, "uuid": "236a158c-7817-41ce-b484-836819c88bf7", "value": 634051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643883, "uuid": "6b8f611e-3179-4f14-8157-bb3c530c7a27", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643883, "uuid": "f9726afa-767c-4906-b131-8ce1c10afbc2", "value": "PI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320048d7-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643759, "uuid": "cdd32d71-77da-4985-9f9c-459ddec84fc4", "comment": "Malware payload (RedLineStealer)", "value": "cd0a9b73df153269f31870619f44c9bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643759, "uuid": "7ca69182-2bdf-42c2-a306-c961dc981fb5", "comment": "Malware payload (RedLineStealer)", "value": "c2f4927a0c3658d83a83218bff71076f368ebc0a4d98e916e7a27387d35515c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643759, "uuid": "14b2e533-5a57-4617-a4c1-371b95d765e1", "comment": "Malware payload (RedLineStealer)", "value": "9c00fce3d2f943b655847bfb9581b5738db5e780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643759, "uuid": "082b1eca-0e33-4b4f-a7f6-1d8a5b1da578", "comment": "Malware payload (RedLineStealer)", "value": "98376c72a489aef17338dbf3012aa7be6b586a40fb77cfbe3528f458e688dfed7ccc2f5c193eca2716bbddf91e57a123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643759, "uuid": "14e4a5ed-6378-471c-9c4c-cc1ba1311afb", "value": "T16F54E03079DCC8B2C59345354870C6E51A7EF8216C61858F2B681B6EAEB0FDC56F632E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643759, "uuid": "42dfa28d-884f-4a34-baf2-5748fee0f3ca", "value": "594aca90413b48c89195867843c2ace7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643759, "uuid": "efa07bc1-d869-4226-9f14-7746aeeae34f", "value": "6144:JL0WbINz35Zf9eCHBlO8gzx/PAqqVZ1KjEnL6nYen8g9uzbgwu:JQWb8fAgXO8IPAq+ZQj+6YeP9unn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643759, "uuid": "aa386e96-5933-4a74-97b5-17a3ce339ec6", "value": 300054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643759, "uuid": "45da4a63-81fc-47f1-95a4-b4b57e858194", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643759, "uuid": "266aad47-1a95-4d3c-aeae-846452facfa7", "value": "c2f4927a0c3658d83a83218bff71076f368ebc0a4d98e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1e13cf-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639641338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641338, "uuid": "2eacd35f-bd2b-4c17-a6d0-88d316e57d8c", "comment": "Malware payload (RedLineStealer)", "value": "61781192a2ca877271b9506f67c5de14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641338, "uuid": "a26de82d-87d3-4afb-ac8c-1aff7129fc4d", "comment": "Malware payload (RedLineStealer)", "value": "c5633b8a534309364b874721936c306cd49e8aaff8a3ffb69ec4a6c9c71f0d17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641338, "uuid": "d3f4f409-ae04-46f7-99d8-64efe2117f15", "comment": "Malware payload (RedLineStealer)", "value": "19853a695caf46d6d21046f2483e6832cdbea18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641338, "uuid": "8cb4b9d6-5b4e-403a-86a0-b58d750540e0", "comment": "Malware payload (RedLineStealer)", "value": "f60bf8f37648844a29d9f439399335bff713bedf5c4fa681e188d42c6f1fb862ea0275a9ec2ab0c763f0eac8d982c583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641338, "uuid": "b23fe597-a5dc-4010-9bee-e09900fd0f54", "value": "T145748C10A6E1C434E1F352F84AB6A37DB53F79A16B3490CF12D516EA5A786E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641338, "uuid": "ef7f9105-8985-41c8-a73f-1370c5d2055c", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641338, "uuid": "63d829d9-e8d3-41e9-96c9-8ca16bb25d68", "value": "6144:5VXnENJ3j3GLxkosOAibHdV5/kQejfR0iD:jXnaJ37GLxkosjibl/kQQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641338, "uuid": "dd3869a1-3b1d-4de9-a569-7a82b4a6a9fb", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641338, "uuid": "7afac13e-9e88-43b5-8623-203fe98ebe88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641338, "uuid": "f223348e-8bfc-4104-ba5d-4b0fa1c930c6", "value": "61781192a2ca877271b9506f67c5de14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c134cdee-5e80-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639666763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666763, "uuid": "0ad06b9d-903a-4c9d-8292-29d04114f50d", "comment": "Malware payload (Mirai)", "value": "e41c38ff861f38ac807166cf89d740d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666763, "uuid": "7de13b2d-e8a3-4d3d-9700-594ca641bebe", "comment": "Malware payload (Mirai)", "value": "c5b29123eeb691cc110aa99d2ea787810fcc860aa578f0d0c1fbc978e50ab97c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666763, "uuid": "0e81b165-bcf4-4128-abb4-de92c9762f58", "comment": "Malware payload (Mirai)", "value": "67d520ed4d2ef85db4411174bff4ab84e2d4a1d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666763, "uuid": "6aa28b7d-cb17-4d51-bf1b-95625df556d9", "comment": "Malware payload (Mirai)", "value": "74650e3423e2e462b8f1405bbc3a9c12ca894a4a144a5fff1cf99f1cf4c6eee400727f827665c746288aa7fc8884bcb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666763, "uuid": "a670e331-e7d2-4aa0-aaa6-a82dc6b91c41", "value": "T1D5433CD5B801ED7DFC4BE6B944120A0DFA35B22055A30F6BA66BFC937C320E85D66D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666763, "uuid": "b635b921-a18b-4d0f-9e5d-68faf5fcf2c8", "value": "768:4GehJs8UyHSmfVwuPOHjDmQkODU8eRAu1+E/H9ytYxrVVO8DEctZ:4GyKu2PL5UpRJEEFytirVE8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639666763, "uuid": "bce13511-e407-4838-b423-2783a0f8e0ec", "value": 60360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639666763, "uuid": "ea32b2d0-da65-41cc-9155-38c3f8581500", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666763, "uuid": "77ca615c-b0dd-4fd8-a636-ad423a0455fe", "value": "e41c38ff861f38ac807166cf89d740d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd488c39-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639641443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641443, "uuid": "4fb15d32-660b-43f9-80cf-99d79cfaa1a7", "comment": "Malware payload (SnakeKeylogger)", "value": "1f35a4b90a011491bd3dade42c09f6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641443, "uuid": "73fb6a82-6427-4c3a-a3c2-c840c1dec2c4", "comment": "Malware payload (SnakeKeylogger)", "value": "c6b029b8de634379fabbf8df9972527368f763785debc33ae45dee1df72c0001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641443, "uuid": "761e0f8d-97e3-49a1-8325-441be4655278", "comment": "Malware payload (SnakeKeylogger)", "value": "b40df3584e023b16fe17a81e24b44841a74b6785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641443, "uuid": "7e236e3f-f092-49f4-a635-5183b18d851f", "comment": "Malware payload (SnakeKeylogger)", "value": "d4b5ae7f6dd588258cfabd6e07d3e3e1680d96f749863f8fbe3b6bf4feb5b7a4304a76d56e18864910f8d5e4580913ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641443, "uuid": "ccfaaa6b-ef25-46c4-b547-ccbcc0e986a4", "value": "T1B894010077BC6B27C46C9BFD98A6210103F1503A6513FB986FC671EF17A2F968652D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641443, "uuid": "f1ab33ac-4319-443f-b2c3-8d05947caf14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641443, "uuid": "192977c9-3e2f-458b-a0a2-d3f43156326f", "value": "12288:ixFVuHoA5QfJ7Uj0rMGSE11l9UP80Ybewqe9QuSK3:0YoA5GESMGSE1L92800ewqeZSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641443, "uuid": "67c71573-5908-4fe6-9804-7bd3a60d2a53", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641443, "uuid": "81cd02f7-2435-4c7e-bb00-a107ec861004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641443, "uuid": "c355031d-daae-45ee-af87-f7174931eab1", "value": "2zV3WrAgknEeCqx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09077f3-5e5e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639652159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652159, "uuid": "525fd300-475c-492d-aaae-014c6615020a", "comment": "Malware payload (RedLineStealer)", "value": "7054aa05f8d6c5a87fe7f34672f6eb83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652159, "uuid": "89a5fb83-e58b-4fc4-a592-1a06539661ed", "comment": "Malware payload (RedLineStealer)", "value": "c6d28aa6a2a7d135fe871c5f1e8d98670c690a6abbad8ad21b4188aa6a9bad4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652159, "uuid": "0c1d09d8-ac68-4ee9-a449-28097066d97b", "comment": "Malware payload (RedLineStealer)", "value": "8827746822afeadb30439c142fe4671220eda18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639652159, "uuid": "53623c45-0563-41ac-9782-1715a54c541e", "comment": "Malware payload (RedLineStealer)", "value": "56754fa6bbac3d83b066ddfa6887915e1ae3f8418229f975def9c3a1f989073e66f3228aa712f2c2c422bcb51a8875f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652159, "uuid": "306472a1-58de-47cb-8ec2-df6095b7a4d7", "value": "T11FA4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652159, "uuid": "16ed36fe-f57d-4a53-9612-bce28b8e0292", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652159, "uuid": "e1df0d65-e629-4461-936c-0582bb1c72ed", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639652159, "uuid": "62884b41-f3dc-4593-99ff-57218180ffbf", "value": 455698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639652159, "uuid": "0d0dba53-6d91-4c2c-8c76-140dbe363bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639652159, "uuid": "8e4112c9-7023-4124-b00b-53daf04aa616", "value": "7054aa05f8d6c5a87fe7f34672f6eb83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9feb0d-5ea6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639682812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682812, "uuid": "20476774-9cb0-4d47-a33e-2aeaab8f0a47", "comment": "Malware payload (RedLineStealer)", "value": "4d71bc15d9e9feffcd5fd1afeffa2c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682812, "uuid": "87fa6825-9883-4304-8dcf-da53fa8abb52", "comment": "Malware payload (RedLineStealer)", "value": "c70ec05d702f3726726927d2d524841f67a7a9b5e844f81b0d8fbcfcbd91fc6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682812, "uuid": "27e7654d-8ca5-4dd7-868a-a10330ce3c4c", "comment": "Malware payload (RedLineStealer)", "value": "af4822e1dc585120025e7cd94b7a11b121fa27ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682812, "uuid": "bfe75224-1b2d-451e-875f-5dab7c8ffcce", "comment": "Malware payload (RedLineStealer)", "value": "345dc0911d307e2aa5edcfde9c2aec15fb77dc7072f521051292f191932633c665fd72a9d8346479e4be9f100b200d1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682812, "uuid": "8b2b1dcb-7cc9-457b-9b1f-4461de2623c2", "value": "T13AA4B000E7A1D035F1B212F84ABA937DA93E7EE1672591CF13D12AEA56746E1ED30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682812, "uuid": "793b22dc-c801-4cd5-9445-7e22c13fc5ae", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682812, "uuid": "d814bf32-e21a-4c07-b340-79e8934b7290", "value": "6144:m/ST6obg8FK3NvIG6AkD9jSV1hc6dGO9kehq4eiLV43baV1o23u6pa:5T678hlDyAoGOLhq4eiLVKbaV1rta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639682812, "uuid": "e489021a-429d-48b4-ae12-480aa38cc0fd", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639682812, "uuid": "74a36051-20dd-4b27-bbad-8fa5c6d4d969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682812, "uuid": "1f2c9abb-12af-4373-8cd1-74c08db1035d", "value": "c70ec05d702f3726726927d2d524841f67a7a9b5e844f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881a8087-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639616845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616845, "uuid": "e2ba3b57-7713-4600-a21f-24bea246fab1", "comment": "Malware payload (Dridex)", "value": "fb3adbf683086048698d56b2501d6c58", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616845, "uuid": "0b828eda-c34b-4969-8381-37176fcf46f1", "comment": "Malware payload (Dridex)", "value": "c7115f02b6d2829d45505aa1a9a6e1978d00f57c0180873fa859c29d2d088a66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616845, "uuid": "76bde4b4-4575-43e2-88ec-034f7c2f5829", "comment": "Malware payload (Dridex)", "value": "bb8d2081d9820e2d806b7b16a54a728ebb081958", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616845, "uuid": "0148e640-412f-458d-8297-3951094b6c7a", "comment": "Malware payload (Dridex)", "value": "6780bf62e4cfb966b017d7587168d3fca7297467efbc4d628708ab58f55896effcb83f74e14b7ef0326ab64503c372c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616845, "uuid": "9f2fe253-ccf0-4ce5-abe5-329736c7aa71", "value": "T12DB4C0A33F4B0C6AD4625D3CCAFEF7A6081F66454588CF3072A3735AD6F4542A825CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616845, "uuid": "41a38cd6-2559-4c4b-bba0-454b7779b972", "value": "425f8965b1dafa239bed13744d5413de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616845, "uuid": "c90b0ad7-6291-4e15-8be1-9dc74455047a", "value": "12288:Eav+2yIUMs4UQ0EysQeu2LzmWMdUJPRXLZvR5xdzJU:77D5MdUjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616845, "uuid": "5b9f9c36-c893-4a6b-8225-34bc645ca162", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616845, "uuid": "0d6661fa-c31e-4b31-a345-cf872f4023a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616845, "uuid": "f16e92f6-392a-41d0-b50a-03396a9fd33e", "value": "SecuriteInfo.com.W32.AIDetect.malware2.27365.32501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc3b4a3-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641819, "uuid": "6c94728a-20cc-4f7a-b90f-99948060470b", "comment": "Malware payload (Formbook)", "value": "07d13657969c09576cbb79a1f60fafad", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641819, "uuid": "cbdd1858-9f83-4340-83df-2f96182f4a68", "comment": "Malware payload (Formbook)", "value": "c90047524c263f981bc16f205e841459673cbfe1f6ddc6cd34311e4d7311bece", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641819, "uuid": "fb5092cb-d8f6-4532-b975-1a6de723a729", "comment": "Malware payload (Formbook)", "value": "cebdc7cc8cbbdc4ab7b20b77e4ddc65c90dae98c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641819, "uuid": "7fad9368-31e2-4145-a888-e03923beed35", "comment": "Malware payload (Formbook)", "value": "832e75414b3a48826792cf2fa59686d61351233aef44f1bbd350d627fdda4dc8125406e7def8915853ec38a17f0d028b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641819, "uuid": "97358f27-8ec8-4e7c-8e03-4cc381cb85df", "value": "T10A641248B96E4B12EACBB6BD3DE99D080F14EDBC7A850637F410B1C9283564431DD9AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641819, "uuid": "fdf6df14-caaf-4dfd-9c2a-f792329e90fc", "value": "6144:56rw5yUn/gGo7fIe98j7KkKwhNjxwi2GF/AP0Dz:kw5RLo7b98SkTjxrXoP0Dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641819, "uuid": "5804e2b7-d48e-4a40-a18a-5aead3bee943", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641819, "uuid": "e56a75fc-a2c6-4975-9c39-9343688edba2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641819, "uuid": "f3127433-defb-4d4d-86a8-5aeaa1262d2f", "value": "Shipment Invoice Consignment Notification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62f7b11-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613540, "uuid": "3e3b815a-2948-4177-b282-a30044ece665", "comment": "Malware payload (Mirai)", "value": "bd55db54c1af1c8414a8ff60e0f2492a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613540, "uuid": "99bc70ec-6c80-4517-8a25-8e79157f466c", "comment": "Malware payload (Mirai)", "value": "c96f49e6407b11abd3579ab954bd9f51cee2c2dda8801bac3bdd312e76270550", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613540, "uuid": "a2e61ae9-82c0-475c-a462-f4cef40c7997", "comment": "Malware payload (Mirai)", "value": "c14e9a775d4348225fe1707b1ca68aeb6bd71209", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613540, "uuid": "99ac271e-2286-4a14-9e87-a8f1312c3cef", "comment": "Malware payload (Mirai)", "value": "7c5acd84f3dc23f1cae8ed7166bcd3a18c4e624b759501b13352040bbcb95af4116bfe11a774471b777b134a5e10e738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613540, "uuid": "8efd39e0-bb2a-40e7-8af3-f9a4f7cbb922", "value": "T12E044A05DA809B17C6E237BAF79B428E73239B5467D733058928ABF03FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613540, "uuid": "88dbf34d-f0d8-4a8a-a0cc-ade222d4ead6", "value": "3072:sV/Yb/dnp+eQPGq+/nTCappbzHdQLpzcMbPB7r45hLSC3zVbYM/992qEmmw3Bq/C:++bCappbz9QLJbPBA5hLSC3z+M/90qEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613540, "uuid": "54feeec5-b44f-412d-a4f2-6d2342aa1c7b", "value": 180192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613540, "uuid": "608981b5-9e4f-4c50-bacb-91b057adad33", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613540, "uuid": "79465aa6-8ad4-4388-94c3-f2e439d7027e", "value": "bd55db54c1af1c8414a8ff60e0f2492a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbbd404-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613469, "uuid": "2f2db0a3-7515-4f84-bb74-923ad60c02e5", "comment": "Malware payload (Mirai)", "value": "1d4ceb227f4938469a37d1aadf6c654d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613469, "uuid": "c17fc21c-6c99-4457-a6b8-a75231e25ea2", "comment": "Malware payload (Mirai)", "value": "c9dd16887a74fd818b2c7b60b987ce9b87e709c74f85eb96b1f7027396c81874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613469, "uuid": "920ff0c5-9fca-4aff-94d8-b9bdcb7ea69d", "comment": "Malware payload (Mirai)", "value": "035a8a502401ca5124360ca7ba797a1e889013bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613469, "uuid": "3463346f-70e7-43d4-8379-56ea7af20265", "comment": "Malware payload (Mirai)", "value": "7902e3693f05e513757326b686014f0c0ea49a81a605d64a59ca0b89927b5a64d27669bfc9bf22893598fc0ded4971b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613469, "uuid": "a9250cb3-204b-40c5-8675-cc95eefdc4f2", "value": "T1B7A35B82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613469, "uuid": "a1287f24-4008-4c02-8530-bdcf27f33609", "value": "3072:aPaqjPQP39VjGWX98732V7kGyNV45heTe7FXnf0OzTyoQQub:ahQP39VjGWXW9NV45h+0FXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613469, "uuid": "d3283b92-e16a-477f-9621-bbab1806ea7a", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613469, "uuid": "2b752e3f-f9db-4bda-aa04-7a26eb72a323", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613469, "uuid": "d79729d7-12c1-420f-b5dc-f3e7bf73a6a7", "value": "1d4ceb227f4938469a37d1aadf6c654d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400f64a3-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650225, "uuid": "cde42d73-d45f-4f36-8283-849e96ab1a0a", "comment": "Malware payload (Gafgyt)", "value": "6045dba28d2af428e6d035a3dc7b0c62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650225, "uuid": "996df993-5cd3-46d3-a6d6-06fb4bcb55b4", "comment": "Malware payload (Gafgyt)", "value": "ca4e0b7c10e521dee70a50f8d14d7c7e10599ba5642e2b833a0417d8e234a0fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650225, "uuid": "c22c8c1b-623c-4140-854e-d477442203f3", "comment": "Malware payload (Gafgyt)", "value": "c8a3f52ece09291893b596a243ef739a33f5c04d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650225, "uuid": "65011318-d1c5-47eb-a02b-040ebdee743e", "comment": "Malware payload (Gafgyt)", "value": "7e11bc9c1841f3e222fb5385ada8895b4caffca3afa28187f4fc43d70e0278b251e9fec96f8e51b06049ee24b1e85a82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650225, "uuid": "098b9ffa-900e-42c4-99ab-a81f8cc14300", "value": "T1F5A35B4794628F73C086A9B121EA59300B57F9A25F9F1A86613C9BF0074F4DA780FFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650225, "uuid": "f277d975-2f70-47cb-96ac-4cc56988959a", "value": "3072:PmqWaTK1f1tPawXVdNk5hqbcnQwtjL8mH+VoB5t7ff2o:mDpbvNk5hpQwtjL8mH+Vovt7ff2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650225, "uuid": "b1f6585e-7b6b-4f0b-9735-3e2c0e76dd7b", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650225, "uuid": "481dd94c-cb7a-4b60-b443-f41d0af6eaf8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650225, "uuid": "621bd155-2aaa-4757-9175-8f7bc9806b36", "value": "6045dba28d2af428e6d035a3dc7b0c62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abde0c80-5e47-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639642246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642246, "uuid": "9a9b190f-5f05-4468-8b3d-344007a2f071", "comment": "Malware payload (RedLineStealer)", "value": "b06691c16c38df919e814bb555fbd34e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642246, "uuid": "020b11f2-e045-4c6d-b523-264e331861c4", "comment": "Malware payload (RedLineStealer)", "value": "ca612bb8fd70332cd79b0dcf033e1432bfc27a7f1c11928dc0668c59dd67f230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642246, "uuid": "e3ce3074-4f13-433a-befb-f8a6436f08b6", "comment": "Malware payload (RedLineStealer)", "value": "f67c4b9539546c40c65918fd356a330bf1d62c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642246, "uuid": "902fb34f-2c8d-4d25-80f7-aee55b126c8b", "comment": "Malware payload (RedLineStealer)", "value": "94bb05241a5a4406e8d7153b4c517428120b44757d62e1281efcb3a4a37b845dc39f2c39d85c9634127d5456ad795e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642246, "uuid": "8c9a16a2-4c81-4040-aec1-7cf27a5c16f5", "value": "T1EDE39D3179DCC872C5A355308870CAE45ABAFC612621558B37A8376E6E70FCC46E636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642246, "uuid": "f7228d56-9932-4b57-b356-2b83fb8fe8e1", "value": "594aca90413b48c89195867843c2ace7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642246, "uuid": "12715794-cbc2-47c4-934b-ba7ece563175", "value": "3072:SLg1/qkFyR7Lpgi7W33JkQNWrxpzbgqru4:SLTkFsNZQNuzbgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642246, "uuid": "e5807fbe-f5b1-494f-a4d9-dac36c406b34", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642246, "uuid": "5f3854d5-1ced-43c3-84de-cc2cc1cb3377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642246, "uuid": "599f306e-1732-4920-9e59-85119908fbed", "value": "b06691c16c38df919e814bb555fbd34e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33df18b-5e65-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639655143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655143, "uuid": "662dae39-7418-4387-b1cd-a178bd069dbd", "comment": "Malware payload (RedLineStealer)", "value": "48cd626dcaf176dc4c9073c4f6c9ca16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655143, "uuid": "ae931c29-3bd5-4282-945d-f00d77f7b248", "comment": "Malware payload (RedLineStealer)", "value": "caa9e86ac425057e422a94a50fc4820f37ffdd58e17540037f000efb03cfa623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655143, "uuid": "599517a8-2767-4b89-a200-16f40aac810d", "comment": "Malware payload (RedLineStealer)", "value": "cb5c57dabe13f675813cd8cc4626963cde625247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655143, "uuid": "c3eac7df-90f3-4766-8407-b4f9b17179b9", "comment": "Malware payload (RedLineStealer)", "value": "d1dc79229f8a677f0d700120d48cd3b42666dc1689546c5806c9abc706137671a95f61a5a16ced002d857cea804ab85f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655143, "uuid": "3b1be0a6-b045-48d9-8189-bd8a5faee7b4", "value": "T1F6B32A5037D89A08E5FF4F707CB0111883F1F5536412E74F6EC564EE2EA2B81AA52AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655143, "uuid": "e46d0af6-3493-45cd-994b-c75b48a71a12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655143, "uuid": "b341994b-f2b2-4520-9057-e0f7fc36cec2", "value": "1536:4WZ7qFhhCdOHmf7Bc/Df4Bysd9p/yD/fF8HKqGbZAKai0jrWbnUf9S004ntv:4WZOF7CEHmFc/Txsta3ZmpW84qtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639655143, "uuid": "2eee68c1-29cd-4fad-93be-83ce064c6bfe", "value": 107768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639655143, "uuid": "82b22a92-ad81-443b-b160-41427780d78d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655143, "uuid": "b03fa5bf-34de-43d4-b082-d7f2c1bc4074", "value": "48cd626dcaf176dc4c9073c4f6c9ca16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb19368-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1639641469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641469, "uuid": "d5f3fc52-f7a7-495d-a74e-c1e208289bd6", "comment": "Malware payload (TrickBot)", "value": "51ddc2c6f1de2401ce987d589dad88c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top161", "colour": "#FE955C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641469, "uuid": "4ee4a033-7d28-4162-9d69-b33d7adcc6fc", "comment": "Malware payload (TrickBot)", "value": "caf56d168c770350da83ad489809007df7813c3bef213c35f1c6e1f4bf3142de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top161", "colour": "#FE955C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641469, "uuid": "cc63cb09-b017-496e-8930-202c8373a445", "comment": "Malware payload (TrickBot)", "value": "01fdb7c669d6c2e8f18393bce2fda086367390d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top161", "colour": "#FE955C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641469, "uuid": "2bea4d9f-8099-41bf-973a-3bb101b7f8d4", "comment": "Malware payload (TrickBot)", "value": "956b3ba4af0a36f1c881740f3860f2ed249faad916b3c2b52819dc30646488d011a10af27e057811753d25ff0c674b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top161", "colour": "#FE955C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641469, "uuid": "fc0b5249-353c-44a5-9150-7dc83f770f52", "value": "T13674F1117390D432C4661930547ACEB11A3F7CE6F6648AAB37C43A6E2EF17E119363A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641469, "uuid": "61796d49-e26d-424e-b471-b6edbd68ac57", "value": "1e14b9e859467fd4c1b3bb619c1a4550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641469, "uuid": "b304dc45-5eb2-4893-990c-c9f55d85157f", "value": "6144:+7a7bO89lgMMMMMgMoJMMMMMMdMMMMMMMMMYI1MCQ4UCLgW6uGpofipdZT4kfmA5:+7an9SJMMMMMMdMMMMMMMMMYI1tbUCLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641469, "uuid": "232e3115-53a4-4959-8298-9b4f91c33900", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641469, "uuid": "0f6c8bc5-a5a6-4daf-b9ec-24047d0805a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641469, "uuid": "800d2c9a-7f4e-4ee2-ba15-4a0a34fae6f0", "value": "51ddc2c6f1de2401ce987d589dad88c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2d023d-5e7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639664848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664848, "uuid": "44430210-4f59-4dc0-b63d-2786fcd0f35b", "comment": "Malware payload (Moobot)", "value": "571cb6e8fd12a8e46055965fcaf25c11", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664848, "uuid": "307e547e-fcaa-4b91-a7bd-f0704db88f14", "comment": "Malware payload (Moobot)", "value": "cb62afed7697f430b4d2948d9de557b41fdc23d36367d678a6fc0b42508a9289", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664848, "uuid": "27abc60a-1cfa-48ff-85ac-04a6124d9942", "comment": "Malware payload (Moobot)", "value": "3691f0e479d7050958bc6ae346d11d1c7cb90b9b", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664848, "uuid": "0a608bd4-8b5b-47e9-b520-dc1a4781cff6", "comment": "Malware payload (Moobot)", "value": "fdbd66a83b745b68ec91bab489ce4dbcb5045556210ef75adea0f25b1796300c3a6db51e593ef90cb7b553882d4d9344", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664848, "uuid": "da9377c7-37cf-4f8a-90a0-0a1ff375b446", "value": "T1BF43E80AFD81AF01D4D812BAFF4E114933935B98E3FEB1129D116B15A7CA91B0F7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664848, "uuid": "289362ce-de3a-4c15-9065-94be9e5eff88", "value": "1536:ASnIL/uuODQQDaM/GOsjMRPeMm5dlQaiH8vS/HwbZnD:2zuJaM7sjMRPeAL8vcHwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664848, "uuid": "a1fb69ce-c81a-4a7d-b41d-e98447692e92", "value": 55644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664848, "uuid": "226966c2-df81-4992-9243-f3f422e0c146", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664848, "uuid": "4ea7591c-824d-42e1-a3b3-371afa39b659", "value": "la.bot.arm7-20211216-1427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5adcadf-5e34-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639634209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634209, "uuid": "d930a2d5-a390-4f54-bdff-de7794375a6f", "comment": "Malware payload (RedLineStealer)", "value": "1ddfe92d483dd2fae0ee7e42b65eacc6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634209, "uuid": "53fd4fb2-da8b-40fa-ab22-22024d78d930", "comment": "Malware payload (RedLineStealer)", "value": "cb9d1e502d2ebbdf2b2ec01b1baf467d50a7d6a49f9dfef3107d5ae2eb1920dc", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634209, "uuid": "aeb87042-8395-4d8d-8fde-e197532572c1", "comment": "Malware payload (RedLineStealer)", "value": "5d62e365ec7a0f938f6ce6723c6200a727b12cca", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639634209, "uuid": "4ca94823-d3cd-4f45-9d81-98a861774d3f", "comment": "Malware payload (RedLineStealer)", "value": "e298ed45c97010a122844ef240c43c09f699aca10273969b60b2c0f802e38b954340d51eef462338d64d2e37d4228fd9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634209, "uuid": "f41edd42-597a-4687-873e-3e92f87f9b86", "value": "T1C0642345A8B997289B394763D3FF5E2B27C124CD1D4B0D34AAA8F1024C5E6BADC23F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634209, "uuid": "8c0bceb0-2698-448c-921c-a51192288604", "value": "6144:01On0RMxVEuDpMCzNiO/cmKk9M1hhPCgRkeeKrx03OFu1e+UuSKJdZG5S3yolR6P:01O0uyCzNcoM1hhqgRJPdciOzsKJdZGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639634209, "uuid": "b9229bc8-23a3-4afc-8747-909c1356c2e3", "value": 334597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639634209, "uuid": "4e47b2db-f579-4d71-bb93-4848ab669ba3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639634209, "uuid": "c4ca8cbb-993d-4f55-9f68-4d8cb94dfac7", "value": "2021_15 (5).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79cc223-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639646533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646533, "uuid": "4623a585-7c68-48e6-b87b-ed74064b7ea9", "comment": "Malware payload (SnakeKeylogger)", "value": "de6e84c68ea27027850e873639ba82fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646533, "uuid": "c8db6a6d-2bf4-438c-ace5-f4509ea2887e", "comment": "Malware payload (SnakeKeylogger)", "value": "cbc1bd6d8bd39663f748459e050809572f955a586b1186e5010808eaf94c576d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646533, "uuid": "302230c5-4d73-463b-b4da-effd87befa90", "comment": "Malware payload (SnakeKeylogger)", "value": "3694b29be12832022c967cb680e9f9f1ba61e362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646533, "uuid": "c61b4bf4-6d0f-4a4e-8717-091b4a82f56e", "comment": "Malware payload (SnakeKeylogger)", "value": "bc9cc9e1d4345f400962b8139dcfffd2e8186dde43518b76a07357d1ecbe71ae0f2743a4580fc59c3a87fb69f2b66c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646533, "uuid": "a927b61a-c125-42a1-ba1f-ae24007fd50f", "value": "T12325125A64F09196E8E4317C4F93C23C67328D984C47469E27D87F9B3AFC2E7460A9A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646533, "uuid": "c213b93b-bd08-43f9-abd3-1131d5c24627", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646533, "uuid": "d1a9978a-f97a-4a03-89b0-96b6c51d117d", "value": "24576:ua49jTy9b4DHB3pyL8QzzAUuqd1TXGEr1FCRa3:ua49jTJh3wLPAUz1THr1f3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646533, "uuid": "10da6c0a-ba9b-4a4b-b37e-09e1a8637bac", "value": 968580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646533, "uuid": "d4091ca6-dd9c-4539-b491-31405627232e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646533, "uuid": "81b7e200-2af0-455f-b723-937366f14e5d", "value": "2309876543234567890-0987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c8a9b6-5e16-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639621009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621009, "uuid": "46ef7686-e2bf-4075-8b15-c382ff62fa19", "comment": "Malware payload (Mirai)", "value": "c8af3d4d3d71eb75878cb9a9dd42d588", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621009, "uuid": "3afdb5df-4be2-451d-92ed-a21e3ace4c3e", "comment": "Malware payload (Mirai)", "value": "cd38f1e423f4483379dba4ddce1d62736f695e770c6e34147207a288fefeb72b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621009, "uuid": "de88435c-3e99-4477-bbc5-38f63c0439ff", "comment": "Malware payload (Mirai)", "value": "3bd00c7842836696a169481fbda5e707866b90c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639621009, "uuid": "05673500-0bc8-4f42-bd1d-116a8ed718f7", "comment": "Malware payload (Mirai)", "value": "783a2b564bda9b002a369616b0c2faa48cb5e6901c510909877503833893661a14acc10ae9a8d298c531a0fdb4e75be0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621009, "uuid": "38101324-98be-4abf-83ee-db684ce6c703", "value": "T1EE833924BC391E27C0E4A17A21F7C722F6F5228D21B4866D3D710F4EBF656407A47AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621009, "uuid": "24a259be-f645-4a8f-af4d-0108a99c18f7", "value": "1536:FrWZnHJSkunDANOJpkm51+fUH4ZtNqMCcz75ZXbtAR:xWZQJ0cSftszczVIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639621009, "uuid": "7a82d3de-2b06-4df1-adc4-3e8bfb819eb6", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639621009, "uuid": "a2ee1c80-66c2-48e8-b524-7a4c83d9a295", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639621009, "uuid": "1e79c92c-c587-4550-889b-f7685041e9c0", "value": "c8af3d4d3d71eb75878cb9a9dd42d588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a9c5ae-5e67-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639655766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655766, "uuid": "9973ffaa-bb28-4db3-9956-f154fa1e364e", "comment": "Malware payload", "value": "4ccf5b4a90d482cfe71430bb5dc9ee00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655766, "uuid": "e1ba4cba-d5be-4e7b-be03-13484388b7ed", "comment": "Malware payload", "value": "cd694f49dac4bd29f6fce4ef75fab8e96e8649cbbde63f24701510020a9a0b21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655766, "uuid": "7e5a9bf9-d4e0-4edd-8160-750283424a8a", "comment": "Malware payload", "value": "1cc95496672e9a7a3b85bf8c461f5623bc799acf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655766, "uuid": "f162e9da-7e03-4ac7-89c8-edcf799b2995", "comment": "Malware payload", "value": "ae451d0983bbb801a4331fb4eb525ddd14291eca800e55b09b2f076df7957ace3fe479b5b190165a45af6d496d88c04c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655766, "uuid": "7321811f-d84c-4353-871a-ab0ad3af2e2e", "value": "T154B4BF3DA3BD5B12D43E5BBC34A3E02453F5EF06D711E31F7DE465AB6462D810AA2209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655766, "uuid": "7c4fc61e-f687-4e07-bb0d-0c0d81e870d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655766, "uuid": "ccf59dd2-6602-4544-8c07-941e080714a9", "value": "6144:U0QKK9oeiPmm6LsNfWnoJdO4lAv6SYLfeJPlKdwBIJCTd3g+y26:BQR7m6CfWBn6Tsodyb3gS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639655766, "uuid": "6477ff14-1200-47e9-a2bd-d5fdc9de71be", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639655766, "uuid": "3afeb1c2-29d4-4767-9061-9ae2e1dc136f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655766, "uuid": "e6254779-4fd4-4a8f-b91d-e4fa4a090158", "value": "4ccf5b4a90d482cfe71430bb5dc9ee00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4827b449-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639683739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683739, "uuid": "6706565f-8b33-44b1-bf4a-63a130be4e16", "comment": "Malware payload (CoinMiner)", "value": "28ce98dc0bbd297f29f7e2e81e5261fa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683739, "uuid": "1ea79eb7-100b-4dc1-bf81-bb704ac8ee94", "comment": "Malware payload (CoinMiner)", "value": "ce5d602e1a0499025a1d86ba53187d39bbad1157bdcb29559827dc09b20a7d13", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683739, "uuid": "84fccbc9-e025-44d2-a526-cc66e3ed3790", "comment": "Malware payload (CoinMiner)", "value": "0c7b81a22bbabf57227a88babc1a1253823a62fd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683739, "uuid": "bf8cbe4a-87bd-44da-97b3-a561070ce031", "comment": "Malware payload (CoinMiner)", "value": "1c4596619e4588b17b2f607c6ae18ec311f708a2dcd1bd68e2d3408a36238e1067f0bb5fd735b134a3fc5eb7c9e26795", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683739, "uuid": "b77c3924-a5db-4490-88c7-01148801d4ae", "value": "T12CE523EBF84ECFF8D1078CB992527220AB4925321EF7C552679D130E75F3026528FA99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683739, "uuid": "c85f6672-4d67-441d-873c-f81c00b69f67", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683739, "uuid": "511d0153-edac-4d3c-96ac-5511ad513481", "value": "49152:sNDUOxx+Ngk2MK0hq9+8bpJJpxjkRAqjxjNSD2S4LbiGfGw61Da2+xe6zRvZTN7r:0DU3gcKZhJL+/GZ4Lbj61D/+pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683739, "uuid": "fdbe0681-5199-40cf-93d9-3a35a24af55d", "value": 3281920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683739, "uuid": "61a5b751-dba1-45d8-8d8e-8d161ab9cfd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683739, "uuid": "d887fdbb-9f7c-464b-8e2e-7d0417281157", "value": "28ce98dc0bbd297f29f7e2e81e5261fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b16042-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639645099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645099, "uuid": "46523eb1-510d-4a3d-9161-8a3d1e951765", "comment": "Malware payload (Formbook)", "value": "dd61e5e3f77da364cc0c52fe21f83980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645099, "uuid": "c5e0d1f9-45ee-4f5c-abc1-4bdc83033bea", "comment": "Malware payload (Formbook)", "value": "cf3b369b7d0b7a81fde0af4a6415b4a43dd726e4750aba216ee21ffc0079f11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645099, "uuid": "d5b31386-0a6b-490b-b30f-f68e6dcdacdd", "comment": "Malware payload (Formbook)", "value": "ba7ac807a73ebbb93b1953533570296fc7e5bc31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645099, "uuid": "e975a5c8-6c2b-4172-99b9-e33fefe40ef3", "comment": "Malware payload (Formbook)", "value": "22b5b6e0888fbc6e5afba61606933fe821e1664ec15736cd95048889603468c4f30edb8181fe7a87d54c21bfa97b727e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645099, "uuid": "059b9dda-7838-44a0-9f93-74b1fc18f7b2", "value": "T1AA942315E1F98AE3C99722735AB7FEBEB3BC515484755C4B6B810F77A072748C340A21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645099, "uuid": "7bcba31c-2579-404e-9539-143baec20395", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645099, "uuid": "80bba9a5-8724-4ddc-becf-d0a54a10fcb1", "value": "6144:rGiGUghTzI/fQAekpqKHUhY66b2FNIe+wKwgm8vAs9qQ1ehUCi/m+49X5oFhj2:KIQpaUhYCzIpwKa8Ysoiu6e+4BOFJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645099, "uuid": "9260bece-467d-4501-a9a0-41dd1beb3fd4", "value": 437437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645099, "uuid": "52ee745a-b4d4-4d92-8e38-6e04cf1b9911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645099, "uuid": "79138873-5221-4c84-8b48-59dec6bbb0be", "value": "dd61e5e3f77da364cc0c52fe21f83980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3f787d-5e7e-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639665765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665765, "uuid": "e1b67d3a-e084-442e-9bc3-67db6c620362", "comment": "Malware payload (IcedID)", "value": "8810603a5a8c9e113a57e4b006172089", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665765, "uuid": "61e89aee-5f52-42d8-a618-2f519f9f8661", "comment": "Malware payload (IcedID)", "value": "cfe2caf566857c05a6a686ca296387c5e1bfdda6915ff0ed984c1c53cd5192a3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665765, "uuid": "b1406ad9-e34b-4793-a604-234fa76c3fc0", "comment": "Malware payload (IcedID)", "value": "79f9b20dc5ac57800800404b3345c8d7c63009da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639665765, "uuid": "d4095243-a213-4d04-bd22-af563f1b007f", "comment": "Malware payload (IcedID)", "value": "1994d30a836ae81ec1eb9c25c5cf2b24d1232e56d37cb87c859b8622f1ad3c6834c7b33042009e68c50a282cae4e5061", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665765, "uuid": "1f038f3f-f4f9-4eb2-b299-27f7e555ec44", "value": "T171C312BE90985835C66E0130A28BCB55E5F9D0B0C9685F3A2FE0D640272B5D0FEEF785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665765, "uuid": "c7a007a1-7d7d-4c33-b8c5-1978a587e479", "value": "f8538924eae17346ff1ddd4fbfce4bfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665765, "uuid": "dc33769e-5093-4dfc-a1f4-b228e896dbe6", "value": "3072:hzld24tJoPInVkvQEmUE4rKdOqYCB4eZ4GHG9:Z32lPIVkIEDE50gBk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639665765, "uuid": "e75d0715-0537-415b-ae92-f053a382218e", "value": 123530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639665765, "uuid": "e1339059-f5e8-425d-8505-7c5d9cf1e641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639665765, "uuid": "5ca0681f-d9a9-4226-a682-2d9cf504e12d", "value": "youYou.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c490debb-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639642717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642717, "uuid": "233f8a83-6e5d-4583-85d2-5a680c450364", "comment": "Malware payload (AveMariaRAT)", "value": "70c8a67a7812369229e2bbec85d7cdfd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642717, "uuid": "341c9d5f-42de-4b2f-98b4-72e7fcd444a7", "comment": "Malware payload (AveMariaRAT)", "value": "d045c70e29d4d456c44987360425ba064495d7a31566fea9f970de9d3290bb65", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642717, "uuid": "dee7e317-325f-4327-bb1f-c05f39bf90af", "comment": "Malware payload (AveMariaRAT)", "value": "2b5854154ffbcf12374214434a5d5bb3bd2c1648", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642717, "uuid": "722b85d3-9d8e-49c9-b0b3-25672301dbe7", "comment": "Malware payload (AveMariaRAT)", "value": "8d8b375d2128589bb41677d7466b2869bf1739533927fafe42fbad3ad29ade6f8beb65e2242518fe6191f4fae744df6f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642717, "uuid": "75fbac2e-9fec-4a2b-9419-470d6c1d6bd8", "value": "T122C42344BA97E9B6280E0579B90A4CBBFC0F76DB917CF2BF48184727DF52B406287164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642717, "uuid": "32bb79c0-b5a8-4c78-8139-e9277ab3a52d", "value": "12288:4wdFCaJKiD4ySSlt4Ec+k/+yAQ3tvt8WpBjX0cADlmu/f:4wh1I6k/ff3NuiWcAxmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642717, "uuid": "1950e393-a43b-4dc5-a7c6-3861905e9750", "value": 573819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642717, "uuid": "d824acbd-4606-4329-98e4-3a95caa80630", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642717, "uuid": "56334042-e7ed-44c1-b9a4-52156123c58b", "value": "NEW ORDER pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a96f307-5e53-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639647371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647371, "uuid": "5a6f59c5-bc22-49cf-ab20-b95dac7ae73c", "comment": "Malware payload (RedLineStealer)", "value": "e2e8ce2d2b1733b2a765df38852536f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647371, "uuid": "ee1b1ae4-ac5e-4236-84fd-54dc87c940b8", "comment": "Malware payload (RedLineStealer)", "value": "d0c3b4545068d8aa7b9a6bc83901c2681991f7b7b33de6e9a4a8af3c0731c56b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647371, "uuid": "4bc06bb2-c0d7-4f48-b951-431f2dd4d992", "comment": "Malware payload (RedLineStealer)", "value": "70b9228574a36bbe64ed459dbdf6a57d31ce0295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647371, "uuid": "c2f0b327-ef27-41ec-867c-38c2f4503e6a", "comment": "Malware payload (RedLineStealer)", "value": "bf7d42f9cb46109086799c7275bb2a6f29adef5c840b2173bea92bce2291033eacc1a194e402674eb542aef5143eb03e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647371, "uuid": "bec286a3-608e-40bb-a486-d638934c01d5", "value": "T146A4BE00E6A1D035F2B312F859B59378AA3F7EA15B3460CF13D426EA46786D5ED3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647371, "uuid": "1c3d3fff-ca31-4c0d-9327-309061f7f8cf", "value": "6fbaa45117a2f7fc3777360d227d81b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647371, "uuid": "cbe32e6d-1131-4385-94ec-e3531c90b44c", "value": "12288:3thagedRc89jhwN+XmLkfJ9hlt//CQ5m:dhTmRc8fXXzdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639647371, "uuid": "6ca37cbc-b08f-4fb3-8677-438db9087bd3", "value": 456201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639647371, "uuid": "7f18bca9-9cd5-4047-8803-07e3422b242c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647371, "uuid": "fafbba70-c35f-47be-a808-35e4c5db9b1c", "value": "e2e8ce2d2b1733b2a765df38852536f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8a036e-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639644634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644634, "uuid": "4b9e77d1-c11c-4f7b-adb5-837ed6747b26", "comment": "Malware payload", "value": "046db44dd0b5a2d51c1da35dab55075e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644634, "uuid": "b86412db-0022-44ef-af14-d9ec8470c3d4", "comment": "Malware payload", "value": "d0d2fba501371d60864287d7523a71506fc162a0ced94421b2053533003bd248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644634, "uuid": "8336e988-a10f-450a-979a-cd6d34f3968c", "comment": "Malware payload", "value": "86075e6dcbe5ad0396c14efaa6e6cef39e92b09b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644634, "uuid": "ea5e5239-eebb-461b-b3cd-649e19429b21", "comment": "Malware payload", "value": "67991cb8d7e25f1c3d0a4e8568a4f4de3ad4889f4d1f889826524002cb9db50733165a078712923c3cd6fe8df780204b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644634, "uuid": "64321657-8fad-431d-ab7b-ad511e001f2f", "value": "T1B1C51B97C6BD62D488B3C41C4222A654D1F3B4588235AFB797CABCF60F725B026AD7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644634, "uuid": "071794a3-a45d-4dd4-95d4-78706e553b22", "value": "24576:VE9yEcTNLOPhtwFAQwDiKpGv9qo3N+OmLyxW/uk+reNWCyTLW5P9fSt3qr13qIgc:VEc1k+F2DzGBGx2ZeNWDWeCB2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644634, "uuid": "b6fc31b6-d46b-44ca-9d42-9cc837ec385b", "value": 2688167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644634, "uuid": "1ebe8252-58e8-41cd-8a82-f37b6af1e81f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644634, "uuid": "121e4297-57a2-4d02-b840-0dd6ccc22642", "value": "046db44dd0b5a2d51c1da35dab55075e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05206ac3-5e73-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639660864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639660864, "uuid": "152d49f7-27b7-4471-ad45-92454423a8b4", "comment": "Malware payload (RedLineStealer)", "value": "ccbd411a6500a8afd7fa8564b843863a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639660864, "uuid": "e3126b1b-89b5-450c-a81b-f734a35c2706", "comment": "Malware payload (RedLineStealer)", "value": "d146f23f55a708b73654bbed239f5210d975e2ccd88788c09bfecc233823d948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639660864, "uuid": "3605f2aa-77be-4ef6-b183-843ce9b19330", "comment": "Malware payload (RedLineStealer)", "value": "b7342e8d378b4ffa9b3ebe2b4f277843126c55c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639660864, "uuid": "6539e34b-079f-44b2-9934-030acec363f5", "comment": "Malware payload (RedLineStealer)", "value": "e052eb3910f8f660419b3ac3fc7a33229adba667ee422f8cabddba6776ba660f750c2a49b2c4cb6257c79b08c86ec746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639660864, "uuid": "bfcd67a5-2dc9-429c-80c4-9c32fbb8f3bf", "value": "T19DA4B000E7E0D035F1B652F85976A3BCB93E7DA16B2591CF12D12AEA5634AD0ED3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639660864, "uuid": "baae0721-a48e-4516-a7d1-78e01ea10288", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639660864, "uuid": "e0521b60-4a9f-474a-af12-6b7202ee661c", "value": "6144:Kl0lqPY5O5kTt6196AvXlyQFSWXLGIz78B/0h5chg+rQWKO:FlFO5A6eAflyQdXLGIzoB/s5chgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639660864, "uuid": "a42d46a3-f352-43fc-8654-1bb1d29314ce", "value": 455742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639660864, "uuid": "6ab7b53d-219f-4a59-b5e9-fc286d5291a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639660864, "uuid": "5876d2ca-a1a1-4dd8-afc4-cf358ab62e2e", "value": "ccbd411a6500a8afd7fa8564b843863a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9180e0-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639642621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642621, "uuid": "66347f18-e119-428b-ae23-77c602400dfa", "comment": "Malware payload (Formbook)", "value": "44dd8d56908c9d7d0fdcbed727efae66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642621, "uuid": "efd89826-0532-4691-9c49-68a074a8f00c", "comment": "Malware payload (Formbook)", "value": "d171f955c622dd166a1b1dacd131120228b424f4cff8dc47fd3df14cc0957bc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642621, "uuid": "e3cf2616-0d96-4044-a680-1ec36f396fd3", "comment": "Malware payload (Formbook)", "value": "efef989746fedc983142555141a9552bb74c1e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642621, "uuid": "c459d7f1-aca6-488d-9a57-911a28ec3f04", "comment": "Malware payload (Formbook)", "value": "97f03f330c1764411970761ab8da085f9668908c34b3f26ba34d3ed3ab4ec2ee96a0b70fd760b83fa58e63258fc57a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642621, "uuid": "a62bd13b-1c52-4f36-8aa3-865d8998fdc0", "value": "T14E05DF8A28C685A1F83BFFB1C86035F716B69FE4ED81DADED4803AD5B9767408745032", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642621, "uuid": "28c41c5a-43db-4b33-b876-192ee68bd1cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642621, "uuid": "73c6e9c8-8d01-46e0-ae84-124f412a92d8", "value": "24576:Qa3ENZw3ULNOimf0pVVJTwoaIrRybq5pJE3k:aNZwFfiXTwoaERybqLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642621, "uuid": "116de661-a039-4f86-a8d3-c64cb58c4b26", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642621, "uuid": "b3f99f3b-1569-4075-8751-dc3876f61332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642621, "uuid": "64346a57-18e7-4fad-a535-73469cc87b77", "value": "E-Invoice No 11073490.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab45510-5ec0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639694293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694293, "uuid": "32a20570-e4a8-4885-a6ba-9200c90f562f", "comment": "Malware payload", "value": "da13ea740fac604524c73cdbe17d8c93", "object_relation": "md5", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694293, "uuid": "c14dbd20-7f64-4ca7-9b90-a7220c186e1e", "comment": "Malware payload", "value": "d196969b35966462fa03ef857e375e9d6172b34053b115df04cefa3d673b9d85", "object_relation": "sha256", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694293, "uuid": "d13f3178-8b91-4ffe-89c3-26553dbe4168", "comment": "Malware payload", "value": "c9406cc0e157eddadcb7bd74e29240307090e9ba", "object_relation": "sha1", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639694293, "uuid": "aca659b0-c591-4400-9217-5296845e3e59", "comment": "Malware payload", "value": "8334fb2e6929b578e5ec31d0063a9d858261b3a204a096f8549eed0ab58d2f933265fdfe65527565a24c1d67c836157b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old", "colour": "#D686E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694293, "uuid": "0a12d932-3683-4278-bb16-c2fecc4af1b3", "value": "T121B44A4AB77484F6E067C13DC9538B8AE6B17C554B30C78B0265E37E6F332A15D2A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694293, "uuid": "020ca79f-b896-49ed-a058-05f1b17cd250", "value": "4cf4b38071609c74a3ee082e69607e84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694293, "uuid": "a471a241-be9f-46c6-90c4-11c1b60201aa", "value": "6144:zmZWyZQHbH+tRDdnwViy/ZZ3VaTntfT5QfltVnbJQiFJyc/01laBaFX470R:qQyZU5iwZpVaTnttQfltjQiF81l4pgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639694293, "uuid": "c561249a-fc69-455b-9bc4-95a4e70b6320", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639694293, "uuid": "cf5aa219-e50b-40be-b5f7-45cf9ad8aeb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639694293, "uuid": "194c2312-5bc1-4f73-8f46-56baa033ddcb", "value": "d196969b35966462fa03ef857e375e9d6172b34053b115df04cefa3d673b9d85.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8eedcc-5e80-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639666752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666752, "uuid": "475c02bf-5a77-47a5-a723-f754edf82b6b", "comment": "Malware payload (Mirai)", "value": "5f0b26d3af7950ad0208a536d86e331d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666752, "uuid": "6ac56ffe-e4fb-4a2b-a8eb-b0de78f28a27", "comment": "Malware payload (Mirai)", "value": "d1f97ffb4eb09162d76ad72752198db09a4c17829a0502de1f74583419455853", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666752, "uuid": "406c98f0-a854-4663-8207-2dac331dc60e", "comment": "Malware payload (Mirai)", "value": "ab0f4c6e6de57fd95fff8e4150ebe531fe9b235f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666752, "uuid": "9d55914c-bac0-4185-9623-35546858c99a", "comment": "Malware payload (Mirai)", "value": "6cd8934d927165048de823ab4e64ad762b3df14f3ae0ced0b7ecb6a4c90b16e126d39405937244fc3a0903a3c9c773e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666752, "uuid": "5fa82fcc-f144-41c9-bcc6-81e05615cc57", "value": "T1CEC2D19FD8F42D43D8BD6C3EA4AC4770AC80F1D2B12AA78DA3C45C00B75945B789A4B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666752, "uuid": "80813fc7-2690-4d5b-8ffa-7f61b2e6b4d3", "value": "384:4G1OrLNQji1jhEiqEjYeJJltlrGPWL7eici9BaosrpTRWGVCzhMhHa:4kOr5DheYJTt4Pq7egBazddWM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639666752, "uuid": "f8a416c6-a1a1-46ff-9e6b-8866f8e6ec7b", "value": 27024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639666752, "uuid": "6807e84c-6da0-41b3-b2ae-cfa3648376ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666752, "uuid": "397efa08-7ba8-4391-a05a-3f06ca2a688d", "value": "5f0b26d3af7950ad0208a536d86e331d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246a856a-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639645025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645025, "uuid": "eacd4058-4451-489d-bbf5-45f65faa8597", "comment": "Malware payload", "value": "c436c42e07c1c93c8aeb48b35b51a4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645025, "uuid": "55b63c2b-243a-4590-80a0-6f8ec2fd4258", "comment": "Malware payload", "value": "d24441e5bb3497db8f6c39a3579b1415efa467e18308f1f9dff228d721b0bdde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645025, "uuid": "4b0d9a2d-603a-4850-9ba7-6bce2babdc78", "comment": "Malware payload", "value": "4ecb0d749df3b76e6fd367bb8cf7fdc2b50a8b26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645025, "uuid": "39395ee7-056e-45eb-967a-59af357a2ca6", "comment": "Malware payload", "value": "7555ef4326816260a43d51c1e10a24f46aff994f12e4f1b408c65f2fc08ccba2d30b7c2d8fad6203822965c39d66861e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645025, "uuid": "562d5a6d-9941-4325-908c-2c7e630b944f", "value": "T197C533AB1417FF72D5CE68B4C8CA3A4BE9E3E31CC6BA31BA1B3DA41561053859E4DC11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645025, "uuid": "da916452-6092-4a36-a8ae-c1707de86d7f", "value": "fc9dbb16a3b4e2cc8d0db4a2164aacd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645025, "uuid": "4221cd8b-370e-452f-a05f-b9f9009ef784", "value": "49152:J5/gVHefM1wisXSKCV514NNgMiMlqQxmRmfiiQ8+KbM7k1NPJQZpktax:L2efHSXV5iOGqQDfii+YfJyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645025, "uuid": "6f70c75f-e566-4bf8-babe-d68319db658b", "value": 2616320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645025, "uuid": "7a6e12a4-00b1-4a58-8be9-64ad692d468a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645025, "uuid": "3df58eaf-8415-46d7-bb6e-e17c5f954604", "value": "c436c42e07c1c93c8aeb48b35b51a4a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6901e2-5e42-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639639831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639831, "uuid": "63c9c2a5-0619-4e7b-9f68-f269c6168270", "comment": "Malware payload (RedLineStealer)", "value": "48e2558ab87d852004cacbdf006d83cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639831, "uuid": "8150eb41-8d0e-4539-9459-3da4ce2a15dd", "comment": "Malware payload (RedLineStealer)", "value": "d24baae8b32a3d7fc54184f499dd0beaf569241950471fd164bc826bd65f8f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639831, "uuid": "6ee22dae-888c-4b9a-a62a-c4b7f2cb0ce3", "comment": "Malware payload (RedLineStealer)", "value": "03e24dbb91779f1ef86119019762dc380609fd5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639639831, "uuid": "0288f6e7-48dc-4e02-a282-190d3eed8bc8", "comment": "Malware payload (RedLineStealer)", "value": "fe371b5a2a9413389e30588a506668040ffdf5aaf96a286f23734f31ad40d03925364ab73011d444a3e40e4ac059ef84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639831, "uuid": "95db4a24-0ece-4b2b-b2e2-8b8a5356f923", "value": "T1DEA4CF00E6A2D035F1B312F859B5936CA93F7EA26B2850CF13D52AEA56746E0ED71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639831, "uuid": "19aa8118-ae8a-472e-b0d2-b15f46a37f8f", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639831, "uuid": "a54fa68d-5e5c-4cdd-a125-bd8b4d0d1879", "value": "12288:RieYn2u+Pwu62hWGnSz3vEUBR5Iemb+yE:RJu+Pwu9/Sggqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639639831, "uuid": "3f93b178-500d-494e-a7a7-d5a1cd99e4f9", "value": 456198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639639831, "uuid": "f5490df1-2d1b-4bbb-85bb-89a09452c000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639639831, "uuid": "f02ba96e-9994-4294-a28d-2cb1c20ca841", "value": "48e2558ab87d852004cacbdf006d83cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36212f05-5e5b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650638, "uuid": "e47e8853-398c-443d-ac64-080e538c2be0", "comment": "Malware payload (Gafgyt)", "value": "668703fbc9e4886f017e48cefd9c00eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650638, "uuid": "266ae5ed-0cdc-4548-8007-85e736ec81df", "comment": "Malware payload (Gafgyt)", "value": "d254357708908abdf1c9f05f081df2a29a44ef27c702fcefab900699cb497eb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650638, "uuid": "ad2eddbd-3dec-4689-a58c-ce60251a19b0", "comment": "Malware payload (Gafgyt)", "value": "c3f6e42d0851d449f56ebb76985e2c288d1662df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650638, "uuid": "5d74cf94-119d-4592-a25c-4b717d115a22", "comment": "Malware payload (Gafgyt)", "value": "4add0b92ec41c368c5f3250b6dc90a3ee86b098bb1b5dc93ef8f2bcdef8b707224a0f5c6d1725a2229aae2811d88e7d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650638, "uuid": "01f8169e-fceb-40f0-a649-427a50651d6e", "value": "T122B3380B7A1C0793C48B99F12DBB3BF19B6DB6F116D361C0A11AEF804772AB11426F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650638, "uuid": "0372ffa8-d447-4b8b-b0a3-f345ad4c11c8", "value": "3072:BnpA/FXOec863CKR5hBTuEmmrVoM5LrffRM:Bn61Oec86SKR5hBqEmmrVoaLrffRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650638, "uuid": "1aac8d0f-60c9-4ff7-993a-2b4e05de915c", "value": 111015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650638, "uuid": "68f93a32-376e-4b8f-88fe-b5322c436468", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650638, "uuid": "0beb3a96-a6ed-4b21-a1ee-e50fc3c5c9b4", "value": "668703fbc9e4886f017e48cefd9c00eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8930d0f-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639615611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615611, "uuid": "a2eda14e-76a3-4fd2-ae07-e32b68492071", "comment": "Malware payload", "value": "8483032b81c129136a27237052909684", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615611, "uuid": "634f9ada-f102-4c3b-9b4c-a14e0bfdac79", "comment": "Malware payload", "value": "d54a26bb4c6353710c26a1452b1642ae249dd203636cdfa56e14ef31ae639f94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615611, "uuid": "cadea693-a435-484e-b7fb-ba1270f04b7a", "comment": "Malware payload", "value": "34aa593aaac85b6e6d0f791a1f66a0594a9a1230", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615611, "uuid": "d8686092-39ed-4424-99c3-e3971882a139", "comment": "Malware payload", "value": "582aa011687ef62d6a57a6095b135cc4fee6a82d7d119a4e84c0bb56cd53b0748dc5cda7e45faaee4825223a014e32d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615611, "uuid": "338b8f44-50ce-466c-97ce-c79b8bc4640b", "value": "T10E23F1D8156538BDD277BC33255B77B18BE289702382EA2AA4E00E784EC63D9F451FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615611, "uuid": "5ef24281-dbee-4acc-91de-ffdfee50ace6", "value": "768:zNFmxOxUfeUXXEK18bRx/zbWwQ22rIrWk/rJNflETzbJgGlzDpxYsLyLSiygV9LC:zNFmoRoXRibRlbWwuTFVrYfBnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615611, "uuid": "c4c02c68-2a5c-4979-9e5f-1d62b92f47e1", "value": 47504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615611, "uuid": "de9bc902-1a2a-43d1-b015-46104c172b4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615611, "uuid": "ceb86860-3695-45c3-9790-9fd0c3607539", "value": "8483032b81c129136a27237052909684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bad13c-5e26-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639627896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627896, "uuid": "cfca03ca-9859-4c3c-8d08-426b5ee2cabe", "comment": "Malware payload", "value": "4888718f44fd7ce4027e7b26f449274b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627896, "uuid": "e973d280-17da-4095-9bac-4baa2c3ef0db", "comment": "Malware payload", "value": "d56052bebd9dc2a6470090cd6cd53f347497577bc54548f737556c65030feb8d", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627896, "uuid": "b8231804-157a-42a3-90c8-7d931c2cd64b", "comment": "Malware payload", "value": "03f4392498a0b48f340fc2d06c8751f24f52da07", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639627896, "uuid": "d37dc946-b4f3-4637-add6-9b1c914af003", "comment": "Malware payload", "value": "5884257d700e3932fac684516e8a5e056b5f176ccb3017cbcc5906fa56fd0f3d15f1fcdccc6eb0d6a8b685104178fecf", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639627896, "uuid": "787ab5c5-ce3c-4617-b470-a21f33077693", "value": "T1D3B4CFA4DA584AD850602ED1FF1886E3B8DBD5E6610C51F43D2DC68B5702DA3F630EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639627896, "uuid": "da3a0a9f-4aa6-4a65-aabd-b66da60af795", "value": "12288:KlI5CmsbLFS7OuId9SLRiozemVBgTtb516WE20qbNiIfF5CowwNJ:JCvFJzSlioybpbP6TqIyFzwwNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639627896, "uuid": "85dafbb7-c7ff-464f-922b-d5d535d37971", "value": 538666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639627896, "uuid": "705575d9-cc32-4cb9-b040-e2ffdd9012ad", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639627896, "uuid": "13d5bd07-2e46-4411-a831-e9976b985f2f", "value": "LCM Europe.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dee07e-5e15-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639620543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620543, "uuid": "b2df8432-666b-481c-b0f1-ef7c25c09e9d", "comment": "Malware payload", "value": "d38aa9953b31b7b01d996a430c08c01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620543, "uuid": "67327cf7-e0b1-4614-8c9c-54cabf31e7d7", "comment": "Malware payload", "value": "d5b7fb21126e1a424b04bb5ef0e4f3c842a0695df4967e69068de34c1b81878c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620543, "uuid": "ef5eb627-3c9a-4f63-bc63-c25ead90d30b", "comment": "Malware payload", "value": "bf874088d840f003e4ab41051a9aa029c01468b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639620543, "uuid": "77f9df0e-7343-4dd5-9e01-89684f303e42", "comment": "Malware payload", "value": "dd2df9f08482dddc422cd3488b9783f5fcf4dd6da577c85658f44dfa46d3cf77e206b0bb4da50e2be0390b9477d70c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620543, "uuid": "95dd71f3-4c4b-4d54-bccf-71089eec3e3c", "value": "T161836F6C62C4C25FE8509A7BB9C7D12005E3AD0EA21FC526DC56F388257EA3FF53425A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620543, "uuid": "70b0cfec-ebe7-4642-9f2b-b529d37e0178", "value": "768:J+GMZ1OAacjB+/xA87DEc9y4HzRvnRT7WRKCBXWU:IxSADjB+/xNo8y4TRvnRT7WRKCBXWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639620543, "uuid": "0a919dba-ae76-4d41-9991-6a5235f597d9", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639620543, "uuid": "02c4ae02-fc50-4f1a-86ab-fad9e797a624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639620543, "uuid": "e3c94620-4e8a-43af-97e8-66937f8f1791", "value": "d38aa9953b31b7b01d996a430c08c01e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3913b65-5eb1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639687785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687785, "uuid": "aad37d19-d4f6-49c3-9fde-f7caf4f7aaf9", "comment": "Malware payload (Dridex)", "value": "f6c1c00a86bc0fb6624b3c30c40d0e27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687785, "uuid": "e2496e5e-a2a6-4d91-992c-1b431688b5f0", "comment": "Malware payload (Dridex)", "value": "d611d87fdbb41df49c42e15b1b310aea6ea941c97c56c20025ff9b7ea7f3d0f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687785, "uuid": "c635c84b-08be-4073-aa45-94e1f8a3bdb1", "comment": "Malware payload (Dridex)", "value": "e1e8ceb03eff6457d047bbbcc04506be06be97b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639687785, "uuid": "d514f5a7-5ca1-4eb6-afb1-84b7d60b4e77", "comment": "Malware payload (Dridex)", "value": "dca2417a987d21d41c3ca013818b9ff2dfbe502667652511210433b1bed03eeb0500f7fd8f09900d0e5c74d746ff3a4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687785, "uuid": "fca71943-da0c-4309-93f0-648471dea3b7", "value": "T130B4AFE5008B1341E65717BB56925E1FE5269CAE6961FF03F808FA3F702CA68F970706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687785, "uuid": "b36d219b-e5ce-43ca-a323-e7632e238a09", "value": "52e2fdaab9e6e0c66f8ede7c1e947cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687785, "uuid": "4fd32185-68ba-48ec-a177-149aa3e3a86f", "value": "12288:qbuO7BnvXnZJ1jNPRfQISExuQlQnA/LG1nbKig1GbaJBhfSQYm9Q7JijTp9A9B2/:ZQQISEzx/LG1nbKig1GbaJBhfSQYm9Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639687785, "uuid": "6986346d-645d-41de-a91a-0a7492733997", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639687785, "uuid": "2d795c0a-5265-4a35-a9a4-f56145bf4d3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639687785, "uuid": "588435ae-44af-4b91-a1ec-05cbea50fb48", "value": "SecuriteInfo.com.Variant.Zusy.410517.13613.11416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0437767-5e6e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639658976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639658976, "uuid": "032d3f0a-1597-48f0-9994-6446cbed5e8b", "comment": "Malware payload (RedLineStealer)", "value": "b42358fe171bbe2ae1b84b1c02ed2b59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639658976, "uuid": "3c747d87-a40e-4c30-9f0a-e3aa2c114aa8", "comment": "Malware payload (RedLineStealer)", "value": "d7d5fc982afbc4999176ec60935aef4fb90c854770a6438775f91807d59e6f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639658976, "uuid": "3c51dbbb-8e53-46e5-8a22-834481c4a030", "comment": "Malware payload (RedLineStealer)", "value": "5e9f77e46974fe8162a902a59d2990db80cc85d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639658976, "uuid": "4601ac13-0aa2-4a29-9c94-16f3ffa8fb9b", "comment": "Malware payload (RedLineStealer)", "value": "337ae9cab958d1ca9d3ff89273bbd37869f7a8d1dba0ffe011776efb1864281e4d33a085b82b4c1a7272756f97f5482c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639658976, "uuid": "6c52482b-25e7-4c59-8846-fff9cc373862", "value": "T1F2F48C097256405BDD1387BD683A9C220A08EE767D68C44D26FE311B3BF0BAF462D5E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639658976, "uuid": "26dddc73-2c4c-4f30-9c0b-d59bd2cd183b", "value": "c7a83f81f9bc3ce7c3894099cb1b3fae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639658976, "uuid": "ed583bfa-d0a1-42ae-86a2-ef1788787edc", "value": "12288:UbdSuKf3ESTN0xkHchrdb0JxLxpugabeMB4mDtlGQlRq4sMm9e5CqXZ:U89f3/p0lTbwxLvugabh+mhEERq4sMmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639658976, "uuid": "a57c2524-1cd6-4243-8cb3-d16bd9b029ff", "value": 760096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639658976, "uuid": "9587a0ec-065b-4de0-b2a6-7dd5800f4bf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639658976, "uuid": "8e412c6b-f312-4225-9fc4-6c828fa79e42", "value": "942aff4c-36c7-46a1-bfb8-e9a558314aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4972d8ae-5e59-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639649811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649811, "uuid": "4dcc1786-1aac-4fe0-a58b-3a556b5cc827", "comment": "Malware payload (Loki)", "value": "f5138e468dc246e7a4ab49c4b3ff1196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649811, "uuid": "9b94f568-f130-4c1d-8a73-89cbecaf6763", "comment": "Malware payload (Loki)", "value": "d9880e20d5aa98bf62a219896505bbc9f0998c4cde3fd3b66048e29caa258ff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649811, "uuid": "f9b628a2-8f23-46ac-a338-2b4721c51456", "comment": "Malware payload (Loki)", "value": "eb2c5dd2bb62f2530ff7dd4fadb3f9daa684e780", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639649811, "uuid": "8646ac66-027a-4333-b936-70d11a4b667d", "comment": "Malware payload (Loki)", "value": "57558f4f832443da5ef9594ed1caba1cc2544d5a9acf8766d9dc76dffe69df7f68b864b6f74dab0ad8de2c4c8ec926c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649811, "uuid": "4bccd66a-00d7-4e0f-9503-ef4950ea21f4", "value": "T145A423A7A68010BBE605467814F7A939C3FBC1E81C6F7E07E7510E867CA79DBD484607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649811, "uuid": "ddc56e56-198b-47b8-a341-f55c23123ae0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649811, "uuid": "a603e899-6e52-426d-b3a3-d97b1d0ce979", "value": "12288:HxnPKV1Yr4BtUNvjMU3TucNod9EQNDxSTNSofUtlQjqq4u+du1:RnyV1bt8jMgqcY1xSTNS8UUqq4u+U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639649811, "uuid": "47487dc9-4037-4afb-9475-7a7e5d27a18a", "value": 481817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639649811, "uuid": "117acd57-42e5-4203-a329-177206e043d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639649811, "uuid": "7f09a8d8-b629-4c71-bfa4-fd76193f0fd0", "value": "f5138e468dc246e7a4ab49c4b3ff1196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdf6eb7-5e82-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639667453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667453, "uuid": "94633794-70fb-424b-8b66-cb07836e45c0", "comment": "Malware payload (AsyncRAT)", "value": "a15da14e739fb9c5e37f4c74b50990f7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667453, "uuid": "e2eb3c7b-c3ce-41c8-93fa-f04126a68d81", "comment": "Malware payload (AsyncRAT)", "value": "d9a3f7d170e6f1f7849e2afdf8a8e9d0e3d16c6be4ae6c01e74599106a4666b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667453, "uuid": "4a8576dc-845d-497c-a604-fe65f8b3a815", "comment": "Malware payload (AsyncRAT)", "value": "61ca90ef381e089de8155f6c81730a61e6472c11", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667453, "uuid": "d406396d-06f5-4c5e-b835-c46e9546c654", "comment": "Malware payload (AsyncRAT)", "value": "dbdd0db06c2ff4c03b61378034e8fbcb8a606ab427125ef966beba9f112839d38fd3305be1c14098c609ce69ec4ca5a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667453, "uuid": "16532a53-486e-4571-be07-c029e68afec7", "value": "T1F9E4D06AA4D22D1F3C0ADDE6F21D1AB43B87D3FDB79A04CF51D8E3C8A5891074948B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667453, "uuid": "a6c062dc-d49d-48e7-b769-40b964506ef0", "value": "12288:GEf0YZvsQl06blwGQWsOd3OlmGDZrezrSYuq7NlYEhluJps9fYIwKTW:G2zZvsu01W9lCreNu0Nls+fdjTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639667453, "uuid": "f128b329-2bf1-432e-8e1b-51a3fc1a6c52", "value": 692183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639667453, "uuid": "d63f06d2-5923-4bba-beec-900cc0193894", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667453, "uuid": "8a0c2ba4-505f-4905-a0b2-ffa8f10cf27d", "value": "PIX43447.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90f6253-5ea6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639683124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683124, "uuid": "4aae9b7b-9994-480f-b4f3-9deb9a28b5f1", "comment": "Malware payload (RedLineStealer)", "value": "802cc6424a52b7fb8c828ae0066b3c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683124, "uuid": "42b44121-c568-4889-acfa-ca4c1f0607e9", "comment": "Malware payload (RedLineStealer)", "value": "d9c1684e03e90f6e21a5c0fc66f5b0448b64bfd2b4c16c334c5d7b26c1bc1226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683124, "uuid": "3410015c-b11a-49c9-a9b3-fb45c5902909", "comment": "Malware payload (RedLineStealer)", "value": "267efbfeeef4fe10ba24e4538f1fb499e0851805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683124, "uuid": "ca3a6e25-5ab3-4669-9709-d5d227d48c1b", "comment": "Malware payload (RedLineStealer)", "value": "2b82444aa44efc9fbc11453b9483924728c502976d178e9c6ebaf3d056723ef2cbf734272dcb818b1a0aa97226dad12e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683124, "uuid": "d87dad84-3c42-49ab-b035-011394dd70a0", "value": "T156A4CF10F7A0C035F2B312F95AB6A36DBA2E3EA1672450CF13D56AEA56346D0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683124, "uuid": "6535a41a-2841-41ec-8da6-c0f4ec5af92f", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683124, "uuid": "760188d0-ba59-47aa-a433-9c9e3bf80acf", "value": "6144:dPSZvSSXkjqsf7AOr5gBCVJCjremNXkIV0/n+Vto4XS6QwY:cSSX9sfsYyYVJaemNXkIVOn+Vttow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683124, "uuid": "d86397a6-48e3-489c-ad83-12f9241851cb", "value": 455251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683124, "uuid": "1a8756e4-9708-4967-86e2-d0f4d60875df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683124, "uuid": "b3803d85-763a-492a-b8c7-1b424d315273", "value": "802cc6424a52b7fb8c828ae0066b3c32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f24a5e-5ebb-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639692191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639692191, "uuid": "943818e4-36e0-414d-844d-e9ad56e7fb10", "comment": "Malware payload", "value": "d18619e91ce262899d813662904ace18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639692191, "uuid": "846721b0-3432-4d74-923a-66891c9864bb", "comment": "Malware payload", "value": "d9e21b3296d12b863e75296efec03c69e884cd86461f05bf69aabf282fec67a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639692191, "uuid": "6d0087fa-756c-43ff-bee2-8ebde255ebcb", "comment": "Malware payload", "value": "25a812002b228f5bab4faf7fab61384aa7206098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639692191, "uuid": "a81c711e-5772-40be-8d5e-2718b591f88f", "comment": "Malware payload", "value": "d8192ddacb89c67a2899ea4439ae38581434a87f5c1144dfc06bede10079821fbba979245f7432fedc9b67858e7cf083", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639692191, "uuid": "850bb428-0d3e-429f-997c-e2c43b2bd8f8", "value": "T1BD0501A079D29815E4C94430DD7EE6ED20917D84AAB06E3222A03F7FBEF1DE5C60535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639692191, "uuid": "bc4cb364-5ba4-4c8a-beaa-9bcc69a7d590", "value": "266d3f32f2d123e0c8b90826ece0ec9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639692191, "uuid": "4c8a69aa-40ac-41a4-b4c6-178190d327cf", "value": "24576:J2ObOAUPhHiVNbAj2kf+QXZf8jn2cbKk:NSPIkfffY2cbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639692191, "uuid": "b2ed9523-62c9-44ce-8021-3ad94c34f1ff", "value": 821040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639692191, "uuid": "f164d4c1-976c-4127-9fff-e6ee3d621b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639692191, "uuid": "8e9dbdc7-6095-4a9f-82ea-8b8dc8c14093", "value": "d18619e91ce262899d813662904ace18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333f4e96-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639683704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683704, "uuid": "4fb7f419-f2f7-4a86-a432-d2a93dcda378", "comment": "Malware payload (ArkeiStealer)", "value": "976ab530a2fa1e14765ee6c9385b7af1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683704, "uuid": "d981ed2c-277b-47f4-ace1-4056e90211d7", "comment": "Malware payload (ArkeiStealer)", "value": "db2121cff516119bfbd4c6f494350658259bbdeec62013cd35336c1f83478ac0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683704, "uuid": "7fdab2d4-dc1e-4958-8217-96acdb888c8e", "comment": "Malware payload (ArkeiStealer)", "value": "eb64ebd287cf239194063d1c8f83f13e013ab6b4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683704, "uuid": "28aa517f-2e3a-48d5-ab1a-33337597deeb", "comment": "Malware payload (ArkeiStealer)", "value": "3f92a46f6a379dd09fdb4e79b59199d756e7f08c01e3aefc323b7e5c1176583832fab5a82a7ed320d9d17ca161d1ac99", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683704, "uuid": "3c33a775-ebc6-437d-9689-0f6a29bb6b7d", "value": "T14DF402107690D032F0F702F45A75A3BE692E7AE1777498CB12D26AEA57742E0EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683704, "uuid": "0ba699fd-37fc-4dce-bdfe-6b878fec77f5", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683704, "uuid": "4bf72625-5497-4e18-b98f-4d65b2dac305", "value": "12288:I1KDImfYP7jkrG2lWXPkA5UPXd1YRUMyKKmJn2jNGfcZdnto9Ys5e3HVA6:SALYP7BgWPkAz9yKKmJ2jNGKtc2HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683704, "uuid": "c54a5a84-483c-42c9-a8b7-6c26c737a908", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683704, "uuid": "b4b540e5-6233-46f5-b030-1cb672e36813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683704, "uuid": "c677d139-a036-4fb9-9e9d-d6f389f1c590", "value": "976ab530a2fa1e14765ee6c9385b7af1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f473f5-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639641801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641801, "uuid": "32bd5cdb-4ec8-4d69-93a0-a4d471ece675", "comment": "Malware payload (AgentTesla)", "value": "b061cb1c42b04d168700dc5b84c69869", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641801, "uuid": "3a7b3116-d4d8-4d89-a50a-9233d1239099", "comment": "Malware payload (AgentTesla)", "value": "dbd2447e71439d5018d20fc46a34c4605d79838833fa2fd2b9249f9a69d89336", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641801, "uuid": "7e3c3dcc-07ad-42f5-883e-31724f84176a", "comment": "Malware payload (AgentTesla)", "value": "0b90e7756ac0019ce43c879c1994e260c3e4ab0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641801, "uuid": "4a7d3a91-833f-4dd6-a6d4-18ef82fd597d", "comment": "Malware payload (AgentTesla)", "value": "469456488ed86bef30b6c6e0dc48ed494606f34ef5941844e2bd17af9c41fba3a64c7e832c298464d14f09805687e43b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641801, "uuid": "a78ab9b2-c53d-427e-bf5c-cf3204c6ffe2", "value": "T17664121B79CA5953F2D7247F46D883B870CDDC980BEBBAD96005B2CD3BBE460AC50925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641801, "uuid": "d9d46fa0-bb01-4024-acb0-a3a9fea0680a", "value": "6144:NHWfTys0XBP1hieLmHmMMkJiCd7Kt48u/+mRIBHq7QuIEYeAnyLnNAp:NHWfTF0XFZTL+iCZm9umu08QuudnyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641801, "uuid": "7fdaa1db-d6a3-4822-ab75-7de9d09857f6", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641801, "uuid": "11a388fd-be11-4968-a1ab-99c024ec27a7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641801, "uuid": "ffd940e6-fbea-45cb-9b77-cf81821da083", "value": "Awb12152021_34527.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86447f48-5e7b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639664516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664516, "uuid": "1c8d9760-d190-4884-bbea-e7b03ad60cdb", "comment": "Malware payload (Formbook)", "value": "e52d81dc125501b733454092531f5d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664516, "uuid": "a3b54095-7bfb-4418-af70-e4ef1f17db39", "comment": "Malware payload (Formbook)", "value": "dc929ea57c7b64279d89760b3d87c6da2b3442acc57b454f539422257b003a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664516, "uuid": "b77d9a4b-35c8-4747-9f47-be97f3f643f3", "comment": "Malware payload (Formbook)", "value": "684860adb1e101f97760eb9a174dbb9c4e3aa41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664516, "uuid": "aa699090-74d8-41a2-972e-9f12d16128cf", "comment": "Malware payload (Formbook)", "value": "8a7b29ba58c5e6dde0620bc425196580902da02d712b2783051fe494d446ae37c7ebb2964833cafd6880edeb82ed21c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664516, "uuid": "61a36186-1daa-4782-8c13-3ee6c145448b", "value": "T147A42316AAE20CBFE1E113302C7BEA6DCBB1D7C609719A5717F42E573865303439B629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664516, "uuid": "00a4d0ce-7859-463e-96c7-5fd2133e1060", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664516, "uuid": "aada9c79-c6e1-46a2-9189-5b101f20d29a", "value": "12288:z+FVzMHCmJGuL92o3YDGYbc/E5h8yOVi0:TEgYDGBwhii0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664516, "uuid": "169abd28-4e09-49fb-b3aa-a674e892b82d", "value": 484151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664516, "uuid": "02af5085-165e-43e6-92f3-b3dfe35956bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664516, "uuid": "7572af12-aad4-4a84-a64a-fc0281d17f0c", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a842c7bc-5e79-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639663714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639663714, "uuid": "c6461a61-0fc2-48cd-8878-2f3fc0eefe3d", "comment": "Malware payload (AgentTesla)", "value": "4686a1d2ff67b9f31c234652511b465b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639663714, "uuid": "5d6f9f09-53a8-475d-83a3-4b2b183ed0c4", "comment": "Malware payload (AgentTesla)", "value": "de4313b9ae70bf38a2261c45627c98f24859edd2189ee6c084d2f282045dfef2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639663714, "uuid": "18cafece-8204-42fa-b207-84328ca06de7", "comment": "Malware payload (AgentTesla)", "value": "72538c3db16a4e3f88db24157d26885c831d61eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639663714, "uuid": "970eed1b-84ec-42ce-a3b2-1d3a53f4bccf", "comment": "Malware payload (AgentTesla)", "value": "9b321b674f6fb476740c607a7a45e866ad7da9bb317b63facb3a0a5d6ff3ade948c6e5f69461001405144e3dd9a13b63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639663714, "uuid": "663db8f5-cb58-49f8-8bc5-8e83ce67bf5e", "value": "T1D73523117EF5981DE6894F3A293590021774B6AFBC53D34FB8C9328D2D7BB094A84B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639663714, "uuid": "fbdc79e4-eb4b-429e-b9e9-432da7a0340b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639663714, "uuid": "2d17da64-cf87-4feb-bf01-dc7793fa9d9d", "value": "24576:tHRZ5nKnIaT4dCYL5Bw0NZU6Gxm3uRSR/yk+lkKT8cQ:nKXSCYLXvcmYk2lB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639663714, "uuid": "a828d1b2-f5bd-4c38-8b90-4453e258feac", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639663714, "uuid": "02130638-4d4a-4bf9-8e46-7ff10a6b321e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639663714, "uuid": "cb11ccc6-320d-4877-9cf0-58ef3a3e1ab0", "value": "Justificante de la operaci\u00f3n realizada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9167b86c-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613425, "uuid": "e344769a-a2e9-4905-832b-0bf4b4305eec", "comment": "Malware payload (Mirai)", "value": "a923bd12e2b0260fd66201b5fb07aa21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613425, "uuid": "fb840903-826d-4dcd-afda-d2656fb85736", "comment": "Malware payload (Mirai)", "value": "df135e7c71b6eb2581ddabc8fa4e044b0eeaba7bf980d3004aa7c9582c8bb17b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613425, "uuid": "bfdfadb1-9e0e-4f84-aeaa-35c81e40be15", "comment": "Malware payload (Mirai)", "value": "5f1fe09734613bcab76ad6e6e42cae4e35493cb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613425, "uuid": "fd0b856a-a04e-4f9d-a3eb-dfc1533f55db", "comment": "Malware payload (Mirai)", "value": "604697d3181a11abb488c32061cec611dccee1d2eaeee10081bf6e56e843665bf91eea7cd609e380263e6952df52cce0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613425, "uuid": "4564982a-a6aa-4d86-ab41-83b041344e96", "value": "T1B8C32993F800DE66F40AEA3605D70725B630FB724F531A7263573AA69E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613425, "uuid": "3342d27e-f91a-481c-98e3-47bb835c79d6", "value": "3072:2INYDFHe69owRBpE2yI2oJ3AP4ILmvI0PDGnSQNER:2INYD9e69owlyIRJ3+FLmvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613425, "uuid": "1c2cc432-3fd2-4331-bdca-dba1718c3399", "value": 118298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613425, "uuid": "4932b686-07fd-469b-abc3-5608ff0a506d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613425, "uuid": "59b46bbb-5586-40a4-a389-8d0e639e11f7", "value": "a923bd12e2b0260fd66201b5fb07aa21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea223067-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639642780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642780, "uuid": "e84552ec-a7df-453c-8ddc-d44a555e0518", "comment": "Malware payload (Vjw0rm)", "value": "069760354f3e37200a7112a84aaa3f3b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642780, "uuid": "ae5c7b99-1b42-4f1d-af3a-92eaef8f1d83", "comment": "Malware payload (Vjw0rm)", "value": "df29cf83fe008627f1475b86bf67530eab0680bc18995786f51719136d079926", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642780, "uuid": "30dafe5d-d566-481c-bcd3-4a27e8c60580", "comment": "Malware payload (Vjw0rm)", "value": "7b55b0e82f004e922f2e886e800e9379c9e09250", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642780, "uuid": "5c049127-5348-4678-8f4a-c8d748266698", "comment": "Malware payload (Vjw0rm)", "value": "e1d146b2b83439611380697ceac0fbbc86166f373f261b18c31401c7e242232a1a6ce5e3a9d62f5d063ff09581c56ab8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642780, "uuid": "7228a1d7-1c3d-414b-bd67-73d71370503c", "value": "T14F81209C284BC63C53D27B8A802DD14CCDF548B47F28D2B5148CDAC5360E97987B19BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642780, "uuid": "5fc5ef55-4632-4abe-9de3-a0be23cb8f5d", "value": "96:SABNo5DRk2c24ZRMHXE6/BIS+Ys+fJ4RDdQqR7bJyKh2OS4UK:zSa2c24ZRMlBIhYs+fJ4tfRfXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642780, "uuid": "f12a76bf-5236-42dc-84c7-71528295200d", "value": 3888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642780, "uuid": "339d5071-697c-47b0-9d05-eac896fa56cd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642780, "uuid": "827ad1c7-3347-43dd-b479-d6f71330a919", "value": "Scanned_copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d386116d-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639683973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683973, "uuid": "cae11f66-c662-4de3-ae41-35fafe10a5fe", "comment": "Malware payload", "value": "b352915a1ce975cfc7e021119ec156a4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683973, "uuid": "786171aa-2455-4338-8f19-8f3f784403ad", "comment": "Malware payload", "value": "dfca39e7833fb0127b1181734f9c8e96dbda3ebb545216f327e796334a7492f2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683973, "uuid": "12917f65-8b81-4c1a-8479-ca065e0fc69b", "comment": "Malware payload", "value": "90e5a5bd35b149028e4116e2a9eb24ee6b4dfe65", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683973, "uuid": "2bf4ab31-6ee7-4b8f-9a40-5e2373427060", "comment": "Malware payload", "value": "b67a1f0dd051d9530c1eeb78aa3a02bfbb3f6ca6ef24e9b0a61329de8b0fceae0d3ab32f18529e34e2bc5d030f27ddbd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683973, "uuid": "53755d7e-c4b9-40a4-ae79-2e3114e17b8f", "value": "T162858D23F2C18533C0732B399D5BA769A93ABE112E38594F2BE42D4C5F366807D252D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683973, "uuid": "7d1aab29-a136-4c0c-932f-e8606bf71a57", "value": "49152:0o1m2vQGFN2nAIckuvGm6U9WxTPHcbOYlEA:NvQGFNci1O8bOYGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683973, "uuid": "03560bb8-0ab7-424d-9e4f-527e83a078bd", "value": 1776640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683973, "uuid": "05aabb2c-42d4-4693-b8b3-6098d00bee31", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683973, "uuid": "fe1d55d8-5f13-46e5-a00f-62e4394c3dc7", "value": "Archivo.Adjunto.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4409f97-5e6a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639657265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657265, "uuid": "fdc5c23b-260d-463d-86f5-bcdd87eebe1f", "comment": "Malware payload (RedLineStealer)", "value": "76954927b70d82d1052ca7a6bb08df2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657265, "uuid": "c4156c47-e815-4557-9533-e451d96760bb", "comment": "Malware payload (RedLineStealer)", "value": "dff01b162d565a073292ab77291f835b457a9bb68791916e9c3e92b20f8eb16d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657265, "uuid": "42e0b2b9-66a0-46ef-afda-f84417038e01", "comment": "Malware payload (RedLineStealer)", "value": "6c0bf1959c50f290d5cbdb9458ad329df583e6cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657265, "uuid": "a7c52ef5-495e-4351-bbf8-1ce904703691", "comment": "Malware payload (RedLineStealer)", "value": "bf6140d796ac4a97483f1a3956f2ebdf664ea11d6814060965508cb3e1545661c3ed39d829ea4162f3d6550b9ca759dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657265, "uuid": "685849ea-a60c-499e-9d08-23e26b560619", "value": "T12AA4CF00A6E1D035F5B252F84ABAD37DA93E7DE16B2490CF13D12AEA5A346D1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657265, "uuid": "86f9f9fb-c7e7-4598-b409-8b5d3ac3cd2b", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657265, "uuid": "b34358c2-eb17-4cd1-8ed7-4a57d6ab0143", "value": "12288:ELAASw3AByvqRYaSEC3XbaYcAB/9ychVN:EBd3AgyRYac31JJhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639657265, "uuid": "4cd81e80-d2f2-4455-850c-ed6490351945", "value": 455717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639657265, "uuid": "ee02ad89-7c2d-4fee-8cdf-d35c94273534", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657265, "uuid": "e246b0d8-3962-4a98-9682-08aafdc7975a", "value": "76954927b70d82d1052ca7a6bb08df2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b301eb-5e98-11ec-96a4-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1639676917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676917, "uuid": "f66acf87-1ace-404c-9ee4-b3972b9e11a9", "comment": "Malware payload (Conti)", "value": "24819ec6a4f57ac3d84538d1b2f422cd", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676917, "uuid": "331cfd05-c448-49d4-8bc6-000686a3ebf2", "comment": "Malware payload (Conti)", "value": "e043dea504d025f18f406d9649b64498338f3330ab9cf30e4efe9c0c2c0231df", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676917, "uuid": "374999bd-78b3-448a-b8ba-4e062de73460", "comment": "Malware payload (Conti)", "value": "2c1ca712d5c1f0920d13208796975afc01ce6b81", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676917, "uuid": "7128d023-69ea-4a02-87b3-b2da188b688c", "comment": "Malware payload (Conti)", "value": "0dfbf36eee0d00437e72e7a1c640e8d3632831c5c4a42f071a2ca1fea32e4e45e32d2a4dafeafea2b29fae826d722247", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676917, "uuid": "8aa0bd4a-6a84-4bad-b792-dcc209821c35", "value": "T144144B01F24D827DD6AE5D31267A7EB280B99D383B5FCCF7B3DA882816606C06524F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676917, "uuid": "886857f0-23e6-4875-929b-e30e906f7d1e", "value": "77679e1e454376d19c1c76600c17ea98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676917, "uuid": "532de259-f935-4722-873c-a3cac6f6bf90", "value": "3072:HJkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34o3xt:HFcuVqTATicDNQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639676917, "uuid": "068e8c2d-bffb-4121-b318-e3054689a5c2", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639676917, "uuid": "8c936ba4-2e8c-4642-94c1-b9ae18fcaf6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676917, "uuid": "b1c77b7b-afe9-4bf9-9080-613687626fbc", "value": "e043dea504d025f18f406d9649b64498338f3330ab9cf30e4efe9c0c2c0231df.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b907bdb4-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639615639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615639, "uuid": "2a276247-6d95-4bae-9453-5f2152c67935", "comment": "Malware payload (Gafgyt)", "value": "c9ea6796841d637fdaec27652426defb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615639, "uuid": "eb576aa1-20f4-4f6a-8ee3-5411eedcd259", "comment": "Malware payload (Gafgyt)", "value": "e07af091da713e8ea888321290713094912f7df5538214ba913b6142f40773fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615639, "uuid": "a0f29411-3897-4767-9ec1-aeb0a5f8dcfa", "comment": "Malware payload (Gafgyt)", "value": "c6a9e51e4fe583240153931864cdba852ab2ed70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615639, "uuid": "80b55081-a79c-426f-b12f-f3f961cda4b3", "comment": "Malware payload (Gafgyt)", "value": "ff036e01e350d4c3d23022609b747e128a75a86c3f0483762ae913a518beb52ffd81be14a6ea96a1bf0efdc95a191d84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615639, "uuid": "ed6e0367-1753-467b-904d-64e3a880e6b0", "value": "T1B223F15B8D0164F0D9C92533FCAA000FF9A92F55F96F6C149E2463A56AD5081FEF3D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615639, "uuid": "22737fb1-9cb0-4a92-8e48-cc47aaa9d3f4", "value": "768:Mb+CVbmKc3o6rAo9pmiNTQhwCWWSAk9FTkEBwlujdcur14OooSxExwUV443UYdqw:Mb+CVbmKgXAo9p/Nkh4TAkXTXBljiudT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615639, "uuid": "dabc6c70-24de-40ee-b2a5-36f6634441a5", "value": 46792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615639, "uuid": "ce41f907-beae-4b05-9f9c-0f95559fabe3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615639, "uuid": "ea85b02b-0867-4264-83d3-ceadef47f64d", "value": "c9ea6796841d637fdaec27652426defb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed6516e-5e7c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639664853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664853, "uuid": "a70a0d21-7b3a-4eb2-8ed4-f2612cc391e2", "comment": "Malware payload (Moobot)", "value": "6c1c515966cba543986cb139a9242ab5", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664853, "uuid": "b8300f24-0689-4989-8621-10d1fdae6a17", "comment": "Malware payload (Moobot)", "value": "e09dfc1ba1052e4b5c2c3ff2d9985f6f5024b526aeb8ae4a1d28d8cd81bb0c1e", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664853, "uuid": "d2f05e3e-47d3-4800-9709-1058bfaa82a6", "comment": "Malware payload (Moobot)", "value": "4ced3989404cf7d485fa308719be4079bbd2e03a", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639664853, "uuid": "8a943b2c-e6a9-4137-86ef-71ae02c85b3b", "comment": "Malware payload (Moobot)", "value": "90a0ffc9733f30a414b426bea96658859fb4bcc23e36bddcf02af87bc1b9012a7e2fb5cadbe34aff62ebc9e634569abd", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664853, "uuid": "4f43476e-349d-4fb0-9040-60392291dfcf", "value": "T11FD20803A94188BCC99DC33147BED92EF963B47C1236FA593B947E23EC4EE511E69052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664853, "uuid": "f34015e9-b3d5-480b-8363-2617456d6058", "value": "768:GKk2ZFC/HfRbba7nFJimcvnrzZo5P+eTBn:NZK/RS7nFDcvpo5P+eTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639664853, "uuid": "aff2afe8-f1b4-4916-a9cb-0bd4043cb1c9", "value": 30048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639664853, "uuid": "273e3c85-6c04-462a-93ec-1d7b603ccc45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639664853, "uuid": "ea22888b-7782-409f-8711-47fc2b9932b0", "value": "la.bot.x86_64-20211216-1427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15f856b-5e49-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639643194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643194, "uuid": "cf1ff987-d5d8-4efc-a6e9-43893035e8a5", "comment": "Malware payload (Formbook)", "value": "cd5e36651db5a0e5c3ec9a3627e9c6ee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643194, "uuid": "b1835e2d-d475-4d4b-a647-df6008a16939", "comment": "Malware payload (Formbook)", "value": "e0d40ddf8d2af27d09ee2fdd12830b64830f102fdfe0df5159a0a65d0f97eed6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643194, "uuid": "fd2017bf-3193-41c6-b141-e0f7ba01e56d", "comment": "Malware payload (Formbook)", "value": "eb1a3578927369fd6185e3575025f8585e2085b7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643194, "uuid": "a76fb2a3-6f7d-4207-8413-ba71ec12def3", "comment": "Malware payload (Formbook)", "value": "52d2dbdfd8989c6aac236e00fc6d64fef250a3a6217e6b6a797c1bc0b237f7ba7db55692de939af75b1a3c000d507224", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643194, "uuid": "24167cae-f3b8-4b5f-a38a-972786b6696f", "value": "T1A964122EF11A574EF393937B98404AA0FF36DC42C979D47F14A07A5D4930BA6A1B5323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643194, "uuid": "0814a975-7bf7-43f8-8b90-06a37eb26b50", "value": "6144:HJNAXZenGHdEzL3aNHV+fV23DX7yP/S3zY5ROwpRn71yd/uE:HJmZZdEzL3aIab7yPa381o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643194, "uuid": "9c713038-4d95-4805-b82b-065c3d057f0c", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643194, "uuid": "9072dd56-a973-4e3b-8f93-a8790dd792e6", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643194, "uuid": "6770ee36-bfe0-4f7e-b2e3-22b62d06576e", "value": "lod1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308a1e8c-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639645045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645045, "uuid": "36154c4a-b201-49ad-bd4e-586f2828f507", "comment": "Malware payload", "value": "ec01013dce114ce432be4310d081040a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645045, "uuid": "c0c45745-ee58-4bee-931b-00c80ebb8903", "comment": "Malware payload", "value": "e169baf293bbb638e20571b7e59b369214a54e78a1e1de4b0705170d593d6921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645045, "uuid": "9cf48c9c-d984-4a13-a262-3a1422975318", "comment": "Malware payload", "value": "5595aed881d28959cf2e3af1f64aa40df5965aa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645045, "uuid": "f83eefb1-532f-4233-899a-30319aeb7b9a", "comment": "Malware payload", "value": "7c563e4fff90581727c58142fc6bcb357518ed60d6939ceb0b45583866fe940a2e73db1f089f900dfa618fbd726731a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645045, "uuid": "3e6c75dc-f55d-4beb-b799-7d8b26d8bbdd", "value": "T12B25012A73DB8129F1725A3124B4C731EB78B4506F10499763C926390DF9583EF39E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645045, "uuid": "83e4a7d1-3de6-49cb-ba8f-3ffc960f17a4", "value": "c94ee1b61e846ba6c48f491c55f58d2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645045, "uuid": "4395d711-96eb-4db3-b5aa-ad817fb2c0da", "value": "12288:OB/MQ1SPgX7WjAnGFM0SZcDYKhBGARaBkzslll0SMKkqFp2B+0n90b:VQ1rXobFM0SZc0SBpwvlllZ1kW8Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645045, "uuid": "786297ca-5d2e-47c0-99b6-e4abe5d516b6", "value": 1011836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645045, "uuid": "bdc28097-1a8c-4502-bc21-4a7575814fe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645045, "uuid": "69223c32-9634-4aac-92dd-1e9cce0f6c33", "value": "ec01013dce114ce432be4310d081040a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2152be2-5e8b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639671569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671569, "uuid": "75c80bc8-94fa-4121-882f-eec63df949cf", "comment": "Malware payload (Formbook)", "value": "90f9a425b955b24ee81c3d676daac7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671569, "uuid": "99401fa6-7d48-47e2-aad7-d26c44018fd4", "comment": "Malware payload (Formbook)", "value": "e1a555c5a9574de6448cde29e8cd3f8312d1420e6769a31c58e4d43debad2940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671569, "uuid": "f20394d8-1e85-4fcc-9eb2-d12e02350248", "comment": "Malware payload (Formbook)", "value": "92a733417245b4b8785727967626298933440a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671569, "uuid": "a91a2fac-e7f7-47bf-b41b-4d25559c2a89", "comment": "Malware payload (Formbook)", "value": "40474787704a0cacb28dd725931ec845435fe0470aabb31a349cfb21b3aa406be2b6f5668cc856fc7a019d776a27b9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671569, "uuid": "dfdbd737-a9a7-4bdb-ae9e-d04e3f475472", "value": "T1C5B4E01132A98B22C9B99BF44C7161A003B57C56BA7AE74F2DC17CEF31B9F804690B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671569, "uuid": "8685432f-36b3-44cf-b24f-31a8eb6c3370", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671569, "uuid": "0ee9f206-da38-4f1a-836e-0c72c06def1a", "value": "12288:r8PapPapPazY8DwZbxWmfEgm2i+TtRJnoS4Bk4fy7EuSK3:r8P8P8PwY80ZNWRohd4Bk4K7fSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639671569, "uuid": "b4ccb89d-dd9c-41b0-b885-5e1fadcaaba7", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639671569, "uuid": "24421349-87e3-4df7-a594-8fb0a349a8db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671569, "uuid": "fbfa8a63-8ff1-45ee-966d-5362ba3a8120", "value": "Pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8055600b-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639616832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616832, "uuid": "2c4bc746-eb5e-4162-9e99-8022395274de", "comment": "Malware payload (Dridex)", "value": "86e6788d144dafc03280e1db3bf00b63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616832, "uuid": "11b78997-329c-40c9-9980-1fa90b5a8af6", "comment": "Malware payload (Dridex)", "value": "e203ff7d35dd31b84a42961aaf43f7887980469247822c4acb0cfc53be5274ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616832, "uuid": "5d03af12-c776-46f3-8b3c-fd5a97185499", "comment": "Malware payload (Dridex)", "value": "3bc28ed723a81ffd35554be5fb7725a4e95829bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616832, "uuid": "399b8864-235a-4356-bf41-56f0424c1ffe", "comment": "Malware payload (Dridex)", "value": "bab7a55a946c00c5d1401d69363828338b2173c27376da6c6b4daeb949ae5cb59eb58eece4e90e6ac16c96f12fe6aea7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616832, "uuid": "e2cdee7b-4c07-4f83-8f48-49b56a6a6953", "value": "T176B4C0A33F4B0C6AD4525D3CCABEF7A6082F66454588CF3072A3735AD6F4542A825CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616832, "uuid": "b6e32a5b-ea5c-41c7-8a22-24fef6b0eda6", "value": "425f8965b1dafa239bed13744d5413de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616832, "uuid": "924b0b86-0b1d-4256-bbcf-bd890cf00a65", "value": "12288:vRv+2yIUMs4UQ0EysQeu2LzmWMdUJPRXLZvR5xdzjU:Z7D5MdUpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616832, "uuid": "c4e9c37e-5f2c-4bea-a41e-6f8b2e27eecd", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616832, "uuid": "9b320b10-8d82-4064-9e29-a82652d631a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616832, "uuid": "5b342843-928c-4cad-a321-074d4a384124", "value": "SecuriteInfo.com.W32.AIDetect.malware2.13962.19924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9cd998-5e96-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639676201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676201, "uuid": "147d5f72-4d4d-441e-98cd-d453d81432f7", "comment": "Malware payload (RedLineStealer)", "value": "a783e099967f868a83a7ff9854b1ca61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676201, "uuid": "d8bdb3cc-c0c0-47ab-9e2a-229b5cb19d85", "comment": "Malware payload (RedLineStealer)", "value": "e2698b1128729f8b5db2359f92532e1b2f1ca61b8436b7666c4ea7f9d85b213f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676201, "uuid": "c3e020ed-a23e-4254-a197-d4f1140ac7d7", "comment": "Malware payload (RedLineStealer)", "value": "607005fbd9b49529ea7e2992d85063b327a97016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639676201, "uuid": "f7330c6b-4796-4408-b57b-77f0e9d66e2a", "comment": "Malware payload (RedLineStealer)", "value": "bbd3abc33ebf0b3f571ce45e20bd54140700ebfb4db6d9dd9b3afbf2c0df070620d0e758a61bde8909ec3521eb65c727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676201, "uuid": "60272e1c-aabf-47b2-bb95-c3ac03e545ae", "value": "T1D7A4C000E7A0D035F1B213F85AB6E3BCAA3E3EA1676450CF12D526EA56346E1ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676201, "uuid": "82ceefda-6a08-407b-be46-d9a5d51f0609", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676201, "uuid": "562bc8da-67fb-406f-86a5-9f939eaa733f", "value": "6144:RvY6t6Hqn0YUUWBFboyYSI4HepiYkhUndqouvrV15raVFo7Jz0F:hcKyzBFboiHdYk8dqouvrVHraVF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639676201, "uuid": "aa65b7f2-2b1f-4bc3-8bee-f94308703e8f", "value": 455178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639676201, "uuid": "6700a184-a0ee-40e6-99a7-6d5a284cde03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639676201, "uuid": "a18e9364-637a-4e93-8768-a2f229a4880a", "value": "a783e099967f868a83a7ff9854b1ca61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e8c33a-5e1d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639623952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623952, "uuid": "ff142a48-7663-4262-a3fa-502db09ee6bd", "comment": "Malware payload (RaccoonStealer)", "value": "a07da855c104042f458271a043316e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623952, "uuid": "f4269b20-4a6a-453c-8b47-40761bc2b740", "comment": "Malware payload (RaccoonStealer)", "value": "e282ef9e1d23c80f8ef68d929b2a45352d7932e4f115d662774044b349fe7857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623952, "uuid": "84261b61-37b5-4e30-baa9-a0fcf5b5497d", "comment": "Malware payload (RaccoonStealer)", "value": "47fb68b45e3a051a2adb642e53f65c7b82ca3002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623952, "uuid": "ad98cdef-44ce-46d4-b0b8-684fa464b306", "comment": "Malware payload (RaccoonStealer)", "value": "7eef75f10fa60bbccebb4295fd43a75f1ba5ad408d47fdcf77fd71738441a726a7321d6106882818f5983261ee202790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623952, "uuid": "5f01d5a2-a394-4ac6-aa6a-50937b37e95c", "value": "T1D9B63304D3EF6F67EF6D4D30799446EC9DA8D8D139E14292A63A73952BC0037835CAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623952, "uuid": "ab2e393a-07bb-4983-a09d-5ab76d5905dc", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623952, "uuid": "c975f4ba-672e-43df-8910-36068bff19f1", "value": "196608:JdbjPzJgM1anIeoDb6yFa0cDE6+918SDkOWTV/dVDdLR+tFwqzlacnHe:JdHzJgMWEDbylDg8SDkFldLR+Fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639623952, "uuid": "e3e2ef3b-ed3d-41b8-a4ac-78de0154541c", "value": 11300324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639623952, "uuid": "8dfeced3-e25a-4ce9-861d-f890ddedbd4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623952, "uuid": "f041c1b5-03d9-482c-8bb0-cc62ad197dc0", "value": "a07da855c104042f458271a043316e21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce43af37-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639641874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641874, "uuid": "25768516-0340-4959-9c1c-59c0441ea107", "comment": "Malware payload (Formbook)", "value": "9d2594bfb5bb605ca1f18d37c84ad75d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641874, "uuid": "657e6f49-94f2-4da3-bcd6-07cde6e53ed5", "comment": "Malware payload (Formbook)", "value": "e28fe21bc6e8d62f3c7d9aa6dfdb707cd648871ca6d26174aa75d81d9d6d12f4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641874, "uuid": "4cfabcc1-440c-4844-bb86-23611f8670d6", "comment": "Malware payload (Formbook)", "value": "512582274bd17e8ed87f20cac18515d9ab570c1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641874, "uuid": "95c8ff03-7b2d-44b1-8094-5f33535ce151", "comment": "Malware payload (Formbook)", "value": "c9c610734ca21b56082dfcffd4394f31b211ee94c7e47506da152fca8ef03dd8b9bc63bea99af76693cf4b73bd1af17b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641874, "uuid": "131ca932-d1e5-4f72-950e-c62de6ea4e0e", "value": "T14C641352BF447B7AE233DAF4D29E49D9C053FC586CC1DAE3A249BA1D403D620927871E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641874, "uuid": "0d556290-9230-4d07-b4f0-13a03aff87d4", "value": "6144:1cFYmzqoQrjc9+ZYXh71e/l8VmehLDcit8vNeJ:mKpAIZSe/l8fD4vNeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641874, "uuid": "943d8506-5fbb-4e85-b2e4-613048d1997e", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641874, "uuid": "49a75498-b7c2-4dfe-9e08-b7bf9543adc2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641874, "uuid": "1e77743e-63dc-4da2-bb40-195c154e539e", "value": "Product RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d402f763-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641454, "uuid": "94c16e76-f2b9-4cff-aca0-35d5251e5e4a", "comment": "Malware payload", "value": "c71b4979cdfa8207b81f9f67de37d68c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641454, "uuid": "be1f9ac0-dadb-4d68-9260-afc34813a128", "comment": "Malware payload", "value": "e30b091e3162eed18f8c1b6a69bb7a28a4c722128456ee36a326a79a3367f514", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641454, "uuid": "f5207ff2-3a9b-4a1f-ae0f-bfb229dc2e34", "comment": "Malware payload", "value": "6d7515b63ef2c4cf8644e5c2036a138a2181c3bc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641454, "uuid": "64da17f9-344d-4b98-b792-10b1da890747", "comment": "Malware payload", "value": "af2a046d46e4878b5e3deca89cf60e153e5ca5b85bd1508c802cf68d8610264bcae07b620ce14b9c3321a319dd09978e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641454, "uuid": "09b95beb-c3ef-4dd1-b5ed-5bc5ee175e02", "value": "T17905AE12B2D88932C57B42706D7ADB9E9535BDA007B1C0FF13D8A91D1FB37C06A36A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641454, "uuid": "1b15e00c-bb70-432c-909a-5a5d8df10ac0", "value": "12288:qW6DfY8owv43bqKlRH1Vq9iyXUAugN+ZkecM7En7En7En7ET:qW6TY8owvitjVqoAUAg7W7W7W7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641454, "uuid": "a9768332-9aaa-4925-a488-0144ac20789d", "value": 873408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641454, "uuid": "cb530fa6-ce4b-4905-8e8d-e8eb24d281e0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641454, "uuid": "96cb8320-df17-4b8e-9abe-3d6f8dec32f0", "value": "NFE_87654.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b460ff33-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690793, "uuid": "6dfcf437-6641-43ce-abf0-b84c081bf5b0", "comment": "Malware payload (Mirai)", "value": "76592bde6387eeb14fa190e41f894bf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690793, "uuid": "45dbcf47-1c32-43cd-8384-a80b6a24b6c7", "comment": "Malware payload (Mirai)", "value": "e31cca983647c6c730f3f565a2c0e64fe323779e6a5354cf6098a343e84f7715", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690793, "uuid": "39cc9e7c-3a95-422e-80f9-c8fc0d5bcb4d", "comment": "Malware payload (Mirai)", "value": "5d97625811da78270caf0007fe764b290a03d53b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690793, "uuid": "97defa84-0851-454a-b57d-958b6d788712", "comment": "Malware payload (Mirai)", "value": "824a0d70a2611732c3b7b21f71c9beabee90e1f671d1ed5f42578645ba637eee4a2fab668a066fa274fd0a66ee2e9ae9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690793, "uuid": "a73634ef-8294-47fd-a656-99210f9b9d00", "value": "T102833B97F800D9B6F409CB3704975906B630A3F60AC326B6B7272527EC760962577FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690793, "uuid": "1ee8e443-f77a-4d4f-8cd5-8752ea485e1f", "value": "1536:dJf1QiPLb8F0IE7wq5LeDHZRmxs6lqMVyVqwq3SGRZgql7bJ:B9LV1wcCi1lqMVyVq9iGRZgql7bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690793, "uuid": "6f49f94a-fc9d-4f55-ad3b-751b286e7fc4", "value": 82128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690793, "uuid": "d4c88ec7-8356-424b-89c0-42980b01997c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690793, "uuid": "c48cec6c-4373-4930-b233-16ccef316de9", "value": "76592bde6387eeb14fa190e41f894bf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b5194a-5e09-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639615662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615662, "uuid": "4055d105-6df0-476f-b84c-c020b6f91f12", "comment": "Malware payload (Gafgyt)", "value": "e9fd1f972de303f0fa1424ec20a7a111", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615662, "uuid": "9b94dc16-71db-475d-9b7c-63b95a45d18f", "comment": "Malware payload (Gafgyt)", "value": "e3279dd17b6ae7c8465e4fc0b60298a6e36b8552df7a13508c7cdb1b7426836c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615662, "uuid": "54bf283c-276d-4a41-a747-d0b9698f62f1", "comment": "Malware payload (Gafgyt)", "value": "db1be0fb716f54f45dde31c4676b3cf38889e6d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639615662, "uuid": "247082de-76fe-417e-889b-69942451079c", "comment": "Malware payload (Gafgyt)", "value": "a9b2fe8dc4c2f6ce5936411e9b1c40557501db38c398053b6f84f0dcf32bc8e43917384a925dd7100f2a6f0921613a33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615662, "uuid": "0d4bd0e6-7e67-42a8-857a-2e9f61f31594", "value": "T144C31893F801DFA6F40BD67604D34B25B630BBA60F932522721739A7AE762D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615662, "uuid": "7ffb9707-61cb-4e21-a43d-637221aada01", "value": "3072:b2Xa1UobEi3odXN0dyDZzJ3SrS6mUet3QBeThENV:b2jQEi3odXWyDlJ3ezmUet3QBeThENV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639615662, "uuid": "47af720c-4e37-4337-9198-2588d64ddf01", "value": 125661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639615662, "uuid": "372877fa-735b-4248-b89e-e6c37ec12105", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639615662, "uuid": "628daa48-37b3-4bf4-9c1b-d91350bde4a8", "value": "e9fd1f972de303f0fa1424ec20a7a111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69e1bb6-5e6a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639657269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657269, "uuid": "c362af48-ac08-4b24-bbce-80d6ca51c127", "comment": "Malware payload (RemcosRAT)", "value": "0d8326f60911be3f5c0662eb33d52f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657269, "uuid": "a7103e55-3caf-4dfb-9f26-5f21f3273d15", "comment": "Malware payload (RemcosRAT)", "value": "e3c4caeafd8e19662239571bd3eee795d2ffb003953ce5eb06026a1be72b32e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657269, "uuid": "eb71372d-6ff3-427f-8b59-73f0ec74f86b", "comment": "Malware payload (RemcosRAT)", "value": "d4a33d7c5998e076f5fe4b16544c87fd6f82b144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639657269, "uuid": "b5838182-d0a9-45b8-b8e8-e552f283a3be", "comment": "Malware payload (RemcosRAT)", "value": "ab65555ee10cc65a11c023c2f1bce87787722a37458ffb0f68ea97f33dcb2d5ccbf1cc9f72070f6fd6b0418ee72e9b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657269, "uuid": "9ae8b851-9d8d-459f-8bd8-00b0bed27884", "value": "T108D4AF62F7A0C873D1531A7C9D5792AC58367D313E28D4472BE81E486F3DE83791A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657269, "uuid": "a8337f4e-60ba-4558-b149-7214f4d39625", "value": "818fefd508faa2dba213d5a222554a22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657269, "uuid": "4a2fab7d-1416-4996-8303-f38e069a6250", "value": "12288:pr979FvACpZmNFHYVidVqxql53FgXJrmv+3R+Z8on1PRlR:lp92CpZmNFHYVidVqA5VgXEv+BCT1PHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639657269, "uuid": "89c459a3-33c8-40f5-9b44-2c8c523664b0", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639657269, "uuid": "50fc2263-99e5-4bf2-b375-62bae2bed822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639657269, "uuid": "9aaa1c89-a948-4e9f-b544-9ad51fe20d73", "value": "Request for quotation,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8e0c21-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639616829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616829, "uuid": "a57cd217-5399-418f-aadb-b3d8282683f7", "comment": "Malware payload (Dridex)", "value": "821d7f73315748debd9fd1aba2ea3565", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616829, "uuid": "4e972a86-2700-47e8-accf-d0925d4f2f5d", "comment": "Malware payload (Dridex)", "value": "e44b1a6a58dd89fec8005134c68ae75278904f51f91ecdabc66e59eaf258bb8c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616829, "uuid": "14312114-f596-4520-8e91-22c42e288a0b", "comment": "Malware payload (Dridex)", "value": "1d328034cfd41b0080c9dce6a8c76fbe94e29381", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616829, "uuid": "1f6259b7-32b7-4963-beac-ca77df611734", "comment": "Malware payload (Dridex)", "value": "f89739dcfdc2d2cd35bb63ce88ba246a1df539ee94d647b7824af1778c6a7b0501867b4f90d3e55ca97df61bee4da6ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616829, "uuid": "356c0d75-6b9b-44c3-81a8-a7b66c94aa4a", "value": "T115B4C0A33F4B0C6AD4525D3CCAFEF7A6082F66454588CF3072A3735AD6F4542A825CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616829, "uuid": "6e6c23d4-0d0b-4011-b0fc-f6b4b0003444", "value": "425f8965b1dafa239bed13744d5413de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616829, "uuid": "19dbf63c-fbe7-46af-900e-f64346fdbfad", "value": "12288:VQv+2yIUMs4UQ0EysQeu2LzmWMdUJPRXLZvR5xdzVU:e7D5MdUHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616829, "uuid": "3a705429-da0a-4771-ab8f-151956d76722", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616829, "uuid": "79177a13-6356-4bad-8a48-1bbb62b4b895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616829, "uuid": "5ffbb6a8-c83d-4e54-8e1e-46ef4c867b02", "value": "SecuriteInfo.com.W32.AIDetect.malware2.21761.23248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea0fc0e-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1639643941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643941, "uuid": "302819a8-e916-48bc-8d4a-67f3ba400496", "comment": "Malware payload (Neshta)", "value": "7516ac47b4adfef609f6ce4dc1dd809c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643941, "uuid": "adac7687-f8e1-4982-b155-622e617db3a2", "comment": "Malware payload (Neshta)", "value": "e657e5580f64554a920f5460edc2a1ae4179b183f7a2adbd613f0e877839bdb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643941, "uuid": "2ecf6e39-1ae2-44af-b0ff-971153e887ac", "comment": "Malware payload (Neshta)", "value": "81d93a74a813e4d2231bf4b06762090d520a5145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643941, "uuid": "5d28a252-7191-4e2c-95a1-ce0e9daefe80", "comment": "Malware payload (Neshta)", "value": "374ed2913a38cb7674603a6d583bbc8cdfaeeea4cfa7b605aeb73ea6a3fe2531f0c58711d1abf32e0cc85b7f2f9e4145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643941, "uuid": "71007778-24a7-4ed4-b691-f432155f1297", "value": "T1C9C4F1D2DD801CB3CC3802B990738E5449AB3D259A7835317BE83BAE69B7907593B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643941, "uuid": "0a34e3ab-f66c-4976-85bf-fba32fc81260", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643941, "uuid": "54fa656a-0291-4b16-b4e1-867c1bd4397f", "value": "12288:zVjbEhStY6jsFnj9yYQf9gyGqVYW9WF9+m8BCLxRz:zVjbWMjsVj9yYQf9txVYWY6BCtRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643941, "uuid": "d1223ca5-19fe-45a5-90b3-8e14a808d6fb", "value": 562323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643941, "uuid": "4c619ee0-c207-46e8-a3b2-96479748332b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643941, "uuid": "0a7573d7-a277-41de-9bfc-4478b44030e7", "value": "7516ac47b4adfef609f6ce4dc1dd809c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a90b16-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639642723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642723, "uuid": "b5d1aefe-feb7-421d-8f68-623a32a97351", "comment": "Malware payload (AgentTesla)", "value": "3de1f5a006718b0f3934e42d00015171", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642723, "uuid": "6b0ca144-5a82-496a-bd4c-3fba58d7414c", "comment": "Malware payload (AgentTesla)", "value": "e66279354315650c7780302abdc2558b6da7e42b1911d6ce8f82c1bbd4168463", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642723, "uuid": "5bdec0b1-8b0a-43dd-97e9-c3273a97ca68", "comment": "Malware payload (AgentTesla)", "value": "6b690697d6e3e177c7f675f34a0c349f24108f8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642723, "uuid": "90f65adf-6e45-4e07-83a3-6e7661d22c44", "comment": "Malware payload (AgentTesla)", "value": "1294e74d57b949a085086e4cdf8d98b6bacdf7655b8aa530113cff2b76331d3e873709fdd36621f173abbae24c68b2a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642723, "uuid": "3190addc-d134-47d6-a2d3-9a82a2f1d56b", "value": "T18C358C312393F98376CC64ED385CB7E83C71BD5B09904A5CABD4871D609247898FEAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642723, "uuid": "cdb6f894-543b-4c07-bcbf-93959952353f", "value": "12288:bNLrOjRY/ffGxmSeCYmgG33PgiuAG1QBmoTa4TgRmpnXKGXR2e344AeEnwa7NmIS:1ks+xsCiG3fdBZuqwm9yi0jUIAzYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642723, "uuid": "3ae7eb14-3f52-439b-bb00-e608f8c6f4fb", "value": 1104840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642723, "uuid": "f5334f2a-58ba-4f4a-95cf-7fca487d4ce7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642723, "uuid": "e2208420-cda8-42f7-815d-0eeed499b9e0", "value": "Copies of documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c351bac8-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639646580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646580, "uuid": "23282f33-d640-4851-a7a8-04777df53738", "comment": "Malware payload", "value": "f4c61569096693ce3e9635bef86627a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646580, "uuid": "12c20da1-7597-41e4-a196-aa9fa22c07b6", "comment": "Malware payload", "value": "e7228b310558ba8e67f7fdc3706f88e6f581d55361d7f2f2b67efb67a30711eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646580, "uuid": "e70914cd-8d03-499b-bef5-d2adb1ece24d", "comment": "Malware payload", "value": "b0903cf9fb41a17bcbd942aa6bec4a796bee0103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646580, "uuid": "cfc88ccb-2981-4d7c-84a4-5c0c50b50aab", "comment": "Malware payload", "value": "23e1f9eae7ad55df3b12433c2ab804e5b524b949f39073a90d7f7b194c23b8a734b0bf8028e485e2621588c5c97f671e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646580, "uuid": "85ccae22-d4fe-4f9b-8547-d82167198f9b", "value": "T19144C76C93385445F321AA74DDD2B878269C0D64BA80D3DA37E2BE6D7836B65FC420C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646580, "uuid": "05642637-1fc2-4c93-8cd9-adda893661e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646580, "uuid": "1842879c-a17b-40c6-93c7-7470e6d9d374", "value": "6144:RMtONj2giiRx8iQHlWKXMtONj2giiRx8iQHlWK1SMtONj2giiRx8iQHlWKa:RMtONjVRx8XFWoMtONjVRx8XFW0SMtOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646580, "uuid": "d89aae51-e1aa-4603-8745-a72220da07fe", "value": 254424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646580, "uuid": "53cee01d-3cf2-44d2-8fc6-12f0a208c48b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646580, "uuid": "799289ba-4e7c-4658-b905-92cd7be3028b", "value": "f4c61569096693ce3e9635bef86627a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590a22e5-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639642536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642536, "uuid": "f56c8c9f-b87a-42cf-a30c-4b3a604f7183", "comment": "Malware payload (RedLineStealer)", "value": "97c2df73b14c762b59ec790419b097f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642536, "uuid": "a52b68fb-7b42-42b5-a202-cd97db99122f", "comment": "Malware payload (RedLineStealer)", "value": "e796fd7e7b3fe5b091261f2e4ac20f27ce06161da23796c29b9882de955508db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642536, "uuid": "eca0d2da-34e5-4e39-9f51-e148c7812424", "comment": "Malware payload (RedLineStealer)", "value": "a2b8b8eb7642e551703e6bc31838ae22f2b51241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642536, "uuid": "40adc400-45b8-4e00-909b-33a8e6d3948c", "comment": "Malware payload (RedLineStealer)", "value": "d5c7e00c9e40698d418560c67cd9f792c24eb3cbacea6f5b421b443f41a6cc8f668371ffd5a5f7be443beb2a3b475697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642536, "uuid": "8dfdb1dd-0709-4e75-9b5f-9d995b082405", "value": "T173A4CF00E6A2D035F1B312F859B5936CA93F7EA26B2850CF13D52AEA56746E0ED71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642536, "uuid": "d5ca8c76-3d29-4cb4-be3b-704584004917", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642536, "uuid": "55a1c56c-7f0a-4c38-9abe-ea9bee33f1e6", "value": "12288:RieYn2u+Pwu62hWGnSz3vEUBR5Iemb+yE:RJu+Pwu9/Sggqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642536, "uuid": "61674ae7-5476-4348-bf30-86e69a99cce5", "value": 456218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642536, "uuid": "d93e5ff0-131a-4583-b6e3-694383810081", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642536, "uuid": "9b0bf929-685c-4a3f-8042-2b60303f5cdb", "value": "97c2df73b14c762b59ec790419b097f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dc3792-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650263, "uuid": "079d29c7-5f95-4074-b6e7-30e5e4d77c48", "comment": "Malware payload (Gafgyt)", "value": "e5767c6b73b4b9c722cc3c39b49dba67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650263, "uuid": "a1d51485-12f4-4b9c-a62d-115fe1c1c2e5", "comment": "Malware payload (Gafgyt)", "value": "e7b523ce5bd76521cca06eef534c817aec4d61153f95b7cd941af14d4d2c3e46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650263, "uuid": "b3a27ccb-5d0c-43de-8364-7850d6ae6233", "comment": "Malware payload (Gafgyt)", "value": "ff1add197a6b0981cbd9c34b23407232678efe76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650263, "uuid": "06b967af-650a-44b8-a9b7-12ca36f65fbd", "comment": "Malware payload (Gafgyt)", "value": "116601baf0a74881b4802228a45cbe5d0ee2bc8c8558db163b1460d82aa55042a616a75eba624e1648b9a8ea7e4137f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650263, "uuid": "e1f66de3-9349-4e9e-bd16-c38c32b14bf0", "value": "T1F8C31945F8448767C2D327BAE79F078D3B36569457D73301A938AEB02FC1B892E39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650263, "uuid": "e9104c9d-600d-42c4-abc4-80a2c7a0a7ee", "value": "3072:qTfe1QDT87X35hUy7vSqBm4drQA2didX1YM:Oe1QD2X35hUy7qqBm4drQAMidX1YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650263, "uuid": "81ef7112-2436-4bca-a617-a98ddf5bf1ef", "value": 122661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650263, "uuid": "cb560387-d339-4b28-a0d2-d89c6e3ce489", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650263, "uuid": "31a74f2c-d279-4daa-84c9-cce40ef412d0", "value": "e5767c6b73b4b9c722cc3c39b49dba67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3703c0-5ea3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639681897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681897, "uuid": "3a8fce80-76b3-4015-b4c4-55db65a3c585", "comment": "Malware payload", "value": "64ee9543ce0c7d8e748ec5e4ff09d9ab", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681897, "uuid": "41777818-2492-4b5b-a29b-e8aab17d7265", "comment": "Malware payload", "value": "e8a8e13e9db00ced12de1ae44484f7965c4431caae85f802a81583cb419b89ce", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681897, "uuid": "95f8f0e2-a78b-4d6e-b24c-4ca55b4d53c6", "comment": "Malware payload", "value": "f3e550335bd3ab8e07727778c2239132f8ea6c76", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681897, "uuid": "8c0a040e-2275-44b3-be9d-184dd7bc563c", "comment": "Malware payload", "value": "d73428ecb2eea271b8dbadaa8e2814549070f1f65f0bc50a0aefe8ddb3fae38aa5eda8fbf7c60bc7be8ab30239632217", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681897, "uuid": "2626ba19-37b4-464b-b724-d7c746ac448f", "value": "T1A522D6EFEA406FD2DC797279139B492D7C6440A1F0CEC55281F5F918BC94623AF7A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681897, "uuid": "b963aa0d-14bf-4533-8804-60d8a9b7e0e2", "value": "192:hqm09vnePvGpOxXlzpR/eL7ro2cNVqNuttfXDvJNaUJtst/QFpiWtmtUXkc1thj:hSFoR1psonJ63WsihLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639681897, "uuid": "1bfcac43-04ad-4701-80ae-3f912ec0b28b", "value": 10110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639681897, "uuid": "386cbd78-e865-4223-bc02-f1a3040506cc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681897, "uuid": "5648a91c-6952-4e6b-b963-c4bc739c53e1", "value": "Factura386.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e411fc-5e23-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639626740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626740, "uuid": "bbeb92db-f07c-45dc-8d2a-a081c0d14726", "comment": "Malware payload (RedLineStealer)", "value": "95b1e2e49e2bdc20ee258323e54090cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626740, "uuid": "3b926c2c-928e-4a82-8504-a5a8c71cbd96", "comment": "Malware payload (RedLineStealer)", "value": "ea53e534c97385c9b4c322177ffabe344c24e39ddfb02579dfaf88d81a45706c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626740, "uuid": "210ad2b4-9fb3-4f94-9b08-b848929e98b3", "comment": "Malware payload (RedLineStealer)", "value": "753f83efc184e089f4d8a65f0940ee13e276d7dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639626740, "uuid": "8713f4fb-2c23-41b9-ab6a-bfcf0198f091", "comment": "Malware payload (RedLineStealer)", "value": "cc74a740aea656526d857c456697ce4346985a0abd825f91943ab0f7541f92cb66e54a84c07b6eb353ca0bf57e4e2717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626740, "uuid": "dc19c440-445a-4dfd-b60d-0d645ccc7f23", "value": "T18EA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626740, "uuid": "c212ed7f-7b7d-4b12-8c11-d79b39669308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626740, "uuid": "799ceddf-9401-4134-8470-9060f80fe825", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2AteulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639626740, "uuid": "e2354fb6-6bc3-40ea-8121-389dc073d0c0", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639626740, "uuid": "b4c6ec9b-b86c-4eab-b53d-828de3cce4ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639626740, "uuid": "ffec02ca-d123-4e23-988f-633101b8d4e2", "value": "95b1e2e49e2bdc20ee258323e54090cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0670c6b-5e81-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639667218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667218, "uuid": "f6dadcc9-eca7-479c-b463-b178ad3b9603", "comment": "Malware payload (Mirai)", "value": "eadc5ae76e2d3dc4118b857ce5a22f91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667218, "uuid": "c569ec36-e136-422d-8504-d1787df07293", "comment": "Malware payload (Mirai)", "value": "ead1be4ad79fa914351e0aee611f169ef7c12f11dda4931476fb60fcd3cf1f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667218, "uuid": "d0b4ec04-9f38-4616-b236-5e7cb5088f43", "comment": "Malware payload (Mirai)", "value": "a3d95e0d7ca524db3349cf91ac9c9f0c2c96272c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639667218, "uuid": "bc242fd0-8f5b-4ed7-b9e7-4cd5d7191c5a", "comment": "Malware payload (Mirai)", "value": "93da7918ad75359e4df6eb5e77a73afa7002ba2f84455b85dcedc3fe5a500efab819185e8c0617c747f0598878481bb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667218, "uuid": "0ce79947-950b-44e4-bb0d-92091a2bd1a0", "value": "T1F2B2D1A0F6444486FDFF7C711CA25FE61BC01F9572A6CEE296846F01C22D5A34B02EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667218, "uuid": "9d02e151-c557-4810-9341-b91e08c3a6e6", "value": "384:75df8QtIF7IZGJi7vvMoIHIg3E0U2c18WT3iYEThNdyFKm6cM4uVcqgw0OarxWX7:75df8QtIF7I0ioJogRfJYEFSK7D4uVco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639667218, "uuid": "8fcd9106-6a70-48cc-ab74-071c9a0babf9", "value": 24416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639667218, "uuid": "88006f87-a15b-4c76-8944-18beae9d7987", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639667218, "uuid": "9e07997c-28da-408d-9fbf-f66eb5e04268", "value": "eadc5ae76e2d3dc4118b857ce5a22f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c332468-5e55-11ec-96a4-42010a9c0029", "comment": "Malware payload (Sality)", "timestamp": 1639648098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648098, "uuid": "f82c32a6-ba24-4d70-86f5-e9c4477619b2", "comment": "Malware payload (Sality)", "value": "160f1d086f6426f1cb0ff10d0717d941", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648098, "uuid": "0ad8e4f5-1ef9-4b98-8467-2a3e7a3fef27", "comment": "Malware payload (Sality)", "value": "eb88869b7f1bc3f33bb3cd56d6cf4d81fbb0beb590cb9678cc1acf3206f3056f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648098, "uuid": "1af343e8-fa57-41a1-8fff-b1b862c2cb6b", "comment": "Malware payload (Sality)", "value": "27b37d70e13a4b6009b55b27ea3f04a627f32906", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639648098, "uuid": "40cb9ae8-b9ad-4611-b062-24803325ccee", "comment": "Malware payload (Sality)", "value": "c6bc6831d30249a8d0256f3a53ab33d2c91c9f8ec2f30415ab26ad79f5e6bd64e8f1ce9ee1a93d6973c31fbd36d3079d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648098, "uuid": "3e2f5a26-7d7a-460a-8c37-f517d78bff69", "value": "T17934AF00FF126537E56B8AB5DC3E5229A61E7FA8A7C81483E7C81D2F15F90D2EA31507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648098, "uuid": "ca16e57d-d199-4495-a032-bcfab5eb7829", "value": "1df6c4b9a33eb17beff1d38492f0e208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648098, "uuid": "b7578024-3018-4753-b7ca-25180e1fba50", "value": "6144:jm24X8urcFClqvSCS/xjF5sNroN1ratuX0sIVw:jm24X8AcFGtvs6NAvsyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639648098, "uuid": "6ff668f1-6180-4677-b45f-0813e7f98e73", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639648098, "uuid": "317c29bc-dedb-4889-b718-f50d599f13a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639648098, "uuid": "80b77bc2-050c-421d-bd71-86323d9d7cfb", "value": "W3Mfc.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97895a92-5e4d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639644788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644788, "uuid": "c61532fd-c29b-4bd1-99b6-158fff60c4cf", "comment": "Malware payload (Formbook)", "value": "47142e658c3e23b79c74a68eac3d3f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644788, "uuid": "f37679bb-4228-47e7-90f7-513c74e3fa29", "comment": "Malware payload (Formbook)", "value": "eb98b6a45ef85a90508b5b2a1c2b9122b34ac6dc62eadd58b0bc15bfb9e868c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644788, "uuid": "c46dfa62-50fa-4dbd-9b6f-5dee6af2b6a4", "comment": "Malware payload (Formbook)", "value": "b6a663c8cdc896b9b1a534e30fdb05fe72354390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639644788, "uuid": "3c0472ed-042b-4c04-9c4d-ca911510e013", "comment": "Malware payload (Formbook)", "value": "64e5de06cc076ad379c3745cf4d3e39e15e1514cd992ea3a0756be0700956cd30b3947963b9d5fe370d0e80f67770a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644788, "uuid": "28b41972-d111-4390-8c85-8f89d7d09b31", "value": "T18315175C7142B18EF4F3C932FE561C58FA706CF3D207C59AE01B324A5A3E696EE164A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644788, "uuid": "7dd8fbc4-61a3-42d3-b95c-3d2d10e0c7e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644788, "uuid": "9d1316ef-fa0c-4ce7-9499-83e56df7e8e1", "value": "12288:u6TgVHdHwTK4Etg1fN8FesbhwOyqTC/NfLblQr1MF8g5MmJZULU7I129XrgV+rci:iV5w+u/sbhRreNftQrGW+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639644788, "uuid": "f0568480-1b17-40de-983d-bf5bf7377e88", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639644788, "uuid": "214d568a-b854-4f5f-8656-f065d9c3022d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639644788, "uuid": "5c70064b-4e44-40e9-846d-d6baefcca27d", "value": "47142e658c3e23b79c74a68eac3d3f72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b57c14a-5e67-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639655774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655774, "uuid": "d384c4c2-725e-42b5-b2de-0e025ab497d6", "comment": "Malware payload (DCRat)", "value": "3e23ae758921e1927605a50c59884b1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655774, "uuid": "ede8fa70-1c09-48ca-a217-13c7fc1fa468", "comment": "Malware payload (DCRat)", "value": "ebee645f5e860dc06697073c47f33a0d9fdf19b4ea3f47bd20ef8579cdb11349", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655774, "uuid": "d49581fc-12fc-4e08-b4a6-b9761ab229cd", "comment": "Malware payload (DCRat)", "value": "808633a031b5a771be5ada457a53c957b8cfabe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639655774, "uuid": "9a06e624-3f4f-4f2c-b500-93f3f5a1cfed", "comment": "Malware payload (DCRat)", "value": "aa878d506a5161f666d0f94de954425a43bbd847c26151a4fdc47ea10a05388c7d53180a04d49c4116d4d44d415ad7a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655774, "uuid": "7f4d3da8-e7bb-4a86-b1f7-e7f65894f0a6", "value": "T108A53365092345A2C4EDE5B4F1BB7A4A017C1BF39F76B72E94518C928738A40F385AFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655774, "uuid": "33c33e49-04c2-44a8-b63a-a2ef0d5b0f37", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655774, "uuid": "57bc5f2c-a1d2-4f71-8370-a2f2475dc740", "value": "49152:IE9EWcXjYqnsr5tLv4ZpTpE9dEts1NfcbVzaaTN:InnfQgPp+OwNkbVzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639655774, "uuid": "27cdb7b0-1d70-4c5c-91e0-ce3923bbc515", "value": 2240000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639655774, "uuid": "6f6e3a59-6413-49db-96c1-d522710611f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639655774, "uuid": "28332f42-509f-4516-a67e-9a9706273287", "value": "3e23ae758921e1927605a50c59884b1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23096f4e-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639683677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683677, "uuid": "4925da5a-7e99-4e8c-9149-cbd80455450c", "comment": "Malware payload (Mirai)", "value": "ded976e9067b98b137a82f4ca742fa41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683677, "uuid": "f9205a06-3888-4c78-9d66-d53f9a30242f", "comment": "Malware payload (Mirai)", "value": "edaf3e1a13100bab43a4ffd4e2bcff308c0eea2d0fd176c92f1e1693bb711f8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683677, "uuid": "ff5056a6-4065-4ea3-b827-866e3fc186da", "comment": "Malware payload (Mirai)", "value": "2be58c58bc0cba6fc943501511e42bdbfb68c1d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683677, "uuid": "f4d9e735-8b7f-4ea2-8d33-a71a25344104", "comment": "Malware payload (Mirai)", "value": "d5967bdfebee8ea31bfb6a8b86fa63ea377c2ed009411e19f59ce296cc96af40108a2d2226b94f6ba67272fbb847b659", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683677, "uuid": "8b84de69-73f9-45ee-8e45-f742bb81b522", "value": "T16963D815BB610FB7DCABCC370AA91B0528CD654B21F47B367934D418BA4BA5F19E3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683677, "uuid": "493569c3-fbea-4722-a2bf-527da48cd930", "value": "1536:QxV9Es96e1l0/7evIGPmkpighRQTtbCTZ6i5iBFn:QT9Es96ejg72IGPoCTGFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683677, "uuid": "3328ed52-5e3b-4a05-b216-f700cabd26d4", "value": 71932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683677, "uuid": "47c156c1-1746-4e78-80b0-459c4b7d52a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683677, "uuid": "1955ae4b-79fa-470b-afdc-9942d310cab1", "value": "ded976e9067b98b137a82f4ca742fa41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c631dbc3-5e51-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639646585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646585, "uuid": "452d09e6-5cc4-4d5c-8d21-0e90f35d3f72", "comment": "Malware payload", "value": "4640aa48fb7e1166fb6ae5a9cd7875f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646585, "uuid": "26f62abc-b278-4cf0-81a4-faf45ea47da1", "comment": "Malware payload", "value": "ee505149ea3f5ad3fca012ce0817e52b5b9ca65d1838ae705e4577b3ed73e84f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646585, "uuid": "4630d327-7849-4ea2-a013-b9f4d3c8a6d6", "comment": "Malware payload", "value": "48441fdafb0a91366b08c406a90891a4d34a4979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646585, "uuid": "74548e25-cea9-4e96-b51c-ff8035c6a430", "comment": "Malware payload", "value": "435073ce9f2720696358a0ec3da271a5f77a8d861db18340ce87fdef7b92b487c7677535bbceb6f47cc487cb2e53ea73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646585, "uuid": "adbd6e98-3bc3-4aac-aa15-efc0b2989d93", "value": "T1255512276ACC7CC6C0381B72777B03D2CB6CED9486A3E41E25D8578985BD1A372467E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646585, "uuid": "99206aa3-c135-46ee-821b-a3dfb266e59a", "value": "a22343b0e3e9005321cfe6e22e11d879", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646585, "uuid": "cc4ce8cc-3a58-4b13-a40b-3d4558d5014a", "value": "24576:gKiCgW8JbNoZpJ4SOiaBleZTi36xQtP1wyrrBP:gHXWKQpqSUXeJxm1hrBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646585, "uuid": "515c72e1-4413-4dcf-81cc-fff88a2280fe", "value": 1329042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646585, "uuid": "e54882ac-42c5-4197-a550-4becdd069d78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646585, "uuid": "c9aaeaf3-0039-458f-a62a-feea401f4b9e", "value": "4640aa48fb7e1166fb6ae5a9cd7875f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03845ccf-5ec5-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639696080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696080, "uuid": "89db74f4-5b92-44a9-a1bd-378782971009", "comment": "Malware payload (ArkeiStealer)", "value": "e89c3f78045dbf9a23598e81b7826a55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696080, "uuid": "292d387f-26a1-4cc0-a68c-174beea6de29", "comment": "Malware payload (ArkeiStealer)", "value": "ee74cc4361dafb970087e89d502f3fa9dc073a4e31baaf9d1f843c630431bdbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696080, "uuid": "6d2f71e6-97c8-4fb3-8cd0-443900ef795a", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639696080, "uuid": "1bf1ecd7-857e-495f-844d-dcef3da32e7e", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639696080, "uuid": "42319f6b-09ef-48db-9fb0-0e161739b67a", "value": 358648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639696080, "uuid": "7f458984-3065-4c9d-afe3-a048a17fda47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639696080, "uuid": "eb46086a-2bc0-454b-8493-4c65be020213", "value": "e89c3f78045dbf9a23598e81b7826a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268f260d-5ea6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639682824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682824, "uuid": "75152f3f-838a-4c4a-9dc5-3c6716e1b9f8", "comment": "Malware payload (RedLineStealer)", "value": "ded4beb70772bb0e279a411f8d137461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682824, "uuid": "9b8f2f0b-0c49-4660-802d-0f93656d14d7", "comment": "Malware payload (RedLineStealer)", "value": "ef01da1799634bf15ebf40772665da4c4a03da8d3c09704525cc576355dd5474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682824, "uuid": "2cfa15a0-4433-417d-9b0d-5560ff5ef8b6", "comment": "Malware payload (RedLineStealer)", "value": "61c796bdb61b209b93dd7afad6112a3998a2db74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639682824, "uuid": "4db76703-2ffd-42e8-8c53-e5ff7f1d0e23", "comment": "Malware payload (RedLineStealer)", "value": "779b915a822d766cad5b891223363ddb254793ae0e850ae2d767b2766fd481fae763f266ab043f37898ac47484464aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682824, "uuid": "8fb90c4b-15bd-4745-93b6-362a11b70a69", "value": "T1F2E401E176E19811D4D84931DEBEE2AC14D1BC52AAB0AD7272503FBF3EB58E1C60135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682824, "uuid": "1c17508a-7b73-43ea-9ca0-3f1230f31ac9", "value": "624e33a2407258d958a51c00359a919e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682824, "uuid": "2bd31b89-20c4-438b-8788-02f9357a88c6", "value": "12288:OlTPZWX27kUn/Z99bZP2O1vx6aoJLwbsynsZZHRk4e41OSEh7uWBJ:iPW248vLPjvMr5wbarRpe4exuWBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639682824, "uuid": "20bd4789-5bbe-4882-8b4d-7e23bfb2a759", "value": 686168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639682824, "uuid": "344bb80c-483f-4c70-a6cb-9f5d7ef740c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639682824, "uuid": "61022bb8-8d0a-405c-9c5a-8a4c7eee4c15", "value": "ef01da1799634bf15ebf40772665da4c4a03da8d3c097.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad9ef25-5ec8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639697703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697703, "uuid": "3ea39fde-cd90-4794-81c4-1ba087fe7f91", "comment": "Malware payload", "value": "ac0a0d64408f40e1c3b0ca8ee8b1e13a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697703, "uuid": "f1f68a31-d2d2-4b3d-a638-c80581d9e602", "comment": "Malware payload", "value": "ef820b648b3feeef54dc625e9aa405335acbe29f33314df89b535579a7b08a82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697703, "uuid": "53ef80e5-cbd4-4640-aff2-808befdba7ea", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639697703, "uuid": "f55d7cab-cb86-416d-ac3a-d9eb6109ad52", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639697703, "uuid": "82d3c830-0c6b-459e-b941-25364f070b1b", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639697703, "uuid": "5728bb5b-57e3-4d9c-b4ba-4d804feb0e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639697703, "uuid": "eb560fa2-2302-4b71-940d-83d7c0857d49", "value": "ac0a0d64408f40e1c3b0ca8ee8b1e13a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece9e762-5e8b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639671560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671560, "uuid": "fa45be5d-cfdd-47c0-b6a8-829bfc50f9fc", "comment": "Malware payload", "value": "198ffd1a7265f51143195b19e315498e", "object_relation": "md5", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671560, "uuid": "1c0b9e1e-0aba-4554-87fa-ee049d4b5e89", "comment": "Malware payload", "value": "f0b81104457bb65aa8d908ccc920e725da1485be7d8bfa8fbdb79cd06d8e9a7a", "object_relation": "sha256", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671560, "uuid": "111ef640-776f-4064-8622-43403502a1ec", "comment": "Malware payload", "value": "31ecba3fe6cb3ce997f94900550458f1b7b95151", "object_relation": "sha1", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639671560, "uuid": "2928e726-b949-4229-aa04-97826cd4aa03", "comment": "Malware payload", "value": "861eb636b3d999e45155a1f213a2d13031a2705f7b8b6e3e375dd72a303bd5a5894d631ce95430943888ab6c77a6e28e", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671560, "uuid": "9ab0e3eb-633e-4581-b801-0adf6667832e", "value": "T1FD2595F622246307EEC391746E02C73514445E4B06F508FE6BD7B2BE0D727266B9AE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671560, "uuid": "26bcc87a-49c2-4423-99b7-bcae6a3cbe35", "value": "fcb54e41e8df228eeaa37df1acecde64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671560, "uuid": "0067515e-74ec-4e4f-a211-5a81893acf85", "value": "6144:UZ3vSB/TRhm3jMF9vcVDzThWlb4ir8UQw8Mz1+:UJm98TS9IMVZr8UQw8Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639671560, "uuid": "7e2b44f6-d040-41fd-af2d-85b740ea57fc", "value": 981582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639671560, "uuid": "33f2061b-b482-42fd-b58c-8dba830a97e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639671560, "uuid": "4ac9c9b7-a8f0-401d-9637-052045ced758", "value": "f0b81104457bb65aa8d908ccc920e725da1485be7d8bfa8fbdb79cd06d8e9a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b2e1f5-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639645029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645029, "uuid": "788da3ef-a7c8-4c1e-b461-b46aa08272a7", "comment": "Malware payload (Dridex)", "value": "c7e352f3f702bc5a54c13963f2a6e4c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645029, "uuid": "93aaa9fe-09d2-45ef-83fa-b28aa52fe878", "comment": "Malware payload (Dridex)", "value": "f0d923f147d65e191df660c5d593e77599dfe95abf43db404da704012056262b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645029, "uuid": "67600bb2-5275-48d0-a9b5-1ddbbfc2bf4f", "comment": "Malware payload (Dridex)", "value": "f06aefdefd603a6a5e8c64c2bb52fb6018736c55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645029, "uuid": "5068f8df-c16e-4c04-a20a-7c8fa2285517", "comment": "Malware payload (Dridex)", "value": "1d634a570caefa613dacc17bd9a3402115489fae0a180fdda0905ddac4605e5ebd4b9e119547919bb92b8ae5f6a4b8ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645029, "uuid": "c40d2888-d657-4deb-ab6f-53ccfae0ffd4", "value": "T182B4BF1E7148C053C9CABD7478B27F2565C5903C2DADA4FBF0A37AA8D74B6A4BC1A074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645029, "uuid": "41cb45b8-3aa4-40ad-9001-08f8a786aff2", "value": "6144:1HG2WUYYUeWUkWk+WUCWUmWUOWUwWUA4UUWqqWUGWU8YUCWC4WUiWUrHw9GlzgYg:AOHwszfO5snBpZfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645029, "uuid": "cd42574a-a705-458d-a2c6-4d962de06ce5", "value": 538524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645029, "uuid": "f456d8b4-d360-4dca-85f3-c4bb177f69ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645029, "uuid": "c42fc2e1-e15f-425f-9d13-80f16f2c965a", "value": "c7e352f3f702bc5a54c13963f2a6e4c0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3a1e07-5e52-11ec-96a4-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1639646836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646836, "uuid": "85d93da6-0ade-4d87-bac0-247041ed9968", "comment": "Malware payload (BazaLoader)", "value": "81cb0a31bb453ec6d1ad01dd48af8f2e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646836, "uuid": "7b1093ea-bb94-4e32-b0d6-a92790c488ed", "comment": "Malware payload (BazaLoader)", "value": "f18abbc411eb048037a5786fb0615dd48f4954d5ac484e3e25d7515cfe221a45", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646836, "uuid": "c4e32a42-03e0-4a23-9093-c88389eefc07", "comment": "Malware payload (BazaLoader)", "value": "063211e860ba27ccf3f4de943a03b27472c1d24d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639646836, "uuid": "72e9d677-3322-4182-b40e-e31ef888ddcc", "comment": "Malware payload (BazaLoader)", "value": "861a2b1323bb6d6696ae2136c045140e857b9ee8a07d95873dda9c095c3b8fe4e8c6e7fec9e2b1ebb41fdf695d595b13", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646836, "uuid": "fa6c7a12-22e3-486b-aaea-33cdfc9e65c1", "value": "T19A549D78B94818F0D6DA99365AAD7CB9227332635EC7AC8C015CB7C2066F772BF85704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646836, "uuid": "edc28e5d-096f-437b-af24-e62746841dc1", "value": "6144:XrBni3GXAw8OjcAgMB8uiUgAJzftxDL48X4l9:ViyZcA7NZXJRxD08y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639646836, "uuid": "4a83761c-90bc-4666-ae8c-89baaf43397f", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639646836, "uuid": "13576a19-2b82-4271-9d1e-f23b1aba50ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639646836, "uuid": "4741e866-2fb0-4240-8cad-79e7cfa35e41", "value": "81cb0a31bb453ec6d1ad01dd48af8f2e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a700c16e-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613461, "uuid": "bf7637d7-6640-4b6c-9a4d-75c43d11e392", "comment": "Malware payload (Mirai)", "value": "7e24dca7e360ba3c4e30bc412e662078", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613461, "uuid": "f19d7b33-77d3-420c-9d59-a95528624470", "comment": "Malware payload (Mirai)", "value": "f1ab4582d16412868b7ceea0e71d51bad4e581bb94a245cf5032a3546ee3f646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613461, "uuid": "90bd5c0a-7243-411e-9ad6-690df5f79b14", "comment": "Malware payload (Mirai)", "value": "0a252e96b6c0a0f5b706e46f3e208d74a2912121", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613461, "uuid": "47c5c040-9ea8-4efd-a98f-7087d73f9d6d", "comment": "Malware payload (Mirai)", "value": "499cbc6e5e56925fceb35b810dfc43991160df0626650c348159408d24cdc033dad872f32998cb75891474aae8e9d11c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613461, "uuid": "f6ed73da-0207-4a60-925a-7c37159e9e93", "value": "T1BEA34A82A740D5B3D1A306F6129B8B150133FB3F4A6B9EA6F35D3CF48B509C57221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613461, "uuid": "45f824f3-a513-461c-93c9-4c87bae580ac", "value": "3072:Jg4eodUWUh917j8mc2deiPUDAZURyPfV5hQTSvxinf0OzTyoQQub:JdRu917j8mc2H5Z5PN5h8cxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613461, "uuid": "fd13f310-fb3a-4da3-bc60-de5b6e62ddc4", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613461, "uuid": "f5f1d7f0-4b33-4e7c-9359-72cc4befce8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613461, "uuid": "bc85b4ac-a375-4fd8-b0f7-36851181b969", "value": "7e24dca7e360ba3c4e30bc412e662078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398be81a-5e4e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Hancitor)", "timestamp": 1639645060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645060, "uuid": "b644861b-ac1e-486d-bce0-a40bba805166", "comment": "Malware payload (Hancitor)", "value": "b5bde27026f7089c8bb85f5120670f97", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645060, "uuid": "166b6ffa-147d-4d17-914b-40c62d131809", "comment": "Malware payload (Hancitor)", "value": "f37f5eb4b2a9401d5543ba8769428c87ca79b1497af2a1e0f2b361050b79f048", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645060, "uuid": "7072480d-e854-4a37-8dd3-7dbecb9684d6", "comment": "Malware payload (Hancitor)", "value": "6e39ae0c274176e3374eab2a7519f22497b7ba38", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639645060, "uuid": "8f5be858-7547-47f5-b9bb-4478d4446637", "comment": "Malware payload (Hancitor)", "value": "93ad65fe0e81c0a9da7ac3e40388f4e66864996c5049fc3a19dcbd0a22cf2031a2d8ccddc9421cc84a374a19c83598d6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645060, "uuid": "ffdc751c-b343-4eb0-b8b7-4d7d58e78b68", "value": "T16604DF13B295CE57E50AC7B4BFC6CA887B6ABE499D01B2CB35443F0E3FB8560891161D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645060, "uuid": "d3f824f3-f423-4c4a-b51b-94e8f9ebe128", "value": "3072:7eMiYqWxXdUx4htbWf707Ah51uTIk5eq5+p1YM/aVZ2X5UExXtQWJ9aa:HiYqWVGq7bqwG51u785UExXtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639645060, "uuid": "c8540fc8-03d2-49f9-b871-c2161eaa868d", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639645060, "uuid": "003d0e76-24f5-4067-acef-d343974836b5", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639645060, "uuid": "7573532d-ba3d-4226-9adf-dae3cfffb8c5", "value": "b5bde27026f7089c8bb85f5120670f97.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3821ec82-5e46-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639641622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641622, "uuid": "1c31eec6-4e6b-4b48-8da6-5942423a9591", "comment": "Malware payload (ArkeiStealer)", "value": "e582a61019375e98005f49ee38257ef5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641622, "uuid": "4e741e9e-dc17-4e11-9b24-ace4ad146615", "comment": "Malware payload (ArkeiStealer)", "value": "f3eded449f5c5bec4cfe89c7598f4c173a5f1fe1519b28ea6236ace9ef99d1b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641622, "uuid": "2baeffb7-c09d-45bc-a4f2-170ab4254948", "comment": "Malware payload (ArkeiStealer)", "value": "51be005943cd60171bc5ab660f5293216496b5dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641622, "uuid": "5ca5b425-99c0-4f25-8ef6-dca30ffeb047", "comment": "Malware payload (ArkeiStealer)", "value": "75d123fc73bcc74ed505457d0a8273acfb01178cf7635574d4ed4058dd594ec2218a5402939440c107fbb05291adaef1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641622, "uuid": "dc8a421b-14bc-4bbd-8d45-373c1ca34da6", "value": "T1A9F4F100A7A1D035F5B711F899B6A26DA53E3AB1673498CF13D416EA8B78BD0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641622, "uuid": "56b1bec1-c627-4579-bad3-381fa66e6a35", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641622, "uuid": "603ee3e2-a84a-435d-bf03-c1f407a8880c", "value": "24576:dtT0/ZGzrUZPRzTZdqQE9ytRXE0YtDQp:dp0/ZGXUZZzTxE9gXE1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641622, "uuid": "cd92e772-03d9-41c0-83d2-caa358709e52", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641622, "uuid": "7141c6b2-3861-44b6-bcbb-4cb568c08210", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641622, "uuid": "ddd06ab1-30b6-4464-8979-6e82fd961e80", "value": "e582a61019375e98005f49ee38257ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30850188-5e1c-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639623570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623570, "uuid": "80479dcd-f410-4e30-82ce-3b0d80095bd7", "comment": "Malware payload (CoinMiner)", "value": "030d32c42f8d6eed949f5a40f835be2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623570, "uuid": "290b63d4-91a5-4db9-b864-1ff9135f3340", "comment": "Malware payload (CoinMiner)", "value": "f57855bf23ce70fccbad6dec4c7d9e97710f222f98dfa0141762d66e56b6192d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623570, "uuid": "29c86190-21c5-4b2e-a72b-be662600402b", "comment": "Malware payload (CoinMiner)", "value": "da239d9de0483bb24a62acbb92a96f98008e55fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639623570, "uuid": "6a291017-e876-4844-b3a0-6323c2a75111", "comment": "Malware payload (CoinMiner)", "value": "baf74b2a21b12fc9a7593954618c0e54d30a0636f19b781755b566f4c77d368e9c1bb1891cd59af6b21af8ba08d3ccd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623570, "uuid": "656c7a8e-be7b-48cd-adb6-6e53b3308a17", "value": "T1FB749D00A6A1D435F5B312F85AB593BDA53F7AA16B3490CF13D016EA5B386E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623570, "uuid": "1b7dba75-21a5-42e0-8d13-19b5a7c70ab0", "value": "4bb8a39044d1acb8817ffc34236f365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623570, "uuid": "f5e078b0-a24c-4e02-88e2-512ec4677839", "value": "6144:goVlxPH+5hD26j8vr3gbL3shpAArO3dSsT9cvU2:vVlxHB6j8vrQbLSAAriA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639623570, "uuid": "83784b7c-6b00-439d-8653-8e389db7bdc5", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639623570, "uuid": "8e0cb1c2-4b64-4e55-bc94-00bcf4b51e51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639623570, "uuid": "03e33788-bbbd-43f3-b51b-6c8dcc233ea0", "value": "030d32c42f8d6eed949f5a40f835be2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22fbf09-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639642739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642739, "uuid": "66fc8161-c81a-4abe-8255-3203ef43b526", "comment": "Malware payload (Vjw0rm)", "value": "8561072eff18e9e77262c4f2fc6839fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642739, "uuid": "231dbe6c-2d62-4489-b1cd-4528fb6a8a59", "comment": "Malware payload (Vjw0rm)", "value": "f613dce107714bf8229ea8312705109a720a8e0823b039abc0abe4446fbeeac1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642739, "uuid": "2dcfb684-4cf3-4d45-bc0a-1f9d7363bf7d", "comment": "Malware payload (Vjw0rm)", "value": "6c2740ec684336d394a0e3c6f35e3cd20898b91d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642739, "uuid": "eeb0b824-8e52-4833-9aef-db166ea35a97", "comment": "Malware payload (Vjw0rm)", "value": "45bd3cfa1acd8540443d59ed6349735a96caf28d09ae800142430e7d215fe5467094af0ac3825445e1cc9da57344b93d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642739, "uuid": "5ffad9c6-895c-4b96-b861-a0b51f24ed70", "value": "T19E12BEF81210353BB44BD4E9897E0A4C1F43E4112D98FBEC94E2E721CCAEB13728D90A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642739, "uuid": "be50f2bc-ce35-4e5f-9354-5338a85df47a", "value": "192:rrPMkERDy9Zzzm6BtLWMI1FD1KJqp3KN5KcBVut90wt68vuz:/8NmJBJvID1Dp3IkcBVuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642739, "uuid": "daf653ac-4795-4c44-be67-ff97491d70eb", "value": 9644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642739, "uuid": "f04cf950-945f-481b-84cd-e8bbc8a9424b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642739, "uuid": "92763765-a62f-4406-96df-fe8ffce2178c", "value": "#007703.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e85b626-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639643914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643914, "uuid": "fecdcc72-037c-488e-8a5f-cb902097ff8b", "comment": "Malware payload (OskiStealer)", "value": "d42ca5b42777b9f0de6c690fce704025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643914, "uuid": "9b3e05ba-c484-4ab7-818e-aa99803661d7", "comment": "Malware payload (OskiStealer)", "value": "f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643914, "uuid": "5cb69f80-aaab-4e0a-abe9-161c186aed0c", "comment": "Malware payload (OskiStealer)", "value": "0cb73eb3f3d6d5a8234d9fdb1e1bb80323cd55e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643914, "uuid": "7e8e44f4-da50-417e-8f48-4d9757cd2730", "comment": "Malware payload (OskiStealer)", "value": "784cedf9b2ca6c51c873f671ffa8d4d55b0e5187561ac183f44f3b3760a33499cb33f664f7692f39031e1096e4277524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643914, "uuid": "19ec80e3-f925-4925-96e4-8d0307b8004f", "value": "T12925239267F9CA55E0DC4776193B890173357A361237E31E6AC5F0DE8E233130AA5B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643914, "uuid": "ac0044bd-4ecb-49ae-b718-1e303b811ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643914, "uuid": "0de43103-1cf3-4d46-a94a-ea502ac63116", "value": "24576:dg9Mo6a3xSMmEOy9v2y6pTuWOgBIe1moKcsRdDb:GkGOQv27fOgBRfxsRdDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643914, "uuid": "1544aec3-ec8b-4718-b955-0bd8ca02d801", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643914, "uuid": "8bee0b6e-be7c-4e0c-b4f8-9f5e66041dfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643914, "uuid": "ba8a9939-6a54-4069-b17f-ad64a133a539", "value": "d42ca5b42777b9f0de6c690fce704025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450b027b-5e5a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639650234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650234, "uuid": "7ef64949-27ee-4b34-830e-596bfc94450a", "comment": "Malware payload (Gafgyt)", "value": "f2b5c8fa6e2dcb64441dcd1b8a13429c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650234, "uuid": "10d88fc5-68e8-470e-9965-5e8142383d3d", "comment": "Malware payload (Gafgyt)", "value": "f71dddfaf799a4c9b85016ba793fd88952768af5581f64ffd8b1d36ffa2963f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650234, "uuid": "aecfd072-17e9-4550-bc0e-9eac718c1510", "comment": "Malware payload (Gafgyt)", "value": "cd0675b835e4359cd6529e5e27469201b298c1d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639650234, "uuid": "69d7fe16-87e7-4754-b9eb-f4367f3daafa", "comment": "Malware payload (Gafgyt)", "value": "c4c70237ae120a12d1ffa04d62a5acb5a2b3b0fe377aef329748a316e113a08840f9fcc0d7234817cedaba1fed364245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650234, "uuid": "191b2b92-8f6a-4245-8469-440007c3d8a9", "value": "T10BD32905F4508767C2D2177AF68E425D37335BA497C733129A38AFB42FC2B991E39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650234, "uuid": "918c49e6-c0fa-428e-8919-3635e07029df", "value": "3072:ohyOe1uxaRjRVVPiVzvsxj45hGSrdDQs7C/9/ZmzQEvl6X2eP:vp1uxaRjRj9j45hGSxDS/ZmzQE9M2eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639650234, "uuid": "a58678ae-e3e4-4826-8ff1-77c2ca4c3b43", "value": 137533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639650234, "uuid": "f2ba130e-2744-4180-a103-641d0fa2ee4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639650234, "uuid": "0f2bdf45-73d3-4381-a910-8088c3734fd1", "value": "f2b5c8fa6e2dcb64441dcd1b8a13429c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895050b6-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639643906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643906, "uuid": "94f5553b-aef7-4620-aeff-acb0cf3d5545", "comment": "Malware payload (Smoke Loader)", "value": "04f0c813898a774f38edb436ed2407bb", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643906, "uuid": "2e88e3ff-1cfd-469c-a51f-8a89a55e0365", "comment": "Malware payload (Smoke Loader)", "value": "f767c98dd6218f19d0401ae5dd88c720635871c132f7486481735cab48b46d85", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643906, "uuid": "22547200-6359-4f7a-8d97-b6e956170ed8", "comment": "Malware payload (Smoke Loader)", "value": "249324be93de538e109ef16ef2247e9f7a59508b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643906, "uuid": "ff7c9a60-201a-4ebf-bb23-e833d71e7937", "comment": "Malware payload (Smoke Loader)", "value": "be0a6ca2cba1fe9673ee775bc36a0aaa54451539e628f926417951e0ab4857089041f6dc6bbfdaff01a644388d82d934", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643906, "uuid": "f0d18ef0-02d5-46ed-b191-9014e979b77a", "value": "T13D04AE1275D2C471D6A245718870FBE91E7FF8B15634484B77982BAE2FF32C04A72B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643906, "uuid": "3e66fa3f-5696-4242-811b-3b8435150b0a", "value": "d585c3f2ae16ed9e33c9881499e84cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643906, "uuid": "ac277008-22df-4316-8f21-9a39a6b6c983", "value": "3072:7KxsI9BVsoQm942Rl4rU6rM9Xa7ZEthsU44L9Y:7KhQefX4BM5zIUpLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643906, "uuid": "c254ff31-015e-4fc1-823a-6b99a57d26a0", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643906, "uuid": "547920b5-5581-4bee-a108-17eb78f008f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643906, "uuid": "5972f7d2-60ae-496b-b701-57a565ac5504", "value": "04f0c813898a774f38edb436ed2407bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0253de-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639684040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684040, "uuid": "e6e76bb3-8a89-4be3-81bf-7eaabc50cc07", "comment": "Malware payload (Guildma)", "value": "0b0f453ffcf5db643c287fe394a3877d", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684040, "uuid": "0b737d98-b873-43a1-8bfd-f5423934f0bf", "comment": "Malware payload (Guildma)", "value": "f784f99fde6eb5c4cec33ad9f4a3cb7e8aaaab226b5a55f7497219953cfd8a59", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684040, "uuid": "8faa6b44-1873-4fe8-8cfa-fdd591532bbc", "comment": "Malware payload (Guildma)", "value": "5908508c5a702f95f9f7eb61a14665aeef63a1bd", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639684040, "uuid": "513d3323-97a8-42bf-a491-6c700aec518d", "comment": "Malware payload (Guildma)", "value": "d7aa4f7eadef6aa230ad5583ba3ec6b99c830962c30208cd3241f77075575174939e91a0774c6026338be369f572c4fc", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684040, "uuid": "fc10762c-d2dd-4827-bb35-f92c3d1cddce", "value": "T19BF09E905F14A7D2C4200E39C0630F308978A8CE6D44663D20D06AC8A4502805E5D8FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684040, "uuid": "2f5cf471-53f6-402b-a93b-455633418bf4", "value": "12:8DpOB+PlyWfcZEV75FJetIME1xpZPM+un2GrgSjXCh6:8HPlDiE7kE1xzMzBJXW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639684040, "uuid": "63ccae21-cb99-46ff-bc89-f139d16eaefd", "value": 559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639684040, "uuid": "b45b0d7f-ace5-4eb5-88cb-72a929691be1", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639684040, "uuid": "9a4cbba4-020b-436a-8ec2-ce4295610df2", "value": "0b0f453ffcf5db643c287fe394a3877d.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c10a15-5e70-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639659675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659675, "uuid": "b5d72d7a-e1e2-43dc-ac18-5b1293d246d3", "comment": "Malware payload (RedLineStealer)", "value": "c16c308d6708f8329456a2a7c73f1a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659675, "uuid": "22d8db2a-5960-450c-abf5-5e6557020af7", "comment": "Malware payload (RedLineStealer)", "value": "f855e3de2fd7f2613a2cfb6e4a59443af8f6bdb3ca1ef6591a5163d276afb0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659675, "uuid": "f9edbee9-a7bd-4e8e-9d18-89605ed20874", "comment": "Malware payload (RedLineStealer)", "value": "98c14bdd00224c0ff5806d352ff70c95dc3a2850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639659675, "uuid": "fce8aa54-e613-4059-a386-33b66d706adf", "comment": "Malware payload (RedLineStealer)", "value": "d00d560eb58c877aa25d41a5263c4abe7fa051736b5dfbc8858abd17f40e77bf18acdd264ace418f4139c58cf93c658e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659675, "uuid": "e86d62c9-41b1-44bc-a649-854758586e29", "value": "T147749E0066E0D035F1B752F44AB6A37DB53E7AA16B3491CF12D426EE5A34AE0ED3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659675, "uuid": "3e7caff0-b166-4d76-9931-8c6b559d1fe5", "value": "f8a1a153568c8d0114bbef3bf9e0fd81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659675, "uuid": "162860d0-96bb-428a-836a-75478d148776", "value": "3072:RI4BNw0hy4hJyOjQB19/3gkOEIOIe39seHp9vaJUz+ctzxqfUNbbob6l/6D48R4w:R11yOj+vOEjI0Sop9yC7tVgUlMUE48R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639659675, "uuid": "3e27cb4f-51b1-46ac-9ea7-f82b54c91194", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639659675, "uuid": "a18440b2-a96b-4f8f-9a5e-d18c52cd5ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639659675, "uuid": "e5ee0536-d4f1-4654-be42-2d5fb211ceac", "value": "c16c308d6708f8329456a2a7c73f1a12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddbaeaa-5eb8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639690809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690809, "uuid": "89a0f703-e850-4996-b4ef-515973d4d846", "comment": "Malware payload (Mirai)", "value": "60dee0cd7db04c0593d437aaea20c21d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690809, "uuid": "85b1d094-fd3d-49a5-8850-a1e5368e8970", "comment": "Malware payload (Mirai)", "value": "fa1a27a2b86012f99c5be09c9d83d4bc4521ff855dfc021a87b5b60b008dad5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690809, "uuid": "ea1a14ee-3e46-4ce5-991a-7bcca07ab16e", "comment": "Malware payload (Mirai)", "value": "28c8e2c091f6dba54dd4f285b94b0c4bef07f573", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639690809, "uuid": "68904f8f-2936-43e1-8108-2ae247ff57e7", "comment": "Malware payload (Mirai)", "value": "8f1481633aa8176cd2b2d1c653703fbf771c5025a8ee015731ee852c813620f69fffbc10527bc361c8e031a257b441ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690809, "uuid": "308db2f4-b71b-4286-9efa-fb2559df593a", "value": "T1A8534BCBE552C0B1E8124971213B7B569A32E3FB50DAE2D6D7685C70EC529126327FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690809, "uuid": "3e05b000-a3d7-4161-a87f-1308f70585a4", "value": "768:0DSjsxv2zRlFk/fHIRrvTOnTrBAL48H1r8DE8sv5VGyVofOoBd0etJ8aaPERIH:m+/kX3vmLHH1m5snG5G0d0etJ8aD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639690809, "uuid": "47c71268-6356-410f-aa9e-1d2a7b273a4e", "value": 63372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639690809, "uuid": "0e86ebf7-85c2-4b6e-9230-bf656ae3f74e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639690809, "uuid": "d8d7137c-faba-498a-9815-ce8794189ed3", "value": "60dee0cd7db04c0593d437aaea20c21d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14f3df0-5e86-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639669286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669286, "uuid": "db8ce00e-c421-4117-967c-1c91b3813f68", "comment": "Malware payload (AgentTesla)", "value": "97dc4bc07dc3da2d8ff046765a1dff5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669286, "uuid": "e16c5d17-e689-444c-a2da-9d1c07c318f2", "comment": "Malware payload (AgentTesla)", "value": "fa888022eab2c3e5ced4870fcdd02a82fe11c4632db450232bc14027a187bb96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669286, "uuid": "7e2496f9-16fc-43ea-8ec1-b1b1d3b6b8d7", "comment": "Malware payload (AgentTesla)", "value": "79de1c9fed1e9aa49e1537ce38225079e08a0644", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639669286, "uuid": "759f6ef6-053c-49d3-88c5-e2fcdb09fda8", "comment": "Malware payload (AgentTesla)", "value": "fd4b3a164ffaf883b9a249b0fe6ac45ceeecd5a290ebb4595d46d8050db76e9c08122b246b7a5ae46bc982fe2b60e475", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669286, "uuid": "623aa71e-2dbd-4e8f-9a4a-49c5c0192ae6", "value": "T136A423FAA90B616B22F864A1472089D29E87FC7C4E4DE0A51105999BF01D4F74FAFC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669286, "uuid": "41646c9d-52ab-4317-83d4-64f14f499737", "value": "12288:b7eDLZ6E/qfHIV1KkCfkP1e4vKcs8xPBuE3Brdc0XK:b7GMXkCIvxxwE3PcoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639669286, "uuid": "c9f86c04-8a1b-4d03-a38b-9cb9f31b220a", "value": 491333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639669286, "uuid": "f1c0c56d-aaac-474a-90e8-940074773c7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639669286, "uuid": "008e8752-d598-4a34-9923-a6986adfa246", "value": "Scan_PDF_12152021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6f2723-5e45-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639641441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641441, "uuid": "ea9417fa-c9f0-4948-87a3-fe6c9f6be114", "comment": "Malware payload", "value": "887de26e617a888f26819fa8caed7471", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641441, "uuid": "b2977d54-c036-4851-9ba3-e457dda9f0ca", "comment": "Malware payload", "value": "faa1366cd397f077e30316898826ddf5da4dbe931361bbd5b026d8559244673f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641441, "uuid": "de8e4991-bbda-4962-a079-b3de25d7cb41", "comment": "Malware payload", "value": "9d3a8ac4a5a51a12e808fcd862873a4aff322652", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639641441, "uuid": "653f9ca0-a9a6-4f0c-baac-e5054a02248a", "comment": "Malware payload", "value": "7a3dfd623d0e2ef29eb160913f2ddac6512c5d5f6a31c0a8e48bab4e29a15f2034ab2d78847786eda4e3486328050d99", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641441, "uuid": "4b7248fc-8b3f-4663-acff-2f81d011f3c3", "value": "T180A57D22B1C1C437D0776E3CDD6BA3689829BD601E28941B7BE41E4C5F397817A2E2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641441, "uuid": "417a5b51-ace3-462b-86a2-58f94c9e23e7", "value": "24576:sOuPhlhx6CW5ATZ3nne7TxmdZZ7iSTtSW6RPEFvVWmdqtF3cN3JscEI5ptwajK5Z:sOafnGTkZsRI0tFTS2aTPeCUpOY9EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639641441, "uuid": "2edce3cf-b2f2-41ce-bdc5-cf9a32f5462a", "value": 2255360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639641441, "uuid": "9d105be2-8754-4585-9bd8-2163a1426b6b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639641441, "uuid": "aa9db256-e6e8-4493-8d87-3494613d861e", "value": "Archivo.EndesaFact.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee31e19-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639642761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642761, "uuid": "8e91242f-d6ed-4253-ba09-6e86fa7e1f5c", "comment": "Malware payload (Vjw0rm)", "value": "4828f0de0d5a6dfe853ed9bc18437863", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642761, "uuid": "b57c245b-3854-45b4-b40b-ffe5e9f9f2f1", "comment": "Malware payload (Vjw0rm)", "value": "fbc8ed5862b8ac3766b10502bc1afef13e84fbf2b07454c8988aa2140fa5ee9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642761, "uuid": "864cda0e-c75e-43d4-8978-c1ee0cfd9f06", "comment": "Malware payload (Vjw0rm)", "value": "c97fa294329a27d8e096f572e69b1319f644c967", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642761, "uuid": "5dff1965-db1f-439d-b2f4-de02a0ed7f17", "comment": "Malware payload (Vjw0rm)", "value": "dca60671767171d00c3b349d411719be21367b348f87332b7e82081fa664041f7eec4cd08946df636a587a41e8b0f30e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642761, "uuid": "50347977-0108-4ebe-9335-c8542daedd0f", "value": "T1FC812F9C284A823C03D23B8A802DD148CDF548B47F28D2B5148CDAC5360E9B987B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642761, "uuid": "a76585f9-87f9-42e0-a3ea-74bbb933d2e9", "value": "96:SABNo5DRk2c24ZRMHXE6/BI7+Ys+fJ4RDdQqR7bJyKhZOS4UK:zSa2c24ZRMlBIKYs+fJ4tfRfmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642761, "uuid": "ed527384-2534-41f7-9669-5d3de4e76523", "value": 3888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642761, "uuid": "4c4d7850-5bc6-47e7-b3e6-913e9822c682", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642761, "uuid": "a6ed9e45-466a-4113-a357-605beb092868", "value": "IMAGE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8286adca-5e0c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639616836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616836, "uuid": "61033767-0a3c-45c4-9bca-b21eaf819421", "comment": "Malware payload (Dridex)", "value": "504fe87d2549bdc3bf6b83132fb39d7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616836, "uuid": "c8a8fd72-156c-45a8-80cc-5f44cc5f2315", "comment": "Malware payload (Dridex)", "value": "fbdbb2388792309d00ba8f6869ff5cc3b7c34097084fef10a0f529153cf83948", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616836, "uuid": "8481f314-7187-4438-9617-a7c220239819", "comment": "Malware payload (Dridex)", "value": "2c45c8a80b74daecd60e6450723ddb9d63190e19", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639616836, "uuid": "861c57a3-2c46-46d8-adea-09a0aacc13fb", "comment": "Malware payload (Dridex)", "value": "ceac25173bdea6fb9ea6c44fa0d804608ebeae11a14823cccd39831bdb6b1fe7f4fb230e7041e6628e5dccb07d87bfd6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616836, "uuid": "9d2ac5ed-6a67-4ffa-8acd-0df9e76058bd", "value": "T1B4B4C0A37F4B0C6AD4525D3CCABEF7A6082F6645458CCF3072A3731AD6F4542A825CDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616836, "uuid": "9477a6f0-258c-4218-bba0-ad24778fecda", "value": "425f8965b1dafa239bed13744d5413de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616836, "uuid": "d3f4d221-90a1-48e3-a4a1-9fc3fb28adb4", "value": "12288:0Lv+2yIUMs4UQ0EysQeu2LzmWMdUJPRXLZvR5xdzAU:a7D5MdUiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639616836, "uuid": "48bc4d24-c187-4c8e-acf8-a20b21bc0ebe", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639616836, "uuid": "f0baadad-d6a0-4172-ab87-b7a3ae1a8165", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639616836, "uuid": "13b54fa6-de44-4b0e-afc0-559acc769b8b", "value": "SecuriteInfo.com.W32.AIDetect.malware2.18913.21414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c1bcf6-5ea3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639681593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681593, "uuid": "a5e2d40f-bc77-42bb-beb9-3b4b3463cf00", "comment": "Malware payload (RedLineStealer)", "value": "03562c7815159e7545d1ee6f37993de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681593, "uuid": "409cb527-a13a-454a-8b8f-a257f1e11e98", "comment": "Malware payload (RedLineStealer)", "value": "fcafb9dc322fef29ee738fd4815dcb436e7a81983997c9aa70066c3832357062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681593, "uuid": "21a36705-9cca-4381-af34-cb87f95ec9a8", "comment": "Malware payload (RedLineStealer)", "value": "041920d4a9bfa3ba21437bcf2f71c547a25a9243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639681593, "uuid": "accde6f7-d56d-4e1d-8615-2cb867aa4675", "comment": "Malware payload (RedLineStealer)", "value": "51c03d43170317c2ff489f3f46d80f56acb4b2bef7e1ca5bc3b3d932bc783341c54f18916f5eef6efd039659fbc90b8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681593, "uuid": "51d88f1f-f40c-4037-bf96-6e73ea8ad6d0", "value": "T118A4CF10F7A0C035F2B312F95AB6A36DBA2E3EA1672450CF13D56AEA56346D0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681593, "uuid": "81df26d4-e91f-4cf5-9403-8b87e7e60d26", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681593, "uuid": "1fc51bf9-9741-46f3-8395-35f1c97d371c", "value": "6144:dPSZvSSXkjqsf7AOr5gBCVJCjremNXkIV0/n+Vto4XS6QwY:cSSX9sfsYyYVJaemNXkIVOn+Vttow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639681593, "uuid": "a277d79e-16a6-44cd-ac24-705dab4afb25", "value": 455180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639681593, "uuid": "c48314ca-21ea-4aae-bc78-04d18c25ac8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639681593, "uuid": "e9fdfbf4-33a6-4904-827d-45f509640670", "value": "03562c7815159e7545d1ee6f37993de4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18d417b-5e04-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639613533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613533, "uuid": "33f62f75-9c8b-4760-9bf2-6b0595d1aac6", "comment": "Malware payload (Mirai)", "value": "5f37a618a17fbb6e5fe9a337d563705a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613533, "uuid": "eb1e97cb-5e07-42c9-b575-f729ade65acf", "comment": "Malware payload (Mirai)", "value": "fd4fd7183526cb9daca37f9fdfd5a10edb28499904d225615c5fb5231e5b1cf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613533, "uuid": "252a1d53-9567-48ad-af18-73fcea956380", "comment": "Malware payload (Mirai)", "value": "341873aa0f5b8ad4d6f8e9bcd9c752bdb1fcfcd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639613533, "uuid": "f116136d-c869-4237-8743-4a0a254ee1e2", "comment": "Malware payload (Mirai)", "value": "fb40ee24450a91465543969e4be2f19ea7d6075fba4fc7fa039bcfa3b35a450a9816c736fa8b290a76f3648fde7fa859", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613533, "uuid": "22a70eb0-0cb0-4c2f-afd5-0dfbe2760f69", "value": "T1B7C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613533, "uuid": "937e9319-4554-4a2b-ab89-8896c691b292", "value": "3072:/YNa/GLBNPoQxphakpiQ9/nYEP/UnSQf/R:6a/yloephakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639613533, "uuid": "af03f3a3-64b5-428a-8fc4-56e39ea85111", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639613533, "uuid": "6babaeaa-37f1-487f-95e5-b877f8160b21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639613533, "uuid": "f7a88e57-8ad2-4936-9446-06f88e7cbb2e", "value": "5f37a618a17fbb6e5fe9a337d563705a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cba3a5-5e48-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1639642794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642794, "uuid": "37ea42cb-2c4d-4ff2-8261-719d9bfa069c", "comment": "Malware payload", "value": "6f0c5d1ab4716937cf05ee50326a10c4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642794, "uuid": "867f4e59-f462-48e4-912f-335a6e49d80b", "comment": "Malware payload", "value": "fdfbc92fdf1b0a903e2e4442ebaf71075f8c968bcc8cdb837aa12aabb9df794c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642794, "uuid": "15641bdd-f6db-45fe-b928-95f7af976fe9", "comment": "Malware payload", "value": "347760cbd5f8197e3db0bebe8c61ff7177283ff8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639642794, "uuid": "1021d570-bf28-4a2d-9cf4-0444e995a6ac", "comment": "Malware payload", "value": "78c7913d29e12d977410e161962b95b48fde9a591b4bf5ae1412a216dae0017a2ec710862aceddb1d176c2f444f5f0ba", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642794, "uuid": "6fcc4022-4d22-4a5f-ab43-5eedb25657bd", "value": "T1B74186F51433C8C2221D16874DA4753ECF4CE257635BAE19DE6D68147F9D8B2B8C07A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642794, "uuid": "ff232071-ac00-4bea-bb07-fd9aaffc7004", "value": "48:SMhZ2rDDprK0p50riBREYX0yW6eRW5BtU8T0vEZb5:SEZSrnhdT0u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639642794, "uuid": "337396a8-c770-4012-a262-23672dca87e1", "value": 2243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639642794, "uuid": "f38061e7-840c-403f-a632-b720ae98fd90", "value": "application/csv", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639642794, "uuid": "0e758245-d98c-45a3-a48c-ebc549d785c7", "value": "UGH82MSGHWUSHSDHWQOL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b5ae6e-5e53-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639647280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647280, "uuid": "178a5b4a-784a-41ba-9ca8-b920544181c5", "comment": "Malware payload (Formbook)", "value": "ffd0eebbad68d358abbed65a378e6e9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647280, "uuid": "42c2b59d-d7e8-4cc3-91ff-c4b095e88d2e", "comment": "Malware payload (Formbook)", "value": "fedf55446e010cc987ff0313ac685c616e4a01f30a6cc807b3b95fb859714f8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647280, "uuid": "794c0813-3f73-4e53-ae4b-57c9a9038a02", "comment": "Malware payload (Formbook)", "value": "769159c6e1a5400304839759257018d373c5c507", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639647280, "uuid": "cc5b1747-bd4d-445a-b7d7-5f281ff9c38d", "comment": "Malware payload (Formbook)", "value": "fc10a4031f77d4f1d12ceecb87ff29d92aaf2a250a0b725899fbc6904c60f9527f99cca0869a38cefa8aec63743bf30c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647280, "uuid": "51208e0e-92b7-4b7c-87db-05143405f961", "value": "T1EC942343B2E59A53EF87847405BBF220C67BC14E41B9B483939A5B6D1D70BC3A79A1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647280, "uuid": "ccb3bd59-a6d4-412b-a4d4-1345cfdc89bf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647280, "uuid": "9f483ada-d822-4699-9c05-758e47421eac", "value": "6144:rGiMyTm+mnuk43xV8jo63xS5YpPkKKkzwqRNvn7HbU7hAO5KMzIeFTY5offtsghD:wyTmVOT8jxBS5o5gIHQ1A67zB9YYsLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639647280, "uuid": "6a8ba1a6-5471-475d-99e4-d4b18314dfdb", "value": 433550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639647280, "uuid": "e5305fe1-4b4c-4847-97be-22d0e8465061", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639647280, "uuid": "c1d46cb9-1281-42b4-a919-0dc5e4d28dfd", "value": "ffd0eebbad68d358abbed65a378e6e9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7d4edb-5e2f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639631836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639631836, "uuid": "740636b6-d5c4-4bb3-9ddf-ab6b56372c3f", "comment": "Malware payload (Formbook)", "value": "06d52303ed1b2e8cc1e1c9cc04f03f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639631836, "uuid": "3e8f7b72-c451-4a19-80d1-86c6d75d504e", "comment": "Malware payload (Formbook)", "value": "ff49729f166632886284a0ef9e5e084151096acc1aa7e43c353e922e2fbb1086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639631836, "uuid": "c9fb1832-c9c6-476e-97a5-c7c87cea3445", "comment": "Malware payload (Formbook)", "value": "e96e1f8f1748e97f6c76e742e2476cffb85e3a9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639631836, "uuid": "ee2c3910-ce00-4d94-b99b-0d77501b09c8", "comment": "Malware payload (Formbook)", "value": "e419d450d382d60063d02722da52dcbd130d7bd73d2bd4fd20eacda8a0fa39d92840bf67e566c49b35a43f114d34be33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639631836, "uuid": "56c2f87f-f69e-4304-8a4c-ccc1c6f66c05", "value": "T1123522507BE29109C36A4F376A22A400337AB90A7E16CB8F3DDC758C566F7D90583B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639631836, "uuid": "482aa2ce-fb00-41a4-842e-249ea277ea3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639631836, "uuid": "cad0ed3f-24ba-45e7-8b6d-4ef9dfac4ea5", "value": "24576:pcgIWnx8ZJaOULONuUXaq5qLpKS+NtX/6GA07ZNMpxjsK2:p//n4asX5c+SGA03W2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639631836, "uuid": "15638648-5a75-483d-8b0c-937ef8285c14", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639631836, "uuid": "e8e55687-c7c8-4ae4-ad36-ed31dd0f8af4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639631836, "uuid": "9b551fe6-ad65-4c5b-91ce-875c75991bc4", "value": "Urgent December Rfq #34567745.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a20a50-5ea8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639683702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "05186654-490a-4f29-9e2f-e0dbb3ca8304", "comment": "Malware payload (RedLineStealer)", "value": "4953323da0d92202462589eb65a72036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "41292a3c-b80a-4de8-a48d-f3dbec479f7c", "comment": "Malware payload (RedLineStealer)", "value": "ff90845cb3223d6c65ec28fdbddb5bb8fc3501d19f6722ef2af302a1d5313d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "bf9b9e5c-81dc-4dfb-84ec-83e76771892a", "comment": "Malware payload (RedLineStealer)", "value": "f10c6633ef658bb2e88ed90397e513fa8f36613f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639683702, "uuid": "ac59e041-cc56-43ff-a6ff-55ed35d3de8c", "comment": "Malware payload (RedLineStealer)", "value": "4cad99bcd84f7fdfa20e1ad6bf625321d278f66ea0692d8474ba351ac6d03ba991d0b41d2c56776f1a70bbee510f7580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683702, "uuid": "d7a91a50-6a15-4538-b7a5-830155dcb767", "value": "T1AAE4D02ECA069CC6CA6B4AF1E470EBFB06686FACA577061C4CF61D0BB5361630F57815", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683702, "uuid": "c2f31115-5b6b-4d0b-bd80-68b27dc8b3f7", "value": "05e81086e2027c91995c138033bf21a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683702, "uuid": "41992855-11a4-47df-9cd6-9193476dc95c", "value": "12288:Zo6CKUfYqzkV9b7iFYMznREvHqHnYWWDo7DoijRbJi7NPz+1L4C:ZpCKUfYqIV9PiFYcRkHqphVjtQ7QEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639683702, "uuid": "a9f2409e-33c0-4e92-921f-38453a8eb0ce", "value": 658128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639683702, "uuid": "414a25c4-cf77-4b95-90b5-d6e2e3f69765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639683702, "uuid": "80bd31fb-30dc-4934-bf63-d007aa3f26e0", "value": "4953323da0d92202462589eb65a72036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ac6f94-5e7f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639666205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666205, "uuid": "0ed17345-fe1c-4310-9615-7d82c2ff08dd", "comment": "Malware payload (Mirai)", "value": "c4367fc155b2aae2177b1d40cb753ab5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666205, "uuid": "98465399-32d6-452f-833f-1fe56b9aa8f7", "comment": "Malware payload (Mirai)", "value": "ffb27dba3ba0ab0e837ac483026ddd60954e3b54b64072a8e46c5b983039aa3f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666205, "uuid": "4e217bff-84ee-450b-b65f-b9d407cf506f", "comment": "Malware payload (Mirai)", "value": "7088c373272e4356bf31eb8d04b70808dedae0ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639666205, "uuid": "6e611786-1376-41fb-b98d-06caadc40f88", "comment": "Malware payload (Mirai)", "value": "0f0955c72b2eaa01e9cb55623953f550907c0e64396e3fc6d11e16bbec2db997e089b2507ce290750c9814882872f033", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666205, "uuid": "e4f5c450-6c4a-4c31-9251-d3de96d8752d", "value": "T175B2E113B14AB877CED2093A4B5E864D5F971270AF93B5233A1411ACC7C750F25774A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666205, "uuid": "f30c3c3e-bd1f-4b7f-be4d-17978fbebd65", "value": "384:vrLN2FEKnI5H+YMncqKmZl8FW2W/5TCZ7tHMJqCtt8IGPQmYYmdGU5E0:jh2EiqencqKqxuMNXGd3U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639666205, "uuid": "6da7b702-d75a-4574-a265-eee0ed601608", "value": 24164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639666205, "uuid": "a8c74ec7-c557-4e86-a16e-565614a9c579", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639666205, "uuid": "58168557-eb9b-45dc-9c8f-7e531e6fab6e", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbd4929-5e4b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639643990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643990, "uuid": "36d70a58-7bca-47d2-a4d9-4d42d829b9da", "comment": "Malware payload (RedLineStealer)", "value": "9fcebc54e8d0276b9723e45d8ae9eac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643990, "uuid": "bef8cdac-053f-4467-bef2-11c8937b4523", "comment": "Malware payload (RedLineStealer)", "value": "ffbb9cbfc1d209d6a3f4c835ecb844b8ab585a4834511613d34191165a3feb61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643990, "uuid": "a9aa5e68-cc53-48c7-868f-66ee19d19c19", "comment": "Malware payload (RedLineStealer)", "value": "97075f6d91c325719360707113952b45f98839b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639643990, "uuid": "95467ac1-3d61-4f88-959a-d5819dbe3d59", "comment": "Malware payload (RedLineStealer)", "value": "96a30144cf1d919d63850705a61edbec641963bb41143cbe699dbe8bb2084a7f84a97a03205af5ca8c25e2237d72df4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643990, "uuid": "8cfee3b9-4df1-4a1e-b65f-8d1fbfd086ee", "value": "T1ABC4120234E2D631C6E605B104A6D7D45FBBB8B05D32415B37502BAEEFA35E05F3A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643990, "uuid": "ba6b5498-5571-4838-9a14-055b8713d68d", "value": "d585c3f2ae16ed9e33c9881499e84cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643990, "uuid": "8be305cd-148c-478d-b897-5063c65c1732", "value": "12288:hZDTm/OlcMIS9JxKj40mrVNkx6KgSJO7z5O8Z0N5eGpnK:hZDTmGZISvxK0rXKjc/56HRpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639643990, "uuid": "6c70af12-b078-48ff-a273-82873f48cd3d", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639643990, "uuid": "b6174175-ae1b-457d-a086-14d94c039736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639643990, "uuid": "5dd107fe-8818-4c1d-bdc8-da19876ab837", "value": "9fcebc54e8d0276b9723e45d8ae9eac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }