{ "Event": { "published": true, "date": "2021-06-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-26", "timestamp": 1624752181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a80bb6e4-9290-490f-9862-acfd96b20087", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c82d9e-d658-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624695956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695956, "uuid": "9c0fee36-1499-41e2-9699-183ad786749f", "comment": "Malware payload (RedLineStealer)", "value": "adaa56594d8c84ab2305f65386e53272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695956, "uuid": "1adc7f58-43e1-4dab-bed6-605f7724ab17", "comment": "Malware payload (RedLineStealer)", "value": "04b5b5acf81fdeb886fd6387abd8f5b1c31586c2907c635c703e7b1320dda579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695956, "uuid": "8a1cebdc-6d35-4551-a4c5-a1e4df9040d8", "comment": "Malware payload (RedLineStealer)", "value": "06e8c373316066babb335817a7996aae14bfeae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695956, "uuid": "1a22b82c-2716-4a3a-b249-80899068de14", "comment": "Malware payload (RedLineStealer)", "value": "17070f417f6c0944118225fa7e0aa3b86a7de9a55e4c5e5d39d1f513a5a526d02180e87bae3f4399a023f0c1b7ec147e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695956, "uuid": "a8eab844-d6aa-467f-bb4e-ed535be710ab", "value": "FC35BE02B3D2C071FFAB91739B6AF60656BE69290133852F13982D75BD711B2233D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695956, "uuid": "0c9967cc-9524-460c-ac60-9e5733b30e2a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695956, "uuid": "f986e333-a018-42d6-89ad-b63e811a0d8d", "value": "24576:MAHnh+eWsN3skA4RV1Hom2KXMmHa9cG7PGA2JDJj5:rh+ZkldoPK8Ya9cG7h2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624695956, "uuid": "8a87a684-7917-41df-8cbc-758334684603", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624695956, "uuid": "8767d77b-ec55-454c-b111-54c3df1ed4c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695956, "uuid": "a7cb2ff7-14e4-4a7d-8c28-43d69255003c", "value": "adaa56594d8c84ab2305f65386e53272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351c6489-d65a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624696849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696849, "uuid": "1f162c70-fe6a-4a97-b69f-0aade0814a1d", "comment": "Malware payload (SnakeKeylogger)", "value": "452b278f614b59c5e8a9160f4c69c91f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696849, "uuid": "29fb4aa6-5e7c-4432-834e-f6bcfa217233", "comment": "Malware payload (SnakeKeylogger)", "value": "05bc6befa45c61005487004f802ed45110b5be2fc4ac24063dc98b168dfb8801", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696849, "uuid": "1f141c3e-691d-4755-a667-449412981fe5", "comment": "Malware payload (SnakeKeylogger)", "value": "233d282a8fd95c3aa6e869c3320686a19ecbb60c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696849, "uuid": "b92a3b4f-7753-46bf-a43b-b17908bd9af9", "comment": "Malware payload (SnakeKeylogger)", "value": "662f065b4738cc11dbf989d44f2ad415e275b8aaa28097e7926c6427d5423505d57881a9b364989b74c14d17cbdf36f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696849, "uuid": "82b9ad29-2ca0-48be-958d-2e76d0d7b3e3", "value": "62940A6E1AF1AF7DF94AC1B720C64D011EA4ED61B9CAF90FB77E28910F20525FE02546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696849, "uuid": "2eac1dae-8c25-42b4-bc40-99f8fc99e3ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696849, "uuid": "a2001c74-f12d-41f3-8e62-6c5542308df6", "value": "6144:1Oqr9aQ3ZbNybkffHT+Gy+VfXTtSk8qWayTB8cTUE07gVYn6UqPPB/:BkSZbNAeHTu+VvTUk53yN2EJY6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624696849, "uuid": "4376c2af-fc71-4074-99ed-c30ab9e9d93b", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624696849, "uuid": "d128fed9-b8d7-4be1-abf4-bbba77568f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696849, "uuid": "2cf9f413-42ee-4872-a323-546d86d14087", "value": "452b278f614b59c5e8a9160f4c69c91f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea08893-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624691791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691791, "uuid": "a9207753-fcdf-49f7-915e-22ba2fd169bc", "comment": "Malware payload (AgentTesla)", "value": "939a42faab70585cf4aed59c73425492", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691791, "uuid": "3aa8faa7-81ae-4866-b0db-b62a238fa66a", "comment": "Malware payload (AgentTesla)", "value": "06febadb1cc71ef3987c339b7c862ea4cd32656c372c4f266cd1af68c355a0c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691791, "uuid": "77a0273a-fd72-44e0-b9a7-409002196615", "comment": "Malware payload (AgentTesla)", "value": "ccc57ed7de341f637e1ba6e671105ec304bd2c4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691791, "uuid": "ce9db182-5ad3-41ce-932a-323536b60f91", "comment": "Malware payload (AgentTesla)", "value": "b5579c25bdccb38649b55b7d7371f1864aa0ca08eb78da49f5709e912cf9514814dcaedecf183f5a073f803b56468589", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691791, "uuid": "84990077-915d-4c3e-bb88-be5a5223c1ff", "value": "A0A4ADBC35A475EED867D6B98AA83C64EA657177631B910A801311DE9E0CBC7CF108F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691791, "uuid": "ef9f48d0-9b60-4a94-af19-d1665e83a572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691791, "uuid": "57934250-c216-43ab-be7b-1a1f4a9df558", "value": "12288:eWccsw5CtqGg881R3fELcIBbN/Jxw8Q5tWj63fLe/2C3mJMxs9:eTcZCYLz3vE7w8B63fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691791, "uuid": "f94a2e4b-e724-46d2-8acf-0613b78c7e8e", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691791, "uuid": "69257328-021a-4a2e-a40c-e2e75db252ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691791, "uuid": "760b8420-0ac2-40cb-9749-e140bbb4b31e", "value": "939a42faab70585cf4aed59c73425492.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5649d219-d615-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624667269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667269, "uuid": "905cce8e-ac98-43e6-a04f-1a2fbd12046b", "comment": "Malware payload", "value": "7e6957c41128e2ef269aa08a1d7ede24", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667269, "uuid": "61449e13-8b7a-4cac-b4b6-d4db8f0d52d8", "comment": "Malware payload", "value": "07b5910e731c2f4bde25d9919703031d8ac73b6344d9c0abf2b39a7e9f8d3b4f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667269, "uuid": "5291a501-92ba-4689-b41b-c938cc84137d", "comment": "Malware payload", "value": "c77876f6208436a76f688ecc5a13dabf4b078863", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667269, "uuid": "f20352a9-ccbb-4e7f-bd07-e125fa803573", "comment": "Malware payload", "value": "6a1e41f41a1e2d129f2c30d50d8e53afd15333761bc49ad95812fe8ebd49cd78e3c698c4773322c21bcd65cf5fda087f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667269, "uuid": "5aa366d2-d36f-4529-aa8f-8ad794b7dd39", "value": "02048E1FE1E2FC6EC2F7557DD0084AF7E7096656A191B29D3D02F26C88016A703AF19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667269, "uuid": "3df4b197-b193-4ffc-8ff3-f55a1dc9a6ae", "value": "3072:4S5FVFEFvFWFRFwFrFSFNFuFpFoFjFyFd3p:4S5jup8HytQL0fKFgzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624667269, "uuid": "d434412c-23a6-487f-909b-8ed53436471f", "value": 188519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624667269, "uuid": "df9dd762-6209-4cf7-a1df-b0772396a677", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667269, "uuid": "b00fcb5e-c1af-496b-a183-4b67de190fa5", "value": "15.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4445f2b-d64d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624691452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691452, "uuid": "1dd08435-436e-4d80-8ee4-7074441c1074", "comment": "Malware payload (AgentTesla)", "value": "689e48973dbab622d270016650b57dd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691452, "uuid": "a2c6ae8a-583e-472b-b904-d602cb5d0db9", "comment": "Malware payload (AgentTesla)", "value": "0bc981fd0177a3032289751031abc774855a142b10abf42f6c34882d328e3940", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691452, "uuid": "cb29a5ca-4455-49f4-befb-3b7836bea5a8", "comment": "Malware payload (AgentTesla)", "value": "165d633f704a22a84d35c5238ba7bc7af6fa388a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691452, "uuid": "96c2b938-f6b9-4e03-8a64-5008282b217f", "comment": "Malware payload (AgentTesla)", "value": "d76fbbdcc0eb0f67db5a675ff14176bdef3a057ac0cc893269baaa040f0776210a9f9a75bf51fac9e6e653c68f8f50c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691452, "uuid": "01b6ba54-9d7b-4a48-a151-c11f423b92ac", "value": "7005D0343EEA9415F277AF3ACED870598BFEB6533703D92968D2038A4213B41DD8196D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691452, "uuid": "6ca7f4ff-5908-4563-a7cb-c2c875c5f6cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691452, "uuid": "ec59beb0-3edf-40d1-8967-c688cef817da", "value": "12288:VVQurCauFS23ptFBzGWSE5D1kIpN92rrN8zilwzxgvAOKG2ffmaNrH/5lF0/2tq4:dP0mhEp1yrDlyiA9f+Wr6qf2VM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691452, "uuid": "0ff8cdbd-e658-48d5-9dcc-54556108ddb0", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691452, "uuid": "53c472e6-d70b-4d88-9bed-56210c07b3eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691452, "uuid": "d058a6d2-cad8-45e5-b9b4-3007311a43f7", "value": "689e48973dbab622d270016650b57dd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf09a2f-d649-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624689720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689720, "uuid": "0746b154-6c8a-420a-ba18-8080b5988035", "comment": "Malware payload (AgentTesla)", "value": "eaee3e3d20cc4bcc631ae195a87b9039", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689720, "uuid": "2dc33d94-8eb7-439a-928f-9260cb5f80db", "comment": "Malware payload (AgentTesla)", "value": "0bced5ba704a7c9e79c3b2754c42693fb717c3c040399b7860c8eb23cbc0a59e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689720, "uuid": "1b694113-7da3-449c-90f5-961143eed41f", "comment": "Malware payload (AgentTesla)", "value": "3383ad428cecacb68da87ee229eb2e642349afd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689720, "uuid": "738d42a5-558a-4d0e-a8cd-a227ca2b8473", "comment": "Malware payload (AgentTesla)", "value": "7dd9c0fe27d98a65f19485805b8be41a2844562e312c07578e6b3641706f826c89ab0508e8d9e2151eca5f2cfb043633", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689720, "uuid": "192ec02c-bd11-46f2-ac2f-bc286f448155", "value": "E6E4375A366D2B05C1B213FBCA7098C243BADE52AE35D1767EC637C60AE4B120521F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689720, "uuid": "c5ceb93c-94e4-4059-989a-222990e57392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689720, "uuid": "25f37c92-9684-4345-998e-fcd7ff73c2c8", "value": "12288:06r9m3kmeA/fAN7ci4/+evKj5krLkhD9eu/h/O:06pm0meA/o2i27vKdJRsI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624689720, "uuid": "296360a5-a987-4a72-b285-52355b996e3b", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624689720, "uuid": "b31dc3b5-dddd-4f24-acaf-9e0ecb2c1c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689720, "uuid": "8adb1646-64f8-4653-9d2c-413c9888caf8", "value": "HAZIhw6FNFiBcwx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eace7e3b-d661-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624700160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700160, "uuid": "65113da2-f330-4e01-9288-d1062cfcf25e", "comment": "Malware payload (CryptBot)", "value": "bcb71fb45d694263db5beb8187869059", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700160, "uuid": "5c0dd3cf-d45a-4083-9024-99d659c5f63f", "comment": "Malware payload (CryptBot)", "value": "0bcf14216198351151d34d3e6ea6c05bf06c62eee05e15804ba132ea455b3710", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700160, "uuid": "45987ade-19af-421e-98fb-0fea85486646", "comment": "Malware payload (CryptBot)", "value": "582eda9bb90f9a64a41704b80f5ef2aded5142a3", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700160, "uuid": "4e4186c5-c7c2-4e1d-9e55-b251b67b839f", "comment": "Malware payload (CryptBot)", "value": "265c170d324f8d12e3304e1314b2904d29335d8ec7c69271a16a3796abd2d13c9cbea68327e3bd42eeba48dcc27c5d6e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700160, "uuid": "30386fab-ff62-4a24-810e-338b88a8d9bb", "value": "F5F48D10F783D071D8B205B419A9BB66A57CBC1447289FEBA3D43F6D49391C11E32EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700160, "uuid": "b7fd72db-f59d-4c30-b339-cb12d634375b", "value": "9b239827ad94cf9e43aed2c8aec6e783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700160, "uuid": "5640b7ba-75c7-4798-b77e-553a56201f13", "value": "12288:f80otHsf+OeO+OeNhBBhhBBFoGPRdGkppcSR5MRTFhu26loXKHEu4uLvjPpQLxGQ:f80kzDpbMZ6HXvjPpQLxGaEl8D0Tb8Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624700160, "uuid": "de799b63-f632-4a0b-810c-8fe0a26987e0", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624700160, "uuid": "71f506cd-e360-4987-b6c9-bdfd0316cbc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700160, "uuid": "0302f915-96e4-40a9-b6c6-de66710d72da", "value": "BCB71FB45D694263DB5BEB8187869059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55a28b7-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (YoungLotus)", "timestamp": 1624691883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691883, "uuid": "026b1bce-590d-4df4-8dd3-114a86b50ce0", "comment": "Malware payload (YoungLotus)", "value": "92d8c89e8dc92d61a9ff78a304711791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691883, "uuid": "78a25d0f-6089-4f87-8fd8-cc4edd4622b9", "comment": "Malware payload (YoungLotus)", "value": "0e4c2040ee56cf81df3334e99fb2e419e9ed81a3c9d47bd8f57bb8a95a927baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691883, "uuid": "83e69587-9eb1-48b1-ab5b-6051b29eba09", "comment": "Malware payload (YoungLotus)", "value": "70695074806311c4d88e3fe2dd7de30a13c97ba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691883, "uuid": "b12a699b-5b5e-421e-a90a-f5478a81d5f3", "comment": "Malware payload (YoungLotus)", "value": "110d4f077fc856a3df58f10610b6506b4882479ca68777913d311da2af555fdaa90fee5b3344f940fdff5ee483b0db7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691883, "uuid": "77dffbcd-f974-42ac-ab69-91a3d0ebc122", "value": "13A38D5AD6270C69D41ACD3018B66776A2359CAD8B42C7FFA3D8FD4F6836050EE3225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691883, "uuid": "7bcaa137-0c39-44d5-beb2-c46f2b7b77dc", "value": "4357284766c55fad255e27178ff7d481", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691883, "uuid": "a519ea82-605e-432f-9728-2c0ef2a81cd2", "value": "1536:I+32lhFXyi+aXm+CCAUAPkxP8ZSa6THm2vI4V:IjxXKLqJAshTHVvI4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691883, "uuid": "5de467bc-31ad-4a01-b666-95e5c150f807", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691883, "uuid": "f5944f12-44e6-4d18-bc25-bcf98f238b18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691883, "uuid": "8c174450-c9a6-4faa-97ea-7e1029d03dc0", "value": "92d8c89e8dc92d61a9ff78a304711791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7556d2b6-d633-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624680206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680206, "uuid": "4e340b66-5409-4d31-87e0-c969912b55bd", "comment": "Malware payload (RedLineStealer)", "value": "705f7238fc5f7daff962f3bb1079bd46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680206, "uuid": "a2fdf760-5a4e-4fc5-80db-20e2eba0ce3a", "comment": "Malware payload (RedLineStealer)", "value": "0e6c5ac15534b9259e68d664d931f7ac4f06fc6dc01e87f1307716e37d46f07f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680206, "uuid": "0c7ddb28-1441-4f69-bf76-9c216ca9b149", "comment": "Malware payload (RedLineStealer)", "value": "72059db3b7b15d0c3c10830a364782acb418b27c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680206, "uuid": "f41673ad-5cea-4015-96cc-c0ba535db0c3", "comment": "Malware payload (RedLineStealer)", "value": "1811f80da4893bce8568a4c2d6381d47c9c40e6190cb66e5415a5bbd45d90a750622378cd45df83ae8cca34c80aad5e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680206, "uuid": "a7714ddb-30d8-48e4-afc0-af6490db7253", "value": "2194AD10B6A1C035F1F216F89976D3ACA53D7DE09B2050CB92E5EAEE1A346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680206, "uuid": "ff2ec515-a321-462f-b7a1-d8fd95bfcd43", "value": "fa9874ea3b40c6a14dcd08fa8e3175b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680206, "uuid": "90696ac8-08ff-46d5-b90d-346d0e136c7e", "value": "6144:cdPxkJrygi2X3hYbZ9au6Y/d/btNt7X90MZYyrS2TkfCZQa8k:+xktygiohYV9au6Y/d/7RXKGPrS2QMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624680206, "uuid": "7d3d168d-881a-4ece-a396-aef7e480586d", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624680206, "uuid": "e7f9c10b-487e-4973-94fa-f5b8bae8e3f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680206, "uuid": "4a9cddeb-c9b9-4ecd-ad83-f4bf93958c2d", "value": "705f7238fc5f7daff962f3bb1079bd46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1978368-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747416, "uuid": "238f5118-fb31-40cd-a997-6a78dc467190", "comment": "Malware payload", "value": "5bd56b948e6e302ec75b3b6e1367b353", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747416, "uuid": "45fedf54-38fd-47b7-8fe4-b90b353309c4", "comment": "Malware payload", "value": "0eaea63aa0dd4fcc5f8483714a10feb5bab53b138bc4d931e384af67d45c4b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747416, "uuid": "2aa5896a-65fe-44bb-8ad0-df86f487c8ea", "comment": "Malware payload", "value": "ea91219dc76661cc89745e15864fab9bfb8a6f7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747416, "uuid": "9fc537e6-01af-4ca6-aa25-a01de623593d", "comment": "Malware payload", "value": "d559ffa492e2db2b3a61ed322fb8711835bec9be54daca72aeb1b19a083a11ea23e6663a23e864e42968a38bbf4a6207", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747416, "uuid": "72d27d6d-8b5c-430e-bbe0-feae84a48b34", "value": "2B732896B8919A22C6D4137BFA6E41CD372163E8E2DF3207AD201F647BC681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747416, "uuid": "bc8c6204-2c25-4514-957d-ddd2c261faf4", "value": "1536:fpXcKpBUlet3DBboJubLCNgpRTZankcahWMP1hB4g5W9/e35fEFs:fpXcKLU1cRYnkvhTtQgt3eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747416, "uuid": "7069f272-57d1-4ff7-b82d-251d88e17880", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747416, "uuid": "00f29071-2e34-4755-980b-6ada9bd8f159", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747416, "uuid": "182b75c1-d369-4475-b1d2-f5a0c93eb9d4", "value": "5bd56b948e6e302ec75b3b6e1367b353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3526ff-d6c0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624740882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740882, "uuid": "c3eeb6f7-7438-49b9-8bf2-06283ffe3e09", "comment": "Malware payload", "value": "3eeadc45f225d9394a2f41dc21183c9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740882, "uuid": "f6185542-64b7-4d2e-99e6-4423dd027d48", "comment": "Malware payload", "value": "0fd4704b373f1d00bc31bde4cc0bfd3117b20711f372099cf0bc14e80c6f352c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740882, "uuid": "c4535f0f-f947-4b46-8a6d-ab976ced0c18", "comment": "Malware payload", "value": "c47a0a4101129e2c56cc47fb032deb2fdd0d16d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740882, "uuid": "3b7ddcfd-3e26-4525-b6a1-6c294c75618a", "comment": "Malware payload", "value": "05a79f3245845aabfc1f2f5b1ccbe3214035197f1027e65aaeb0061a6dfe961a006ba13585e285ac19dec7a732fd6470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624740882, "uuid": "5a5997aa-ff0e-4022-bf50-b35fbb9d3176", "value": "37C3F9B2B801DFA6F00AD6F604D38A25BE30BBD30F6252627317356A9E731D52C67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624740882, "uuid": "f58d9747-5845-4037-8056-3ea60b208a41", "value": "3072:hu7mOgRwucad/Dp0KdSYyBVB5TiWct5umXw0lUuTH0nP:huSVcadLpZbyBVXTiWcLumXw0lUuTH0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624740882, "uuid": "f89ee078-6dc9-4a42-aa48-72ff9600e71d", "value": 128974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624740882, "uuid": "26bf9548-45d4-4323-af8b-e43978b6012c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624740882, "uuid": "dcd376ca-0f4d-41de-a6af-d52093dafae5", "value": "3eeadc45f225d9394a2f41dc21183c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762b3a20-d615-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624667323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667323, "uuid": "d5b47e88-bb33-4ad8-8bf4-a8b373cb0ae6", "comment": "Malware payload", "value": "f1b97a4299586c847ddd10753ecb869d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667323, "uuid": "b88fe964-e66a-4f1c-943d-1be0d9c599c9", "comment": "Malware payload", "value": "10f2a027a4d8845cc65d98a0897a56998d4e8a978bc46c0db57c4da7070b5f52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667323, "uuid": "2d492dbb-f226-4be1-bb68-8f943c8e50db", "comment": "Malware payload", "value": "1a9758bb6f721bb926b910778008891fe87e2dc6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667323, "uuid": "75a08a6d-c64a-487a-9d02-cd51eeb9f484", "comment": "Malware payload", "value": "d6b1f9a2d062218157376fc28b6cdee24861bdd6c8b07a9ca2111b9ce118c34a1ec46afa746262b06c5a3d6812636b12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667323, "uuid": "ceb2323d-67a5-4810-84c0-78bed38d95bc", "value": "A3C159EB00E5E90F3CB182A07DF0E790092957B49351933A7D5AF975A3204E8B5DA37A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667323, "uuid": "3609eb38-90db-4304-9ac9-2c0c79ea0bc0", "value": "96:Xd1v4A/5XJk6bwsQGmS46ayhWho97J97CBtTiyh/IHiCLfJ4fJhV8e4Tr3ck494G:NOA/55fbwbRS46aThw19OwyhwCCLmOeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624667323, "uuid": "681a8775-b6ed-4d33-8db2-2cdbb2e6c5c6", "value": 5916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624667323, "uuid": "2b5ee244-bdce-4b30-bd6a-64c0194b47f0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667323, "uuid": "18f8e401-b9b9-4b0b-9900-f8b3fb5946aa", "value": "word.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaa4ad9-d648-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624689375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689375, "uuid": "105daff2-a59c-4f14-a353-4ef87ba07796", "comment": "Malware payload (RaccoonStealer)", "value": "afb698582199dd76136f3fd78a6b40a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689375, "uuid": "f7e66737-d546-4e8a-aebc-c61608e4464f", "comment": "Malware payload (RaccoonStealer)", "value": "12c65e9b2189c8853552288feac6470dcc8ffe458f33c43d95146a420045c7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689375, "uuid": "0af0f84b-5fb7-4dd0-983b-951496d7a421", "comment": "Malware payload (RaccoonStealer)", "value": "71ac488c5478abac471076363ffc5450a851ff98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689375, "uuid": "217d6473-887a-4e0b-8548-ef0d88a90443", "comment": "Malware payload (RaccoonStealer)", "value": "2a32a99c4d004b388785b224f97e0216fca04126096bc7afb78c530f68a646b3d23e9b00d3bf6f3ee6e2e7a128a0ad22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689375, "uuid": "72913f67-d9f4-4b3a-96c7-e9ad7970fb5d", "value": "EAE4F111B5D08071D5721D3819F8AB346A3DBD301F358EDBA3D43A2E5E305D29A3ABA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689375, "uuid": "8eba2fc3-d9d3-4c29-adbf-fcf609471941", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689375, "uuid": "351f1128-7fac-4886-9212-2d3fc4446860", "value": "12288:VOOfN590uu6opX+t4sPxXEg112rYvqefXU+468QZ467XKtFYev6DXfdH:YOfNkuu6oLsJXN1WqqeW68QZ46jKLYeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624689375, "uuid": "9c056b86-61c3-46af-ab2a-1485fada194a", "value": 702145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624689375, "uuid": "a2ba0153-4c37-4512-bdff-4e63e97a5984", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689375, "uuid": "17591f30-1b05-42fe-ba53-61ed8c949fac", "value": "AFB698582199DD76136F3FD78A6B40A3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff083a36-d6bb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624738849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738849, "uuid": "2bd6abe7-94ab-46e4-ab05-a5ba7087a6de", "comment": "Malware payload (RedLineStealer)", "value": "447277242f41c97d99d42ad49e14bcab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738849, "uuid": "fc2e89c3-70c8-4ee1-b401-f336e464f04d", "comment": "Malware payload (RedLineStealer)", "value": "149a77617331e9e1ac97571ab85ff42dd11d2cc02e2463dbf15ef0830b9e08f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738849, "uuid": "43837b5f-ccd7-4840-afa5-7ef2c38010f7", "comment": "Malware payload (RedLineStealer)", "value": "5ea6bd0847b687576143421fd709976e466c7928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738849, "uuid": "cbb4c7fc-1ebf-498f-8b71-3440de3f69ef", "comment": "Malware payload (RedLineStealer)", "value": "bf5575de7492e9855c94f797475c1bd1ec6aebd92835133c9b23cd392cc87f5134a1cf744b27644c7a2c6f2d53b54f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738849, "uuid": "3800ead2-5e1b-4938-9268-80fa9cca6827", "value": "4F66332663018677D29026758A0F71B7B43AB7890F7921CF6BC95B391C32A0D27F47E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738849, "uuid": "b00684cb-8195-44a9-9ef7-b8bb1488f12c", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738849, "uuid": "b363543b-72a1-4cf1-8478-c7ea4e8313e4", "value": "98304:pAI+5p+goreqMswPavGIM45Uz8hyraVTe5fh8ndc3sTURdcsGc4Z/mjjAHlo/:it5p+gyhio5UzQbMBZRfGcbjjalo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738849, "uuid": "8cc6a41c-f7b1-4da0-881d-1ff60ae35bf8", "value": 6558767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738849, "uuid": "95f62dd8-4f7d-476e-b9ef-148e01b87830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738849, "uuid": "30ec113a-f633-40bc-8dec-776309c9b11c", "value": "447277242F41C97D99D42AD49E14BCAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add6f9e0-d6d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747732, "uuid": "98af09fb-468b-4af9-9076-dc1ef595b976", "comment": "Malware payload", "value": "b94900997c710a4a86630b5530abfe11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747732, "uuid": "f7809bb9-70fa-43bc-a4a4-3290ddf9bf57", "comment": "Malware payload", "value": "157d959be0123bf02b661b20f3de2afe36c01546a1b9f1fc083e4984f1678402", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747732, "uuid": "c1deb4d4-899a-4803-86e7-0ef8605727fa", "comment": "Malware payload", "value": "615a340445f210075be65f9cc975688163535276", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747732, "uuid": "ef4ef4be-3517-4fe1-8eb3-722ccd4d54ee", "comment": "Malware payload", "value": "76a1b24d31f5049cd8685e211bba3016624a17e84c609b3bbc67f54de8573d0125b4bd7e75fa9c99f62d3c9181e88be1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747732, "uuid": "29b86db6-9c2f-4c0b-b8f4-4f24e3f263aa", "value": "6B833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747732, "uuid": "0149d93c-1c83-4e6a-88e6-d8f021872f1e", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCkdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JjBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747732, "uuid": "a2b0220b-4cf4-4845-96df-6aee6474d07e", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747732, "uuid": "8461be9e-fa14-4584-b99b-d8dbe3795755", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747732, "uuid": "938d644c-ad0d-43d9-a938-ecda9d7e132c", "value": "b94900997c710a4a86630b5530abfe11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a35e9e-d67a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624710701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624710701, "uuid": "b22e5a3b-96b7-4eec-a66d-86e077a22f98", "comment": "Malware payload (RedLineStealer)", "value": "01f3f6dd936666332dce562304fbf77f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624710701, "uuid": "383b35f6-d024-4e33-a85c-2342482f3157", "comment": "Malware payload (RedLineStealer)", "value": "1ad538c4b298f4750efdc59a57f77717ba5fbf8e3ac594cf984af04b85f9a501", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624710701, "uuid": "8a4252f9-5f09-460e-bb08-00a6a87b510d", "comment": "Malware payload (RedLineStealer)", "value": "9c5d35553af4d41fe623953261651a12256fab8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624710701, "uuid": "fda9ca09-7c98-4d9f-94de-bbf7970cc3d0", "comment": "Malware payload (RedLineStealer)", "value": "a95192b8b127b5bc9baa3c9ad82a744564d5caa0b9a82b2d09cbe6d7b4642ba858eca3cbbe0b9a092d45a3ba32d30f6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624710701, "uuid": "ef9435b5-d9d4-4d27-b03d-fbb1162c384e", "value": "02459E24799A9016E1F56E3EC6E095747729EE166F03C90A26F43FC7173B3C3C9A019A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624710701, "uuid": "213e49e4-d982-4927-8537-64bf4bc6f36f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624710701, "uuid": "0015ab20-e5e0-41e3-a755-724475ab4875", "value": "12288:Nh9KrimyKwuo3M35wdjbnzY3Vy0EoJHQAp/Lavme0FspIqWkZNaG+to:NOrR5cM3VyGmAplJ28sNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624710701, "uuid": "74cdf10a-c04f-4f58-bfe9-1e99a4480472", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624710701, "uuid": "4ca8b070-3927-419b-a18c-c8cdd7e18db2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624710701, "uuid": "863ca3af-55cc-4923-ad13-62f53c698eee", "value": "01f3f6dd936666332dce562304fbf77f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df07791-d66b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624704111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704111, "uuid": "1ea3e8c6-0984-4682-ac3e-7fab4aac6e10", "comment": "Malware payload", "value": "59f122929a3dc1cfb09018668c13f270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704111, "uuid": "35048a42-cad2-4881-933f-904d4611062f", "comment": "Malware payload", "value": "1cccfc83a668d9ac87ad438bc7428d7d4eb7c224e437d37d15b7e7a274468545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704111, "uuid": "483fccd8-0d56-4f20-9154-fe46ea20fb51", "comment": "Malware payload", "value": "871456eb92ab8d6e908135159119c5711127dc4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704111, "uuid": "7075bcd7-45b3-49a0-99f6-8abf44ec6371", "comment": "Malware payload", "value": "4bc0a3bb23173c47f99fc8d079c4fdf1e39f94f957fa33abae09b27e0d1d3d46a460c49dacb285d2e49ba356d0eef334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704111, "uuid": "2f0b2891-91ec-4b76-b91d-d18dc0038090", "value": "20847C00AAA1C035F6F316F4997A93AC953D7EE05B6050CB52D4EAFE5A386E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704111, "uuid": "c32195f4-cd80-4ec9-95d2-87608a1ec045", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704111, "uuid": "31946b6f-45a1-4004-8f42-e79b67feba98", "value": "6144:iVw8CxDFxkT6n7hrHLdEj1++p+X1mhbr4zVQNCddmOc3u2EZcskL:iqi6nVij1pAMhb82NCddmOa6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624704111, "uuid": "9da5620c-57c5-43c8-9ed8-3d28fadbcbe7", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624704111, "uuid": "67e18661-f58f-46b5-8fcf-1e99e669d3a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704111, "uuid": "0879988c-b982-4bc6-8372-9a76cda8574e", "value": "SecuriteInfo.com.W32.AIDetect.malware2.12783.31957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3a6b5c-d62e-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624677968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624677968, "uuid": "ae99f641-2627-49e5-85d0-f6128f6756f8", "comment": "Malware payload (BitRAT)", "value": "1508a1270a38e36744a86570b09d001f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624677968, "uuid": "6c80a0eb-4983-4935-bc67-d1be9d4f1285", "comment": "Malware payload (BitRAT)", "value": "1d5fe435b3c5e617031d183ae10ac226364d02fc9221fc3302d5decc4c3d4a10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624677968, "uuid": "0b3f41d8-01e9-4913-9fe8-e474cb865a1e", "comment": "Malware payload (BitRAT)", "value": "f651bd4bb0acf488c3e7c54ef80cb24098c076c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624677968, "uuid": "d317be4e-83a9-4bf5-9071-89b0eb577e37", "comment": "Malware payload (BitRAT)", "value": "1a5fa6146526d331696d812c767afebd055b3e841a32eebf938f820f16d322cc21d6607a7cf174d73e7731cb6814722a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624677968, "uuid": "a3d5b9ce-24bc-4d90-9d40-f69da6b27f2b", "value": "0875335DB3F509B2F14A46306646A6B442AD7DB9A12E650FD3418F9C3AF1FC09BB2307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624677968, "uuid": "16e6a53b-b884-4714-9b18-b2830e33ea62", "value": "6930eddef69ab61e6824340dff912310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624677968, "uuid": "4ad4a4e2-ae91-45e3-bbcd-52da1b7de311", "value": "49152:SbpVZ28eUcMmPck3iuvUSdY/NwjZKQQBTy:Sh28eLFF3jQ/lpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624677968, "uuid": "fe480c1c-16e9-4bcd-8393-d27a0d51de4f", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624677968, "uuid": "42941504-ba00-4078-ac8b-88df915ec81f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624677968, "uuid": "7627b3e6-2443-4963-905c-90ab43a10670", "value": "1508a1270a38e36744a86570b09d001f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9f3ccb-d69f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624726413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726413, "uuid": "e18bc441-1801-460d-be78-4ba0cce59d77", "comment": "Malware payload", "value": "912d5767c4e843b568aeb2e3706db74c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726413, "uuid": "6e31553c-a6c9-470c-8831-3e5d9b9480e2", "comment": "Malware payload", "value": "1e313eacb0f2334b87804eb93042f03c62a41e908529e720cb77a294ce82cd90", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726413, "uuid": "844e000d-7546-4c52-8bcf-a1b0116fc0fd", "comment": "Malware payload", "value": "214d173969967b6a282f1c26523a9da449e1178d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726413, "uuid": "a9d5822e-6c74-44bb-b0b5-c2107a2d08cf", "comment": "Malware payload", "value": "a1cdd712f9d2619309014933fbb0b9534b88705d39b75450b3b737fed0d2ab87bc4ac2c9d5f93bc61f3a5b85c9a6d982", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726413, "uuid": "8a09c1c6-0cd8-4ad9-aa2d-089184c0622b", "value": "CF451218E7A04D8BF987687DB10F5C842DABFD69FE45A9811178374DF379E3302A0468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726413, "uuid": "3c2e1325-ae34-4db5-ba61-f597331bddf1", "value": "24576:FiYjY1QYXuZ4OdeaCtUjhPFzYGtxaPsgdE4BleRS7MZRr:cQYXgvdC8hPFEGtxaEgdEMLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624726413, "uuid": "6b23efdb-0dd8-467f-b4b5-f47dd453b6b9", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624726413, "uuid": "d42dc4b1-d15c-4589-a1c2-6f396e96e2d4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726413, "uuid": "bfac5c1c-5122-4f5a-8115-8a8b53b3c665", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5644dbf3-d66a-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1624703776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703776, "uuid": "0160b75e-0e22-438b-9fda-7a09e94f3dad", "comment": "Malware payload (FickerStealer)", "value": "f7bc09a33134bb0e54ee34676f54ff08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703776, "uuid": "10338d45-c979-4b84-99ed-b8a51bf1b727", "comment": "Malware payload (FickerStealer)", "value": "1f29d3bdd7a70fa1cd070a5d53e4917c983ed6b7be5f9f40979a92ed87cee37f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703776, "uuid": "a1bd37b1-edc8-4a22-be1e-d7f9e7a3d826", "comment": "Malware payload (FickerStealer)", "value": "26c327fa720e440b32eddff1279ebe3ba90e53e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703776, "uuid": "79e5cdc2-ccf0-4e7f-bfa9-e5fd64864de5", "comment": "Malware payload (FickerStealer)", "value": "62691703250efac2df685d89a663e9aa9d1b220aaf7ba9e267d143736f214e526b17570e4a31e9c52e45374a0637b16a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703776, "uuid": "03af2841-48dc-4876-a969-1326c8f523cd", "value": "38D48E10A5F49C25FAD622FC88AB9369973D7DA05B32C3C742B5A5F58B631D2EC70342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703776, "uuid": "b87e9163-622c-459f-9b39-e8371b193516", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703776, "uuid": "0494fd7f-c711-4e1c-affb-a6e51ff4358a", "value": "12288:ZMNJBGhpQkQgB/brZfAYtUwnJ2RUC51EW0rF3:0JQIJyrZYhRUCLy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624703776, "uuid": "b91d7c1d-0abe-457e-822e-4fc18d9f69cb", "value": 621899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624703776, "uuid": "9dc0a2b2-f88f-43a2-bcef-82037251e781", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703776, "uuid": "0267c0a6-baf4-402b-bd38-85cb9950ac9b", "value": "1f29d3bdd7a70fa1cd070a5d53e4917c983ed6b7be5f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948f2008-d644-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624687560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687560, "uuid": "03433817-30ea-4554-8691-0de9b0ca1786", "comment": "Malware payload (RedLineStealer)", "value": "95a6a36585b43d0a5d2a3b1666fb20c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687560, "uuid": "bf50e5db-546f-4684-9615-e98196aef676", "comment": "Malware payload (RedLineStealer)", "value": "2216daf252b5f3b4b00238a097e0df2a57c20780dce0ff49b418e966d63b3059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687560, "uuid": "3110e2bd-5047-4e2f-b503-c280858ef9d1", "comment": "Malware payload (RedLineStealer)", "value": "8968209599682737ca080ad3ad038962e54dc02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687560, "uuid": "3fbfcafa-a098-4148-b7e9-9a459ea40144", "comment": "Malware payload (RedLineStealer)", "value": "f522d5c2afc7a4eb8d1d18b49c7518314b6fa47988c843ca3100dd8bc3a703cd41640f0d97e6964c67a4bba6422fe3be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687560, "uuid": "2fc72465-9e9b-440a-957d-305fd202ea4b", "value": "75250121FB9A01B6CFAE2D7094F5A755DBABAE4007015A87974C350EC92F2C4DBF9183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687560, "uuid": "ebd5c216-f4fc-4c23-a681-e15a0e320b27", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687560, "uuid": "bbbb0203-e12d-4417-b0a0-298fc31ee691", "value": "24576:x1qUuV1EEAGpIiFUFbqFHeUGhNNs4A8BSMh/HkOnCcP0W:x1qUuNAG6FBqFH5GLGASMhjn7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624687560, "uuid": "5866b62a-75c4-49c4-93d1-304ce9603f15", "value": 1056472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624687560, "uuid": "ed339c74-1015-4839-940b-731eb4fff30c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687560, "uuid": "5f0019ef-f5cf-435a-87da-a7f379cc8fc8", "value": "2216DAF252B5F3B4B00238A097E0DF2A57C20780DCE0F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6793ce13-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624691779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691779, "uuid": "470c977b-5ccc-45a0-81a1-40e35e997b3a", "comment": "Malware payload (RedLineStealer)", "value": "d123e29301b5f516166ab990f8c2f0cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691779, "uuid": "f7647732-4623-43d2-b9cc-66d7984118b6", "comment": "Malware payload (RedLineStealer)", "value": "22ddc2ac013f08434bd0e732424dacae97cb2343df9fe349bc0905bb9ded86f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691779, "uuid": "5f943bf5-777a-4150-bf17-f7e75860958d", "comment": "Malware payload (RedLineStealer)", "value": "e6b5d4344814b99ed9d387ec1677498f34d2b284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691779, "uuid": "47542c94-f51d-4366-917b-ccd0d064be79", "comment": "Malware payload (RedLineStealer)", "value": "80ec8c4967d04e998efa2edd1b68a502a0cd8e1294700d2f3c503bc29412253e118069197b4d8bfaac21bf9422126e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691779, "uuid": "45ebf7f6-7411-46de-963b-9e2954c3dffc", "value": "A4A31A20EA51C039D8E662F846AE93FDF51C6AB1534434C793E66AF293782E1FC3105B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691779, "uuid": "7b737b5b-cf0b-45cd-899e-a2fc909bceee", "value": "1536:YlBezfysQLnWVAJKdLy4NoktCoFA0U30xvqTdisTY+R/aG6a7o+F3t:YlBWybOWKBaoFA0UEqTEEzRCG9c+F3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691779, "uuid": "4cd781d9-9429-4e62-8f79-37bac877e0b3", "value": 106900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691779, "uuid": "975491e4-6c0a-4509-84a7-0fa4d5f22a39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691779, "uuid": "d1846e2d-f6a4-4915-be91-5d2acaec1dd4", "value": "d123e29301b5f516166ab990f8c2f0cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505307bc-d681-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624713645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624713645, "uuid": "d70c205c-2351-4b9b-893d-831ebf67a06c", "comment": "Malware payload (AsyncRAT)", "value": "d95770c4675a4747dfe35ec0fa02e386", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624713645, "uuid": "9aa80545-6136-4944-887d-1df54c9a9a5c", "comment": "Malware payload (AsyncRAT)", "value": "24917d985814da147d7cb41713bf75d66b43b5c1fa33c598d2499b23fc473336", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624713645, "uuid": "85320c48-1330-4ad2-bd61-cd05a1cacfe0", "comment": "Malware payload (AsyncRAT)", "value": "b7cc4972c2bf521945bb10f2f6e975d24a1c8099", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624713645, "uuid": "eab450c9-3565-4161-8792-0c4b030d94f6", "comment": "Malware payload (AsyncRAT)", "value": "cbac406faa4fae737fcd7973ef65fccde3e8d54c52848791cc3431bf7e6ff7e749ec929fb6b268625da5874e2a75c135", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624713645, "uuid": "1a45168d-7420-4280-a758-aa88cdfb0a49", "value": "D684C02036F81B22D1F9DBF559A5B6104FF6722F741EE6480CC260EF56A1F418EA0D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624713645, "uuid": "e6863734-cd95-4793-9976-efd239e85a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624713645, "uuid": "0ce18a7f-366f-4cb1-bba5-c822ce741682", "value": "6144:l+KUOB75B7DK7hg733vKD3/b3DANO4qYVBILM00GVjDmG2dXeIUGE2kw66evSSdw:8UB75B7DK7hg733vKD3/LtNNA0jVjDxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624713645, "uuid": "6af91478-69a1-4c55-840b-3c13d046c04e", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624713645, "uuid": "e12e2478-8e77-45a5-840b-58ce0a2210e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624713645, "uuid": "836de812-03a1-491a-9553-34d804a89aaf", "value": "D95770C4675A4747DFE35EC0FA02E386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3408cddd-d628-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675372, "uuid": "55f9fabf-ca09-40c4-a337-d85593e6c9b4", "comment": "Malware payload (Gafgyt)", "value": "28e96df56a4d038edd0d6a89f98a1b4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675372, "uuid": "07c767d9-942f-461b-a8d9-b31c756db578", "comment": "Malware payload (Gafgyt)", "value": "24d2a2115ca93111e4ab1e2315c9ad29253221fb737c45a171899533e10d8f83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675372, "uuid": "c8517796-d5e5-43f9-b94e-59ed638ac583", "comment": "Malware payload (Gafgyt)", "value": "24bfe04b13c3c70f2adc3bb05c70e0110427837a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675372, "uuid": "bc3f4ff4-c1af-49b1-b960-8b1a32d6792d", "comment": "Malware payload (Gafgyt)", "value": "3172b5e147a5de6cdce3f96ce1ed7e0513d10d69b84b622e8ebf9ee91a635d6590f531d8122c26bed172780f5da719af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675372, "uuid": "e3b437e5-a70d-4862-b3cd-e4f70b483696", "value": "D9D30914F901473BC3D21BBAA64D528C3F391AFF53DB33157A3469702BC6B992D269A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675372, "uuid": "ee838abe-cf2b-4970-9666-02d042349fab", "value": "3072:tAUNG6kYhaiofPfIHqFeoykDm043GQ7LkmbE//NO:JG69hSfPfIHqOum043GQ74mbE//NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675372, "uuid": "f8462421-1b0f-42c3-977e-7ca9c8e78711", "value": 141009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675372, "uuid": "c8044fa7-5dac-4e1e-91ae-36492274e753", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675372, "uuid": "fb0a2020-be1d-48f3-a7cb-c48f0ccd1f5e", "value": "28e96df56a4d038edd0d6a89f98a1b4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe216b6-d625-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624674077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674077, "uuid": "562294e3-4b11-4cb4-b6a8-9ae98ffc77a6", "comment": "Malware payload (Loki)", "value": "7764f11068414cb488d5bb3db47f76ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674077, "uuid": "a425b48a-de4d-4b83-99cc-9940f5fe731e", "comment": "Malware payload (Loki)", "value": "25ec95dc0a01b8fb96e81da38fe572a0731dab96a2f3c8b86d7d238222473d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674077, "uuid": "2e47abaf-ed94-414c-a319-06b82d37f412", "comment": "Malware payload (Loki)", "value": "81fa4322ea3cf3f8add0ba6c444f101829ddc847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674077, "uuid": "bba211b8-8461-4c9c-ae42-e1520e575adb", "comment": "Malware payload (Loki)", "value": "a3bc11ec6ea0844f476d83d29bb446e2e91be6dfb82af0974456732a8e85df778ccae5c475ba2f8f1997022ef1a0e3d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624674077, "uuid": "ea8be3f9-0071-4e38-b800-572725daac79", "value": "27A4E1A1B42CACF1C0B548386D29E37C7A6E9DB1B445DE41B44CF38BBE713404BEA656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624674077, "uuid": "90b98b67-3e30-4af8-a08a-f02d9c3cf699", "value": "6efb01682d3555ddda27cff9c20f8170", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624674077, "uuid": "0d81b502-595c-47be-aab1-389ee3f21aa2", "value": "3072:t//UE7yDQcjMrW9Y4i+geGg3U7qLJG6tEryxMTxhElWgp/41xZWq1KlWgp/:tHXeDFM8YaPGg3tJXtE7hEPa/ZX4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624674077, "uuid": "4c131e33-efd4-4dee-b481-7cda89677ca8", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624674077, "uuid": "dc920fb5-d249-4367-8449-709d481c135f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624674077, "uuid": "98541bca-bf17-4484-ba40-51335c97290a", "value": "7764F11068414CB488D5BB3DB47F76ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0ec55e-d6a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1624730143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624730143, "uuid": "eb12aba3-f8ae-4b1f-9e7d-db2dcec32153", "comment": "Malware payload (Amadey)", "value": "628046f65334a7dbe5f98adf759ddbc2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624730143, "uuid": "3e0fb341-bd1c-40b0-9848-ad9a6dc631af", "comment": "Malware payload (Amadey)", "value": "28024ed87f6e08815fc91d00657dc29540cecc92e229584b37357357631420fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624730143, "uuid": "a8c98861-ca3f-4149-942f-a020151ef54a", "comment": "Malware payload (Amadey)", "value": "d5e15eeee434603d30424f194adec1dbd3d91884", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624730143, "uuid": "81753d69-b408-4e5e-9df0-a525cac7fd87", "comment": "Malware payload (Amadey)", "value": "0e927f1dd9e55834a2b938fa32874dfc362b9c2a748cf6f719c8b18fa538105759898772d14666f7d618ed6a9e8f4457", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624730143, "uuid": "277d5c41-6a93-43a3-a21e-f6ac2b740c57", "value": "86C4C37C31EA8362CF69013581A8D3FFE6EE22F04F31387ED37469A985DAA5B1531125", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624730143, "uuid": "f02fc5cc-466f-4a6a-97d5-a9a1f60ab0f7", "value": "6c8bc1e429dfdd4090d7f8be2af53422", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624730143, "uuid": "de87a760-6230-47d4-84bc-8a1a3beff2e1", "value": "6144:5RUu3hKCEo9Jc2EOuX5AnOwBh6/1OoeAD8AcTZKtHtnNPp0a:5RJKCB9JclLX+Bh6VYHwXnNPp0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624730143, "uuid": "5c2dc6a9-2860-423b-a3c6-9a9cd63e51eb", "value": 576001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624730143, "uuid": "717634b0-75a3-46e3-a05b-c64d57081d73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624730143, "uuid": "cb1f24cc-9b99-4935-885a-424b2f003e5a", "value": "628046f65334a7dbe5f98adf759ddbc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb004a8-d648-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624689458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689458, "uuid": "d0b9a166-4458-41ec-afec-9b33e6b3227f", "comment": "Malware payload (AgentTesla)", "value": "33645c71f505b0dec3803384a4a3fa3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689458, "uuid": "44268874-7566-4cce-a9e8-98fb916aa613", "comment": "Malware payload (AgentTesla)", "value": "29d204b34549846157ddc889ef72e21db132e0f476eae328500687ac6879bbe1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689458, "uuid": "2334b33b-77dc-465c-8253-ee61f60bda20", "comment": "Malware payload (AgentTesla)", "value": "4d41375b8444bde7fcbf4674a49379e00db7442c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689458, "uuid": "da811f3c-f7c2-471f-b8de-118cd6c40401", "comment": "Malware payload (AgentTesla)", "value": "24f4527f13fbf1882c4a1a2f409418c9e75f056e7832668a184aca20cd4d39607f16bcd324fa56ef72a9b815fcb88b66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689458, "uuid": "41ce2aca-d4be-47cd-9116-a417ba5a3a32", "value": "9B842389592B46E0EFEB783D011CBBB728F60CE5158DFE0360986FC375479D0B992A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689458, "uuid": "caa7a5ce-fe78-4629-958f-6df5ecaed6e0", "value": "12288:/Lh++r8Gd6/1VgGC9pLAsaHlixUekH18jrBas59DtjYD8M:/V+48Gd6/1Kv9pLAsa0IKf5hdYD8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624689458, "uuid": "a7ead76c-1b36-44ba-90a7-85e561b4f199", "value": 395451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624689458, "uuid": "b49ac92a-d50b-4d65-a102-1542bd9e0ef1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689458, "uuid": "2b3e6423-b88e-478e-98dd-e9c480a4b631", "value": "NEW P O 121120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5b00e3-d6d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747728, "uuid": "c3d64814-71dc-4d4c-a67c-b76286cf7676", "comment": "Malware payload", "value": "8244fc421eab85f5035fcbb89efe29aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747728, "uuid": "250a6e43-a3bd-462c-b4e2-d7c15b9864c4", "comment": "Malware payload", "value": "2a33f149ae20f9c941886b5149b7c54551d2385620979f63d0b0eb4f8e2399cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747728, "uuid": "d6224b7f-0762-4926-a4cb-3f3946461a76", "comment": "Malware payload", "value": "b875c6dc286b8ff9e5fd5ad140e58ec594bc36db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747728, "uuid": "d462e4be-e38b-471f-abea-0a8145550c4c", "comment": "Malware payload", "value": "c85d4f58937f7e44e610e7e87658d3b96bb1df3c587115315ab3622dfb407781591a2798a0b25912ebcadc523442b01e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747728, "uuid": "a2e5eb24-a6a8-4856-829b-ef8f41cf72d8", "value": "BC633995B4029F3CF88BD6BA90170E05B921638457C30F2BA6A6FDE37DF3054AE25D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747728, "uuid": "c926cd2a-0b0b-4beb-bb3b-ba7c35ccc4c0", "value": "1536:yKYDydkSp1P4HCnI58Ok/Tgp+nTuRb9D74:yKYD/S/PaCIM/xTw9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747728, "uuid": "378ab119-9de1-4a5d-b0e2-6c8a14da2059", "value": 72332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747728, "uuid": "66ab3f31-c7ab-4968-ac51-1d07d7ed8cb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747728, "uuid": "df1f4519-bbbf-4a82-beb4-67b69f662b54", "value": "8244fc421eab85f5035fcbb89efe29aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd283ef8-d64d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1624691520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691520, "uuid": "282fa7a4-8193-4f97-aaa9-cbe61f693623", "comment": "Malware payload (Gozi)", "value": "dd10aee2c7ab98d64703e4887d49defc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691520, "uuid": "0519f0e5-ba09-46b4-b248-9baeb81d44fd", "comment": "Malware payload (Gozi)", "value": "2c9325a4221934b6d639f2e9680487fcb865c5fd7753b674d93b95720011505a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691520, "uuid": "6e22d660-2a98-49c6-9cf9-332336f28954", "comment": "Malware payload (Gozi)", "value": "f6c124779e707ca4008a02eeda642d5ef9ba31bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691520, "uuid": "9569c5bb-a663-4098-82ff-3e42b4a0d881", "comment": "Malware payload (Gozi)", "value": "b90712ab6d3d34f3c44b530167a912078c959df83fa56975ce156639942579b41e06daabd222b9f0e6aa9ef8146f880a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691520, "uuid": "dd572a6d-9210-4a89-bc8b-e4a9260423da", "value": "5415C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691520, "uuid": "977bbdbd-7b50-4192-8b65-9bf96a50b404", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691520, "uuid": "b2b892d9-c840-4e57-9040-779f36b7d461", "value": "24576:HQfpzjXPgfW8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgyJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691520, "uuid": "97e3f106-8cc2-4b6d-8390-7bed32f9c4c9", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691520, "uuid": "41292f06-2b74-4c1e-a1f8-faa99ba72bcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691520, "uuid": "54f8c343-8a3c-4c70-bf4c-058a278e36a0", "value": "dd10aee2c7ab98d64703e4887d49defc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0084793e-d627-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624674856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674856, "uuid": "1142d29c-b0b2-46ea-b6d2-88ff0e2a74c5", "comment": "Malware payload (Gafgyt)", "value": "f23bd6f8972b058434870f0ffd88c89d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674856, "uuid": "b68e64bb-6c02-4ad8-8c52-b8d74df52909", "comment": "Malware payload (Gafgyt)", "value": "2d4271c493ed8c0ee09b0bbeb6d628af05f949c8db99803b227b97831ca95213", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674856, "uuid": "b9d53bbc-ea55-4a7d-946a-151974ac843b", "comment": "Malware payload (Gafgyt)", "value": "b714d3ebe824ecaad11b1ea914f781a56ea50603", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624674856, "uuid": "15242a5c-0dfe-498e-8282-0c7fb17a184b", "comment": "Malware payload (Gafgyt)", "value": "b3c2adb07d70458366c3ca2a5041d7550639f9c353c1687f93cd7e3d50d13abea991ed7ce77708ed3a4b3cfa584dc8db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624674856, "uuid": "a8b80030-e11d-40e5-b84a-246ec75c2f45", "value": "7FC31937A7180B63C1C749B02C7B77F18F54AAE702A351C9B91A9BD016779FA2417FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624674856, "uuid": "4ebfd420-0e88-4957-9a74-382ef495b404", "value": "3072:TBNrjwvlF5WLNcIwZGH+mz/90lxwJhctUNO:TBNrj275WL+IwZA+mz/90l2JhctUNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624674856, "uuid": "91cc3216-8738-4aec-811a-e56094a720b0", "value": 126669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624674856, "uuid": "47b22891-5c35-4671-b742-cb87c178814f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624674856, "uuid": "8c58d4b0-1879-4ca6-8d99-4fe528b97111", "value": "f23bd6f8972b058434870f0ffd88c89d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ef9a45-d669-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624703447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703447, "uuid": "d87a467c-ef13-49fa-a230-a072f93f7016", "comment": "Malware payload (CryptBot)", "value": "7cfbf5ddc9d80df8544a962185448451", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703447, "uuid": "dd642ce0-cf62-4789-9b19-eca8cdb2f4b3", "comment": "Malware payload (CryptBot)", "value": "2dd214b7750c889a14bb6c1be4ff3b32e1bce2fba8d274de69b36b442486a1c6", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703447, "uuid": "6661f75b-dd45-405f-afd0-87f9ab18e265", "comment": "Malware payload (CryptBot)", "value": "f37b0979ee3f05bc5e7a0697f5cabb0758c710d4", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703447, "uuid": "5232d11a-fa46-48a8-a076-f8cca09d8f2d", "comment": "Malware payload (CryptBot)", "value": "e5b6fe80318969646fa48c8f625fd2d274f7a37d4e451dbce93df049e148e6635933fec55de38f3021dfe2bde6830b0f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703447, "uuid": "f612509a-08fb-4c75-8187-8a4cfaee994c", "value": "4905F100A6E1C035F0F351F899B9E3A9A83E3AB1576804CB12D5EBEE16746D2DC31B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703447, "uuid": "6a1485d1-bd9a-4acf-b960-b031fb2a76df", "value": "317e1613a74924db7338e46c59a9fe90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703447, "uuid": "f711355f-09c9-4ee2-a48a-9ee9f1ab69ce", "value": "12288:HXnENgrrYmJR47aa4AodYhpS62pAx8nGpCpBNG8cjU3Qm3BP+nx/SQ:HXENgIc47a9dYf1GGqBN+jpm3BGMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624703447, "uuid": "78102dfa-b72b-4074-8aab-00cc423d3af0", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624703447, "uuid": "8d2ae626-284e-4947-a3f6-2b7a0d802d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703447, "uuid": "c419958c-5e36-47e0-8427-3d1df78b9a56", "value": "2dd214b7750c889a14bb6c1be4ff3b32e1bce2fba8d27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4174bb2e-d6d1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747979, "uuid": "0feac942-ade9-4482-816f-da5b9b5a1d7e", "comment": "Malware payload", "value": "b684534bc19b677d0d72a638af25abd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747979, "uuid": "62256576-cb05-4282-a377-2252ef9b6899", "comment": "Malware payload", "value": "2e075f50bd470e96a48537559a317578543c9c1a8d8ed9aabf6ea45982e40229", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747979, "uuid": "15738eba-8c99-4018-9d84-b915b10cffc1", "comment": "Malware payload", "value": "32ee713c757177a7bc8a2e23be415bc5c8d845a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747979, "uuid": "2657dfaf-5e80-4b9b-9a60-71926c6b6415", "comment": "Malware payload", "value": "c6e30aee24bf37de3a61e40fb216d08eaaaae8234b72fd3461334cefa45fd4b305df22dd8643451a71d55c21c712ae47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747979, "uuid": "f7f7a774-fc4c-4af7-a50b-83e4b22a71fe", "value": "51933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747979, "uuid": "357ddf2b-254b-4a4f-80c0-24ddbfbd676d", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8gl4umXxVqDrstKfz9e:Q97vk51RcG7AOl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747979, "uuid": "3b015e49-5001-4a30-b881-93e2bc7f2f47", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747979, "uuid": "1b29dea3-a0db-4695-8261-f0a5daf1567f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747979, "uuid": "39e8c229-ec0b-4009-b079-6403efe3f444", "value": "b684534bc19b677d0d72a638af25abd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6a17a7-d6b9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624737933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737933, "uuid": "1eb6b4bc-1af9-4fc1-a11e-2fc5c5afda0c", "comment": "Malware payload", "value": "c5c71b3b714ceda91977bd08c92a2e70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737933, "uuid": "159d97fc-2b12-4f85-ae8b-f60090b76aa5", "comment": "Malware payload", "value": "2f1b909a7c96ff19f18a928fe3d9e45bb0188295208ed1cc2a2cccc7bd63b7ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737933, "uuid": "68d22bd7-974f-4e29-8a73-b1c6653a9c87", "comment": "Malware payload", "value": "24c889f16a52f27889d1530270cd853109773037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737933, "uuid": "2c11393c-775d-4485-8a26-9169eed926b1", "comment": "Malware payload", "value": "44c6cc43eadc784f392ca690c0ea989924ca75e944481db1b998a32a8d8bba9faf0f6f9dd2263c44ff6625412f2d5e0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737933, "uuid": "5e613186-71b2-43fb-a0f4-7d76ff4ef6c0", "value": "BCE42211FB1698A4E4848B7BE0E779201330BD604912EB6F75CF529A8B37FC2155CB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737933, "uuid": "5aaa0288-d20b-405e-8be4-0288d01c0909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737933, "uuid": "5385400e-e6b8-4dfb-a794-01a476e687dd", "value": "12288:q7iYC/dIVYS1/0ScuitM4roPqrKX/FtSP30esnHpk4JJFiLnT42S+U:q7HodIV100itMtSuX/Fkv0znHpJa82SX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624737933, "uuid": "67462ee4-e0c9-4b7b-b126-b2433842c0a3", "value": 683120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624737933, "uuid": "a6103fbb-7c1f-4b4b-b3f9-6daa84e3224c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737933, "uuid": "0ac33210-a8dd-4744-9b66-32062c34e0f0", "value": "c5c71b3b714ceda91977bd08c92a2e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450b27f8-d628-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675401, "uuid": "5a1cb8d8-b90b-46e4-be23-d9f4303b33ba", "comment": "Malware payload (Gafgyt)", "value": "f46061c16dba9d591f3f89b03d415544", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675401, "uuid": "14c25d2b-b9c0-4d7e-98a9-4dd561ef70dc", "comment": "Malware payload (Gafgyt)", "value": "3194dab031c780d13d1ffd17a77d9535afc80e17cf1a6936e8a7f7d3deb6cb43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675401, "uuid": "661eb66d-9fbc-4607-b8d6-618733a71f6b", "comment": "Malware payload (Gafgyt)", "value": "a501485e28b2bcf760eba4a216f7f6f48ad25ec7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675401, "uuid": "35f13373-5b49-4051-b6e7-e084dc5dec02", "comment": "Malware payload (Gafgyt)", "value": "fb2b7c9ea7bf312488436eac51854eb09e3386de46031eaaf5ecdd5fae601c3a259600429b7718dd31d90fa136b32119", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675401, "uuid": "6150b105-5b80-4675-b5a0-b2379132ca30", "value": "A0144C24D2004767C1D3277EE68E524D3B324BEAA3DB7319A5349BB43FC2B991D26D21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675401, "uuid": "9d8214d8-d737-4fb3-9b6b-c2732d1e8e53", "value": "3072:1eg/fdV68tHXTdlaLhg8HhHkezFxlLJJT2SWLR//M/9xKSmXnw+ByGrmN3:p/1M8pBlaLhg8BHksLJBRWLRXM/9LmXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675401, "uuid": "4cb8cfa3-8f56-4264-b2cd-ce65d8cb6d43", "value": 193556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675401, "uuid": "66711090-3a82-4fdd-89e7-f4fb4e1f4928", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675401, "uuid": "10305c3a-02b3-4e97-9883-987c4c8df50b", "value": "f46061c16dba9d591f3f89b03d415544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53984d61-d691-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624720522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720522, "uuid": "0f174e87-5ae6-4909-afaa-dca2fcc19588", "comment": "Malware payload (RaccoonStealer)", "value": "e4294511e6df4cfd7e1b95c9d8fc2752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720522, "uuid": "bb8186fa-0cc7-41a8-83f4-7be2837a70a3", "comment": "Malware payload (RaccoonStealer)", "value": "31aaf1ea33e7e5b1f08771d516b1cdd94e5205b2b3ddeedd5643414683e26ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720522, "uuid": "3263993a-1743-4a58-bbbf-2f231d129a04", "comment": "Malware payload (RaccoonStealer)", "value": "19e6af10c15ead327e801177cd4f7846e7ee2850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720522, "uuid": "17ee776a-d17a-45e4-bc86-61c151bf91a7", "comment": "Malware payload (RaccoonStealer)", "value": "0a1c3ca9831a577d5170c616cc07d195b68d27aca00c96b7698448b166a70527488952a50b28d5395b6d0ad700dce0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720522, "uuid": "f634802d-bcf2-4b9a-a3b3-912cfdd3afe9", "value": "2EC4D010AA90C038F8F732F49A7B9368A92D7EB1671450CF62D566EA46346F0FD31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720522, "uuid": "7e994719-9069-4c2b-b551-21eb78196eff", "value": "73cd2c860835285a059a586bd5b4f5db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720522, "uuid": "79194c15-e2b7-4913-ba11-f25b2740b3e9", "value": "12288:gEgW7l00CYiZNds7q3dNYksz4ruiYIou/k4M0soQgIlLx39X4:XgW7Clds7Oq4ru5Il/k4MuIVX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624720522, "uuid": "bd455294-4d97-430b-9578-8a76a1882b8e", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624720522, "uuid": "4723c937-e8cc-40d3-9763-c8dda82e11f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720522, "uuid": "07a582d5-df61-40db-b183-ee0302e7093f", "value": "E4294511E6DF4CFD7E1B95C9D8FC2752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f69c945-d628-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675364, "uuid": "5150956c-0803-4cfe-a07d-35cbc2c5aee5", "comment": "Malware payload (Gafgyt)", "value": "888759202e963fb4e8fdf1325c371454", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675364, "uuid": "256aab6d-1165-4bb3-a8b0-612e9c762867", "comment": "Malware payload (Gafgyt)", "value": "31c61d515dc38bec6a7b959b4efd4b493f77aad049b2e82db3c580aa7bb56a5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675364, "uuid": "dc4bee1d-a134-4200-b0a3-c7fd6a1fa5b6", "comment": "Malware payload (Gafgyt)", "value": "6f750af305495712eb89f041b30094f5e8e2e5eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675364, "uuid": "bdac2166-2f5a-4f91-a570-364ff1a4b417", "comment": "Malware payload (Gafgyt)", "value": "e3a800624343afeba0c34181491116b31f122d383ccde3753be2580219fc755f023617313759abac5f64463d14af449f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675364, "uuid": "332efe65-75a7-4d3d-b0d7-56d9a3742227", "value": "C0F3947E7A21AB7EE26886300BF7AF70CB5511D726918343F12CD7185E7528D285FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675364, "uuid": "59fa8be7-7405-471a-b8f8-59457a3cfbbe", "value": "3072:m/vqu1748RXM4Rwx+IeSmRWTd3pCmdh5XmOuhwGsoaOQKNO:Kvqc748RjcZ3plbXmOuhwGsoaOQKNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675364, "uuid": "09a0f019-55cb-439a-9871-99b5d0d0c652", "value": 167895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675364, "uuid": "90c575e4-d9eb-4996-bb5f-21124ff49dc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675364, "uuid": "3c859105-91e4-4a0c-a87b-42b4c01fb9b3", "value": "888759202e963fb4e8fdf1325c371454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cb62d3-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624691692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691692, "uuid": "37ffa608-1462-42f8-8ca6-1854b4ca85c8", "comment": "Malware payload (Formbook)", "value": "2016753da1efe1011bca8f426b069102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691692, "uuid": "2586e84f-0f55-4961-b1a9-a53582707032", "comment": "Malware payload (Formbook)", "value": "35d5ace8383b8bbf1b4f1846b8f4c852899bad23312c02a1fa413c4d913e8603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691692, "uuid": "752c4da9-550d-43d4-b1ff-7446eed1ff14", "comment": "Malware payload (Formbook)", "value": "eaf5ae04bb35e84e57a95153392b8998a1dd520c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691692, "uuid": "66891270-e751-44bc-9057-c455b6f8deb8", "comment": "Malware payload (Formbook)", "value": "48eb94853ea5ec76a0529f60d17b02305f528586aa1959c1379172c5841808ac6822155865942337d4fba13e5570bf65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691692, "uuid": "c28bf6dc-ac51-4453-932b-69be16ae3ea1", "value": "1E34128377C098F6E1A359F121B9A36CF7FED6810A226947DB751E3F2672142C61D0A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691692, "uuid": "dca7cef5-6910-4ac6-899c-eb9eea4e0995", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691692, "uuid": "42e32577-a56b-4ec1-a557-5670c44ba1df", "value": "6144:MTqjFASqKs2Bz4IooumT1FEuY6nsRKTTMJEcj:MZSqtmNFEuYqsRKTgTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691692, "uuid": "64a292ed-433c-475a-bef8-29a58dba65fb", "value": 230843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691692, "uuid": "e237e191-f87f-4e46-a988-3c5420abbaf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691692, "uuid": "21cd4b67-a8d9-4c29-a364-ae02c8529d30", "value": "2016753da1efe1011bca8f426b069102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851f24a6-d660-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624699560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699560, "uuid": "e1b96efd-2b72-43e8-9096-3de2ed129983", "comment": "Malware payload", "value": "459f347590000459c312e38cc6a44ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699560, "uuid": "104d6ecc-caba-4285-bdb0-8653a7ae1ae3", "comment": "Malware payload", "value": "3991ded07d37f90d15c445a0cce467a74d0e761b533815a9b7d2e82e3cd47eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699560, "uuid": "7c4fb4fb-1b8b-4bf8-a21e-0e9960b7d0b7", "comment": "Malware payload", "value": "5cf00645925815d888ac8f946c88c61a4bd827f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699560, "uuid": "5987d87f-92e7-48d1-b559-f31d9ac659a0", "comment": "Malware payload", "value": "19670b73de6d3dbcc1306456a4e79313a550a601a460373bdc5669b2d202c5af9e5ee4a67bde4d3b24d9651c2ae3f2b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699560, "uuid": "2b33deaa-30ac-422c-93e5-700abc521385", "value": "52847C00BAA1C035F6F616F4897AD3AC953DBDA15B2050CB52D4EAFE5A386E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699560, "uuid": "27451f08-18f0-4926-b8ae-37ebad56dd98", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699560, "uuid": "6cd94e8b-f479-440a-b29d-67131320f33d", "value": "6144:42w8Crg+xkQ6n7hZHLdEJ1++p+XMRex7vMmpxVa9iStN+u2bZyQk7:4Vp6n3iJ1pAMAxMmpxVa9ztWF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624699560, "uuid": "b34f33ac-544e-4ae6-8b49-b706a6d62eb3", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624699560, "uuid": "ead1e5fe-9d51-49f4-a9a4-73906214be12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699560, "uuid": "d11ec5dd-ed78-4080-ac94-3024cc450a9c", "value": "459f347590000459c312e38cc6a44ad7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c06904-d6ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624746644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746644, "uuid": "81c631e4-6a6d-4e59-9f67-82e9c6c13a2b", "comment": "Malware payload", "value": "bd7bf7a2aebb3822c008459c9057cd13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746644, "uuid": "c504d135-a968-4187-bf92-23df994f5172", "comment": "Malware payload", "value": "399b9f44795e44ad320b7a6a7a8248f323a707bcecdf0ef2f2b469f4317d5543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746644, "uuid": "5712dd36-eb69-4000-8094-f7389332c1f1", "comment": "Malware payload", "value": "7bde4cd37f4eb9d8c2baae6316350a76d52e6caa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746644, "uuid": "9cd3ef53-0ffb-4e5f-8067-f434f26e9c4d", "comment": "Malware payload", "value": "422525a9907d9ffbf237959121a706b8f0e20ef790315d5a91e4600663c519dc59e7206a749e53fc295b5e692f1bc739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746644, "uuid": "f5eb972d-2221-4a58-b200-af8bd0daf051", "value": "CFA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746644, "uuid": "6da11493-f76a-4a74-bdd1-955a6e4d9d84", "value": "3072:VSx+i6mqaObhN2nPNKV+qKmZuqQ4DPwXXtse:y6mRObn2nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624746644, "uuid": "81e98e9a-d412-4426-8434-78b5749017f6", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624746644, "uuid": "bcf56176-47ea-4f46-9075-56db4227fb4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746644, "uuid": "34d86fe1-b16b-4246-b591-4aa24bbbb18e", "value": "bd7bf7a2aebb3822c008459c9057cd13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bf53a1-d636-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624681542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624681542, "uuid": "c53086f4-2662-45d1-b281-5efaa3591dc5", "comment": "Malware payload (RaccoonStealer)", "value": "0ebed841879c82faf8bdc8b1f3980ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624681542, "uuid": "604e01e0-4ef2-44e4-9e1d-53c3e5ee3ec4", "comment": "Malware payload (RaccoonStealer)", "value": "3ac315d081c5f415b514924f875a97c8e7a74d94a2610a079e4ccb66f9251ea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624681542, "uuid": "c72dc7be-80da-4230-a729-d683d63576b3", "comment": "Malware payload (RaccoonStealer)", "value": "4d131741e773202e047962a96c596b1254935932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624681542, "uuid": "df1b51a2-236f-4613-beae-3de0fca22daa", "comment": "Malware payload (RaccoonStealer)", "value": "65519c4bca381765dfa2b351456a98784b26ba9bf0347e5d7454a7b77d9ad84cda23854dece234c1c60299d0b137e0c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624681542, "uuid": "30e8d5a4-091f-4ab1-a0c4-75e5b622f9d3", "value": "9EC4D000A7A0C0B5F4F332F899BA9E65A5ED7EF0672550CF62D51AEA16345F0AC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624681542, "uuid": "faa18637-5d13-42fc-94fb-2a444fc34107", "value": "76567453f097005b8c49393a915ef4ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624681542, "uuid": "5e96153f-cc70-4f6c-96ee-62e3086b6440", "value": "12288:ZUT3hHJ1U5btAzESANlli+1rzvE8rYCpyg8LH9fEzTlG:ZA39JpzaNz/1rYiLU6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624681542, "uuid": "9e9723d4-a69f-4629-b000-cdebd9264791", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624681542, "uuid": "dfb99043-8abc-4bf2-9b57-360ab1987623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624681542, "uuid": "b21fbebf-7906-4866-bbbd-ca4e1e287f56", "value": "0EBED841879C82FAF8BDC8B1F3980AE2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522d57d3-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747149, "uuid": "3bd388e8-4984-49d7-bac4-5e9961c88093", "comment": "Malware payload", "value": "771b34d0dca1daa6c9531653c1110c14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747149, "uuid": "3cb1dca7-1c12-494c-ad66-f6dffaafc29c", "comment": "Malware payload", "value": "3dd27d814cabb2c985c350d1e3a6d5b52576d3d94ed8dd5e4f562afb56282d69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747149, "uuid": "aceb79a5-69e6-4156-9047-1eaa4d99c5bb", "comment": "Malware payload", "value": "34b5fbd3afb87f2c095461e89ba09b82755f3d11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747149, "uuid": "88d34a78-f098-48f7-bf51-1deb76c5777a", "comment": "Malware payload", "value": "bcbe99763e46ac58bd16ded122c9b4178ed79820e9b36ad0f61a82147211396a73d477df7a390d9d373216730db9f8fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747149, "uuid": "d6587997-052a-4b67-b5fb-ca5e94660588", "value": "B693A51A7E258FBCF799823547B78E22965837C62BF1C141E19CEA015EB024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747149, "uuid": "41dc4ed7-8e8b-4e2a-93aa-9e455ffbac7f", "value": "1536:AKzqmzfphPukFhyxCXgHUveFz0H/DZ5mHZXvEY2QPU2:AKqYhuezWUveFwHF5mHZXvEzIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747149, "uuid": "d615400d-1916-4983-bd9d-c0650a237bb2", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747149, "uuid": "dc46c28e-5aa0-40df-9812-a9733c67684a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747149, "uuid": "0a48742a-ec0c-40b4-b337-7ddd7eb89367", "value": "771b34d0dca1daa6c9531653c1110c14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffa266f-d666-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624702262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702262, "uuid": "ea8993ef-d5bb-4d78-8c06-e226ecd4c906", "comment": "Malware payload (RedLineStealer)", "value": "aaebed01fd16f5eebc6cf895051481c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702262, "uuid": "a3234d9e-c77e-4ed5-b639-5c72cc45ccad", "comment": "Malware payload (RedLineStealer)", "value": "3e01977de2513158a302d6b9c3e7d9a5f29ef88f5154157f274152983322e3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702262, "uuid": "320c95d8-9bfc-433a-8051-dc92a43fb382", "comment": "Malware payload (RedLineStealer)", "value": "4e468ac933030a5535a2af09ddd310f51ccb4acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702262, "uuid": "e3241280-0f00-47f5-9673-6821aa256908", "comment": "Malware payload (RedLineStealer)", "value": "fe35b161892f9426c663732df4c1644b75291c6e47c109fdcddbb3e99d12c6a3c79fc8b987b65ba022520d916cb2e8b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702262, "uuid": "c81dfd11-2a98-4de2-bbf8-5bb62f0ae8d5", "value": "44A33D59A3ACCA29D7FD8574B770112943F0E6CF6402EB8B8DC1A49F1E637C25A056F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702262, "uuid": "0a7a5a35-2590-4612-961d-8f6f3c8d200a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702262, "uuid": "73ec7caa-d1c1-46aa-80c0-bd575683f94c", "value": "1536:5PO/xzzlICeZ3frzROvJccD3RRfRvjWb9Va36Hx+y0Cdn3Enmx82EbG6a7:5PO/JzZeZ3fxOvJcaPYc6Hky3d4RE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624702262, "uuid": "49a9ea28-f490-48a9-8d63-79a086337460", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624702262, "uuid": "f4743fa2-3d76-482c-a2ad-a986ea920bb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702262, "uuid": "025ffc12-a7a8-46ae-bbe7-1344c684ab02", "value": "aaebed01fd16f5eebc6cf895051481c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4f8c5e-d65a-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624696812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696812, "uuid": "b94a3a53-d91d-4ac4-9d5a-dbad8763d9ed", "comment": "Malware payload (CryptBot)", "value": "28ddd1e4cf6ee8ea509771c45d73842e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696812, "uuid": "6826369a-46df-43ea-885d-b12b0d2d586b", "comment": "Malware payload (CryptBot)", "value": "3f73237acdf89666712734296663edda4c5f7f7ca9271313e4dd94291dc5b531", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696812, "uuid": "5a81c168-9807-4218-83d0-ce4218f02603", "comment": "Malware payload (CryptBot)", "value": "0f36546aa3e814a6c4bfbdda6ac94d95c8d5904d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696812, "uuid": "9980fe1e-7e8a-4d70-9228-d0aef9a6417c", "comment": "Malware payload (CryptBot)", "value": "ccdb58bbb0462d7cb66aa456b56810ee488ba82b13361c7e595fb9079c89414b20861dc2de9061bc8fc1cc8c943b69f6", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696812, "uuid": "39f3fdc2-e302-4f28-ba4c-b8a3793410c3", "value": "7605E100A691C436F1B342F8AA75C36C983E7EB15B6444CF12D1EBEE16246E2EC31B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696812, "uuid": "6e9bd581-18c0-4146-a1c5-51c5a9dad506", "value": "fa9874ea3b40c6a14dcd08fa8e3175b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696812, "uuid": "6757b6bd-4076-465a-872a-34741a2e6933", "value": "12288:+Pa6gA1uK0dvDzr9eYUQwDXJ1Vuj1B+684bS/TyAsF1ydt41kG:+PfgsID0tlP8R869uWAsOdNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624696812, "uuid": "3a0ffda5-81dc-4c29-bb6a-81b92bfef60d", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624696812, "uuid": "00eb00c9-57ca-4133-bb66-b3aceb1d02e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696812, "uuid": "61166d65-43cb-473e-9cee-a4ec8e74fed3", "value": "3f73237acdf89666712734296663edda4c5f7f7ca9271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1e07ef-d6ba-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624738174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738174, "uuid": "1b3d58e5-1ca0-4f42-a8e7-0367b20053ee", "comment": "Malware payload", "value": "0b39c355930187c37066532ca2a3be99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738174, "uuid": "1a2f121f-1f1b-4e7e-947d-2fc8a5fb698f", "comment": "Malware payload", "value": "3fef241a0b77291ffb508cdeb13a953f3b219890feaf0b0d4210bdfcbfe5c0ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738174, "uuid": "d2250472-2d45-49e3-944e-6dd6188d7d5a", "comment": "Malware payload", "value": "6848bb35b17d0a24fcd693c350a921d825c98676", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738174, "uuid": "b2c38265-c6a0-4968-a040-fb274830dcbd", "comment": "Malware payload", "value": "eff1bd540de6d9622825d4cf9abb838ca6ad1c89349376cce8ea7517fec00c2161affd590f0a9c19ce783492a15a9649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738174, "uuid": "8ee6a8ec-ea92-48ad-9583-b56a8280c80e", "value": "3AF2E132F1C91DD1EAEB8AE06CB59BC03FF4DAA622D385E0D5D25F04E6225727504AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738174, "uuid": "7f56b310-1342-473b-96ad-903af1e64d16", "value": "768:L5nGGh+LqlSQxpnzptaFDv2cQGzDTkEnUFHUEJsu64uVcqgw02NWXy:BGGeuSapzHGDv2+zDwGMUv4u+qgw06WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738174, "uuid": "1f46ff4a-1710-4788-9bc5-9b50cee0d233", "value": 36512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738174, "uuid": "b5e32584-f69b-4727-bf9b-63fffb27ff9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738174, "uuid": "e3cbe348-5023-4c25-ad72-0e1b25e611ba", "value": "0b39c355930187c37066532ca2a3be99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfffac65-d63e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624685109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685109, "uuid": "cd72352d-6fe0-423b-87c2-2953fd282f7d", "comment": "Malware payload", "value": "5dd0e434bd0ebec24aafd67c1f42690a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685109, "uuid": "7a6d3994-2b53-4022-9d6b-08023f10388f", "comment": "Malware payload", "value": "410efc30abd91864c136cc7952d17c86eaa4d843e2b745c3f9635addadec6b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685109, "uuid": "f0ce6fc5-7c4e-457e-b18d-77abb0e11150", "comment": "Malware payload", "value": "2146db15ebe119bef0e0fa90ea28352c057183b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685109, "uuid": "93ee44e9-e648-407c-98b9-ca01ec61716e", "comment": "Malware payload", "value": "fd5c53a8a4469e08686f0a89074e1f404a8eb6be45a00b9c337a164f56c2f63ef2af18e424886cc86c81c144350fb3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685109, "uuid": "2737886e-9ca8-42d9-b7d4-843d5491b197", "value": "CAE5231128DBCC31CB7A28FE093AA661EA913D93C575935B3BA10E752A057B0CF4E4F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685109, "uuid": "bf1751b3-6015-4cc4-82fa-d3842bd9532a", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685109, "uuid": "c0de7e62-c0dc-4d47-9344-a738e8379ad0", "value": "98304:CNNqXpy05Q0N1rsYSZ6BoXh1kkypSH3Oh5Bemg:Cm405QYtsTEB08T8HehLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624685109, "uuid": "e0fc83c3-9a6d-4a77-ae96-a0f3c383256e", "value": 3153920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624685109, "uuid": "9d4d4213-7571-4cc6-a705-cec53324d659", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685109, "uuid": "cb893d01-f722-458b-a392-7dbe4497b3e0", "value": "final(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a7de84-d658-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1624696311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696311, "uuid": "a1005382-0a46-41f5-b91e-d2ff68503492", "comment": "Malware payload (LimeRAT)", "value": "420a1403272a9f4742a8b4ee18c26284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696311, "uuid": "2f00f486-d084-4f02-afd9-56e737066f56", "comment": "Malware payload (LimeRAT)", "value": "4233d225c143d87e4f6b79476a69d54389e434053a787b83b41192ea110d0bbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696311, "uuid": "07e24bc4-02ce-4bf1-857c-14f4d158649a", "comment": "Malware payload (LimeRAT)", "value": "8fc660f5d3fe3ed9629a8c65869d20ffa80363f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696311, "uuid": "3ce21e52-ea60-44a7-8f73-668001402ab9", "comment": "Malware payload (LimeRAT)", "value": "96c225a6923571c5fc81fd43966cd71d4fd877ef4950ad2d4b554e89c62ea9d674a6ec77f08a5ccd7c7b89d5e11e64a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696311, "uuid": "3a4edc2b-3b09-41e2-bcca-8016ea16edc2", "value": "7BF48D24699C4319F176EBBCC9B02E414EA9BD21D211D4CB2AD33E8FF733941CD5662A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696311, "uuid": "0c362e7f-8680-4d6e-b79e-5036965fd79c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696311, "uuid": "57b1103e-a287-4a38-80f1-ff31e7ae4f34", "value": "12288:kIAAhJZaF75GF2ibA6Sm/HO5J9MdpNNR36UH+4ahldt8VU2EfPrHLEgkMnJ6PM:LAxb8AJovPR36UH+4C6u2E3Tzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624696311, "uuid": "c3a3a94e-3d29-43be-9ab1-d87b5cfd262c", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624696311, "uuid": "62c99c72-5abd-4189-b765-5ae50cf0f229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696311, "uuid": "5afba883-2e06-4db5-839b-6baa63da5329", "value": "420a1403272a9f4742a8b4ee18c26284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd186317-d6c0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624740885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740885, "uuid": "01aea2ef-d832-4c05-b691-947131bb97d7", "comment": "Malware payload", "value": "23b375c4b3215e1f6d3fed51216f1ddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740885, "uuid": "c7aaad5e-c14a-45df-a5bd-cb50e596fc4c", "comment": "Malware payload", "value": "45331c8070a2b6f8f971143181b53fbb1e8fac3009bbccaad41e37cc1eb48888", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740885, "uuid": "62d0699c-9137-4442-95b9-c57be75d565f", "comment": "Malware payload", "value": "7e9a80eae61a5b2c6d533aca12bd2d1c8a70b873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624740885, "uuid": "699999ab-2b1b-40c7-9944-5b24873a5a4c", "comment": "Malware payload", "value": "79271e13690e03c40a70f7a6a867e0f353ac4f0e1179656b195bceddf2ca32ef0023ab9ed97a258a4626c17fb720380f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624740885, "uuid": "8224fac4-d70b-48f4-a273-22b6a450e66f", "value": "6CE33914E8018B5BC2D367FAF79E439E3F3516A653D733116A38AD742FC27992D29420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624740885, "uuid": "0f58e040-9674-40b9-9f53-02894fff8153", "value": "3072:Ues7qtt2aBsEDTLxvQkyPf5ggqnEQDuGcNfqGP:Z5t2nEDTLxvZgqnEQDuGcNfqGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624740885, "uuid": "3d8e6667-5db2-479f-bcfa-89ff72d73335", "value": 146525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624740885, "uuid": "8e7da4e3-b834-4f09-87bf-b753e8021a5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624740885, "uuid": "abfc519a-5306-4244-8c44-cff34f780c0b", "value": "23b375c4b3215e1f6d3fed51216f1ddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d96cb9-d6ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624746638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746638, "uuid": "c13ebde6-5cd5-4393-adf6-fe720f929d2b", "comment": "Malware payload", "value": "7b04c5b37b05a1448d2a612e187af662", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746638, "uuid": "3943065d-b722-45b9-9145-1c6aa943e03a", "comment": "Malware payload", "value": "47c145e0b3676078b1f740fea524756739c3494f4382dbdbc173206560bddb63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746638, "uuid": "b346003b-0485-4a7b-bd67-7cd216d65987", "comment": "Malware payload", "value": "7b899126aea13756c73275f59bc15f04cbc54720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746638, "uuid": "d881e3fe-9ce5-4699-b1ce-a80fec4404de", "comment": "Malware payload", "value": "1ea14286ef6feed1d78d29aa290c4511e58b9c46b3913a703d2a692b8a779452a7497b3ed20507e71f24af0ae82279d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746638, "uuid": "b1763233-40e6-4e96-ba39-f57d499edc11", "value": "0F33F861B8926A1BC6E0237AF9AE558D332063E8D2CF3217CD201B157BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746638, "uuid": "b4422c00-7de8-4d61-8821-977627f0da9a", "value": "1536:aymy2hHuA6bBvUImk2ifflvYs6Ioh+kWXXkQ:aymy2hOkds6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624746638, "uuid": "5e521ee1-abb4-4eb9-b43b-1ad61b94a33e", "value": 54652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624746638, "uuid": "1fb78e1e-9e02-446e-9bdb-b4926b779e32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746638, "uuid": "ab8392b4-5b34-4b60-b0bb-c05550ec4b3f", "value": "7b04c5b37b05a1448d2a612e187af662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8ca1b5-d6ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624746924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746924, "uuid": "fe0211e3-fd0f-40a6-8403-e9fe55cbe4fd", "comment": "Malware payload", "value": "405a6ac52dfc54847a178bc4f735bfad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746924, "uuid": "48fd4519-449c-4a5f-9a2e-3fe0e4c2d8b8", "comment": "Malware payload", "value": "493a1949fdb5d34e5b3b41061959425208ada52b9a65ea8ca13108f7f525b8f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746924, "uuid": "b7e39a16-5323-4062-9166-71ddcc6159c0", "comment": "Malware payload", "value": "62ebf73cd6cbd2d3aec357f19676942f8cffa168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746924, "uuid": "d3f7677f-84d5-4b7d-ac28-37bde331bcaa", "comment": "Malware payload", "value": "609218801e335d929394b6f34614788f3b6b9a1f5be255a779319a761da2b9fb2ed69e03c8fc33b8e132bb721c272a01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746924, "uuid": "e25e5ef3-c284-4d1f-b1ee-eddfb1945678", "value": "FEF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746924, "uuid": "dad029aa-a0cd-4b68-891f-ff1a9c8f1b19", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBcYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/SYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624746924, "uuid": "d620a937-d626-4ddd-b7eb-bae870622dd9", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624746924, "uuid": "c29cc143-1bda-4540-9608-cb69c12ce093", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746924, "uuid": "a0f4ce5f-2536-4250-9f8c-090c04e60afd", "value": "405a6ac52dfc54847a178bc4f735bfad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507846b0-d6b4-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624735549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735549, "uuid": "139b8645-2f97-455b-91df-f7cacf40814e", "comment": "Malware payload (BitRAT)", "value": "34fe2d088c220e9d46d7373524a491d6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735549, "uuid": "7fc80697-ce38-49eb-95e3-443e57ab81d6", "comment": "Malware payload (BitRAT)", "value": "4de4e4479e8b39e6be8bddfbc4669d6e14c0e22128320cd04dba7dea991b6992", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735549, "uuid": "f50b25bf-a84a-421a-97d7-30d396578e7f", "comment": "Malware payload (BitRAT)", "value": "6ac28571f4b60a20bc0592821940d5f4a11bd349", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735549, "uuid": "09a04eb7-eef3-4e6a-9947-91a818f8f2c3", "comment": "Malware payload (BitRAT)", "value": "1502dd4efe0cbcb9ce6740d321bd1b8a98e18b6cc8c6a1c143038523034ad318941060b1a97e6cc9f255bf19844bc285", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735549, "uuid": "f2e26f62-ed7d-4468-91b6-b2103d5ada40", "value": "5D6533F692119113FA6CC67C79127F252A22869343BD72E63CCE99176D3C316BD02877", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735549, "uuid": "600b18b5-1610-4563-9fbb-47086fc99da3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735549, "uuid": "a901b8a2-f594-4b0c-8d28-c4c3f0fa3a22", "value": "24576:NJmQ3QWWrDXNmFyC2SadnEHgeJhDIZyHvoUdEdNH4Nh564YI63PJJr2ESr2M:NqrD9TC2SVACoUe91JxJiVaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624735549, "uuid": "1b93f6b5-56f1-44bd-8fbb-fab1c2c52d9d", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624735549, "uuid": "cbc6ed09-6b73-4ecc-b412-faa421183e73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735549, "uuid": "46d98060-9ed3-4b21-9018-9ec8af33f65b", "value": "34FE2D088C220E9D46D7373524A491D6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a170fbc6-d6d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747711, "uuid": "e2e0b3f3-8f7e-4aeb-b712-be6349d2f319", "comment": "Malware payload", "value": "de5d1ed51b628d10ea78e4a000fc8741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747711, "uuid": "2a26a3fa-92ad-4999-8894-7315b74e15d7", "comment": "Malware payload", "value": "4e259e5b4fcaaa72750198d22053c10e017e86caf64ff5c41dff67fd626040e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747711, "uuid": "62489fdf-9373-42d2-9b53-d053f76badbc", "comment": "Malware payload", "value": "fe3c40daf7d09431f6636656db081c784456346b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747711, "uuid": "ddae5139-ead9-48e3-8c59-f822d17069ca", "comment": "Malware payload", "value": "8b12afe47417ff5569491d6a084243890349193110b2882aeb483fa1cf8286f60f7eed5f3a53cf852a5b09fd241f96e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747711, "uuid": "cd3ccc4d-c258-4e3c-82ae-07ede67f7090", "value": "ECB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747711, "uuid": "728f1d02-a365-4924-ab6d-ed55b991e3a3", "value": "3072:MSY+46m1qOzssnFPPKNy+AmkZrQAhPDCXFke:06mgOzJnFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747711, "uuid": "f5b4d20f-5ef3-4bd8-ae32-82791dedabe8", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747711, "uuid": "c7b692eb-5723-4433-85ff-08368628cbe4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747711, "uuid": "56aebf14-60e0-441b-9224-3574c2ac3e46", "value": "de5d1ed51b628d10ea78e4a000fc8741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f978ee-d69a-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1624724415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624724415, "uuid": "f4fbbadc-037a-4e4e-af88-02552f0c884c", "comment": "Malware payload (DiamondFox)", "value": "df18127434df02b89ba3dc6c973ba603", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624724415, "uuid": "fcc352bb-f1d0-4cb8-bc20-a4b79cf6d2e7", "comment": "Malware payload (DiamondFox)", "value": "4e825059cdc8c2116ff7737eead0e6482a2cbf0a5790deadd89202a4058765bd", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624724415, "uuid": "d7e26ef9-eee2-42c0-b8e2-64bbae09c562", "comment": "Malware payload (DiamondFox)", "value": "4a65beed86134b677afe991839d3750c0648c9d5", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624724415, "uuid": "c0adc5d6-0f44-44c2-80d0-0cf75f445e97", "comment": "Malware payload (DiamondFox)", "value": "2fa241706e1aa22ae6a1bc4671f59ff378e4573b8a042043179e13d892c392e0b0d3341698bafa1e450e42fd093f632e", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624724415, "uuid": "233ea18f-25b5-445b-bedd-60bc28f78ab7", "value": "BDF63302F1E2C835C49A16B1493A43709B7A7C35B774C6F72FE834AA9D243D1A936B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624724415, "uuid": "b0b1dba8-93d6-4a93-b19b-ede30b04595e", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624724415, "uuid": "9a598a88-b8a9-4469-91ca-97c83d63da6e", "value": "393216:cVjSEKSHcI5aYG8UIm8qm8ZQf7ziwSBk6NCJRVaxlq:YxBnYUTSBxCEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624724415, "uuid": "97a6da77-6afd-4a40-acbc-233a1b0ddb5e", "value": 15606291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624724415, "uuid": "29b90a2f-8cc4-4ab4-9f32-83852f057e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624724415, "uuid": "c402df58-ba4f-40a1-9e29-996f20a04014", "value": "4E825059CDC8C2116FF7737EEAD0E6482A2CBF0A5790D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418e68d5-d628-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675395, "uuid": "07b1e85e-dadf-44ac-91cb-adc2b2414734", "comment": "Malware payload (Gafgyt)", "value": "d443000d1956b7f4939aa397527bee2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675395, "uuid": "5ba00179-95ad-4f09-9b54-4bda90a731d3", "comment": "Malware payload (Gafgyt)", "value": "50b1a5a3ebb0651029a6caca42d318a9dff8e2c3fbf6579e65885e3aa554e262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675395, "uuid": "48c17704-b7ef-4c64-8f41-89e8c380e8aa", "comment": "Malware payload (Gafgyt)", "value": "9aeda46caea6883a2050b4c42dd6addb00c73d43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675395, "uuid": "187d1056-1782-412c-aa89-c9058024b8cf", "comment": "Malware payload (Gafgyt)", "value": "4ccf3b47b6aeb296a7fabe77929aa58b864bc6dcc1f135420e31f25af7a44907dd7d213454f5632c87eb8be0b08bb9b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675395, "uuid": "18c593e2-09eb-47d7-89a9-7d2ee9805cb5", "value": "B1D3FA14F804833BC3D217BAA74D468C3F355ABB53DB33157A3499742BC5BA92D3A9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675395, "uuid": "214df91c-7cfb-41c5-91d0-19714eebe270", "value": "3072:1AHHn0nna6vE9PzVNz5nSOxqeDmQmw/khQLxkFME9PNO:S0na689bDz5SOxqomw/khQLKFME9PNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675395, "uuid": "f602d7d3-6f09-45c3-8c32-ad3c94ffa8f3", "value": 134255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675395, "uuid": "e9aaa252-80a7-4fec-af09-c61dcc71f964", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675395, "uuid": "bc6852c2-59a9-4015-b26a-4e6c34dbaf6a", "value": "d443000d1956b7f4939aa397527bee2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f17c2dc-d6ba-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624738178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738178, "uuid": "6de19f05-0bb0-4608-b8e3-7bccd8f577d7", "comment": "Malware payload", "value": "7714478819183382bad2846af1354d59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738178, "uuid": "c20d1bc5-fa25-4356-ac69-8bf98f2016e6", "comment": "Malware payload", "value": "5448a95609441e842dccaa1376060f7ed3c122d1ead042aa62cf9dc2802adf8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738178, "uuid": "fcdfbc0e-2640-4c82-9539-d02312ee7f3d", "comment": "Malware payload", "value": "1edbb3e748fedc2dfc88cc020e75b15584d61f33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738178, "uuid": "cf9df59b-d57f-487b-aa48-ed2480e37a56", "comment": "Malware payload", "value": "ee198856a7b0f065ec1c1b29def349fe918543dde28f86e4935c41ce03a74ea22ce4175add92916b91d39b1193acf641", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738178, "uuid": "189fcca1-0c3a-4d93-a488-344120226875", "value": "13D2C063C0960A94C79A0832D82B3C0C6978BB09D5BD06B9AFEDF1058D75F255BDCB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738178, "uuid": "ccd04c13-e163-4294-a238-c975b7615f61", "value": "768:NYicrAqMzfOwAHnMZvPFInoL1FKQTCEnoMnbcuyD7Uryqf:OzAVfgHMZvPWovnTeMnouy8mqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738178, "uuid": "09b9cb86-2136-4468-90be-0869a005683c", "value": 29508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738178, "uuid": "11907cd6-6c9b-4149-95bc-f3eee4f12fe6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738178, "uuid": "2a3e94ed-d484-446d-aedd-d6b345c44e96", "value": "7714478819183382bad2846af1354d59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c175c7f2-d64b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624690642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690642, "uuid": "649c6881-e702-492b-91bb-05cd7af025a2", "comment": "Malware payload", "value": "87872ed8c9ba802830765c902f91d367", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690642, "uuid": "07d7eb2c-bbbb-4b88-abc3-ea11e9114d8a", "comment": "Malware payload", "value": "57aca7fc07cc2d52d95ca6cee1fddce1c334686d46f069f35c24b4fec440753c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690642, "uuid": "5a8a2dc1-fb9d-4851-b45f-88063ddb0f3d", "comment": "Malware payload", "value": "e92c48b14ffc4baf8f4a0864ea9d642507f0974e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690642, "uuid": "e05534cb-aebb-4973-98e5-be9cb0abf138", "comment": "Malware payload", "value": "6b6d9dc94ae8202fef0daa85a6ea5897bb8ebff15b6b1af990ed6d2453069a5b942594dcc49905f3b1fc83e3b114e78f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690642, "uuid": "3358ea76-d4ed-4991-b214-231c17f8f15f", "value": "B6612A74A52C5A91FF5B6F628E34F19C66E83BA11AEF0ECB312E95110B45F985E0A005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690642, "uuid": "132ef5ef-301d-4025-86b5-6c1b2d3b8ee6", "value": "96:/gLRIm9seY51nY2zD1SJYLlnUFDDhHbXqf4:/8b9s9LNLJnAxHbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624690642, "uuid": "96f4e7ad-fd64-4ad1-8e48-b15b55286067", "value": 3292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624690642, "uuid": "3a85254c-c4e6-4bf4-9d55-970b7d8f42ac", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690642, "uuid": "51535fc4-494b-40b4-a918-a4a303b49815", "value": "POcopy-customer0086.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327ac11c-d6b3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624735069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735069, "uuid": "83f86f4c-1ee9-4495-81a5-4c82aee511a2", "comment": "Malware payload", "value": "0533044b6e65dbe2c84f78e43a37a0a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735069, "uuid": "ed21af5d-9574-474e-89a8-c524ad50e77d", "comment": "Malware payload", "value": "57bd1d7a3ce9a10797575f75af56a675b3739ab5901e383a7870b17fa328ecb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735069, "uuid": "8ed2ff3f-74ad-4853-9a9c-ae43a06d4ff8", "comment": "Malware payload", "value": "0513796322ed3364335eb9c47faad3324ff162fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624735069, "uuid": "759c1a0d-3738-4ce9-bd7e-91976ec5dcd9", "comment": "Malware payload", "value": "10a7f63b5026b4fad2059451de5b9a8909e6b6b4a1e5be10d3a7f72b6e395350a078cf15e26e60f6057b48ce1548bb1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735069, "uuid": "c0d43cab-0cd0-4b87-9dba-6e2f9728faee", "value": "62561240D5C9A8A9C1161032983DB53938D9F69BD27BCC9FEB1C270560BE3D2E16BE4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735069, "uuid": "ce8f77c7-1109-419e-abaa-03a13f20db41", "value": "2b914b6fd04316572d777593dc737715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735069, "uuid": "efc81aa3-a5a7-4faa-8df9-67676a4c18a2", "value": "98304:yUHwMgMDKQL8DUFLLINdC2G/htFMsrtzhvZ81OliMW1Cw5W9EsS+b6KR5+IVLRIb:yUrtDVCWLUzW6aBPFAAb6w5KLAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624735069, "uuid": "a0c6e957-b08b-41c7-b7e6-7d2501e34c1b", "value": 5998402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624735069, "uuid": "61a05073-d383-4dea-9589-00d2172f47df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624735069, "uuid": "52e27016-6b35-4313-ac0d-0a4c3da6bda3", "value": "0533044b6e65dbe2c84f78e43a37a0a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdeebbd-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624691760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691760, "uuid": "59b1d2e5-efb9-43ad-87ca-2a52d32748fe", "comment": "Malware payload (RedLineStealer)", "value": "81716b05ded258378040c9c369b4d1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691760, "uuid": "127ba41e-a485-43c3-90e2-3778a94ba9f8", "comment": "Malware payload (RedLineStealer)", "value": "5b1d5e7cbca5156e7ff4a39d2bd55cc6d1b3286ddac9951fd2c075e1acf3b0c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691760, "uuid": "eaef4736-9d5b-449c-b78b-f85d91d49dc0", "comment": "Malware payload (RedLineStealer)", "value": "d550bd45a712b45adfd2013c73e02e2ba68c7ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691760, "uuid": "3b650d68-dbb1-49be-9f4a-078357368d46", "comment": "Malware payload (RedLineStealer)", "value": "35c394ec6bd040b6eb83a7929ce085fdcf7a1414ec29089ca1f30671ed1e9c26ea1d9da7d3be169735fb7e371e1e083e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691760, "uuid": "1826fe27-5d3b-4a08-99ad-507fc2a61ee4", "value": "97949D10F6A1C034F5F712F88A75D3A8A83E79B16B2450CB52D5EAEE16346E2EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691760, "uuid": "c8a9acc0-245e-4301-971e-b110d2e878d5", "value": "a8fd13cfcead7aa4bc2d91debc97c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691760, "uuid": "39b317b8-c835-4017-96f6-0f4d6317876d", "value": "12288:9G+6fA0UkEZNMyQq6egDKvRkAa5Qi5HC:9G+6QQ9q6eSEKci5HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691760, "uuid": "20a7eb8d-daee-421f-a58a-33052ee0d359", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691760, "uuid": "20786672-706b-45d5-bba1-5f7537ba48a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691760, "uuid": "a70abcb1-d253-4bec-a263-549090275c28", "value": "81716b05ded258378040c9c369b4d1bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d4ce71-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624691699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691699, "uuid": "192085d5-d8b4-43fc-9cc0-98afe197e363", "comment": "Malware payload (RedLineStealer)", "value": "3964cb1d8a56fcbf13e286e8fe94f6f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691699, "uuid": "1b8c8fbb-7325-4aa1-8dc3-694a2e736791", "comment": "Malware payload (RedLineStealer)", "value": "5c191414da0698605097bec67f7c649c24bd176cdb5c06f83ca213b8b053d4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691699, "uuid": "d604d501-25f1-4844-916f-09c01c963cde", "comment": "Malware payload (RedLineStealer)", "value": "784ab9f1879c644da28f4e3cb4887e95643e6378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691699, "uuid": "594a3562-eeb6-4559-a159-768e4c13cf9b", "comment": "Malware payload (RedLineStealer)", "value": "48bb1d457f6de886302cbacfbf16ae24585113b779e6f3fc475ccb8221a22eb850df6ee167f33248daf5f3cd52b1a4ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691699, "uuid": "f89ea29d-df15-45ca-8a13-ffd5c9b4166b", "value": "F794AD11EAA1C034F1F302F89A7593BC953E7AB15B6450CB12D4EAEE4A346E2ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691699, "uuid": "48e43e3f-902e-4e35-b298-b76ae216a990", "value": "4a891687ee9846e9d6ffccd45a4930df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691699, "uuid": "5df829fc-a9de-46f2-aa49-e90670e561f0", "value": "6144:fvfi6WeA0UXodEGbxbBSdIewQbkmRLKVeMCtO/KJs7Z3Wp0ZlZDqEk:Pi6WeA0UDkxb3VD4aktOiJs70cfOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691699, "uuid": "67ebbf03-229c-4166-892f-711bff9b1372", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691699, "uuid": "1fb56b38-8754-4778-8010-d970f9c9705a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691699, "uuid": "67ac1f80-1fb8-4e61-9297-3aed6f1070b1", "value": "3964cb1d8a56fcbf13e286e8fe94f6f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83653ccf-d627-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675076, "uuid": "f68d3c8b-ab19-4b63-9de0-afee38731c24", "comment": "Malware payload (Gafgyt)", "value": "2262799169c43a6e9fbc13b1f2f9215e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675076, "uuid": "26c6c91b-d5ec-4196-96c4-5ed0530bff38", "comment": "Malware payload (Gafgyt)", "value": "62fbc955849f6f05bb211ff189e2bea0a804c3ec757486148e15e32f8652ad68", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675076, "uuid": "99afe663-5152-4c7b-ac93-7351276ded06", "comment": "Malware payload (Gafgyt)", "value": "60549ffae224aa341b9cdfc9acf4c115e2ec747c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675076, "uuid": "5de331fd-a388-4da2-a30b-28688b6911d9", "comment": "Malware payload (Gafgyt)", "value": "88c1b782ca5d1e1a2b8be0f87dafa8b2ad433eb822a3bf89a9d5766a2552ab645b1a7be7163f057ce84b29d486081650", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675076, "uuid": "ef3aff92-e378-47b4-a2b0-4a2ed47d78c4", "value": "BFC30A33B3A1C9B7C04345742B9FA9A09D12F5FF0732A16B73A42E602F1E9C75C59A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675076, "uuid": "1f10cef2-bd4d-4ad0-87c9-a26d23db84b4", "value": "3072:trqnmubSrkB3YRrR2keYVXxhu+42zjXkeQD9uZ/DMTmJhHqCnmwFMV5PwYnKE+NO:OE2ozTAji+GmwFMV5oYnKE+NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675076, "uuid": "53a2dbe2-5ec5-471b-8f52-c4fd9ec867d6", "value": 125357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675076, "uuid": "930c2f8a-6bc3-43c8-8dcb-374a0dd1d6c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675076, "uuid": "0e5d7093-c327-496c-8429-91dbdcf2fb6f", "value": "2262799169c43a6e9fbc13b1f2f9215e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6032ed6-d64c-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1624691025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691025, "uuid": "f15dafad-9950-4f19-9b60-b4ac3e730607", "comment": "Malware payload (AveMariaRAT)", "value": "aa187d6c09054eb93db25c82c0f4594f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691025, "uuid": "246d1e87-5b6f-4368-81ad-52eb970f4a2e", "comment": "Malware payload (AveMariaRAT)", "value": "666b1b5b3a2056d495ab4bea4b776f3a9843870a70c3e8390ee9b6b75098f841", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691025, "uuid": "5434ea4e-a266-4bab-b68a-dfcaeb8d521a", "comment": "Malware payload (AveMariaRAT)", "value": "56978ceb49fa82fa8c946c6b03fc1360cfe4c50b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691025, "uuid": "e59288e0-7f23-4b5a-9692-9a9b81a60d91", "comment": "Malware payload (AveMariaRAT)", "value": "ad0313f5f4f2798a883fa4be78930e2bff7de5eb6d35cd6dc97032a81bc2a61449f8089b2d22beacf9deb76850dcf2df", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691025, "uuid": "94a7196d-cc44-4693-88a8-9a57026bf026", "value": "1AB39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691025, "uuid": "bb182e84-910f-4e96-80c7-eeb6b1ba54df", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691025, "uuid": "6430036a-8f60-4186-a9ea-6a8ed82d98b4", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01m:K1VmhaH8EFvW+0OVE0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691025, "uuid": "eeb3a5f3-9777-49a7-b21d-a56f71ab7090", "value": 112116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691025, "uuid": "3c25a536-e611-4550-a721-37e5cce831e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691025, "uuid": "ce8b4ee0-5da6-4d93-81a5-43f6452b48d7", "value": "aa187d6c09054eb93db25c82c0f4594f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5a8a2f-d627-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675089, "uuid": "92554e08-a61e-4c4e-9883-ff5a802de372", "comment": "Malware payload (Gafgyt)", "value": "fafe91d7811d2c181a6c4e3935d7fab8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675089, "uuid": "7d107aa3-8a3c-423b-b396-2fe762181fea", "comment": "Malware payload (Gafgyt)", "value": "68afed3a47bd7fc21df34d09d1a7869377878b2d85f6addf42d2af5042e6ce82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675089, "uuid": "b9abc406-fd02-4702-9f51-377daecb2e74", "comment": "Malware payload (Gafgyt)", "value": "b9b330e27045b0aecffb1bfda8f980a386ca08fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675089, "uuid": "cfd32e8c-0b93-4fa3-b525-5ee79f9e8d63", "comment": "Malware payload (Gafgyt)", "value": "532f82f00c68b86c388399372209f8514344c296ee475b9d35a4e29dd7f8f0e8366d4b9f79f7b16888896d8f0b7acaed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675089, "uuid": "1e849cb5-8396-4460-81f8-848bf9091997", "value": "40F39375B7A18EB7D80FCD7706999901188CD98B42D96FABB3B4C628E74B84F04E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675089, "uuid": "9bc8511f-006a-4f62-9136-2903768b24a9", "value": "3072:6yxQhb4ZVMeLHdSNumb4wKAXmOuhwGsoaOQKNO:6GQumb4YXmOuhwGsoaOQKNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675089, "uuid": "8a239318-f1a8-4520-94ba-1463d3fdf918", "value": 167895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675089, "uuid": "fafb4031-58d6-4747-a418-7f001f8e4af8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675089, "uuid": "f7aac096-9a5c-4eea-9f6d-221cbd532a4a", "value": "fafe91d7811d2c181a6c4e3935d7fab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b5795f-d6d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747722, "uuid": "1da8b553-b85a-4530-ae9b-368c4681628c", "comment": "Malware payload", "value": "a3be8d84d5ea386cebf225b91ad04191", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747722, "uuid": "40005477-d03e-4131-8246-fee958d6aeab", "comment": "Malware payload", "value": "691243280e8950c8f7d4c960862335642dcd27ea8cf9315fabc392b280ca25e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747722, "uuid": "4265975e-9632-46fc-928e-48d2c67b3cd0", "comment": "Malware payload", "value": "296b8b67426c0a373baae08f497f4b4a42812d5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747722, "uuid": "4e62dc21-db5b-4a60-9391-2169c351c4ba", "comment": "Malware payload", "value": "14460d1ab96c4d9db7141520059753bcf62d98a6a932abdf28fbb3292a83769185b5b1998c16f17542f88f0e14f08749", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747722, "uuid": "aad88507-bf25-4761-8676-78cacdf64e3a", "value": "7DA30896F800DFB7F40AE67604D34B25B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747722, "uuid": "85b75328-e92c-4216-9ab2-cadb2ca3d7d3", "value": "3072:pNerWBIvC/IymEdH8ffJBOKmuxVqDr78fz1e:pNerWBIrym+85BOKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747722, "uuid": "9ab66966-49fe-4e0c-a917-6fb0d0112e18", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747722, "uuid": "1c522b21-5825-4ec5-ae10-485190bf438a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747722, "uuid": "c5b0ff8c-836f-4e6f-919f-3cb31cd63ef9", "value": "a3be8d84d5ea386cebf225b91ad04191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade4d07f-d621-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624672570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672570, "uuid": "3049fc40-d721-44c4-9f1d-c5b69ca03387", "comment": "Malware payload (RedLineStealer)", "value": "6080cdf3c23a43caeba7e55dffc72bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672570, "uuid": "41e04089-9ee3-496b-b76d-a5aa2cc1d8d3", "comment": "Malware payload (RedLineStealer)", "value": "6a302cdb1efa324f9fa2688866f25809ece99319f1ba3025abd50b757a17ddad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672570, "uuid": "097c23fe-4d3a-4eee-aa52-e36e7fe58d9f", "comment": "Malware payload (RedLineStealer)", "value": "dbf1d46d963b561751d200fe3ef95f07b9f645f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672570, "uuid": "a4b4b4c3-38a8-4a8c-97c9-48cda32bc3d1", "comment": "Malware payload (RedLineStealer)", "value": "f35f694ae6fbd241484b47af5d3fdadc95a41bbff5ff1aed048e5a35cb6bd81517d5f352d4ac68d1efcbb05bfa39afab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672570, "uuid": "75dafc22-4c30-4353-aa13-a2a83cee6c99", "value": "1EC633495640BAF7F4488FBF42226FF4CBCFF4E59E40ED8B8B6D55181A21892D50E9C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672570, "uuid": "655d1bc1-7045-4528-b33b-2af935a07a84", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672570, "uuid": "5861fd5b-6239-4aaf-9480-d381e441e989", "value": "196608:PGqlH+s8u7KTMe7qAWnGFyl6b2btDhTXEFpqvE8lEwoSITRYluQq0aDWS:txcqAWGFyl6ijTXEcE86WIFY1q0Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624672570, "uuid": "f5e00b19-9f2e-4219-8487-b1e44ee1fc45", "value": 12411748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624672570, "uuid": "80aab5ec-41a9-4e6a-876e-656937a864d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672570, "uuid": "98c8f674-616c-492d-a4ad-932b7f248574", "value": "6080CDF3C23A43CAEBA7E55DFFC72BBE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a56f6e-d668-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1624703076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703076, "uuid": "04c49c76-52f0-4391-a08b-6f2ab7ecea35", "comment": "Malware payload (njrat)", "value": "4aa2b85b4040c5bf5af3f3ca541f0552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703076, "uuid": "186a7e9b-2ff9-4c7e-aed7-07245890f68e", "comment": "Malware payload (njrat)", "value": "6a66ad5c6a5d5dfbd6ceca4147c736a9761976310e973a81acbd79fe33910651", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703076, "uuid": "69c63400-fa56-46e3-b029-e378f044cc79", "comment": "Malware payload (njrat)", "value": "353885ea9dec8eb1dc62986b0e657dc6d714a8b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703076, "uuid": "9a8377bb-b237-4271-b933-b15d9165d89c", "comment": "Malware payload (njrat)", "value": "247af7447d1c38e3c0246b797ceeffe6bdc4a867c7b77619f4e5d0011ada2ad27291c2abcb8f79ea7f613d847be7136e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703076, "uuid": "56c35878-bcf8-451e-9e1a-550c62bd1c5a", "value": "6935E01029D5935AE1B6FB349DF0E7A58E2A7FA2BA13CC0E34E136472673B039E51135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703076, "uuid": "e9e84793-ef64-4bdb-a2d4-e837686bd363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703076, "uuid": "65f6cc73-70cc-4e43-9024-2aa613dd7685", "value": "24576:vujD+bAaMd3REebAaMd3AZwCEqwnMF0pJ6aUBRmAT1a:GmAaMVRE2AaMVqEqwGAJ6TvmAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624703076, "uuid": "cbdb5a53-c1fe-4236-bdd2-b889bd63bd0d", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624703076, "uuid": "2315d0e9-b958-4f6f-a526-866b0ef0aa2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703076, "uuid": "fc20290a-d1cf-4d85-af4f-91899af0aa51", "value": "4aa2b85b4040c5bf5af3f3ca541f0552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f27231b-d669-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624703442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703442, "uuid": "d541ce7f-fc10-4faa-a156-632493b58d6a", "comment": "Malware payload (RedLineStealer)", "value": "331e6bda278c65dc49a4977a4976462b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703442, "uuid": "3e152158-9d6a-4887-960d-15f473bd2a31", "comment": "Malware payload (RedLineStealer)", "value": "6a976e219af2974ee4d7c7986ba0bf300ab4315a91814589ecb50078376449bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703442, "uuid": "661ebb33-d7c4-442c-ae19-46d7b977c0c9", "comment": "Malware payload (RedLineStealer)", "value": "2ce818e15faafeec94a224f988ebe5a9e8bf1ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624703442, "uuid": "4c567768-47fa-4330-a0a2-1277e3fe5a15", "comment": "Malware payload (RedLineStealer)", "value": "afac6af86fa1151dcf4584f9f4e76b759d6e71f20459a5d4aefec4bda89a85ba989ed3b7f389d1015552fba14bddf5a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703442, "uuid": "f145cd9b-2562-45c1-b445-3680f4132d27", "value": "BF74162864BFC01985E3EEA12EDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703442, "uuid": "bda509a4-fe18-469b-b836-1f807e736848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703442, "uuid": "27582edb-042b-4e7f-9309-abfe1725412b", "value": "6144:i5Yqofbq/qmIu8zuz4ojLGbT6Tv/3Xxjm+g:i5Y3fbq/qru8zuz4iLGbT6Tv/3Bjm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624703442, "uuid": "fd86b1f1-67f6-45e9-b5fc-ceb7c31aa77f", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624703442, "uuid": "37a1014e-c622-4152-a28d-1eb75166223c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624703442, "uuid": "2083bc24-b471-46e2-ba08-3aef770eb243", "value": "6a976e219af2974ee4d7c7986ba0bf300ab4315a91814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5291c930-d6a7-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624729969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729969, "uuid": "bd7028d3-29f8-4098-a131-cead86eef5c8", "comment": "Malware payload (BitRAT)", "value": "e39f404f193bd1e12fac9307a43adbed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729969, "uuid": "86c8d33a-9532-4ba8-aef6-0072c0a04ad0", "comment": "Malware payload (BitRAT)", "value": "6c127e6dbd6095f50768a04c8c7edab47b372cdb4672b9c5ff2c14a44b19582a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729969, "uuid": "4d41b05a-d8df-46ca-ba6e-e5b690655019", "comment": "Malware payload (BitRAT)", "value": "fb2e759fcb30b6e7299922e0e362f9b677162c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729969, "uuid": "fbfc0266-bbe6-4193-9be8-9a3ec46f369c", "comment": "Malware payload (BitRAT)", "value": "714ca8e8215ae9e5612dc08fa50e559512686165259af1b611a22649b85da248922b216ded1d68ee0809adc664a7f27b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729969, "uuid": "f8b42489-4a45-4a65-96f1-c9c05ee0afb8", "value": "8606CF02FA41C562D2670230E9AE77BE057CF5344B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729969, "uuid": "d166349a-52a5-40f6-9d9a-36418cedfdcc", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729969, "uuid": "ae1df058-5b12-4a60-acef-0cabd65330be", "value": "49152:gXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VI1:gXrEeZzdhjuV/gd1VzsGUqNKTHvQejR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624729969, "uuid": "cb12fba5-76d6-4c71-83b0-efbc1b8b0040", "value": 3941888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624729969, "uuid": "12e2d28d-4ac4-42bc-b321-30fcfbad4cf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729969, "uuid": "f4012669-3d4f-4095-8feb-5b54640c7a86", "value": "e39f404f193bd1e12fac9307a43adbed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599447da-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624691756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691756, "uuid": "04b73658-b484-42c7-9889-41b889966b2b", "comment": "Malware payload (AsyncRAT)", "value": "8297c49f61c1b498eb46729eff3a1c44", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691756, "uuid": "aee904b0-26f3-47af-9484-1cfe36fd1998", "comment": "Malware payload (AsyncRAT)", "value": "6f17b58e1488f1767e4abb7e1d748a5aa2e6f29899814c019cb3418af9a0d536", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691756, "uuid": "08c47b39-b275-4a8a-9786-74a9d7adbee8", "comment": "Malware payload (AsyncRAT)", "value": "9d0a6ea40f7db15f52e52d4a1d96af95f49e5cce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691756, "uuid": "fe97faad-8644-40b5-b81c-ce0ed837cc8b", "comment": "Malware payload (AsyncRAT)", "value": "c44e2e04015f06102d21280a8aa44bea0886bfba63856253bb0335d0904a8c5cfab392fb806e33717343794e9768a158", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691756, "uuid": "e4ed8ee4-ae12-4f53-9e45-7bdbda9118bb", "value": "3E45D0563430D398E7982A7091DB813D4370EEA59DF6BBCE1F1E35EA05B02295C50FAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691756, "uuid": "c9285587-580f-4d93-988a-6d3830da972e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691756, "uuid": "e6ee0a16-6015-4a22-926b-a5ccedf51115", "value": "24576:B3kD2wAEG2E5/BiVY7bWZ8Pyw+vQulIybepSJzkOpULGdHjS:52EJA+3u8PwITl+pULGdHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691756, "uuid": "7d80bf55-5028-4d75-83b5-a74942c7f026", "value": 1204871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691756, "uuid": "deca6858-84ed-429b-b4c1-985f7214b566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691756, "uuid": "cd9d4aef-9108-4489-81b5-821f57e31ecd", "value": "8297C49F61C1B498EB46729EFF3A1C44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6b6eef-d649-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624689690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689690, "uuid": "1298754c-ac12-4aeb-8445-9c76010123bd", "comment": "Malware payload", "value": "a55dbbc9061dcb2126f78f5508a4c8ce", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689690, "uuid": "b8a34fdb-0c8f-47e4-9c3d-0f8b092268d0", "comment": "Malware payload", "value": "70f5c43cd7fa51240f496bab1c6a9cf1f67894a0dbe42932346a0184498ad016", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689690, "uuid": "8195b01c-b9fb-4551-aae8-77f9ddb9fd59", "comment": "Malware payload", "value": "f621a853d9bb81c3a410e5bc4aff24ff2cb3152f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689690, "uuid": "16655236-e403-4af4-ad83-d4a2c70bf4ba", "comment": "Malware payload", "value": "4c6c934978b214eab24fb95e47c180b1615da23d604083c6f7aa821c5f465365e8dfd1b5c2a348a4334f03e171bd45d5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689690, "uuid": "db7c9f37-bc0f-422a-bca1-8b1d21d74599", "value": "4F75337AC77833FEC3E1A928CE078F76965029CB7149A429B53E171C25CC63885987DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689690, "uuid": "e9370c74-4f0c-46a8-ac13-ce9f1345865a", "value": "49152:OQ3QWfqyDAFOKLgnbJFKh9Tj51oH2qh0WNdJ7:dgyIPLgnNkP/Qthd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624689690, "uuid": "e2df1922-ab69-45ee-acf7-158508af63c7", "value": 1599864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624689690, "uuid": "109cc45e-3f46-46f5-8b75-bb8d3a07d9b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689690, "uuid": "d5fd1373-5065-4b17-b4e6-2f752ba590de", "value": "RFQ-517708AXL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99796aa3-d627-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675113, "uuid": "59d8ed94-8929-4f5b-af44-3abe62ad460d", "comment": "Malware payload (Gafgyt)", "value": "5998d330e10405e3f1ff5d89a46a37d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675113, "uuid": "1b67a030-7a86-489b-b122-a7256174cf3e", "comment": "Malware payload (Gafgyt)", "value": "73373644e04ddcd0e9437409dac0ba7b8b8895a831251e228cb26432761f8684", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675113, "uuid": "722599ed-c739-4c07-bf0a-f19f01bdad27", "comment": "Malware payload (Gafgyt)", "value": "1585bcd32ece1325d3bc4d7596e32aeeb9610d2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675113, "uuid": "e75680d2-d5f4-4d9b-bf5f-26c81673860a", "comment": "Malware payload (Gafgyt)", "value": "f08c870aed39f13596b16f3d187ce4b91aea64d9254148cee99ddd0738600e41f132e4ab2f4ee493e1a510f0eaa9d7c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675113, "uuid": "3c5be8d7-3c0d-4edc-bcaa-cb4bab590b4e", "value": "B9B33C79B244C173D14319B91187EF110E32EAFF160BE64AF3792DB49E1A4867522FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675113, "uuid": "5d8ca3ac-f5e4-4974-990a-339395d12ad7", "value": "3072:zFRJ8+8kQrUaPUhGXAJIPtYbiVtAulKn+u1YSmzF405DF5nc+UG:z6+FMj4MAKaOA6K+lSmzF405R5nc+UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675113, "uuid": "545cd7da-001b-46fc-82f4-e176e8a6d6d1", "value": 108359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675113, "uuid": "0f2bcf36-ae00-486a-b5df-fc880d24910a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675113, "uuid": "2e6e9dfa-33af-4590-92a2-7edeb0b4c163", "value": "5998d330e10405e3f1ff5d89a46a37d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948d5648-d659-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624696579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696579, "uuid": "dec0b2d8-25c6-49b2-b1ff-be8bfe629efa", "comment": "Malware payload (AZORult)", "value": "c74d736acb2fde91f29ad12ff84355e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696579, "uuid": "e943700a-0ffa-4834-b01f-1a71a0272604", "comment": "Malware payload (AZORult)", "value": "74f108a1e08fa3ebc3ff8e54f4950e5fa1e75a6e4a9a9968e226b31064fe8d2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696579, "uuid": "1fe8cbd1-e182-400c-a524-0c67c59b1c62", "comment": "Malware payload (AZORult)", "value": "57caa18bdf4d293d6702179d4e28a1642eb18d14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696579, "uuid": "64ad1cac-ec16-4eb2-9236-b7efcc109020", "comment": "Malware payload (AZORult)", "value": "fb86283f9e1325259664819483370f5faf7e4ef44775ee060222a1baa71d86c079425f50618dcefb6424d9ca0c438125", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696579, "uuid": "70a512b6-b823-4cd2-a6ef-2e34270ff4fe", "value": "BBC47D2E1AF1BF7DF94AD1BA10D64D011FA0ED62ADCAF90BB77E19610F20515EE03942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696579, "uuid": "dfc64c5a-cca3-4a92-802b-ec5c923fafd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696579, "uuid": "80881771-6493-49c1-bb96-9d049849e783", "value": "12288:YVI69G552+B2kgL+iwWN21yjhkup3ekAM+37:anQ552si+kN21yaQexM+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624696579, "uuid": "d69641cc-2add-4846-9c12-813e70c99c65", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624696579, "uuid": "c90ebb7f-1ea4-44c8-bcad-bfd32d00f248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696579, "uuid": "3045bf99-0919-440c-ace7-56281ed1bf67", "value": "c74d736acb2fde91f29ad12ff84355e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3104425b-d66c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624704573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704573, "uuid": "293bc719-a00f-458f-80c7-ec41fcfbf62d", "comment": "Malware payload (RedLineStealer)", "value": "81917be52c7ab89738dfdce9c200a455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704573, "uuid": "31e6caaa-56f9-4c79-a08a-cceb83b8a39a", "comment": "Malware payload (RedLineStealer)", "value": "7661bd5c87f1a9ad322c337f11b600dce2b6fe911656ca9fd1aeaf2197451488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704573, "uuid": "bfad303e-83ba-41d6-ae3e-613bf1ec5d77", "comment": "Malware payload (RedLineStealer)", "value": "c8a10d4012a3b58db7992bbc48e1bfc90a19a660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704573, "uuid": "e55b8823-8a74-49d4-bcb8-96682a5ec7f4", "comment": "Malware payload (RedLineStealer)", "value": "2dc4a80fba37500f34e885bcb9a8381b092ad68071eefd02adfe4f145efa69cda8e59ff462335737b130030e960efe42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704573, "uuid": "30d345c6-758f-43d1-b334-2084bacef0c0", "value": "099527893B96C3E1E765017DB07E163E0E282D6214E2FBCFAA5CB37D1A3A95118F0D51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704573, "uuid": "c52c9767-ad4e-4a1a-a383-850217ef3244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704573, "uuid": "d2cd27e8-6dac-4982-8d16-dec63cd861f6", "value": "24576:Ev1CrwvW9O1brwerQIWONYxBqSOFg+OLwfAyX0gV2ozVwTGhPJ7l:EErwvb5rweFWONYxcSMgEkh2VwTgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624704573, "uuid": "623ae6f1-436d-4372-94fd-dea2b534f943", "value": 2020376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624704573, "uuid": "da99a056-3226-4b79-9b7b-1b37a4381300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704573, "uuid": "4740012b-089a-4036-9476-d46e36824b96", "value": "81917be52c7ab89738dfdce9c200a455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b067868f-d64c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624691043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691043, "uuid": "f1598ea7-2843-43a4-b0eb-6bef8e889d66", "comment": "Malware payload (RedLineStealer)", "value": "e3134de4b36091b9db345fdd1cb3f4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691043, "uuid": "fc5b9af7-f1b7-4fb1-b626-c44ca66e52b7", "comment": "Malware payload (RedLineStealer)", "value": "796641693606c51475b6f29a63a9568729b097660ea2cfd9e15b610325dd0b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691043, "uuid": "84c12912-5c21-4b8c-9de3-5d4f5d81035c", "comment": "Malware payload (RedLineStealer)", "value": "3dc6856e6221910a75c9a4edc86590b1b0584106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691043, "uuid": "71ed28be-f1e6-402f-93db-b560655969fa", "comment": "Malware payload (RedLineStealer)", "value": "48247dbe5f1e4e77b4b6c3080292f50c62285c1033f549d72c5fb45ff197b49d41faeeb572b9af4cb8cff46c35493a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691043, "uuid": "6f054885-02cc-4bdb-bccb-12a93c05cdfd", "value": "7E955A4C3BA493E2E7752171A076173E0E282EE254E5FBDD7E6CB04D0B2DE462AF0951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691043, "uuid": "11820b26-965e-4594-989d-f624b9f02ad5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691043, "uuid": "f6946a65-9f43-42d1-bd6a-50ca16d3899a", "value": "24576:lQwmiNO1brwerQIWONYxBqSOFZmTiOOLwfAyX0gV2ozVwTGhP97:le5rweFWONYxcSMZwkh2VwTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691043, "uuid": "5baa53e7-eb69-4b4a-ae33-485ea36ceab0", "value": 1945624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691043, "uuid": "27f93707-ccdd-4f0a-8a59-057474a84045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691043, "uuid": "1cfee47b-009e-4566-8f2b-542a23a52da0", "value": "e3134de4b36091b9db345fdd1cb3f4cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad9c72f-d6c8-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624744237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624744237, "uuid": "892511a1-12ae-4d9d-92e0-ea28cef927eb", "comment": "Malware payload (DCRat)", "value": "1397ba4734a30c94e3456bd8b73c5f97", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624744237, "uuid": "c14529ed-afda-4803-b207-31d154813bd1", "comment": "Malware payload (DCRat)", "value": "79e5b41bf65d21940dd5b48a6387ee8e77e1287c47a36af8b13bcebbab81364c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624744237, "uuid": "43ddddd8-50c7-491a-a8ee-d7b5d33b2fc6", "comment": "Malware payload (DCRat)", "value": "da6345a437a36f74da85e843c101a8fbaf2377a2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624744237, "uuid": "3d75ef87-81ab-4625-8811-7da1bb50e2c4", "comment": "Malware payload (DCRat)", "value": "3414c3942bf4bbbae473645003a66422f157073e38c092d84ddd70006dc66e7f391e6f1f9faf043cb89493215aa91c81", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624744237, "uuid": "a10953f2-40c4-42a6-af47-cac6d8100b2f", "value": "9EE42B223698CE01C0BA1636EDDF851407F8EA417A66EB3B3E5A735D65533A30D4E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624744237, "uuid": "902970bc-775c-4870-95ff-8a24b73b787c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624744237, "uuid": "1f409efe-60ca-46db-a145-c56ffda27e46", "value": "12288:tO5KU3DSTASNtlb+vjodpBNhe3dom4zDnqn:tGr3mTVX3BNh2dq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624744237, "uuid": "9a4d010c-16f2-4a2d-9443-fbcf8b42a32f", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624744237, "uuid": "54366f7c-e5f1-4b5f-ae6e-478a388ce062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624744237, "uuid": "0a8f7fa6-2a3a-40dc-b97d-51655f6dba14", "value": "79E5B41BF65D21940DD5B48A6387EE8E77E1287C47A36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74f43d9-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747426, "uuid": "b7602406-0970-4f68-8350-00e2a9ecf7fa", "comment": "Malware payload", "value": "6c803f62f708f19c513c62e0afcb8e2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747426, "uuid": "de5bf793-74b9-4bc8-90b2-e0adef0720c7", "comment": "Malware payload", "value": "7fe841f995fd72c1a91b3bc9a24a391ade483484bd76574f13e6c552f0f586e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747426, "uuid": "53cedcd6-c8a8-4ee5-ba7a-158bfd171da5", "comment": "Malware payload", "value": "493d9977086f2ef871ab30ab7ec76966b4008262", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747426, "uuid": "48c78ce9-5ef4-49fe-9e49-637712d89f08", "comment": "Malware payload", "value": "439b3d0dfe81d8ef1cfa9c0311f9201ca0f50c1c82a964a44548563e9ad9aacd728f29431b042e6b9a256689c09934a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747426, "uuid": "d4e80df1-6816-4fb1-bc62-f7f708a4254b", "value": "7193E709BF610FF7E86FCC3709E91B05198C550A22A97B367A34D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747426, "uuid": "b989fc01-5073-4486-bbe1-e70313ffa347", "value": "1536:nSITUINkErcWGinZnH7zcSAkaI91rFSEZa72PzY:nSITRNsWbtHMibSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747426, "uuid": "04c60c37-adf7-4ce7-94ce-14f44311a37f", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747426, "uuid": "e5b89432-4939-404a-9891-303a00086f96", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747426, "uuid": "33bd37f1-5103-4173-bb44-831066aea40c", "value": "6c803f62f708f19c513c62e0afcb8e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fce20d0-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624747145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747145, "uuid": "75b65e4f-9002-4e52-ab0b-bf14df53d758", "comment": "Malware payload (Mirai)", "value": "3ef12ba61173de935cb1d6fcd2343a35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747145, "uuid": "481f9275-23a3-4cb3-b9d1-f43da82167b8", "comment": "Malware payload (Mirai)", "value": "84d1c6ba4813dfbaf51cc10203ccf729b88f50845781754af732378c72fca8c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747145, "uuid": "848f8c21-bec2-4397-9dbd-259d4a861f59", "comment": "Malware payload (Mirai)", "value": "2636ffd30ba7a79335248b35648ab18905ed28df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747145, "uuid": "851b5e2c-c654-49b8-ab3d-80aabed728b0", "comment": "Malware payload (Mirai)", "value": "798f749e49209cc0423aa57b789ca96668dc765a8e3828b62308b8a67cbad4c9729e7c75213bf929341790c3f26e8e1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747145, "uuid": "b31666a4-94d4-4910-96fd-4bdb42a9f870", "value": "60534BC0B643E9F5DE020674306BEF324E36F6F6211AE987E3E4D673AC425419543A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747145, "uuid": "b734c188-69c3-4cce-916a-6274b04095eb", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKUm+eTWoTnt05XFEiRh:1jSwY4keBfrtOCQsnnF1uTNh0513R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747145, "uuid": "6e1d86e3-f6f8-4a06-9087-3e5a928026fc", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747145, "uuid": "abae5e23-fb95-4baa-820f-76ae1eeb5d86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747145, "uuid": "d5fa61a3-8052-41ce-8ec5-997351569798", "value": "3ef12ba61173de935cb1d6fcd2343a35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07596efc-d6bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624738433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738433, "uuid": "5edbbacb-6158-4b2e-a4ab-370159b3d309", "comment": "Malware payload", "value": "d5e736b14a01bf394c2ae0e657761ee5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738433, "uuid": "8b5b0a85-53bb-4139-9c57-f86f78dbbf4d", "comment": "Malware payload", "value": "8686eb9c1e674f9097ba946ee572192ced57907a0e154c4bced0312a798092a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738433, "uuid": "9971bd9b-5477-4a74-a6ec-b38c0a6d5a45", "comment": "Malware payload", "value": "67db3f60015b7070f8459c0497e7672d9cbcf7b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738433, "uuid": "a73f3d18-f09c-4d73-a6ab-08fff64a76f5", "comment": "Malware payload", "value": "93cb5fd16855197ed1d279dd33d8c92c0e0d87c586ecfcc9d55f2136c6ce23405a5ee574d1964e6e302a9f1d32f68353", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738433, "uuid": "103cb94c-fe2d-43d0-87e6-fd40634d84b7", "value": "08F2D0739198B172DA541831B0E90AC7337D1EFCF4D3621606CC976CB66A067AAFB50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738433, "uuid": "4efb5ec3-8707-472b-bcf9-a6ae40d82624", "value": "768:unhWYMpSp93FZKG0E0hdyS2SNXcp9+5fh/JXWU6CL3UV:unhWYMopoG0E0h92S6p9+dh/JXWUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738433, "uuid": "86037cbc-a797-48eb-b3fa-80227a971202", "value": 36940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738433, "uuid": "902a979d-87c8-48a0-aa2a-3a9bf2e2e6df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738433, "uuid": "6ee312ad-b192-4c00-bdf7-38b104bbf286", "value": "d5e736b14a01bf394c2ae0e657761ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f2609c-d64b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624690723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690723, "uuid": "9d48808d-d75a-4e3e-a367-3c9f6b306068", "comment": "Malware payload", "value": "dd8db8b0f45c6a70a736bc67ab94db15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690723, "uuid": "d2693b5d-4647-4572-9fd9-bca26091920e", "comment": "Malware payload", "value": "88233b71d03b52882c4c89fd6b25410de1c8e278ceb29c110f8a5885dcbe646f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690723, "uuid": "4edeab19-6177-4e30-96cc-454b04a01a08", "comment": "Malware payload", "value": "0789215ac0fa69ae290dd36d25f133addb1a5392", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690723, "uuid": "1208b323-1fd2-4d38-a0d1-d60dd3180741", "comment": "Malware payload", "value": "e244f6aa698f407462725b097b56d57c72b129fa89ba96671b2cbc266e1927596aec56bf6ef5e28842ba941938a4c56b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690723, "uuid": "352bcdca-746d-4e96-b3cc-03ff4c1279e7", "value": "87E0C2BFA8154C05C70003FF655DF5918D80CAB723389A08BC2FC84DF85A0B8DD2AAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690723, "uuid": "6a8baf0a-dc57-46d7-b645-f7c376b4146c", "value": "6:F3OMPQ7goJfeTSBJdbpjQJJGovMRsYFAg3rfdPRBmQmF4OQ:F+9JJdtQNqFPbfEQmF5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624690723, "uuid": "034d15ca-1cc2-4113-9e48-75e0627c9c01", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624690723, "uuid": "5f7a791e-c0f2-4ef1-a22f-4a0b9a8335ef", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690723, "uuid": "dae39ce0-f7ba-49a2-9362-00ef758a9b67", "value": "25-JuneStatement_ID360364829128662.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5b6213-d6c1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624741366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624741366, "uuid": "fb62816f-e4f6-4bc5-b440-b909a60e726c", "comment": "Malware payload", "value": "3596d0e3554649465e54ad8d02c243d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624741366, "uuid": "b1183e80-45a5-4cb1-a6c5-cba83a2f9355", "comment": "Malware payload", "value": "8b509027690f32416d07f1c9bf608cc403e5b653cf87a722341fe5ef580a6a47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624741366, "uuid": "86fd9486-41a7-42de-99cf-4a54fe6fcdd8", "comment": "Malware payload", "value": "d0c49431112153e7e53e1de5c2ccb78ec68fda45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624741366, "uuid": "61c9b434-34c9-4201-bb90-c8f9b8768f7b", "comment": "Malware payload", "value": "35f016318c7f4b710ec01e168b5917581975360d3fd0ecbd964ceaf183393879a11486c928eb1b0bcfc07364a80949d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624741366, "uuid": "4a02a82d-50de-4cb6-a9ff-00c79c8d60a4", "value": "1AD33954F8048B5BC3D277FAE79E429E3F3916A663D733116A389DB41FC27992D28420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624741366, "uuid": "cb26f70f-ac43-4ad0-8870-aa0eeff8adb0", "value": "3072:dh57RtVxkNCqO9TbSvmIArBmBqKRDD6wZcfaoP:XzxkUR9TbSvnBqKRDD6wZcfaoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624741366, "uuid": "fd928ae5-0d3d-4a6c-9871-e8ede6f8e734", "value": 142155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624741366, "uuid": "146171ef-272f-4826-9bbc-7e2043fb5c28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624741366, "uuid": "9e335392-6110-4e63-ac1e-dbf4a558d416", "value": "3596d0e3554649465e54ad8d02c243d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e7e556-d62b-11eb-875b-42010a9c0053", "comment": "Malware payload (Neshta)", "timestamp": 1624676929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624676929, "uuid": "e2e3691b-eea1-41a5-8897-248948a657d3", "comment": "Malware payload (Neshta)", "value": "2eea363c28cc47b3f9675ba121d769ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624676929, "uuid": "7d2137c9-fab7-4a79-97a0-0c8f408ee6c0", "comment": "Malware payload (Neshta)", "value": "8c049b5b08f47e1c87b75e5b16b9bdaf48b3be100b2275dc5e08646b12a86b11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624676929, "uuid": "f0348d20-d18b-428d-ba7e-82938907bf52", "comment": "Malware payload (Neshta)", "value": "a2ac28694063911a1b00979db541f7712ab1563f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624676929, "uuid": "0c53bd3e-cb3f-4386-a957-0e574fa74f07", "comment": "Malware payload (Neshta)", "value": "74f7f51d5e3b602d0c68e63e0cdf5e70b66bc7c83791ff4a2945044da812d984fc764615b4ed3c9b0d5b675b8abedbe9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624676929, "uuid": "f3f89d71-0055-478a-af3b-75eaad854cfc", "value": "4F65A59C361175DFE817CA72AA645CB4EA107CBA470FD203A09726DEA90DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624676929, "uuid": "02e732a6-f8dd-48b2-983b-6c7a98165185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624676929, "uuid": "e9c890e1-84be-436b-aca7-0979c3b83888", "value": "24576:TPj9YIC59jFiBP6ilEXvZyYO0dOq62H5ejSAx:FYpiSi2Zh1nxN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624676929, "uuid": "e0cd10e9-2745-46bb-b2ca-33445a170d01", "value": 1528832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624676929, "uuid": "406e1c97-03ae-4112-81e6-ac5a473c286e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624676929, "uuid": "dd58b3ef-cb66-4735-a7ad-1ff7cccc4592", "value": "2eea363c28cc47b3f9675ba121d769ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a39deb-d64b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624690726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690726, "uuid": "2fd57bfd-909e-4227-bd3e-868f1bfe6f41", "comment": "Malware payload", "value": "126588b562d0fcf1b5911ba25dd13d0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690726, "uuid": "948a5d95-6695-4550-97a3-4105482dbe20", "comment": "Malware payload", "value": "8cdfb5bef464b8c95b7bc58c53735dbae31eff9109e43fe3eba339b0869ec8b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690726, "uuid": "ed43db10-1683-4d57-9f9a-3e439949dc74", "comment": "Malware payload", "value": "05357bea7c5b4eac1d5f1aad1729b0a903c2f87b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690726, "uuid": "62f8c4ba-2582-420f-ba00-b77c94c07873", "comment": "Malware payload", "value": "552d6a64d09a7f6045f212609bdd81d6a05219154cece9a8fd879b9bab16df974814d6aea1d42d679dba467fa6969ccc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690726, "uuid": "35fbcf4f-69aa-45e2-996a-a3381c03125f", "value": "70E086AAC555DE060D41ABAD881A755AD691059C17784C29BC64C84631A90AA98445D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690726, "uuid": "1542dd2a-addb-486c-b0fd-85c41e5ec069", "value": "6:uUMqrUuQA4GJ41FoyuhmcEvsovVJ3JLr1LgLlNoLMfrdV8g1Fo/:uUrwuQ3WQoyu0hVJMhNWsb8Io/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624690726, "uuid": "131619fd-3061-42f1-9aa7-d9a79577fce6", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624690726, "uuid": "8972a876-34e2-4da6-804a-2018f2c132a6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690726, "uuid": "f8b2e0f9-ccef-4df0-a298-418362a6d747", "value": "25-JuneStatement_ID1360364829128662.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a413e7e9-d6d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747715, "uuid": "600634d9-a0e7-4930-819e-c55ae7ae9587", "comment": "Malware payload", "value": "33cd21d43e8a902f55b5cf399923c93b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747715, "uuid": "737793b6-d0f6-4d18-85c1-0307a0168444", "comment": "Malware payload", "value": "8d5cbb64a12967d1478126f91e182ed60067085fa9fa15e54032cf2314517a73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747715, "uuid": "2d917e4d-0396-444c-955c-44708e371b5e", "comment": "Malware payload", "value": "6f47a59e082d726a67317faf302507fa9b479974", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747715, "uuid": "fd12bd86-b370-4e0c-a981-b25b04d3cb5b", "comment": "Malware payload", "value": "1d8aa06be3ba55c8b49031d0496bdcb1b56a82d9fae2955c957210f16bec605c8960833c80b58251f9412109198854f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747715, "uuid": "5da5c0cd-4339-46fe-aa8b-57a836d785fa", "value": "1BC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747715, "uuid": "46e164c2-e4a6-4bc5-9480-4ff8d789048b", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeBEdWfRZrmW+IFj:Ted0W0MZQHNd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747715, "uuid": "4b72b5d8-74be-4935-8460-9f4719994114", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747715, "uuid": "e66e00f4-f8ee-4699-8676-1372eac6d424", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747715, "uuid": "8304b770-5bbf-420f-8469-317f8a058149", "value": "33cd21d43e8a902f55b5cf399923c93b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6170a68f-d623-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624673301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673301, "uuid": "b685dfa8-1fd3-4b16-ad7c-0c4544075e29", "comment": "Malware payload (Glupteba)", "value": "398f539621f2e14c194e5980899fecb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673301, "uuid": "59cabdb9-d5cc-452f-8105-acd9f2f4ffa8", "comment": "Malware payload (Glupteba)", "value": "8e0ee387d0c15f1025517b335dce057306e1278ee77a338e0800018226ba2433", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673301, "uuid": "9bc0bc66-f5c8-4646-8cfc-9f3bd4da6fc7", "comment": "Malware payload (Glupteba)", "value": "ea1508bc5632d93db828a7014c3fa2d64e03cf58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673301, "uuid": "f574ec3e-41f9-4b49-b870-d9ef196d1b8d", "comment": "Malware payload (Glupteba)", "value": "a3cf862c59d3e64630723cdc4cdb3f1a893bb5fd163773d1771e33463f2fae5edc4a163e86f6e26f95cf61e40fd2525e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673301, "uuid": "1b484480-dab2-41e8-a79b-9a031bfec849", "value": "A7263300A1B0C475E9B702F4D66AD3E9592CB9B45F3044CB23E9DAEE8E352E1DD31267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673301, "uuid": "10666d56-e52d-4bff-b966-44310e56ecd3", "value": "ed5488bcbdcd1d385e7d9b63bac8f551", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673301, "uuid": "20dff8f1-2389-4099-8173-ed5543d041c6", "value": "98304:3maapWFc7INkuS5dLWNZhfVN3g+qxRPQyUmE/8F8:WaapWG7FldLWNZLN3ARQyUmEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624673301, "uuid": "b1b6e9b4-1f8c-44a5-94ee-37555823a8b7", "value": 4750376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624673301, "uuid": "bd3dafb8-390e-4d04-bfdc-29cbc34d58de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673301, "uuid": "ddecc7bb-1f94-4a59-a2cf-5420407a803c", "value": "398f539621f2e14c194e5980899fecb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7c455a-d64d-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624691497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691497, "uuid": "c8ff8f45-bf12-4a17-8a02-c6dad8a3b6d9", "comment": "Malware payload (ArkeiStealer)", "value": "2d25b8d4c346cf9907738d76fdfbbfb2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691497, "uuid": "41a65da9-bc87-40cb-9e42-9f8aa7a50c1c", "comment": "Malware payload (ArkeiStealer)", "value": "8f1ec2b723ec84f616415cf2470ee78ccaf8ea429f3d1f25b82709502366028b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691497, "uuid": "ea6f3139-7d50-462f-8841-f491afde3c62", "comment": "Malware payload (ArkeiStealer)", "value": "cc6bdd720b9f743dd943aa4188ddcdf27867530f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691497, "uuid": "8e6803e6-9c16-4932-b965-21764d352e68", "comment": "Malware payload (ArkeiStealer)", "value": "e9b39219a9daaa88c5bbdf14b5ba4a7a793c2ab98f009824f95121ccb7616754818f38cc6b5d3c650b0a87734af3dbbd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691497, "uuid": "2836ac4a-c397-4c87-bbd3-b6f7a9096e8c", "value": "7BE4E010AAA2C031F9B312F859BAD27D643E7EB1672450CB12D5EAEE16346E5EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691497, "uuid": "a44c4828-db29-412a-a029-d28ceacec4e6", "value": "bf720d2682cb81fe4c5a725cf3097898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691497, "uuid": "633095c7-8369-4f7d-b3c2-4b6a64310106", "value": "12288:csOnA8Ts/Ys1C6Yck0QD5W2UwreBJKNQpjZUZ+WH0VMu6UJFvegKdW+/euL+U:csOfBYlQ02UwrezKojZMYlvegKhRL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691497, "uuid": "7497274f-b59f-4fee-bc8f-468ad3e2b1b0", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691497, "uuid": "7ba692ad-300d-45dc-a331-ff23109497b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691497, "uuid": "9ea2a66b-28ed-4d31-a413-e61ef33a3a08", "value": "2d25b8d4c346cf9907738d76fdfbbfb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a789744e-d6bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624738702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738702, "uuid": "7a561bea-46a6-4658-bc1b-48dd0d993a47", "comment": "Malware payload", "value": "a45fb6c5145359de912c5f4d00248405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738702, "uuid": "b9507220-d123-497c-aab6-993d81398612", "comment": "Malware payload", "value": "90b405aabf9274027fbdca37ddfcd4b289e1452148990547b32a9e794f832e51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738702, "uuid": "8f2812dc-7ccf-486e-b6ad-73285cdb3cea", "comment": "Malware payload", "value": "29cca0a55627f4815c33e90fce0320fcab5ffc4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738702, "uuid": "2a2a62ca-f0f4-4136-b756-75d59674b8ab", "comment": "Malware payload", "value": "d43841fa8c8774aec23d37ecdcc8bbdf47b90fdda26fe65b3340cd3acf06561c890b6b8425f7144363cd27a1fb9c0f6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738702, "uuid": "0ec79142-99fe-4e7e-8906-01a6cfb21261", "value": "415302899605ACB0E2328D3BE66E561EB9A94F7175DE37E25F109368F0C119F6F0101D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738702, "uuid": "16c9a66c-5527-4ef0-b45c-b42653de9481", "value": "1536:xbkdML2gpfq1emDrtZQ8oHuxJlhASc3k65:xPigvpY2Xk65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738702, "uuid": "862fc546-5764-4fa9-b74f-81f7c6780ea8", "value": 62992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738702, "uuid": "401641ac-4e0d-4aaf-a755-43cb0b9e7656", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738702, "uuid": "1db04ce4-75b3-4be7-9d0b-c2564cd4cf67", "value": "a45fb6c5145359de912c5f4d00248405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8f4be2-d6a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624729553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729553, "uuid": "d4ae2eea-a412-486c-89a8-6899a6c3446c", "comment": "Malware payload (Loki)", "value": "26bfc28fc87d83b2c2e93f0c89448f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729553, "uuid": "574d5eab-79b5-468d-b4e2-aae4e71c1995", "comment": "Malware payload (Loki)", "value": "91f80e04b9ada0577f0100bc45062f87be35b1f2b7096986ca2e5137be311fd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729553, "uuid": "64aa4c17-cbd3-40c9-a312-8be80357e731", "comment": "Malware payload (Loki)", "value": "0fb8a5b8aa02887f58ea1860fb919b1849160864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624729553, "uuid": "bc92e761-4d2b-4432-a801-69a169a505ff", "comment": "Malware payload (Loki)", "value": "1d984f011e7203a6c2778d074a16036b4e08e681603f59c935bab7187eb32b0434f0c810d6fa0b47425fdda8af385564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729553, "uuid": "c15fe529-b34f-4cd6-9a90-cc6aa28f20e1", "value": "E2058F160ECF422EE2758E7657B0EC47C3766EA62A05B2112EC032EDC9375DADCEE511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729553, "uuid": "82660bf6-58a1-48c7-9ac0-80d578318acc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729553, "uuid": "70436979-d315-4422-b53e-5b872385edcb", "value": "12288:qYGWFHmKuSMPQipP5Gls9LpnKxmtIq+oRTFJ8I5t0RU9TXQAtz:rHRRipIcnKUtIq+UTfBTYgMAtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624729553, "uuid": "174289f2-1df7-47dd-a3a4-a35b305f9f8e", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624729553, "uuid": "ca1ef79e-4548-43df-815d-5a08697687cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624729553, "uuid": "3fe5b653-a948-407a-bf53-e21e5acbc0f9", "value": "26bfc28fc87d83b2c2e93f0c89448f93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664a34e3-d618-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624668584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624668584, "uuid": "0d49a0ed-4f22-438f-b324-7428c4914193", "comment": "Malware payload (AgentTesla)", "value": "0137cb7005089d7eef88f7057ee64943", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624668584, "uuid": "d6a4f3cb-a3cc-4f88-b364-bafb4db1c0e0", "comment": "Malware payload (AgentTesla)", "value": "95706dd9738a31636416e21a724ab85a58bc96ae801b782ea363da3a13e97701", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624668584, "uuid": "edc2c0b2-3672-46a0-a2d2-3a4000aea766", "comment": "Malware payload (AgentTesla)", "value": "ac02735ed0f62d124dcb1dbafc54e0eb5c12d4d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624668584, "uuid": "9e23ba8d-0ac2-49d4-96f7-4579744e3dd2", "comment": "Malware payload (AgentTesla)", "value": "1701ba3709347e633ab5a5d2d29e4a2baa03359c917fd7c3bcedc3b7b1eb9315c4348454e66a3f22b1cad65122589d13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624668584, "uuid": "a2df3624-76f5-45c6-94ac-9cb360bccdb4", "value": "76A49EBC36A435AEC86BDABA9AA43DA4EA617177131B9107401311CD9E0DBC7CF215F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624668584, "uuid": "b538c978-b774-4a1d-910b-a3b0593791dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624668584, "uuid": "32333393-ef4a-4b8c-899b-e71d6cfa0025", "value": "12288:zYAE3xEkgXatOETpstTwMT8Zri3n++9OkcrokF85PCaPYw4tAssSMu90pQ5AKNsz:QEksa4Eid4Z5+z0mYwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624668584, "uuid": "fcac960c-949f-4e2d-ac9a-345ab0b0352d", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624668584, "uuid": "71294b6d-4754-45ea-9794-5edd71a64e04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624668584, "uuid": "3720c1f4-a0c3-4f3d-8e25-88a3cdf029ca", "value": "0137cb7005089d7eef88f7057ee64943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d61c669-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624691870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691870, "uuid": "3f205852-6eaf-4f34-b177-144c318831be", "comment": "Malware payload (Loki)", "value": "7f82d1ed48825e5cd8a71376a289172f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691870, "uuid": "a762df6a-1827-4929-ad0d-6adf20f8774e", "comment": "Malware payload (Loki)", "value": "95b28e800ba3db113b766df762c9cbfe45200f2a4078aac8ec9f56eceedf490e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691870, "uuid": "a9ef6d52-f2b2-488a-81b3-1312be321863", "comment": "Malware payload (Loki)", "value": "a4a4023ac96033ab0ee527a2b86aa5e43b39070f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691870, "uuid": "dd870de4-65c4-4ba9-9aa4-e2fcae489043", "comment": "Malware payload (Loki)", "value": "d670e313acfe42d934b01efad91dd06606abc729758c8ac16344dba0b7380bc1bde8f1828133f59746d1caf7cba5dcde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691870, "uuid": "30f67eac-eecd-476b-9539-11426d8abd59", "value": "FC749D00A6A1C035FAF312F89975936C953E7EB15B3440CB52E5EAEE1A346E1EC31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691870, "uuid": "5f92f33f-a4da-47dd-ad88-2ffa6640bf44", "value": "5467269905ab1e926b10a1155c1e4f19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691870, "uuid": "26b88bca-e0f1-4cd8-96ad-47b019afe59f", "value": "6144:kj3JYjrjunovQnLxN/pJjuh89774jCp4LZfb5mfaUk:gJWjunoonX/p4h8934kCEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691870, "uuid": "896a56bd-4e51-4a2d-9945-e18b7f39b52f", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691870, "uuid": "c6234c87-3eee-490d-bcac-fc7b7899d975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691870, "uuid": "d931e08b-10de-441d-a84a-f7a84bf6ea34", "value": "7f82d1ed48825e5cd8a71376a289172f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4753d0ce-d663-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624700745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700745, "uuid": "62fa8327-0004-4067-9e59-3480fa84918d", "comment": "Malware payload", "value": "750a876f72adba0240b63f6fa75ac0f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700745, "uuid": "e9a677a8-4bd2-4c78-8051-e680e7ccc250", "comment": "Malware payload", "value": "96aa98acfc7b20f08b3fad53f7e3c7ce3d8463d3376e1cc76949b20aa265c403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700745, "uuid": "d15207f9-75d5-4df3-8c53-cc1625a06377", "comment": "Malware payload", "value": "74a5f3a65a549d84b50ef6226cf6755db9591e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700745, "uuid": "f4889feb-74e7-4e1a-922a-409829d758dd", "comment": "Malware payload", "value": "5e60f977aa82bd94e2c8a2202fdf3b5ecfed5c5151ac53fe4fed7cf1e8f29ce96f717bcce13ad2a534cc98fe4d038d95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700745, "uuid": "3d4273c7-c562-4057-b544-16f18b2b90bf", "value": "38578D90F8AF64F9FFC2553064676A2F273066059325DEC7C6049EB3E867AD20B33166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700745, "uuid": "afd2fd10-8978-41f5-99db-96e42944aabf", "value": "4d028340f95202ab4f8ed495dd117513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700745, "uuid": "1d01f295-66aa-4c0e-b9b4-b4c9bd154895", "value": "393216:pl+EovKB0dBJoH5SWhggYfZwco92ORO5pvxQ:ps1ddBJ/SY9OYrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624700745, "uuid": "adccc0ea-3250-4d17-a0a3-2629185a991e", "value": 27512832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624700745, "uuid": "b36f63fa-45ef-42b1-9152-0dd2a1dae272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700745, "uuid": "70a33128-83ba-4e72-a054-3de1e6b05588", "value": "750a876f72adba0240b63f6fa75ac0f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4c2073-d686-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624715757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624715757, "uuid": "5f3da67b-2a9d-46cb-8a93-075b8ea65eee", "comment": "Malware payload (RedLineStealer)", "value": "dc86e6b47b6cafd7e3fe119562ecc459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624715757, "uuid": "10eece1e-72b7-4824-a2e6-b8658085829a", "comment": "Malware payload (RedLineStealer)", "value": "97684c32074833dcd6f52e6dcdda9287e62a9b0f240806db4a7cd4c503976f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624715757, "uuid": "c2042f50-ae9d-4c3f-a329-979d9aed3048", "comment": "Malware payload (RedLineStealer)", "value": "16446c65547cb9e2b549a64d524fb7eb04b4d79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624715757, "uuid": "ba1cfb39-cc84-412d-ad58-39d714abb5c9", "comment": "Malware payload (RedLineStealer)", "value": "3e93e0928a9295b20c303ccdfb55b0054da9987f7d6004dc3506b1514c89a8afd9a93766c77efcf975b0a8055750e93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624715757, "uuid": "1cfb175a-38e8-492b-a895-ace2398cda6f", "value": "3BF533443C7A6697E0638BFD2A75A9D699F5E903BEF443A0639204815EB301BD071BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624715757, "uuid": "2d31715d-8673-4672-a07d-1db493ecd53f", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624715757, "uuid": "7a968817-243a-4330-8583-fcd564cb705d", "value": "98304:JLUqeOgef2fJDpG8+KGWtwYeYSZQ1HDfIdl1IlazvSF0zm:JJBgcuHqYX/yBUOv0sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624715757, "uuid": "3ca2887c-8f6d-48ac-a819-1eff04d4c931", "value": 3489143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624715757, "uuid": "edbb6c4f-5af9-4282-b393-231998542e3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624715757, "uuid": "d13ff97b-7bfd-413c-b8b7-23ad6d990336", "value": "16446c65547cb9e2b549a64d524fb7eb04b4d79e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce561ca-d628-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675387, "uuid": "b89cb88a-9a0a-41a8-94b2-e8db7d978a90", "comment": "Malware payload (Gafgyt)", "value": "d832b87f0187b7c7b8b51b686825236b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675387, "uuid": "769a2f01-158a-4c43-a33f-4e33bcd5fa07", "comment": "Malware payload (Gafgyt)", "value": "97a0490d820b332d8c621a61cafb7e9d01cfada03b9181049fdec4010561013f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675387, "uuid": "0082c0bc-e54a-48ed-ba4a-7d20ab149bc2", "comment": "Malware payload (Gafgyt)", "value": "dcfe9ef499dd30a5b0f40f7c6848370bbecf221e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675387, "uuid": "41d670f6-acb8-49d0-bff4-0670b786b973", "comment": "Malware payload (Gafgyt)", "value": "5a1eca48ddb6352e92c369b93185b7a79f1ca0ab1d935e5bfae0202fc6e683a664135270f332831f93b9d0cbe871728b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675387, "uuid": "67395cf5-1056-414e-b9a7-cacaa26cf1fc", "value": "17E3E83777230A37C1C6043115E31731BE65D7DB34BA93C7BAA05EA86F1A9843456BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675387, "uuid": "a1b1afdf-e28b-4781-bed2-de9553a43bc5", "value": "3072:RgNeZz4evwoPTRpEZblq0qDWmz/9kl74YTcL/NO:2wz4b4oZBqDWmz/9kl8YTcL/NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675387, "uuid": "bf4297f3-f406-40e5-845b-e3c4c2a00319", "value": 143067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675387, "uuid": "252f99c3-c527-4be0-9769-028c0775ec15", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675387, "uuid": "0287e0f9-3bb6-41e7-b1c2-097be6da3dc9", "value": "d832b87f0187b7c7b8b51b686825236b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ef18cc-d6bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624738426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738426, "uuid": "902e42f4-72fa-49c2-8f9a-a075ab0985e6", "comment": "Malware payload", "value": "5b9b7e844709c1f8e868d0dca2dde77b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738426, "uuid": "b5fa064a-a180-4cb2-8c99-8cf859eac17a", "comment": "Malware payload", "value": "98338a492a6a5e416e67f573237a392c40db151378c45d1572f77a1324c066ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738426, "uuid": "2248cbe6-b727-4c8b-834d-94fefd40810c", "comment": "Malware payload", "value": "4d8fd42b77d7d87b58a2ed433f1aa1c61856d2e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738426, "uuid": "0046d805-d821-42f6-96e8-63e22e74158a", "comment": "Malware payload", "value": "b317ef58fa478efafe446b655b59106f68ebbb166beb7ecbb670d33e41bbac15148aa8e850dbddeacdb0c00acfb10075", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738426, "uuid": "c8f85eae-2413-43e1-8431-0fcd783db63f", "value": "4A03E11DE0B00DC5CD7C9A36516D2B32EF64688C328FC3DDA351E599D0AAE07B54F1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738426, "uuid": "b52517e2-6f66-4204-86aa-f5e89997ff85", "value": "768:qu+dhF07mTlV27W63RxxMB7PNXU/d4ZrGMhVchbAjiz007IT2WRk:q1jZlV2lBAd9KurDchsjig0cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738426, "uuid": "fe676010-21d9-4baa-865d-357c4b64adca", "value": 39580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738426, "uuid": "816f3e39-a3f8-489f-9d34-4f19b5793d41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738426, "uuid": "843e3fab-6cea-4004-a843-5acb3dc8e09f", "value": "5b9b7e844709c1f8e868d0dca2dde77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad31ca1-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624691785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691785, "uuid": "6357cc0e-7d15-40ae-ba1e-e65c7b8f8ed5", "comment": "Malware payload (Smoke Loader)", "value": "44da3ea381b7c499288c8af03cb2f273", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691785, "uuid": "1fd69c52-5a6d-4d8b-8207-de599783fdd7", "comment": "Malware payload (Smoke Loader)", "value": "9a6df8254125afdaf645dd3e76100f3ed825f2a4e18b39ac8a5c5f8e0cfb56ef", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691785, "uuid": "aaac4d71-8c60-41db-8f91-5a2b6f43ef99", "comment": "Malware payload (Smoke Loader)", "value": "de79f31cf5f64084f5f5d21bcc05784e51be855a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691785, "uuid": "51029717-9a0f-42c9-83a9-09808b0a92d2", "comment": "Malware payload (Smoke Loader)", "value": "c75119831c6df095715559c666e3bbdcae85168f83a3233d88577ca1c5f005d6903e8c5e17c8e59e8e39158d67acb4ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691785, "uuid": "7931690a-ddd1-4e13-9796-adb21307b157", "value": "83748D00BAA1C035F7B312F88976936C953E7DB15B6480CB52E5EAEE5A346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691785, "uuid": "9016d637-f933-4faa-b22c-03d225b6d9f6", "value": "5623df6c548fad12f71d235627729e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691785, "uuid": "229bca69-d2e3-4e91-8cb5-243151b50f6a", "value": "6144:fhDUdhfAm+f0KqGQXZDj1GMTZtxcpXM05IadZeLR5GkM:FUdhfAm++LXZDcMdtxaXM3q6RcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691785, "uuid": "98b631be-8a57-4654-9872-1a700d73aa11", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691785, "uuid": "9e1359ad-a938-49ef-b24d-126ae27162fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691785, "uuid": "6476af50-9d9a-48fd-ba32-eae5ef799a80", "value": "44da3ea381b7c499288c8af03cb2f273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e687faaa-d6ab-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1624731936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624731936, "uuid": "50c45f65-13fa-42d0-a632-5fedbac4cca6", "comment": "Malware payload (LimeRAT)", "value": "509746077f282a14944abebe4beace97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624731936, "uuid": "eae86858-9d97-4221-a9eb-a4fda758e06d", "comment": "Malware payload (LimeRAT)", "value": "9a7301af530c1cea87de6bc6a1c788abffd2b2e5a548886052cf7004a98c2ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624731936, "uuid": "142c2c34-a296-4d68-8a8e-e2bc430ef5cd", "comment": "Malware payload (LimeRAT)", "value": "dd79caca39633ccffe55e80c67310b001ab37b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624731936, "uuid": "27caee5c-f70a-4770-8c6c-02bc2df318b8", "comment": "Malware payload (LimeRAT)", "value": "4a457b3bff952053dd1fec253cfff2d7951cfe41569b54256d573f2584d67f399081de948f34aa20c0449777a172697c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624731936, "uuid": "95c1b6b9-67ae-47c1-8b83-cb33e85c8679", "value": "5F058E242DA85225F1FA9F7D8AA0D06157ADFE136F03C86D78F42AC72772543C5F122A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624731936, "uuid": "7e1f1d66-9791-4af6-b262-a4ed33ef607c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624731936, "uuid": "e6b8c04e-c8a0-41e6-831c-78cd87b73822", "value": "12288:e2F/Dowuo370zQXeRaAuyZazX4skIK2P5WilhJPYa9E/AgHvb7K00:e2xXeRaAusQ7Kc5Wi7JPYa+/jPvK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624731936, "uuid": "71dfd435-03d8-417f-9f9b-0c23ba8ad428", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624731936, "uuid": "fe69080c-4b44-4465-921e-3047fe370f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624731936, "uuid": "447634bf-eff8-4b1d-9808-57a4ebcc0e87", "value": "509746077f282a14944abebe4beace97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68365d80-d68a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624717550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624717550, "uuid": "a4c8e4fa-efbf-455d-a77c-f9069a72ce94", "comment": "Malware payload (NanoCore)", "value": "df7f94a2f724f8ce6538cc6aac7c1835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624717550, "uuid": "de11c85f-03e1-4f53-89b6-39ce4d78b26e", "comment": "Malware payload (NanoCore)", "value": "9b93bc63e8686b6ede762911a687c646fbb3a7a4830c057d96acd623ca18d38b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624717550, "uuid": "5bc0d46b-df78-4873-9649-daf6effe59b3", "comment": "Malware payload (NanoCore)", "value": "1079533efa7a09b25123227be1c515ede3790477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624717550, "uuid": "cbc47f03-726d-4cf1-8bd8-8513fff300d6", "comment": "Malware payload (NanoCore)", "value": "1410b8b824800d0c8655bf376c5c09af2b957b64dc03af7f4183b9321eebe018432bd779e46d57eb3ec9caa8faa9ae16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624717550, "uuid": "199c42af-577d-47e4-9326-7d8f5a288b39", "value": "CC14CF2A7BB84A2FE2DE8679712211578378C2E398C3F3DE18C465B29F567E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624717550, "uuid": "59a55573-2793-4822-aaa0-6940fa99ad53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624717550, "uuid": "ac74cce4-9060-43fe-ab05-a7bbd1096bbe", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI5vfdBFvBeiDYI343auG3UBUsj:wLV6Bta6dtJmakIM5odBFvgiDUEszp9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624717550, "uuid": "70f32010-d967-43cc-8c42-3fdc22e975b7", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624717550, "uuid": "44b9890e-3680-4b60-bc91-d229986da827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624717550, "uuid": "f1d1e5df-aca3-4e65-b0a4-a8fdd4881395", "value": "9B93BC63E8686B6EDE762911A687C646FBB3A7A4830C0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873239ee-d627-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675082, "uuid": "50ddc01b-7cbe-452b-848c-2dabd4bb636c", "comment": "Malware payload (Gafgyt)", "value": "17d4f41032673fda5233bf7a1a5c31b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675082, "uuid": "3bd64e2c-901c-43e6-8a37-1b307d28f1cc", "comment": "Malware payload (Gafgyt)", "value": "9ba75052a94db4d24e5e7bfd7e584824a010408e8f167999d3125d210f67737a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675082, "uuid": "2565e2b9-a568-4d37-b1a5-6d9721ddceda", "comment": "Malware payload (Gafgyt)", "value": "c6eea78a16e72f22b7867ea6eee7a71e6201ed13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675082, "uuid": "19921be0-96cf-4f50-94c8-0a83f629f139", "comment": "Malware payload (Gafgyt)", "value": "998e0ce49bd90d26ffc27ea9d836c92bf7dddb5a5e3a490b900dc3df63238a5a8cf34bf76c8833b07e622cf20de1938d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675082, "uuid": "9077188b-3db3-4aaa-a2bb-540dddc1d3bf", "value": "C3C3F8B6B401DEF6F00B9A3904D7AA107E70ABEB4F575166B32739769D3A1C53823E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675082, "uuid": "6d756381-82b2-4b40-bc6c-569162dddf91", "value": "3072:wSzlWf/Zk1T3/aObiw+zyIWSDQcA2Hmz/90lxwYTct8NO:wSK/21T3/aVZyIbcumz/90l2YTct8NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675082, "uuid": "b85e3b4f-e016-47d5-8e2e-a3ed7d2e470e", "value": 125314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675082, "uuid": "eb3403d8-4535-4fcc-888f-8fd13d5c3893", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675082, "uuid": "c27d1021-bdb1-4a3f-9a0f-38cb6073da13", "value": "17d4f41032673fda5233bf7a1a5c31b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dc46aa-d64f-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624692063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692063, "uuid": "51c90f36-a259-4348-8230-0228621e9de4", "comment": "Malware payload (ArkeiStealer)", "value": "102b84edd5b6cd471bf85d46740965c5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692063, "uuid": "69997896-819b-42b0-854b-484708e2df32", "comment": "Malware payload (ArkeiStealer)", "value": "9c539f0ca8a0b221b8239b1cb06e3eee431a72175b6360f518394ffc2ffaa939", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692063, "uuid": "9f9403a1-0a90-49f8-b909-2382e1ec2dce", "comment": "Malware payload (ArkeiStealer)", "value": "0dc0642762dcc741798ea23e36a0c172b43fe4cf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692063, "uuid": "228edec5-ea65-4aec-a707-a652a2e34e49", "comment": "Malware payload (ArkeiStealer)", "value": "9a0f0b3e02eaf30ea0da296542671270a17ab9b9026508316e7d1f35f9ac5c94fa8b3c3c359982756cc7facb13b88027", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692063, "uuid": "66cbec47-0d37-4ae9-bf39-aeb17c012141", "value": "4BE4E010A792C435F9F312F4A5BAD268693ABDA0AB7050CB53D5EBEE16346E1DC30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692063, "uuid": "3bd6573f-ae5c-46fc-918b-a15830a8887b", "value": "5387efa108146c925b39d07106b3a7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692063, "uuid": "eb98f681-d7b9-4d6f-abd4-404f9787cd0c", "value": "12288:b23pG/J0kPD6Zz6BgEC7bfCn9XJ6tI2iGEAhY0Z81hn1hpw:yZG/uCgEwb6Hwj5EAhYmIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624692063, "uuid": "c006dc26-f961-486f-bbac-7b408f3b11a0", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624692063, "uuid": "3ba66b1c-a9ca-46a4-bb47-45fdabdd5c4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692063, "uuid": "c8708ea7-04a9-47c1-ad49-63f8ec9d3db5", "value": "102b84edd5b6cd471bf85d46740965c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af226727-d64b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624690611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690611, "uuid": "1f6ab609-b4af-4d30-a5bf-e3a297c7dc22", "comment": "Malware payload (Formbook)", "value": "dd15e0b20f3f5bbec923841838d677c9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690611, "uuid": "2c742a14-95a6-480f-8945-76f55e8cb8b1", "comment": "Malware payload (Formbook)", "value": "9d077cd76795269075d579dd88addee88b7f4ff55b4b80b575a93d3b320d4f33", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690611, "uuid": "b57e0355-d189-403f-8896-1c0e26813226", "comment": "Malware payload (Formbook)", "value": "7079de6d18814c363b7c17cf66d1d5bb3ab42295", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690611, "uuid": "faeb7950-f103-4eeb-a7ad-bfc837a8e112", "comment": "Malware payload (Formbook)", "value": "9b9d6c94b587fd403ac33e612ce8b7453ae1508f6e5450bcf051ccd4866606cfa75954ac4136c99136fc8b51dc196a5f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690611, "uuid": "ac8d8a19-9814-4d5c-a0b0-7b5c85f628f7", "value": "CF451273AE4E1A81C3AFEE320715ACF724DCED74A3B683015E3C32A59BB43681593955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690611, "uuid": "f7b87ac8-6e64-498f-aeb7-20bb32412335", "value": "24576:ENNfxbu/fqv+hPA72mcdPNVdvit5eAJmWZR8Q8VvsiBY:QNyfzUsDi5BJr87vsiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624690611, "uuid": "8fea418c-4b8f-4fc2-b40f-6fffa293b269", "value": 1187704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624690611, "uuid": "5063b617-54b0-4135-a920-db57eed2178f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690611, "uuid": "682928d8-98ee-44c5-b7a1-b077b63dd467", "value": "Quotation_Request_for_Customer.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562a6d24-d64f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624692180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692180, "uuid": "7f098c51-810b-4459-9a45-2e45a110277f", "comment": "Malware payload (AgentTesla)", "value": "a593ab7fc23709506fd7485a4684f3e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692180, "uuid": "2f9f1a49-aaa2-437f-98c5-8ce6f2233f4a", "comment": "Malware payload (AgentTesla)", "value": "9f2ac60f8370f645f50a08dc1c87c0c6964013c586138942bf457682f1d6eaef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692180, "uuid": "098fb053-24f5-447a-9610-6e51fe30ff74", "comment": "Malware payload (AgentTesla)", "value": "ef2951822d82768c366caa4f6b2c657e18725045", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624692180, "uuid": "15aed411-2ede-44f6-b56c-97555e102f04", "comment": "Malware payload (AgentTesla)", "value": "94942f2d95426be97cdaa4e5c27cd1c36a14ea2ee5e04293861d6dc9212f7a488e98f497045e51f4f82cf4ae712075ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692180, "uuid": "344f9aa4-773b-4ac9-aeb0-b9cbef63d1b9", "value": "99D5C00ABED669A8C59C8E31D2A7459C43F4552BB3B2F79F25C617E1DE0021B2E0F0D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692180, "uuid": "12a8b87d-9e65-4f88-9fe0-7638c8c6c2c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692180, "uuid": "9fd1cabe-6881-43bc-ad3f-aa947233d7da", "value": "49152:KrxjTzUzdsUpaf9HbF9Mfbf2Y96y22WT:KrxYOUs/Mfbf2q6f2WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624692180, "uuid": "a0bfede3-9f4f-46a9-8ef0-174130134e7f", "value": 2907648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624692180, "uuid": "6a796efe-4dc9-4c0a-91b6-bf5c7893252f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624692180, "uuid": "5b5e5248-d11e-4bbf-9a0d-d123f7f98f3f", "value": "a593ab7fc23709506fd7485a4684f3e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07c521c-d64b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624690721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690721, "uuid": "ec9b8073-7204-4731-8e9f-44e508c9fd82", "comment": "Malware payload", "value": "a247760de369af0d6471acf6936c686f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690721, "uuid": "5f7770eb-d3e6-4990-aafa-a044d09da137", "comment": "Malware payload", "value": "9f2dc13eca046330aa236336bb05e2a3c12623243afb6d307fd5be87b8bc0654", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690721, "uuid": "f3b63bc3-f745-40ec-b28b-e152fa51e1e4", "comment": "Malware payload", "value": "aa42ec52e5d9b446d3e81eea6cd2d5c58825f630", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690721, "uuid": "f5f8b770-baf9-4023-aabf-5e58bc0130fe", "comment": "Malware payload", "value": "fa331f3901bf47a43172a2f5cdaababdcd103b3488adf1440215eaac1aed47dd30b1612b8381db0b40b4c7bf004053e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690721, "uuid": "12d52ec9-ff07-4fa9-a9a1-c545763d46cb", "value": "A8E0EB4FE8F7BC146B0B230DC14FA682C8E043E4363A803BBC40CD90782643838042E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690721, "uuid": "0060194f-9ec1-49be-a1b5-7188ba435125", "value": "6:4aMqiPh9+uQKdgLHAJvfPuuzOoodDFovLPtN+lwdD4+sQ:J9c9OKdgLHwv7CovRN+lED4+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624690721, "uuid": "b7418a69-45de-4677-9688-aa3358939dc9", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624690721, "uuid": "dc3291bb-70c6-4629-8099-1585cb76148f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690721, "uuid": "4ed5cbde-0256-49c4-a7dd-3a1331569f16", "value": "25-JuneStatement_ID260364829128662.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00c2aab-d6d1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624748219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624748219, "uuid": "b01a1936-d1b8-49dc-af9d-2eadde8857b2", "comment": "Malware payload", "value": "b02a66eafdf9c0e4a3391a2e8bf91a61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624748219, "uuid": "a6c53266-1a8e-4e01-b42e-682cafbf13b4", "comment": "Malware payload", "value": "9f9d5ea3f8d53a4573a99c17fcca0b7410e38b5478e12edae07594a122538394", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624748219, "uuid": "05c8157f-1db9-4ffc-b230-c3b88148ae2b", "comment": "Malware payload", "value": "ae5b49ea9c7a04b9d4f09f5bc805d11d642d232f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624748219, "uuid": "d9e28d66-0717-46de-b944-ab14cf69b38b", "comment": "Malware payload", "value": "49f91a1b5ddf1d2f227060c2afd29bb062da432dad14cb084a669395a08781592beef5fd4bf07bb79f1782a39635b979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624748219, "uuid": "f9ee4488-d6dc-440e-9959-ee64761e3874", "value": "B5735B32B9752A27C1D1A43E11F74B50B6E117CE3AE8C61E7E720E5EFF246506012EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624748219, "uuid": "3bbbdd34-7011-433b-8c6b-09161b40a6d3", "value": "768:DYaoeBr9Xvoapq9/BnjjgtLsAS0TIDpw9VZLm2EBG1pSGiLO+7+MvhDFvC:EaLBr9XvoapS/BnjjglsMTqQEUyfBvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624748219, "uuid": "da8eda6f-a684-41d5-bd02-32df1d2dd9b7", "value": 76168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624748219, "uuid": "1904c124-0ee7-470e-a134-a45b64d9501a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624748219, "uuid": "6c42d665-fc69-4385-bd35-af9058cd2390", "value": "b02a66eafdf9c0e4a3391a2e8bf91a61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49876c6-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747421, "uuid": "706b68a2-3565-473c-8ac0-48ee25afcf1f", "comment": "Malware payload", "value": "3fb8cb7d6d77bb2d28aca7d59bc7e182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747421, "uuid": "c2dd5f62-222b-4bfd-8403-4dd486dfb64d", "comment": "Malware payload", "value": "a07c7be8f5420a94cfd67f79badf27161883f772ea20dcae026be5e8b19639f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747421, "uuid": "8d88c6f0-8c3b-455c-9eb6-fea2a867a8a4", "comment": "Malware payload", "value": "948c04f9b71ce8407ccd61a65d22a9b373f95f90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747421, "uuid": "bc3f5ee0-7e77-45b9-95b1-9fbe4ff87567", "comment": "Malware payload", "value": "87ebe761b5bd0da568ea5cebaf038f109f4d6567c32d235a074c5d8b1b0d0638fa73b48e747d40e139a89b76f52bb63b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747421, "uuid": "80ea80be-dd3e-4f6a-8dcb-262e709370d6", "value": "98830855B8818A11C9D512BEFA2E118E331267ECE3DF72139D201F643BCA92B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747421, "uuid": "d8f42e0d-4d82-4765-ab60-071ab07faab7", "value": "1536:QWn3dfYbDT8+05UAlStSGevTHv05cR7ch5i6H1oXK/w5e5l995/RGcsIAiScGHbd:L0T8/5dlTGUjv05c9c3pHm6Y0nScGHb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747421, "uuid": "d96e7422-749a-43ec-823f-2dfaf10f0dbb", "value": 83552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747421, "uuid": "51ecd51c-18a1-4c83-a95a-d5f0bc0147c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747421, "uuid": "66059d40-a115-4a04-b8f2-c9f18c736b01", "value": "3fb8cb7d6d77bb2d28aca7d59bc7e182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4841ed6-d62e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624678218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624678218, "uuid": "b38915a5-6da5-493f-a9b3-1ab6b46dda6e", "comment": "Malware payload (Mirai)", "value": "86cf88675e2939c40a6196c25a06b096", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624678218, "uuid": "a8f08fd0-078d-4ea5-9b72-678ba0b76d4a", "comment": "Malware payload (Mirai)", "value": "a442e4e87d5dd4544769894699301fb819ff41a16f06a37afd7a7d48d227bb3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624678218, "uuid": "2e0a6448-0d46-46f0-aa80-12d35c1c0be3", "comment": "Malware payload (Mirai)", "value": "f2d803512abc60ef4359f9caaf188bf45754cd17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624678218, "uuid": "106af3cb-8505-4d74-b553-c47f7844363e", "comment": "Malware payload (Mirai)", "value": "775c124ab373ad97f0e670af5f1d18a92245c405de93b0c38a6f31de6e62e6767efe84f4bc467cb5fe9b19339a88135c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624678218, "uuid": "3a42ba7d-be5d-419f-958a-fada2d763464", "value": "C9833B96BC918A27C6C423FBF62E528C372153E8D2DF31039E211F6536CA56B1E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624678218, "uuid": "b7f6f9df-09ff-4bec-8fbc-d0d6e3aef47e", "value": "1536:ZXv9AJalkFKwzLte6/OlmOFfylj5Wcyha2Vhv/OwhKbMOajl3OGS6YstSa10q:ZXv9+7rzLI6/OlI6aUtmwIWlSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624678218, "uuid": "b3a9cee9-cf81-4d73-8447-4ed9633aead9", "value": 88672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624678218, "uuid": "79471918-3da8-42d9-a74d-74a5823b683b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624678218, "uuid": "6b16d5a3-71c1-4bf4-8851-d15a56e4d294", "value": "86cf88675e2939c40a6196c25a06b096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0500fc2e-d6bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624738429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738429, "uuid": "00e2144d-7dd6-445e-ab21-f208b5d3608d", "comment": "Malware payload", "value": "a88982e412303be385c262d29edb20ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738429, "uuid": "0c799ff3-f714-40d9-ac78-120af17b7876", "comment": "Malware payload", "value": "a5b993dc0ae2d51f955c0a9738e029fc084df2d72cdce306f5cdc0aa5754160f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738429, "uuid": "5273774d-24cc-4e6b-b6ce-632b221d95b0", "comment": "Malware payload", "value": "6bbcc3f714c690121c417652460f61d85dd59c74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738429, "uuid": "576bdfe3-02ae-4b8d-9d95-a1ca87a1b89b", "comment": "Malware payload", "value": "6dbfda9d76a3ba97ecf0f26e59b9746e657cb976f6d25e161a8ffb2fa70fb3d63643ce7953772e9a568370ee64140948", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738429, "uuid": "79d68969-95e0-4aff-8306-e8f7df66639a", "value": "F7030234030162F8D565B77EA8934BF06A200F663B438D93E18571FA9DA36297F27BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738429, "uuid": "f05a23ee-1ddf-40d6-9398-7d1dc7d380a1", "value": "768:ZkRdVMqfF6yk6e83nlcZXAiKFLZBphBf5+sqy2uaNCZ1JgGlzDpxYsy:276qfF6oe8OwjLzphBf5+sgCNVrYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738429, "uuid": "44a801aa-2509-452a-afb0-b713791dea84", "value": 39308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738429, "uuid": "6f7568ba-c7a4-4f1e-8118-29aafa416445", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738429, "uuid": "b525de4d-02ef-4b61-ac46-1f3e54497525", "value": "a88982e412303be385c262d29edb20ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8e3b36-d691-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624720539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720539, "uuid": "4000be79-ff26-44a4-b92d-f8cde70fcf46", "comment": "Malware payload (DCRat)", "value": "e4752abf0f20d4ffb3e6d560f0b717d6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720539, "uuid": "5c48490d-08b6-4c03-af57-42b0067c2fed", "comment": "Malware payload (DCRat)", "value": "a6673fb12d144ff4db370f33158e67c63a2e053685fc396b255141192a38abc6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720539, "uuid": "cf77b851-3630-4e42-b9a4-1ed3e17ae564", "comment": "Malware payload (DCRat)", "value": "b3cddf4fa00679931b6c235e2c207df0d6bcf3ee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720539, "uuid": "9c053f6b-7d06-4a29-bc7b-931bc2b08938", "comment": "Malware payload (DCRat)", "value": "642ebeed690573a5a54b40323e9a4a87b1f2cd890bf9f3e0c974440ba8a75c41ee2f9b0d576c5aa11ede534a9159de77", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720539, "uuid": "36dca750-9e85-4e6d-946a-7d88838d194f", "value": "6B357B527648CA21C0692637D5EF55144BBCFD00BB62CB1B7F9E336CA9613A36D0D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720539, "uuid": "b1c792a0-4adc-4797-81aa-ab9aa0033a07", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720539, "uuid": "78535542-c27e-46c0-965a-11f5f1df553f", "value": "24576:Z2G/nvxW3WtZJ26oa1ZHrgxsoQcnI6CTRr+H:ZbA3w2UHrgTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624720539, "uuid": "fd85d8db-af6e-4d4d-b1d8-f1bc4d3d95b8", "value": 1150695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624720539, "uuid": "f58fed8b-deeb-4ac1-a726-e71f02e4c3e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720539, "uuid": "c609c60c-5a22-4735-b79a-771ef30def58", "value": "E4752ABF0F20D4FFB3E6D560F0B717D6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad43ee4-d657-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1624695623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695623, "uuid": "05d240ff-51f0-43b2-8ce5-7aaf394c8d37", "comment": "Malware payload (LimeRAT)", "value": "8512ad366a71e727cf375aa93dedb0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695623, "uuid": "64b6f42c-e5db-4c80-b132-591193ed845a", "comment": "Malware payload (LimeRAT)", "value": "a7a6878415ab3193493e00c5d9cb653d43cb33f43a5711c5e111e02b6ad5e405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695623, "uuid": "98a96e22-685c-40f1-8610-f8fa64aca6a4", "comment": "Malware payload (LimeRAT)", "value": "8d263a3e32a23434063964777b56a19fb3041faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695623, "uuid": "725525bf-45a7-4e80-91c7-a7aca2e75cb5", "comment": "Malware payload (LimeRAT)", "value": "fd1416de6452bb86aec50cdcc60e772c6ab83ff1840457a434f18dcf1672f50a54f5ceb67f1c2308ad19d46707979a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695623, "uuid": "457e538d-38d5-4b87-95a1-ab0e502c456f", "value": "F3E4D02426ED812DF173AF3959D835A29A6EFEB33B03E919305163565633E80CBD113B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695623, "uuid": "47ef1d6f-bafe-4527-9f3a-ddb1e8e544cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695623, "uuid": "cfa9db54-d1e4-40ba-81ed-675779ec1334", "value": "12288:rSSmr1BWsjJ6/KyT9UP6Xt/Ir2Xm+MTbjnApeYITX7ILVu:rSbBtyZS6dQK8bkslX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624695623, "uuid": "42db86dc-188a-483d-b2e8-56fc25c9b066", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624695623, "uuid": "dc61a869-77a8-4b2b-884c-8823beb98ceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695623, "uuid": "d2be8680-f56d-4cb4-8a04-df0a2eb19c70", "value": "8512ad366a71e727cf375aa93dedb0c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59e5b31-d63e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624685119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685119, "uuid": "5e11e164-4977-43dd-b504-7ef1badd0994", "comment": "Malware payload", "value": "e1ed8dc6958fbd9e09a14ddff49874e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685119, "uuid": "f7c31436-f874-40ad-9d94-379819e70b4f", "comment": "Malware payload", "value": "ae32233ca2a4c0ffb03a6da6154ff2610fe445bdfd8619948b09117ca44ee30b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685119, "uuid": "92383136-0aaa-4ed2-be76-c84e26a71a0d", "comment": "Malware payload", "value": "77a28723ed48bea09b1f230b47efb30be1e0a6e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685119, "uuid": "552fb3ed-9e0b-4b4b-9e1f-f90d25994889", "comment": "Malware payload", "value": "0c4fca6cf031fe725565a9111dc3261ace8a039b9677bdd8a7cf137870cd06e5b63591be6a9f561db318005de192f4a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685119, "uuid": "d57b947d-4bb6-4093-8d84-4df77ada9a07", "value": "C8E5235028CB9D31CB7A64FE053B6A21E6D13D93C475936B3BA20E752A096B0CF4E4F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685119, "uuid": "2e573d42-33bf-4803-8d53-37f8650b32d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685119, "uuid": "948f6aa6-715b-417f-898e-07e357b8c7ee", "value": "49152:arsmhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gA:aNqXpy05Q0N1rsYSZ6BoXh1kkypSH3O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624685119, "uuid": "303d4c15-c4bc-430a-a27d-2e660255009f", "value": 3092992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624685119, "uuid": "862b5ec4-3eef-427e-95fe-c8239215c664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685119, "uuid": "791744a7-dd56-44aa-b17b-bc322b29d4a2", "value": "TOTOTOTO.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b35209-d65a-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624696841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696841, "uuid": "18b0e286-a368-4cab-8fef-f7bda45e2611", "comment": "Malware payload (RaccoonStealer)", "value": "a0398eaee184bdd5da2ded03fd02e598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696841, "uuid": "6684539e-de83-4238-9471-a9da43cdfb12", "comment": "Malware payload (RaccoonStealer)", "value": "afdbdff7a2510b208b5ebc47ac621ff14a15aa5673ed6cdf7f7f0f8ad4c1e1fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696841, "uuid": "b9a8b58a-a56a-4314-a9ce-04ef5c299bb2", "comment": "Malware payload (RaccoonStealer)", "value": "46141e70b28544d6c3cccca56e35a52f3cb4671d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696841, "uuid": "a8299d3b-9251-43dc-bd69-2b18f6e757f2", "comment": "Malware payload (RaccoonStealer)", "value": "3de912dbf7699f52f0084dbf9f6cb45848b3bf6003bb86b38415378ff56dc1286b9b872fa6331392def04543510a4a58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696841, "uuid": "9b77820f-3528-4a8e-8ab4-d3bc245f24a5", "value": "4CE533417CC195F1E5676932457CEE11283DBC246F78CABF63985A0EAA322C1EE34763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696841, "uuid": "3e4a3800-2957-4b1e-82db-3b78586000c9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696841, "uuid": "4ab79114-e1e3-4c0f-b52f-7816ded32a5d", "value": "98304:UbUQ1ztF+NEGSK9KVELOIsZXOt1hizE4vM:UwQYEGg+iROgooM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624696841, "uuid": "20454e0a-bb2a-4687-a251-409f84c7a113", "value": 3177829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624696841, "uuid": "abae595f-82e0-4127-840b-0e97f2aea8df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696841, "uuid": "4d4ee0cf-1322-42cf-bf19-984f8bf18bb4", "value": "a0398eaee184bdd5da2ded03fd02e598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331b30ab-d66c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624704576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704576, "uuid": "cb4f3936-dc05-468f-b765-354e06df45f8", "comment": "Malware payload", "value": "5ed4eeac4456d4661c25ba66ece338ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704576, "uuid": "338d145a-5ee7-41d9-aaec-4382bbb94249", "comment": "Malware payload", "value": "b0e81166e58cc1a5994f442585494035d658b24f232e6ed51f09f693f6549651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704576, "uuid": "3621f7f3-f87d-4181-acea-1721a9cae782", "comment": "Malware payload", "value": "b1cff47d16cd01c49b78f25f8c201f91e40581d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704576, "uuid": "943cf30c-1ec7-40a2-924a-af0e43da5a6b", "comment": "Malware payload", "value": "51f3606c3217dea13e66e22350be7e147e2bcd2b5f6f8a2b4a4d295288bb12140b33bf8c00401cb997c0780e8e07789d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704576, "uuid": "d9c235f9-be63-4350-af25-42012144bf3d", "value": "9B847C00B6A1C035F6F616F4897A93AC953D7AF15B6040CB62E4EAFE56386E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704576, "uuid": "c153e41d-665e-4397-ae34-561fc07837a6", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704576, "uuid": "d0f2e7b6-1edb-4182-8f2f-e08697e8288e", "value": "6144:u2w8CsgVxkx6n7hsHLdEM1++p+X3IZxUSHcbNA7/zsEqu2bZ837kL:u7I6nwiM1pAGUBGYJFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624704576, "uuid": "38eb57d3-6495-4840-8ac4-cdaba7d9a485", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624704576, "uuid": "4c992ac6-4d2b-4f61-857c-37d76bc66c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704576, "uuid": "becf0d78-a505-4bfa-b426-8315e5fe462b", "value": "5ed4eeac4456d4661c25ba66ece338ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95014902-d627-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675105, "uuid": "2862a6ad-80d5-49d2-8dac-15fab5907d80", "comment": "Malware payload (Gafgyt)", "value": "dfefc962a9931094affa9180825e772d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675105, "uuid": "c8c493f2-1263-426d-b54b-1b068444f208", "comment": "Malware payload (Gafgyt)", "value": "b1219259800c17142f7465e42ca2f39f80165c129c8b50e00d132fc921483dd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675105, "uuid": "48a8e5c1-63ac-4cf3-9e2e-d670e8a081d4", "comment": "Malware payload (Gafgyt)", "value": "e6e451d9268c9804869bdf8923e062224ddb815a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675105, "uuid": "e140bc62-cab7-4e9e-bb39-65efa29fe1d9", "comment": "Malware payload (Gafgyt)", "value": "485aea884bd7ca96ee3cbee9ea5c5ad51b6e75c4d4f2aa3457981b81f6062770867e3a98f8264c35e895449187c08230", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675105, "uuid": "5284e224-5045-4285-b787-1447736f3eee", "value": "A2B30B79E703C1B7C4430EB5024BFA565E20FAAB062F9A4AF3785DB4AF1A8C63515F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675105, "uuid": "bb382515-09a8-4b29-8f2d-d2195cd3adae", "value": "3072:k2tHMyioIo1dBrnHrA9JzyiqglzKoSaJezjBkKsmzF405DF5nc+UG:jMoIoTKFhKo/JezYmzF405R5nc+UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675105, "uuid": "35882415-615f-46ed-a225-1b300493cf05", "value": 112455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675105, "uuid": "abea5843-ec71-4e34-8e69-840baf8c11c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675105, "uuid": "417136f4-330b-4a50-9a1c-e8cfc38c7bfc", "value": "dfefc962a9931094affa9180825e772d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8cb057-d664-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624701376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624701376, "uuid": "44926da6-3e95-4952-98d0-901123c03492", "comment": "Malware payload (NanoCore)", "value": "c03ff0ce39b7d8da85f04d0b5f7bc239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624701376, "uuid": "7537e919-ad67-4793-a717-5534f42ba893", "comment": "Malware payload (NanoCore)", "value": "b26c95976936054915610598a19dabb10dd52f47b9edbdbadc079d2e91717814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624701376, "uuid": "2dfcf126-7833-47e7-9d16-d80db60a6c12", "comment": "Malware payload (NanoCore)", "value": "0ecca66bde2af894b8e3948aefd493653dd7e80c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624701376, "uuid": "c1c525a9-9ddb-4e94-b2f0-03d5efc6d94c", "comment": "Malware payload (NanoCore)", "value": "b09cdb64829e664446541163a9a0155dc33db0d012cd3a00ddd3f1be0f7a4fd70afa34371513e014be2fa41c3fe2d12a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624701376, "uuid": "500bd3bd-c52e-4ba5-ac4b-1b2b9731f1a8", "value": "759633F7598311A1D45DA3749EA1A8D52F4CCF2B7AE0B822C95B4A3CD0F43F80693B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624701376, "uuid": "fa9a149f-8d82-4a7a-8c94-90aef0f1c2ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624701376, "uuid": "beba28f4-bf5c-4b25-b237-3ba8bb929135", "value": "196608:o6aFBue5lI0POQbQPM6tWp65qSFJIRGcSFyp1E/51L+vwIW:oB1lInQUPM6Up+zkS4K19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624701376, "uuid": "7e6e38c3-aa2e-4190-a6fb-c641fba126cf", "value": 8666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624701376, "uuid": "0e9cd234-1380-475c-9fce-b57e18a8d26f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624701376, "uuid": "b836d4c5-c8a4-4574-aa13-d9b56dcfc701", "value": "C03FF0CE39B7D8DA85F04D0B5F7BC239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895b2229-d6b8-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624737363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737363, "uuid": "4da8af93-65f9-4202-874b-b6fdef2926ee", "comment": "Malware payload (DCRat)", "value": "2a16882cd647bbb98665dd8b333fde39", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737363, "uuid": "95c38ddf-6c01-4317-824d-c8a1a4bbceb2", "comment": "Malware payload (DCRat)", "value": "b28556202314fd3c990ef5907a7df61390441ee6fe49f047cc74bdfc9e5bf9c3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737363, "uuid": "623105cf-2c19-4fa2-9812-1033b32ce297", "comment": "Malware payload (DCRat)", "value": "463f3fee5311fc1d3819102a17b3a0a043af75e5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737363, "uuid": "e2591800-15e9-4b0d-9961-bc4970733877", "comment": "Malware payload (DCRat)", "value": "262bfc634e3784cb0ef018bb7f9d97d3db02c9a9eaa4fef4e9a1cb40bb0aa6bf71263ce8bc473eba7670114fce2158b3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737363, "uuid": "1eccf39d-bbb3-42ea-9ae1-7f15a6d2a3bf", "value": "7B056B223648CE19D169163BD9DF461A0BBCEE40B762D7163E5F33BC68513A36D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737363, "uuid": "609292d5-0009-4454-81bf-4634550e4bd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737363, "uuid": "d65ba78b-338b-4791-b9d7-31b03e5055d3", "value": "12288:Yg2mvaK6r4ZxObaaJH8WScRHm4ox/gDOejOFQyMoLrw67qn:Y3mj348WScRHmTg8FQyMo/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624737363, "uuid": "67c7daee-00f9-42aa-a3ba-97838f95656a", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624737363, "uuid": "0d47a005-c420-441a-8840-2f4159abb49a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737363, "uuid": "fe7a5726-5602-4605-b43b-d02f510eadab", "value": "2A16882CD647BBB98665DD8B333FDE39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b73b1d-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624691719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691719, "uuid": "27720e42-eb9f-4441-8209-9e363aaff903", "comment": "Malware payload (RedLineStealer)", "value": "c940e830258c860e81eea82900449ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691719, "uuid": "6e7d88b1-cbe8-4824-9488-d3dcc2331f8f", "comment": "Malware payload (RedLineStealer)", "value": "b3daa8d8b247d807ed0619e9f246a6769aa8334f61586a2579ea4886ffca05c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691719, "uuid": "2f745b09-bd34-4321-ba17-e55b87cea469", "comment": "Malware payload (RedLineStealer)", "value": "d44acd8027d442d82794be4d45ad53af9e8ad163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691719, "uuid": "34500188-1d85-4457-911f-38333070c7fc", "comment": "Malware payload (RedLineStealer)", "value": "77be10b521923889a86389959f21975db19a7645b00fd649f36479283c75277f40044b4f13618ce487ba980bd3ba30bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691719, "uuid": "a915c862-1e88-49ac-a6c5-c9b907bbad8e", "value": "7C94AD10BAA1C035F1F612F48A7693BCA53E7EB15B2450CB12D4EAEE56346E2ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691719, "uuid": "2a627936-e9a6-4866-add1-cd99315fac4e", "value": "95c98b49c73bee041cc2512ce9afe8b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691719, "uuid": "3d1e3cf9-7bd0-4d0f-9a02-e5f137cc9fbd", "value": "12288:isqsA0UkIS/wYX3KWTfxa9u8cWxDWBzq9:isqvYaIxUHcWYzq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691719, "uuid": "6892e860-dc6e-433d-bd5b-fc3f3fa2b569", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691719, "uuid": "19ede5f1-a2ca-43d7-856e-9f17b3394153", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691719, "uuid": "45afe3ef-6475-4f46-a916-4da8fa7b4295", "value": "c940e830258c860e81eea82900449ac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3832b9a7-d628-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675379, "uuid": "6ec2967f-612a-4e6f-93f8-d835272e3629", "comment": "Malware payload (Gafgyt)", "value": "9425e1a30a9fee1ec9f0ab2044a8c72f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675379, "uuid": "48e17479-c241-43ef-be22-5b29e5ecdaec", "comment": "Malware payload (Gafgyt)", "value": "b49c25d98b90ed60ba29f6da732fc522584b1abee0b2d4dd4835959fe95a0b43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675379, "uuid": "9e17fcc0-bedd-4ce3-ba68-06b27e487ebc", "comment": "Malware payload (Gafgyt)", "value": "9465c5bce442692822f8faadd9dd6b65a13b2892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675379, "uuid": "8175e4bc-fd0d-4d04-bfd1-52722050b04e", "comment": "Malware payload (Gafgyt)", "value": "6591c1a070d530d564bcfc953adaee8e38b03f5b63e2522efd0069e5f23e088ae46907ccb58513eef8b3eae49e080e2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675379, "uuid": "25dc200b-f45b-4805-9645-b2eb7f812646", "value": "08C32973E4614AB7C1479D7924A669200F129DD75B6F1A8A71388BF0068F8CFB40FEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675379, "uuid": "918db6a7-f158-466f-8321-cd9c97c77b83", "value": "3072:FrqfS5S9QXq74RR9unavY8cmug0l0wbRct5NS:Fr/g9X88naQ8cmug0lXbRct5NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675379, "uuid": "9438d279-d926-41cb-a753-de6c228f8bc9", "value": 122298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675379, "uuid": "9ed0f17d-b488-4911-8d21-84b059f36ebe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675379, "uuid": "05392397-c2ac-410a-bfd1-a9ecf5e3faab", "value": "9425e1a30a9fee1ec9f0ab2044a8c72f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16be2679-d623-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624673175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673175, "uuid": "7e1be515-7c90-4f6b-bbca-676bf879e9d2", "comment": "Malware payload (DCRat)", "value": "7905e3a433a1b91a29720b92a8454ed9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673175, "uuid": "e42a5b59-98e2-479d-bc4a-a3540d06f416", "comment": "Malware payload (DCRat)", "value": "b5b2d5cea424511ac2b41cf9e9a4e47d1b26df12b3edeed7f9f0fe7bf39b085e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673175, "uuid": "c9bedd56-4935-478a-81b9-cdbbdf169ec1", "comment": "Malware payload (DCRat)", "value": "eda8d12f703d39ee5a04e7bc7c3cff056fee1fb3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624673175, "uuid": "1dd6612b-6301-4a68-b7f3-63325eb6d06b", "comment": "Malware payload (DCRat)", "value": "bb911c530d13d08609d483bbfd20d16ceb8a919b70e93f75c592dd68c751faf7b97a1672548354d5d6c7c5483aa2d443", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673175, "uuid": "85b45285-905c-449c-8fb7-a7c868a01b30", "value": "C9452882D6E85671C16C6DBDD0045C26C30649CB12A5F9E71014EFF0A96AAED3F3D8AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673175, "uuid": "5a136801-35ba-4fa9-9df0-20cb7122d90b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673175, "uuid": "d685de48-0d7d-44eb-a51e-5b198c901fb0", "value": "12288:Gpu5A4g1kf8/TIgUEH//7D7QxcJOtUsdHoUIULUkficW6CWBvBkBvv:l5nSg80QD7ycUUsdrgHWVBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624673175, "uuid": "09fdb788-128d-42c1-92e3-69d8cd58a174", "value": 1238880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624673175, "uuid": "dd9f31da-2e69-4b68-ad16-40413822e2e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624673175, "uuid": "9fc395b5-2bbc-4bcb-997c-9406e2651259", "value": "7905E3A433A1B91A29720B92A8454ED9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0144901-d6d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747736, "uuid": "9982f49b-eea5-4b8f-8c06-b8b2208e76c9", "comment": "Malware payload", "value": "dbbbbb2700b7a393a02c4b5f56bf4cc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747736, "uuid": "8e4cbd1e-89f6-4b9e-b7c9-d84f7487d655", "comment": "Malware payload", "value": "b60e4a053a61adfc573265dabc6cddce87f7115fa810f2da0c6e147c3a35cce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747736, "uuid": "8f69405a-34ea-4c61-9cb5-0093213b3b95", "comment": "Malware payload", "value": "65bec338ea6dc72753bec8f4080af6dd39ccb3b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747736, "uuid": "f27f8689-42a1-4da2-a1a8-067845219e55", "comment": "Malware payload", "value": "05f526c028c83710780964c7bb72a4620b12397da8e657ad159c8748ad2e98b1b72de33847ef16c633bc05a44dc2cbcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747736, "uuid": "2accaae2-fd18-4663-9157-33b4704aa103", "value": "69C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747736, "uuid": "a0fa3098-49f0-4eed-9b66-31eae9304b42", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Ep2+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EM+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747736, "uuid": "07be5ef9-2581-4a93-8e30-709efdf53849", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747736, "uuid": "292ddd62-8dd2-469b-ba93-d63988b587f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747736, "uuid": "92d385e9-5429-4e01-be44-caadb8acd06c", "value": "dbbbbb2700b7a393a02c4b5f56bf4cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfc5b21-d6ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624746628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746628, "uuid": "b104e281-324e-4418-bb30-2eae8a814860", "comment": "Malware payload", "value": "4e758f9779206dd81486dbfc74cbcf33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746628, "uuid": "325f54bc-e973-48ce-be70-b18dee01f78e", "comment": "Malware payload", "value": "b8dd28f28350b5e4db343f11bfc1a57d9a323826557b9dbc9fb6e6a76695b8b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746628, "uuid": "d75a3073-24bf-44d3-af81-c37fb96bd867", "comment": "Malware payload", "value": "e224da3f4ea672ed1484d3307b44d442533d6b27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624746628, "uuid": "c827b04c-91bb-4f10-a172-ee8c62f3fbe2", "comment": "Malware payload", "value": "f362a4fb2e559829a0412d5159cba4cf7a579959162949b983019cc00879acb3a50f4cd9c1e50d5f01370c9dc011cef6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746628, "uuid": "5f478310-19b9-4852-9c19-90817b221626", "value": "2FE34A46FA818B13C4D5177ABAAF01493332A794A3DB730689285FB43FC676F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746628, "uuid": "1e484c24-d4cf-4b64-bf7d-dbc605497a9a", "value": "3072:8hCj1qyA1k84yzuhjncl1gXGSC2ReX51C7cf1Ch0Sff0M/9FU33l:iCj1qyA1k84yyhj46ReX51C7+11SfcM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624746628, "uuid": "995e012d-99c0-4839-9d01-c58e62fdfdac", "value": 148941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624746628, "uuid": "a7a97554-2c8c-4b47-a8d1-e4ab81008b78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624746628, "uuid": "22243144-567c-4bfc-ac66-ff5002b14fc3", "value": "4e758f9779206dd81486dbfc74cbcf33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dce0906-d660-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624699601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699601, "uuid": "d2d0cd9a-8c85-4df6-8395-da9cc1469e75", "comment": "Malware payload (ArkeiStealer)", "value": "b2437b9de2c4a5606aefcca921cba7fe", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699601, "uuid": "03ceef4c-d277-4ae5-9f92-001daed3e6a7", "comment": "Malware payload (ArkeiStealer)", "value": "baa011a0a4e29a1b2aecfb5001347792be97956fd7e1df5b27902f2a8ee5aa61", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699601, "uuid": "d4bae7af-7d4c-4147-a1e1-17f95c426aa1", "comment": "Malware payload (ArkeiStealer)", "value": "80ab8226772b79f71f7fe8a6ef1607ace7e705b3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624699601, "uuid": "7303bb42-169b-4794-a171-991ed35797e4", "comment": "Malware payload (ArkeiStealer)", "value": "8c05e94561cee2f3f34fb6a3eeb8afd774a1da2fa3fb04be87ead2541430e51b95caff79ed7ea4dcde2c89c5eebed16c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699601, "uuid": "4c6bdd0c-6033-44e3-87a3-0e50dac28a3a", "value": "DAE4E000A791D031FAF312F86979D3AC693D7AB05B6440CB62D9EAEE16346E5DC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699601, "uuid": "e319861f-ab9b-4e0f-98cd-e90cd9ed14c7", "value": "15b3a9347f4ff2346891602b4cdf58c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699601, "uuid": "b512b2ad-2475-4dcc-80b6-f92c2c18ec6a", "value": "12288:OxHkCHur2j9ZhEHopNWFk3D/qQpY7zNQXl0eQY965JlrQcMAgDfw:QHkhCZmA4C0N20Yybrpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624699601, "uuid": "dfe80a0e-e72f-4345-b218-55d5311d444e", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624699601, "uuid": "2a291a0e-dfcb-4a75-a94e-4d4985bbc624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624699601, "uuid": "6493acd2-345b-4aaa-9839-af235c493e66", "value": "b2437b9de2c4a5606aefcca921cba7fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dc792f-d63f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624685203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685203, "uuid": "e43cabf1-5fa2-441f-b01e-fb61a91866b9", "comment": "Malware payload", "value": "a4678f59038b62a217a8819392ca9f55", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685203, "uuid": "27bcdd16-403d-486c-93e0-86c5068dcab7", "comment": "Malware payload", "value": "bac7f50c74e28687e2f18f88b4b277ecbe36acd96a00c41418b17383786142cd", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685203, "uuid": "9fd8ec18-cf34-482b-841f-dcb434041ec8", "comment": "Malware payload", "value": "6e309cc69580bd42dfc9095d50f187f5e8776145", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685203, "uuid": "6d8d874e-9507-4b66-8371-e20276e7474c", "comment": "Malware payload", "value": "1c9b115dd5ef8dc8ced966b71c6a7265802185af86bad685d5acb77d927bd2e872659f468b7a50c115cc178f4eb81786", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685203, "uuid": "3cac9129-c257-4dbd-ae01-3b33a205ee01", "value": "F131CD2A2BDA6730C377863B44F1E64189367D27EA538F5D059082CC2859301EC69E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685203, "uuid": "f2743fba-6439-44ed-bb05-9db62a883220", "value": "24:8I3JiM+f8C3ASA+/2xxxlaHCaY+M40xlZ4I0W/XQaR3+9/qvY+/vm:8ODLxxAHCaT2xsIVXv3QUYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624685203, "uuid": "1ded9f9e-5c07-4f2a-b51a-0555f9696263", "value": 1654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624685203, "uuid": "98c824bb-5a23-44f9-9500-8ac94b31626e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685203, "uuid": "47448c08-7e8b-4e9d-b2ef-573f550e3cf9", "value": "bac7f50c74e28687e2f18f88b4b277ecbe36acd96a00c41418b17383786142cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9302e3-d692-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1624720859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720859, "uuid": "faa972d6-64d4-45cf-b651-a47777898a66", "comment": "Malware payload (NetWire)", "value": "4e2ff191c86e45f399d0f31a5c42b60b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720859, "uuid": "1a4bc2ee-ce16-4c10-aa7f-92d256c7ecf6", "comment": "Malware payload (NetWire)", "value": "bb988ff7e440eb871321f3d5ee94c7d241d4929e57b0e687e3ee61466b6880f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720859, "uuid": "5fc361a8-8ae8-4d80-8f88-c8a1831123ff", "comment": "Malware payload (NetWire)", "value": "1e399895e5837ac9a77a1fa890a82a92e9e6c14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624720859, "uuid": "94f8756d-bc10-493f-8774-70e6c55358a8", "comment": "Malware payload (NetWire)", "value": "e91261c488da96e6ca0cad06cf76e65558fd6ec51a3acaaf6332d1b71dbf753ba90f2ed30519c73d1b82da07af71c842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720859, "uuid": "7e0d15f1-6356-480c-8429-23f7d77e1b38", "value": "6E545B5E7ED6887BDA32C63F1A1473BB9F074D82393085EB5994EACF40397428B205D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720859, "uuid": "1d5f5bdb-a21e-4500-a8a2-4bb4c0f16281", "value": "52bef57f2313d2dc5bfb9b12e8f897b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720859, "uuid": "831a1fe2-8bc1-4870-97f1-9fc4cfe1a762", "value": "6144:7yylDqmBrI2lFU6CzjSiuPnBRL0elpbTYwnQkR:XqazcjSiuPBR5lpbTYwnQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624720859, "uuid": "4510e8e4-a58d-487a-b3e3-f7109b7bd24d", "value": 284152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624720859, "uuid": "e7657145-eb22-4447-92df-ab259f28c06e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624720859, "uuid": "d0401215-0554-48bb-bb94-d4fab5bfcb18", "value": "LnsathwafhvylbbptobwoppapjxmujmvteSigned.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cab4d17-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747139, "uuid": "18fde838-e5d6-43b6-9989-889ebc0829ba", "comment": "Malware payload", "value": "faf3c67804dc9d0046d79f81bc204e8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747139, "uuid": "e259944f-e22d-4bb2-af47-92d516c40ba2", "comment": "Malware payload", "value": "bd6190cba5b963d48d86c93595bccc8c8252936556d180dac3157707f3e5032c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747139, "uuid": "c84de457-91c7-45f0-aa9e-a00ccc088132", "comment": "Malware payload", "value": "e8119e63eaff77c71bba667fa99e1c945da10234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747139, "uuid": "4f1100f4-128b-44d0-8d10-1f4f5ab22ce8", "comment": "Malware payload", "value": "a41a20bf974d78dbad1eed0ea4413e81d39f72525ab760e060998f94db0ab125a046a8d1ac31b8d728ca40f679b29951", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747139, "uuid": "66981a80-ad42-4feb-be15-715e788acfa9", "value": "BC833C02E743C6B3CC830BB2029BAE665931BDAA1E2A9F49F31D7DF45B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747139, "uuid": "1477e3ea-7a9e-48db-8b9c-d6b8ba77d86a", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LxWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YN2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747139, "uuid": "2cbd692c-5238-423c-9989-4ee6b3b114e6", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747139, "uuid": "a7d54589-2d03-4213-b676-2a7c77ed8775", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747139, "uuid": "f6781ad3-57fb-42db-991f-650bb28258a1", "value": "faf3c67804dc9d0046d79f81bc204e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977ecf79-d649-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624689712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689712, "uuid": "1f5dc900-6bf3-4a4d-82d0-3c12a8bc22a6", "comment": "Malware payload (AgentTesla)", "value": "06fec34220ef54ef3e7bf1dfa3e24cfa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689712, "uuid": "f8a9b6fc-4b5e-46ae-8ee0-732bbd519858", "comment": "Malware payload (AgentTesla)", "value": "be4e461b1c123ea995c3d8a204ac398077228b26e93c1186f2e58ad801ad8a12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689712, "uuid": "824703b3-9a1f-4ed4-9499-ac27b7eb9623", "comment": "Malware payload (AgentTesla)", "value": "dcb460ef3f2626d2497dffb6c92d45c5014c2957", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689712, "uuid": "c8563beb-8b2b-4c9e-b6ae-2185e4dbca3a", "comment": "Malware payload (AgentTesla)", "value": "9887c20eb693bc6feb50f0f0724f28a68f5939c8a39c938a9093156c562e3bf59a4336adc85f07426e0ce74926ecc692", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689712, "uuid": "70fd9114-3fd2-4f27-86d0-903f969f83d1", "value": "FFA4237B19678A2A82DF9FB67F8C4D40848EB4CF901224701D56592A53277E3D9DF0EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689712, "uuid": "872fc045-a06b-47c8-a19e-ccd0b19ea6fb", "value": "12288:HONCCia+P7N9G1hcJt4zzZKLVSZSuiMPsrT:IufPaTzF+mriMmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624689712, "uuid": "109333af-87a2-4c62-a7d6-06a0e653c85c", "value": 457787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624689712, "uuid": "2c193671-76ea-4dfe-80ba-8c5884fff33d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689712, "uuid": "c3c682d1-fed2-4fd3-bcfb-c62381adba5c", "value": "stowage plan.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c201145-d622-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624672862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672862, "uuid": "1032466b-ddb0-4685-86c1-579ce00bcfea", "comment": "Malware payload (RedLineStealer)", "value": "792bf0600e486c7ba4274b559640b4ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672862, "uuid": "4995e43b-306d-4386-8047-a43a031e2b3b", "comment": "Malware payload (RedLineStealer)", "value": "c20a935e747f700a8ca03c1ad435796760bdc1ae105521db835b6a1566fa2c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672862, "uuid": "1b4e7323-83e5-40d3-9dab-b236bd23329d", "comment": "Malware payload (RedLineStealer)", "value": "cbfcabfe9d9fdb66ef02a7f47fc4355529759d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624672862, "uuid": "3cda5572-b2dc-4573-aaab-11b5ba16be40", "comment": "Malware payload (RedLineStealer)", "value": "c277443595c37c099b9f26463064df8e632767ac2d815cd19da909fff046e3ac1e54afc6dd443cb617c4ead250d89fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672862, "uuid": "292ba508-8933-4f70-86be-273cce0ba3a6", "value": "79E35C2033A8871AD3EF4B7EF470441582F1E34B6262EB5B5E5476DE2B23B45A2117B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672862, "uuid": "e2cd7d2d-2a9d-4faf-a6fa-611f76cc7c85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672862, "uuid": "d8f473b3-d132-41d3-93c1-3a44f805d3f2", "value": "3072:K0q1JmOTM9hVgZ+rbZexpAP6Y2sSJqoD2X7BpGGoMTb3R35dINX9rdhx4:KiOI9s0r1exGoJqoDC1pGGoMTb3RDINN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624672862, "uuid": "286b15bc-efcb-4603-b7da-1972ac63e011", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624672862, "uuid": "50c53134-e78d-4986-a7e5-e24ce9628f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624672862, "uuid": "c358156b-b807-4a8e-bb0e-8f95bc121eb6", "value": "792BF0600E486C7BA4274B559640B4BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b754c7-d627-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624675098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675098, "uuid": "a8ba86a8-2b05-418b-85e5-30a0c86d6835", "comment": "Malware payload (Gafgyt)", "value": "1cb17ecc390345c595a819fbf417dd95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675098, "uuid": "002cc736-17bb-46f6-b2f7-e246fc058c88", "comment": "Malware payload (Gafgyt)", "value": "c2c0fe3c0680793f3de14d9d7deaf354a3211570e04e7790a11057b61ae86b2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675098, "uuid": "b849be40-36ee-48a3-ad45-dee3b0e07e02", "comment": "Malware payload (Gafgyt)", "value": "8d1de736f1550123dcf02f378829d4845feb624f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624675098, "uuid": "ede2ba80-405d-4d3e-8d7a-0bfd86150074", "comment": "Malware payload (Gafgyt)", "value": "646ece9229bfc9426bdf021a51cf57cb9dcf666a8ba6fe06a99e10e7292022e542dbe2fd43b34b64922087e9813d4668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675098, "uuid": "3fe54c9e-aa71-4084-8fbe-9c3cbb41bb38", "value": "2DE31A14D0104777C2D3177EB68E524D3F361BFA538B7325AA346A742FC2B9A2D3A960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675098, "uuid": "3291ec21-a37e-4281-83dd-2459f00abde8", "value": "3072:9tIX3zrvpYHpwrLf/aIoDQzMSV8LeUvulLOZIjlD4VOPtmKwQ5ggUiLN3:a3zrvpKcT/aIoDQIhvulLO+yQtmKwQ5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624675098, "uuid": "925b4a9d-5be2-46be-882b-2caf16955e9d", "value": 155916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624675098, "uuid": "1e4e1226-d5aa-4337-a203-0ef27f91d9a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624675098, "uuid": "ef145a9b-0e58-4ddb-87bf-ef5831fa6707", "value": "1cb17ecc390345c595a819fbf417dd95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a82860-d66c-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624704584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704584, "uuid": "f5677e80-2379-4380-9d8b-ba94ed4b91aa", "comment": "Malware payload (Smoke Loader)", "value": "287e928382dad8ff1aa18148421ee984", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704584, "uuid": "cc43fdf3-778a-4a16-a378-f532a6c2994d", "comment": "Malware payload (Smoke Loader)", "value": "c2fe29a6da53447a6f9f112e7b2af81e3fcdd85cca2ecac816d145e580bfcdf8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704584, "uuid": "adcd498f-fd0d-4665-8e8a-eeefa9547121", "comment": "Malware payload (Smoke Loader)", "value": "c5fbe7bcb7adbfd8cadd52162cc58b2f5ba7d3b3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704584, "uuid": "f0e82b1b-ea3f-4e9b-ae1a-e1f00718c770", "comment": "Malware payload (Smoke Loader)", "value": "10dccafc4ea7f98579270226604a0740ad0531bcba12402f59e26181a2d3c958ea797c22700d259f2381741422283aca", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704584, "uuid": "c7d78ca1-e937-4966-a51f-15662b20d4f7", "value": "A8747C00A6A1C035F6F212F88979D3AC953EBDB15B2050CF62D5EAEE56396E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704584, "uuid": "c8033941-6d22-4f17-8565-a2771e1d0793", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704584, "uuid": "47d89ebf-4a1c-46ef-a998-ea427b18b3de", "value": "6144:OEw8yy61hkGqEGs97Qf/nk8WWu45v1dmYN4RrtVbe2NZ4vRYkL:Od7q27mnk/ardmYylLnDIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624704584, "uuid": "70d1d376-0e5c-4dad-bd74-25598f1b430c", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624704584, "uuid": "d993ed1c-a0a8-4acc-84b0-4c9b9c1bfabd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704584, "uuid": "0e902859-4d9a-478a-927c-f3a72f16c815", "value": "287e928382dad8ff1aa18148421ee984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a63a030-d69f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624726466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726466, "uuid": "201f1d18-f155-401f-8d52-428c151b423a", "comment": "Malware payload", "value": "f77a01028f7f86951b7a19b366617d07", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726466, "uuid": "befa6f06-d8eb-48c0-a918-c5ecae048d3f", "comment": "Malware payload", "value": "c3310c6fa21ec5ba4735fca30d98dc81e73c5444e22e403083e21d5e01c4d146", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726466, "uuid": "d2e48ba9-8a5c-4ff0-9b21-9909a9f1f792", "comment": "Malware payload", "value": "f7315c3a262b17fa1dc0721b92ec63399bf6c4fa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726466, "uuid": "a9816aa4-6561-458a-a0d1-baae5c2abefb", "comment": "Malware payload", "value": "aa78581049845114528a297e7451946503d253da59cd294423b7943b19c7e5644f2c653c5c603cd1119f68db430a1af1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726466, "uuid": "4775a48d-540e-4735-b899-42449c25d4c8", "value": "7B01C54C7D76F18284C9D644E2541152BC8C464E81587F1304504C69777CEBEB93E5FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726466, "uuid": "4460f150-c61c-4a8d-85ce-33537585b067", "value": "12:aO66LoOS/+SYrjA6rOSkhBtcK3lPRkp227ZNnO6hnsqeeSsXNTJmnVCDXqabOSyG:3LTShYrjJaSGsSJMpRsqTN8nVCD6tSyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624726466, "uuid": "abef34a6-8e28-4edb-8a97-c2fe768773cf", "value": 704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624726466, "uuid": "0e6cb817-9100-4622-9909-43df3a450a00", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726466, "uuid": "79982bb4-8cee-4026-b649-6fc897efc2a1", "value": "Order Image Specifications.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e3c6e3-d698-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624723556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723556, "uuid": "4ef7d86a-2fde-4f57-ac9e-4be5c836fcf2", "comment": "Malware payload (RedLineStealer)", "value": "e736b20b7760695ee6b7cbcc7a52cef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723556, "uuid": "7a084ee9-cbf3-44cc-8e6e-e9f62b2e39a3", "comment": "Malware payload (RedLineStealer)", "value": "c41a17e8071ce8240acd4ea88dece1d2259be2b8a96ff092000c4dd69c9b1f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723556, "uuid": "5e215e6b-25a7-4e6e-ae12-f2deb4c56a91", "comment": "Malware payload (RedLineStealer)", "value": "791a5de953a959d65185668ac64f13d6b6671fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723556, "uuid": "491cf951-c5d1-4f30-b42b-eec5490524d1", "comment": "Malware payload (RedLineStealer)", "value": "8027ad3d1293d34701b568e86287a67613f96c261fb47df20a87e956596cdc78772e2f5fd0c9fdf9b321a54cc9476377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723556, "uuid": "ff456f7a-aa4f-4538-b2b9-54ca4e2c6d23", "value": "86F533C851C9FC19F2C6663E7E1D56E035B979134088078CC3A94FAF7AD31D8B42ABA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723556, "uuid": "4d18a81a-9b21-487e-93e1-2086adb82ea8", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723556, "uuid": "8530a3df-4739-4be7-a52f-fd4e3dae1ea6", "value": "98304:JKaecOMF5q7Fc/1zo6V9UmGSUy/zuLQq4JBO7x/J:J5ecOMFxFxDGPgfq4Jg7xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624723556, "uuid": "7a9948b1-b91e-447b-b458-46d08f8bda34", "value": 3332631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624723556, "uuid": "1d2f7d61-be23-4116-b3fe-5a4d946bb348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723556, "uuid": "91f9abe5-60df-4f4c-ac9c-49d199884f28", "value": "E736B20B7760695EE6B7CBCC7A52CEF3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bda05be-d69f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624726415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726415, "uuid": "86fd2159-0a02-47bc-b624-0dc90f33946c", "comment": "Malware payload", "value": "4e8ece755ac2b0175461c4df0f7ad1c7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726415, "uuid": "e56b9592-1f4b-4925-ad4f-7d086c1cdbef", "comment": "Malware payload", "value": "ca23210f9fb6e852316a88f6f13ca97b558b134ac91e7c972dedfd7dcbd06e1c", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726415, "uuid": "8b3818ca-6316-4c7d-ad15-b6224075b526", "comment": "Malware payload", "value": "be6fde9bfc9ac3d05b2f0d7fbceecceecdd96885", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624726415, "uuid": "b7e05b8d-6ada-494c-bb69-1fbd787744da", "comment": "Malware payload", "value": "8c73a5514323470b7ed2539c366ed4d6cbc5be567cde31dcf89240f3c08abf8e1f5d4bfc05157555429e880b6e1d3913", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726415, "uuid": "8b7a06a6-ab3f-4dc7-a5a2-da1329660506", "value": "A14512C39ADDCB92F542573A2C97C66297C82C023ACFD1C625393993BEF58E49A4117C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726415, "uuid": "1c62b996-c402-459f-b9e3-374cb04f7097", "value": "24576:xuKDLgt2868fMgDGMn+OY4bB/BhQ6xMvTJo/Sh6erA0WbV13mm:xuKXq68f9FY4BQ6+bmx4A0WbV13P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624726415, "uuid": "08f50e2f-7c97-4fe0-b092-d3ade7047f07", "value": 1228072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624726415, "uuid": "ed1c41a9-72d1-41e8-a40d-8a864c9311fc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624726415, "uuid": "9a53754b-933f-47c2-bc04-5515af747ce4", "value": "AAC_RFQ-19002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e4cc19-d655-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624694944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694944, "uuid": "92d902ea-3960-4cd8-ac87-ce9875f78162", "comment": "Malware payload", "value": "0646d2be6a1251ea30c78a072b16c8d9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694944, "uuid": "e329081d-4199-428e-b94c-e01ce0d35877", "comment": "Malware payload", "value": "cbc33a9a7cc70c2ab98efc7d3480dcc748f39eda03040ff31f783cbb7339abc5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694944, "uuid": "1e5566e1-b1d8-4055-9f97-6c2dcc6946f5", "comment": "Malware payload", "value": "3bf170e5d9908b10c1382a553b671578d77f44ec", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694944, "uuid": "e6f92c54-2889-41cb-b4c7-c9971c86957e", "comment": "Malware payload", "value": "9fcd01d962a7a186cb7185d6fef31a85e56a8fa024bb9af3c01990373d5c9d02cf4375563acd481a1cdbee6ce1736b94", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694944, "uuid": "86fa5af2-b243-4c97-9996-99be90aedea1", "value": "ABD5CF2E3AC27AD4C0644E3AC67A04D843F19E5B2172F7AF55C672D4DE3171B632E0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694944, "uuid": "3c478dcd-66e3-4a33-bba1-960ee5acd7ed", "value": "49152:HEF2oLv9McVIampamTec3AUzdsUpawNw90Mmhhv0T:0xlchOUXNw9Ut0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624694944, "uuid": "e99c67b7-06be-4f6c-abb7-9f7640e7b7f0", "value": 2785280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624694944, "uuid": "3f5df8dd-10e9-4eb1-b65b-873598d2aaa1", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694944, "uuid": "3ed32a65-e5a9-4eeb-ac9c-38f8ea37d681", "value": "0646d2be6a1251ea30c78a072b16c8d9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb49f9c-d6d1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747975, "uuid": "4465b159-861e-4c4d-bfd8-09013c8e3921", "comment": "Malware payload", "value": "3ab31c9b5e97b10fd8812650e5f086ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747975, "uuid": "1aa2eaf2-d975-42d8-a755-0f398a736868", "comment": "Malware payload", "value": "cc3a9ec38fe8e8bc8c6f22e59fdd95b51033bfc99fc9c149e002ff098acf9420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747975, "uuid": "0afed20e-f19a-43cb-b17f-ce194a5f58a3", "comment": "Malware payload", "value": "504157231548b7c92791ae1a02fb434b1f64b756", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747975, "uuid": "96756c8d-1dfc-465b-9306-5bbbb3b3cc0c", "comment": "Malware payload", "value": "b25af4c740f1c2a45b7a5bd3a67866032b3992e7bed5abca92b596fc7841e7aea2dbf7c2d412aa7093f82af8984ec4a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747975, "uuid": "b314299e-1547-4ba7-bc94-db017f309d35", "value": "61635C02B2280A47E5931AB4253F1FE057BFEAD025F0B685695FDB568635E371086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747975, "uuid": "ad61c18d-2377-457b-956b-1c084bc2b182", "value": "768:hcM3+VHuQYRPbMlxkSC1yHyx4cDzPH//1ZsV+8uiFzBjl6HHleKnsbmqVr4sGZMe:uw+fYYC1yHyau3/mRkyVEsPkIOwDEz0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747975, "uuid": "c5f9a340-311e-45a6-82ed-56470101a565", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747975, "uuid": "ab7df9b2-5361-46a6-8253-b46320170d35", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747975, "uuid": "13275fa2-7d3e-4f4c-9413-049e392aff85", "value": "3ab31c9b5e97b10fd8812650e5f086ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4707f3-d6be-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624739757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739757, "uuid": "ade54e34-eba4-4cd0-9cbe-94d2a99b2811", "comment": "Malware payload (RaccoonStealer)", "value": "21ab8121e4f4be76154cd35d36a5c230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739757, "uuid": "2646546d-d83a-4ef2-b326-638ec603cbdf", "comment": "Malware payload (RaccoonStealer)", "value": "ceb40abe1bf14b26e4fc311c373a43770dfc67c8a9d0801d8ae7509e3507eebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739757, "uuid": "bb1272e0-0051-4318-b0e7-425faba455ac", "comment": "Malware payload (RaccoonStealer)", "value": "ff09f28117d1ac62f0a2be63a0140bcdc381e902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739757, "uuid": "ff51aab3-2d03-4d66-82e1-0d4dd42a8aec", "comment": "Malware payload (RaccoonStealer)", "value": "3de254f55d748d035b7b23306450d599105ec95ec7d1850402ffef842a4db4b978b16e2473930a445054f25df2b0dc97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739757, "uuid": "9c299f98-5fdb-4a7b-8efc-a343cc226101", "value": "D345D016B798F221D46D4EB00A7643F4A92ABD315912891B72FDB70D2F32DC39C217A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739757, "uuid": "c2534749-feaf-4c8e-8f4e-4b94a61eb8b9", "value": "940e37cc2afec51fd8035d0d4a0942ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739757, "uuid": "d987ffc8-403a-4367-b0d9-79f01ddc51aa", "value": "24576:GxYLC4vpP18rsGQ52x8ELTHXqzbQs9hnLJ369:ovwp9YHHCd969", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624739757, "uuid": "3b48dc25-dc37-4053-b0cb-9efe028f1c0a", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624739757, "uuid": "cafb24f4-38d1-4d60-a6fb-e5012c742216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739757, "uuid": "d427ecf7-0769-450e-99a3-e66543d23ae3", "value": "CEB40ABE1BF14B26E4FC311C373A43770DFC67C8A9D08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3e5eb6-d655-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624695040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695040, "uuid": "06f2e115-df22-45f7-b495-93f4acb09611", "comment": "Malware payload (RaccoonStealer)", "value": "a8cbbdba951de49ff61ebf96f5f7b793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695040, "uuid": "ee04e39e-9d87-431a-b478-ebacf099709f", "comment": "Malware payload (RaccoonStealer)", "value": "d1621aa8dd1273a4b6e4f3e6b83188044af80c6ffe9aba2e7e191f159ce9b1eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695040, "uuid": "5cc86bac-bc7c-4db2-9c07-481dc3adb1de", "comment": "Malware payload (RaccoonStealer)", "value": "7389456ef535facc9fbde433b4286c618df806e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624695040, "uuid": "ab5f7e79-66a2-41ff-a36f-7f128bc2f2f1", "comment": "Malware payload (RaccoonStealer)", "value": "052415eccefed4660e5193e826bd6b53dea766c0897f39c6cf6bce47a1cc1118a09efb3cb19c5c8155a8489cd81d4997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695040, "uuid": "33d1258f-90a6-40c6-b4ab-9795c6728379", "value": "8F0512015E608A33C35A45F5C9BE0184C57ADC2273D3D57B974B78DAEBB2A8610B62F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695040, "uuid": "a8899403-9a24-4783-a376-2d13734dac6a", "value": "561804e327d70d350d3a386252109151", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695040, "uuid": "a9392ec6-fd8e-4e7e-a733-836a8595347a", "value": "24576:vaU93lT2JTn7uQVYiTSOSMID+/PAoQOz4dqo4KO:vaU93x2xn7uQVXTmMg3dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624695040, "uuid": "5af1ab9f-a509-41f8-b538-ec792dff6e75", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624695040, "uuid": "962cd2cb-2b2b-4062-9be5-890556821432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624695040, "uuid": "5b1b6b1a-02c3-4064-bda9-6d14ad714ef5", "value": "a8cbbdba951de49ff61ebf96f5f7b793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7b7765-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747436, "uuid": "4a96cab0-52a9-4ec4-9707-8a414f0eaea0", "comment": "Malware payload", "value": "191b501b6812b124fd4f5feb13447ef4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747436, "uuid": "4988a905-412c-422a-a9b7-f98d3b141541", "comment": "Malware payload", "value": "d337099b42afa14c3ecb6d06043d8fc02dc15457704715df6f2d7f77a6e3aed2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747436, "uuid": "6071b039-81a9-481a-aca2-f06b4a39fbcc", "comment": "Malware payload", "value": "f0a316c93a91debc374e2d33a8ae45d338bfe2f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747436, "uuid": "b3c4c838-898b-4f0f-9756-03816e2b8c5a", "comment": "Malware payload", "value": "cfd04a7afe97afd3bd0409e64db9b8a5479038a06e7d7e36d26891fad660748ec90d80b66bb554f893d72b1c7fc2cd87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747436, "uuid": "b5d81298-08da-4bd0-919d-7e78086f0ad0", "value": "F6639D3AE41A9DA4C0424634B0E5DE361FA2A9C043272D76AFE442B61807DECB55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747436, "uuid": "98607470-0df2-4da9-8e63-39bc5f7b94fd", "value": "1536:wam7dIbOF5lwtHAlp8vnt4c/NrzHT21+hsCDR:wPubOPl0tjTg+hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747436, "uuid": "3213bbec-a427-4259-8cb2-74b2ce424d48", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747436, "uuid": "e0b61e77-1451-41f0-9aeb-0bce3fb683d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747436, "uuid": "7a118419-3a76-4f41-a84f-c4add7733d67", "value": "191b501b6812b124fd4f5feb13447ef4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a5ba3c-d662-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624700332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700332, "uuid": "b54b8fe8-11ea-4873-b0d1-69f921fed395", "comment": "Malware payload (SnakeKeylogger)", "value": "022f6aa1e42810f317eb0d39e2b56197", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700332, "uuid": "ca38869d-5000-4b34-bb38-2571edb5ff35", "comment": "Malware payload (SnakeKeylogger)", "value": "d9495cecdc41dda48c3f32184976be55b87455c292ef3a4627740e1e67bd75f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700332, "uuid": "0989b5e8-fe13-4066-8cd9-12d3c75c3c10", "comment": "Malware payload (SnakeKeylogger)", "value": "32179e886741d89f7037623a5c6e7de201892247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700332, "uuid": "70350df7-6ec3-47d7-8734-b13d3bd8923c", "comment": "Malware payload (SnakeKeylogger)", "value": "0c9b8b7a39a42faef6785dc67328453c72bd44ee1c91737e55c107fbedd11c5bface943b959b077ee6e9f067d2eab51b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700332, "uuid": "69b5d674-8322-4558-8c98-06435db47e0d", "value": "E1941A6E1AF1AF7DF90AD1B620C64D011EA4ED61ADCAF94BB77E2C910F20514FE03946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700332, "uuid": "a5fde86f-65d0-474b-aa03-b36f16229aec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700332, "uuid": "f4a5ceb3-62b9-4df0-a052-eae1f14ecff0", "value": "6144:HPX2wgBI8EVi+ObvMsCEZXMp0TKL3V1Cq8/hWKVmKfAKH:Hv2wmI5TOj3nTYqqGhWimK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624700332, "uuid": "3d1594fa-3a8f-402b-8fcc-25d58ad86d23", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624700332, "uuid": "a6320d83-79c4-44dd-a1e5-c899ce3a9c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700332, "uuid": "792172d3-0801-41d8-b14e-3e3da8abe4a2", "value": "022f6aa1e42810f317eb0d39e2b56197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06394401-d64e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624691616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691616, "uuid": "db91d1d5-db71-4c03-b926-c59cd404ae14", "comment": "Malware payload (RedLineStealer)", "value": "5c3204e6915eab6113dd6ee3a2de7779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691616, "uuid": "4ef22e1b-2a0b-46bd-81ee-3ff95e0b42f4", "comment": "Malware payload (RedLineStealer)", "value": "d9f6f258e09d8a365d2d570732d36b175d305feeded2850a958f3537d5f30cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691616, "uuid": "02dd2ac2-4fe5-4a50-b6ea-d0567083b241", "comment": "Malware payload (RedLineStealer)", "value": "ea23f0b6c3910b5c74823d31e3c4ea26d8b2986f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691616, "uuid": "ea8f03d1-e38f-483c-9a86-6b7e2ff3c250", "comment": "Malware payload (RedLineStealer)", "value": "96c618b3584c7b4349e11b7de73bc31b2a6770fdaf61f1bd44791e3252cd7e6a20a0fcd106969f57c217cb8a04cd9930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691616, "uuid": "b7542213-d745-4ac6-8709-638e077f0d59", "value": "4794AE11B6A1C035F1F602F89A75D3B8A53E7EB16B2450CB12D4EAEE5634AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691616, "uuid": "fbc1ac14-684d-46d7-905e-69d18edc3d54", "value": "95c98b49c73bee041cc2512ce9afe8b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691616, "uuid": "18eee8a7-abcd-4c6d-b700-d70510499bb6", "value": "6144:HSRNqJA0Ux4dxGXS/51IwAuL6ZRZ6n2Q8KB2ySkxg5PXZ+imik:mNqJA0UkIS/fIwAH6n2PKQySkUhsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691616, "uuid": "9e988c38-3a93-4aa7-9677-ded196f4e086", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691616, "uuid": "813b8f5b-bf02-4b16-9696-37b1997b743a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691616, "uuid": "acdc8df2-4df4-4670-aef6-9200300079ab", "value": "5c3204e6915eab6113dd6ee3a2de7779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa1840c-d615-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624667338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667338, "uuid": "e1387780-a0f0-47bc-a170-8189e2ba56fc", "comment": "Malware payload", "value": "5562d4b0b0707245170b795a79422da3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667338, "uuid": "2ccf313f-3ad4-446c-bc96-f327bd827631", "comment": "Malware payload", "value": "dafcd9bc5e53c080eb9d4054c4b5cb802a2a218068448613b1487cc63c6da031", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667338, "uuid": "3c2bc87c-76b7-4d91-9d04-b02abf436d88", "comment": "Malware payload", "value": "6589763db24cfc1c14a4355e61440de95d18f508", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624667338, "uuid": "4c58cbed-211a-422d-b563-4e3cbfc639ef", "comment": "Malware payload", "value": "2187888e6d12793a0e9edde97c4bd080dff88634fedd357dd208ac178b098b265df9468f3e2f6eb76897a0cf08de5c1b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667338, "uuid": "52a766b1-d05a-4a75-96d1-02f7f187351c", "value": "F0F0C0654D3ECECA5967D5D890F6E54CE9A37B20108CFE0043DCECC66E84B48C3922C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667338, "uuid": "a14a826f-63c5-4ba0-8af6-203ce6aac198", "value": "12:c6QclfhTD5LWy0cqSPsnWRcYnf37kYtzNk6ULWzB7BYMSe7k:csphCdcq96frkYcpE1YMdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624667338, "uuid": "90c96859-8b50-44fc-876b-3d9f2bf30bbc", "value": 538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624667338, "uuid": "deef6995-71bf-4da9-9277-4fb5850328d6", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624667338, "uuid": "8cfef04d-a7b8-485f-9199-a832633f7e7b", "value": "word.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207ac3a0-d66c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624704545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704545, "uuid": "e75e7746-582b-45e8-995e-4a90dfc4788a", "comment": "Malware payload", "value": "98b8b91034eb638b4ff7d4963c08aa61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704545, "uuid": "66001c19-f66b-4c06-a231-0e434a54f8f0", "comment": "Malware payload", "value": "dafe70cbc4be879f7eafd15ecb2caf9bd3db72685512dd8fadd13dda367d3156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704545, "uuid": "1e408dcb-f1c3-49fc-8eaa-d8f6d9850f12", "comment": "Malware payload", "value": "a4384c454f19f059aea414b5d8c50097dcdd1a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704545, "uuid": "ce9dc9bb-5863-4abc-abd3-f91e6cf91fcf", "comment": "Malware payload", "value": "9f277d447727c018c2a263c9f56be67de2d141659ffdb833d8f7c168724d81b00879bcd77b6feb809d387cd85245db22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704545, "uuid": "574110af-5c83-478f-a3e8-05ca4e81f723", "value": "88748D00A691C035EBF212F8897AD3AC913DBDB05B2550CBA2D5EBEE56356E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704545, "uuid": "c369df83-a5c4-46ca-9b89-448ca385896d", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704545, "uuid": "03412aa3-d04f-4c53-aa5d-36b08b5293de", "value": "6144:xPw8yRhChk8qk2czLQP/OkMmmuYClEmuKoZciUZCW+ni2RIz6aKZOOkP:xvxq0LWOk/q+EmGZTUZ/Fsak/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624704545, "uuid": "599fd7b6-0e9d-47f1-8107-6e85d626dc7e", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624704545, "uuid": "150712cd-afb5-4b4d-bbdd-1e84db446f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704545, "uuid": "fd8d2b68-1508-475e-969e-68c3e3395eb9", "value": "98b8b91034eb638b4ff7d4963c08aa61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa89d5a-d655-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624694898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694898, "uuid": "fccf9bb6-02df-4acd-98c9-fbf32143b7da", "comment": "Malware payload", "value": "b95107de7ede70408944caf2a5795044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694898, "uuid": "aebaa386-a691-45bd-ac03-3c8237b811ca", "comment": "Malware payload", "value": "db6707dfd3c466dd3265628f922abb9908916f58ee47d9575cc45233a858e3fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694898, "uuid": "5cc988c6-2bf4-4fee-bd1d-01716ec8efd0", "comment": "Malware payload", "value": "b337066e2a3ab998c772c07294a09ece998912e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694898, "uuid": "b17d0781-9b74-4d0a-a6ab-d6ef57769dca", "comment": "Malware payload", "value": "9128b3225f4e814c30860493f894c6ea2d3ec17cf1231bec1a788d46da84999971961eb397173cd7c189cd7b3b584d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694898, "uuid": "5c7d3eb4-1522-47d0-8853-40701b00b644", "value": "8F450110A2A1C039F5F652F8D97AD6AC593A7DF19B2100CB52D1EAEF96346E2DC31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694898, "uuid": "455bfea6-cc33-4802-ba47-07e90e0fed70", "value": "317e1613a74924db7338e46c59a9fe90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694898, "uuid": "1f285ba7-0ec6-430c-99f8-31980be7a574", "value": "24576:ewoHyFZCsqTdogOBX3jGBDq8lY/SNFbyQae:3FZCss/OZym8m/SNNNae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624694898, "uuid": "3d3a2799-8443-4952-ab6e-01cdbb7831be", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624694898, "uuid": "d38e8ded-3f8f-474c-8144-0eee9d597155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694898, "uuid": "b683171e-62ea-44b5-9c37-b2c789f3afc0", "value": "b95107de7ede70408944caf2a5795044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be07d50d-d64b-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1624690636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690636, "uuid": "8580bb84-7a30-40a4-bbc6-142529e60877", "comment": "Malware payload (LimeRAT)", "value": "377e4866436af4d7c7e8ddd040a8ee97", "object_relation": "md5", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690636, "uuid": "3212b7c9-3065-497b-83de-b8febd86e0cb", "comment": "Malware payload (LimeRAT)", "value": "dd6701ceed97d8873151a33f9f717eb6591a7b12d06c79223fec600382160cb8", "object_relation": "sha256", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690636, "uuid": "1e08fe94-a198-4a19-8815-98489d656d24", "comment": "Malware payload (LimeRAT)", "value": "6b3dfb3f71627837611499680bd6aa9ab27246c5", "object_relation": "sha1", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624690636, "uuid": "17ed3be5-bb16-40c6-a309-64269db63cb9", "comment": "Malware payload (LimeRAT)", "value": "9543a01a8dc033f1b4bde2aeff65c4a674d6f7b800022e0151938b6b72dd3f9c1e6e7765b47a8c43b974f06ab6ba4855", "object_relation": "sha3-384", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690636, "uuid": "cd872e59-b9c9-4aed-9abe-0b6c8e4a6a52", "value": "42451231F4DC190BC84E203E4D7482D78E0DAF6A33596939DA35FAD5D236A3443B269B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690636, "uuid": "0b7e0299-320c-4710-a005-b8e532a37f45", "value": "24576:N9gh0YPz5f1n9v3IoLCNgEj+jbw34vpe6Qiyf6:H2/N3j0gpjbw3TiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624690636, "uuid": "8637d0ce-01ff-49d1-a5b0-35a455df9ac3", "value": 1201304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624690636, "uuid": "74f9be81-f6bd-456c-9bd3-f142b7760601", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624690636, "uuid": "9d79ac46-938a-4b9a-b18a-2c59db8718a8", "value": "Promotion \u00e9t\u00e9 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81cac14-d63e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624685123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685123, "uuid": "144c82cc-1e4f-4f0d-9084-cc2facb49bd2", "comment": "Malware payload", "value": "65a6466c853b7deda7623d9c37595f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685123, "uuid": "43357a57-298e-44e4-9ea2-a9c620b5fcc8", "comment": "Malware payload", "value": "dd7467326b5dbcd055941e33656f809480735384e671e20b91fe5ab6cdf15dc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685123, "uuid": "228612e3-cadc-49d3-8684-238b9067c9b0", "comment": "Malware payload", "value": "7f8b93127b2da650ff3d94d8b35a7a20ec23ef4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685123, "uuid": "f22e04fb-acb6-4aee-a9d8-069dc66261ba", "comment": "Malware payload", "value": "274182391e9825410ecb62e337938f3c1e2113307f6c4fa11a55f6d3cda57bcf23a0a19698cda1c7b0783225bc2374dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685123, "uuid": "d8bbc0cb-425a-43ed-99c8-4c8a9fdc0c0c", "value": "48D1970073F88B36F9BB4F7969B352011539B756ADA3DBAD5484121E1D37B804E62B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685123, "uuid": "b387ea53-3188-48e3-a437-3120e1f2e472", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685123, "uuid": "6f99b9ff-36a4-478a-a1c3-c46fecfbdcbd", "value": "96:eSyPSk5qoiclzRTcgGxB7Z6CFrqQzI3/8UjDCyJhzNt:eSyPS9LKZGR6T/8Uj+yJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624685123, "uuid": "ac2fe772-1b45-4954-8d1a-0c98e15b785f", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624685123, "uuid": "4d468c80-bde4-4a54-bb4a-b6510c9ab358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685123, "uuid": "a126200c-06e0-49fb-9baf-73e05619a224", "value": "LOLOLOLOL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc47a1b-d662-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624700326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700326, "uuid": "bacde09f-6f35-40ac-9686-0baf5aa9ccd3", "comment": "Malware payload (AZORult)", "value": "8a77bc53e303338385897ce4aeece39a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700326, "uuid": "308498f1-2645-44f9-a285-58a42372037c", "comment": "Malware payload (AZORult)", "value": "dde3a0acb5af6979e3f72ed3642625189521667da37534f8b60394fe02be5e97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700326, "uuid": "4746095d-7aed-434c-8796-1b339dbe8766", "comment": "Malware payload (AZORult)", "value": "380a3cc13e2a2ee9ce01d45f8432702da3d7f359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624700326, "uuid": "77e07db3-eefa-42f8-9803-126a46cfdaef", "comment": "Malware payload (AZORult)", "value": "6e2acf81719bab66daf1a971ae59815979557da041bb03d43f1bdafb80e9d03252fea242998f94bb0e7a3d1e633382d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700326, "uuid": "3a57f366-6b1d-4dd5-a37f-0335d0d4415c", "value": "E7849B77B152E92DD773C13DA0A2E109BD634E171CF646091BC473FD8636AA8AA31F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700326, "uuid": "0d585fce-43e0-49f2-b0fa-866474cc7dcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700326, "uuid": "f64d3a8d-92c6-40c1-bc59-dd7348e2a202", "value": "6144:xtvLOOB7nHqz03Pr3Ie2cKc5vnT9H/uEiSr80LD9uPTR1NdCyWkk:uUbv3j8c5vThuiD9ubNdC33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624700326, "uuid": "a9b91e12-5b02-4c8c-bb57-23b0283abe92", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624700326, "uuid": "029423f6-7ae3-4c22-a0df-10829ef62140", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624700326, "uuid": "dc1a2f25-ebc4-4b1a-8b46-29397c9de296", "value": "8a77bc53e303338385897ce4aeece39a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0efa9ee-d653-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624694157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694157, "uuid": "57e2d30b-55e7-4580-8995-9ca36fbabcb8", "comment": "Malware payload (DCRat)", "value": "8e4bd512d1ac215f567743a771532008", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694157, "uuid": "738cf26b-d898-4785-9551-54a79f5930e2", "comment": "Malware payload (DCRat)", "value": "e1168abd0c24c43423463607b92547d5a2365d7fcbd8e6264f7a1b2f91328d6c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694157, "uuid": "bb732bfc-5f13-46f2-a7d5-f171b872530f", "comment": "Malware payload (DCRat)", "value": "4b1b95b50fdde612ad00960ca1859687aa333844", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624694157, "uuid": "5974ba88-c276-4c2b-8e00-7acce180a5fa", "comment": "Malware payload (DCRat)", "value": "0c429cd77068c3c447feb5cebe68d8d07e9c7bf1f9fcdab561d520c1a1ac6108bfb8b6ac5a28ef9526b6a004941dd4fc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694157, "uuid": "c0827554-f210-46d2-befb-108d96331d73", "value": "45151202FDD195F1CA611931063AAB21697DBA301F108EDFA3D84D7CEA711D0EB35AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694157, "uuid": "fc7bfdd1-cd0f-49e9-9be5-7449b22a6874", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694157, "uuid": "724a6a06-90db-420b-90ad-140518bfc54c", "value": "24576:M2G/nvxW3WzNUARcOXS9vfBmBU84TEBM4:MbA34ULOC9oK84Y+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624694157, "uuid": "ac26850f-1443-41e2-baae-e2c23b6cd743", "value": 926067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624694157, "uuid": "687f0300-551c-400d-bf1e-80e11572aaa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624694157, "uuid": "28714e28-d1e2-4c76-bcf0-4c44898c2667", "value": "8E4BD512D1AC215F567743A771532008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bf8723-d634-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624680450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680450, "uuid": "67b22827-b608-447d-bc13-7137658bace4", "comment": "Malware payload", "value": "a115f8ce5297ee91348fec49889eea23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680450, "uuid": "ebc857f5-ccb9-424e-b854-3f0675a1d70d", "comment": "Malware payload", "value": "e45164555700bc491659b55361a3c3fd44a7b1c411aa8f2e32ed11c4ec703ee6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680450, "uuid": "15c6fca9-1a95-4aec-bc50-0ae529bd9244", "comment": "Malware payload", "value": "ebaa385ca38e1cc94c2cea2b629169b22ed19dcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624680450, "uuid": "78c858c4-fdd7-46ad-9bbb-7b9a489eb26f", "comment": "Malware payload", "value": "371c171954b330a31c1e8537a5adfb104c067013058f0c5bb868b434f91bcf23006b8457c23368b963ac85883a6f875f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680450, "uuid": "b620879c-2a05-4fa6-89f6-a1e0a01017be", "value": "3656237726660146C0EACC3A992B7DE4B1F197365F82DC7816EA6DC023328F5F31B952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680450, "uuid": "e1f59380-e5be-4f5d-a924-8b24e9d0ac7f", "value": "b07ab959f99397ac2b65e475966d4148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680450, "uuid": "c2f2862f-b920-4fc6-a796-ffc3a0472c9b", "value": "196608:5xCpGLeUrrz3yY6SpyVYbVudVyNuWAD3:2ODPz3ygpz8dVyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624680450, "uuid": "5dd8fee7-28b8-4061-afbf-797095396bd9", "value": 6457344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624680450, "uuid": "fa94d63e-3121-4df6-bef3-3af59e57d476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624680450, "uuid": "ae7075ef-dcca-48a8-b569-09b885e9bbdf", "value": "a115f8ce5297ee91348fec49889eea23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f98ac6-d666-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624702058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702058, "uuid": "8b2a5c6d-7343-4893-a296-3cf14fe71aae", "comment": "Malware payload (ArkeiStealer)", "value": "0ddca12532ab638fe8c4a75ad574d994", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702058, "uuid": "e6ef5a70-338c-4e8e-bddf-7ea172cfedbe", "comment": "Malware payload (ArkeiStealer)", "value": "e8104ac6fcd1052611d0de47d66087dccd5e2a0332b26d90d2bd9a68c903330b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702058, "uuid": "309628dc-511a-4ff1-8cc5-6d9cccfebae7", "comment": "Malware payload (ArkeiStealer)", "value": "2e962848fe128e3d915605d23af40c016df4fd7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624702058, "uuid": "294b1f05-fb9d-4752-a703-22117c930a8e", "comment": "Malware payload (ArkeiStealer)", "value": "d9ebcd7febd9fab333332f5325dbc79669511a7225ba23f3ecb2870076ea2c85a809ae56147369b65fb3b2e4e03a805d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702058, "uuid": "d928966a-cc7e-4697-a983-19bacab063c6", "value": "F9E4D000B692C032F6F212F89D7992AC653D7AA25B6451CB52D4EBEE1B346E0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702058, "uuid": "72953299-6221-46a8-a792-07e77c6dd77d", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702058, "uuid": "29c44e84-903b-4310-94e4-ec9c8a8eea30", "value": "12288:ChVlh3frxYt9NjqwYg3boLiY6vwDtQfEQqhFgh:Olpu7IwajDtQfEto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624702058, "uuid": "e786187c-878e-4050-81d0-329ad5a551dc", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624702058, "uuid": "5087323d-0458-4820-b0d3-68e3ce25f810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624702058, "uuid": "f98c3928-40fb-4dc5-9726-473e4b8af236", "value": "0ddca12532ab638fe8c4a75ad574d994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b5df12-d649-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624689466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689466, "uuid": "9cb2399c-d1e1-40fc-9f93-6eaf72eb4e20", "comment": "Malware payload (AgentTesla)", "value": "155d32c21e92d6600061461b819322ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689466, "uuid": "3955ec1d-6cee-4684-91ec-dc093a7dc5b5", "comment": "Malware payload (AgentTesla)", "value": "e985e128f42a39a12abe1fe1a047c4f8a7627ff9b3de6672b4b595348ccca916", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689466, "uuid": "78510c52-bf3d-4ff2-8ad9-671ca048ce00", "comment": "Malware payload (AgentTesla)", "value": "d59204273676d0e6febf5b6cf6f7a5cf0ec63b89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624689466, "uuid": "a4fc0c50-bb0c-42f6-bd38-d22ccb0d9076", "comment": "Malware payload (AgentTesla)", "value": "71da6c873a627a639f9d61fbb23e5d27b0aa750ca053873b68730c30dcc5d680b05ec1fffa42012a863e51cca179799d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689466, "uuid": "39e58705-5ec9-4867-9208-822575961ef2", "value": "7EA4DF8837B95FA2E5BB4BF91674611083F9692B213EF54A5CC330C606B6F404CA5F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689466, "uuid": "a0bb399f-5594-437e-8dae-a7cc5a56648e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689466, "uuid": "ab730d95-9094-4819-bd8c-a52de8f57619", "value": "12288:w629Sh6/pVkGCXpLAoaHNaxUeGXrgjrBGs599tjID:w6qSh6/pCvXpLAoaAOsv5HdID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624689466, "uuid": "29cd3ec2-d394-4aab-8645-19d7b0489e68", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624689466, "uuid": "fd9e5f89-3d82-45b3-adef-74a0c5fffd0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624689466, "uuid": "25d59796-baf8-40e3-adcc-439285b5d3d9", "value": "NEW P O 121120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd06277-d65a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624696863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696863, "uuid": "c8cf8f9d-7a48-4188-b1c1-16e4e4663b88", "comment": "Malware payload (RedLineStealer)", "value": "ae7b227a15dcbb03c98eb3c521a144a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696863, "uuid": "93f3869a-185a-43d3-82be-54455c0cf679", "comment": "Malware payload (RedLineStealer)", "value": "e9b1c69cc3df6d07ee61d511ea52dc2e24f42cae98c1c9776ebae6021376606b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696863, "uuid": "18a6d5c4-3179-4d51-a6db-ae8b71d62962", "comment": "Malware payload (RedLineStealer)", "value": "98de70d297f81378fbeaba757c55c75dea331054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624696863, "uuid": "705e9d84-611a-411b-8adb-601b7b21715a", "comment": "Malware payload (RedLineStealer)", "value": "98a7f9ad89d224e261740c714c4553279d9c81645118fd67d822f400baabc0362c7580879089509330d9b763ea55b494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696863, "uuid": "13eeaaca-96a2-4046-ba07-ab7de87ab31d", "value": "FC840428647FC01985E3EEA12DDCA8FBD89A95E3640D743701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696863, "uuid": "4e815a56-bce0-47b0-a66e-26896911e314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696863, "uuid": "18185e38-1388-4a38-879f-69afa7205efb", "value": "6144:I5Yqofb8asQ6Z5/M733+LYK6Tv/3vVwVmh:I5Y3fb8asQq5/M73uLYK6Tv/3vVwVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624696863, "uuid": "9559f943-940c-4afd-a819-ecfe05a641d8", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624696863, "uuid": "97af2248-a0ac-492e-af7a-156895df8f11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624696863, "uuid": "81a61582-37a5-4fbf-ac3a-41fd6533bf1d", "value": "ae7b227a15dcbb03c98eb3c521a144a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b40703-d645-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624687860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687860, "uuid": "9816dd03-509a-4aa8-bbb7-8d9b7206bec3", "comment": "Malware payload (RaccoonStealer)", "value": "a0d3c0ebbd5fbdf61022416799f551ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687860, "uuid": "4e0a5b3c-e79c-4bd1-b9f1-c113a1102169", "comment": "Malware payload (RaccoonStealer)", "value": "ef1d91fe25dabf1bdc5786fda6a80ec716e28742aeda9513130cfd47c5da4c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687860, "uuid": "c08ad059-075e-4d6b-ab88-f83112e821db", "comment": "Malware payload (RaccoonStealer)", "value": "27091fa3cc338e13ef056769e917c37b6bed2b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624687860, "uuid": "a032c2ac-1311-47e8-bfa9-dc69eadf08d4", "comment": "Malware payload (RaccoonStealer)", "value": "944bae2c3b0adec49f8cec6e6a888d4ed6fc9cc102dd5a75035c2136ac30379eb02586da119be3366f17cc10436fa45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687860, "uuid": "332d0b73-6eb6-4e34-b8bd-6cfb8e1608c6", "value": "1BC4D01067A1C038F5F732F456BA9278E9297AB16B3490CF62D516EE57246F0EC30727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687860, "uuid": "9a7eace1-6710-4151-8922-853c6873b45e", "value": "fd6ceffd8ee4d2c3457149f5628cc57c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687860, "uuid": "21aa8406-972c-4fc7-b458-34e790e96df6", "value": "12288:4+G5w/RZPH4r7Few8jTREQ9pzjHy+eLDP0:ZmA44j3REQHvHy+eLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624687860, "uuid": "2879c80f-cb1d-40a4-9735-6829b60f068f", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624687860, "uuid": "50eeed8d-14be-4fb3-a2d0-fd3d8bccfdd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624687860, "uuid": "dae4fc25-8e91-4052-8cf5-2e5da9c5b1e5", "value": "a0d3c0ebbd5fbdf61022416799f551ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad43c51-d6cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624747431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747431, "uuid": "202e2791-2864-409f-98f1-bc6b5497094a", "comment": "Malware payload", "value": "e5ae718b883501f80566a31886011c83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747431, "uuid": "5f3eca03-d5ce-46be-8579-7910c45eeca5", "comment": "Malware payload", "value": "efbcba53427059ef47bb994c665ad2103168f711e99c65417d97d58dae1ffeb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747431, "uuid": "2bce9222-3217-473c-aaec-856e091f8488", "comment": "Malware payload", "value": "02a96d02b6e941c8fcd22bdc6e845a6f41a6912a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624747431, "uuid": "cad85977-85d8-4239-911f-22c7f83b024a", "comment": "Malware payload", "value": "d3efb0655976753de579ef90bd1bd6140ea03ec9c309614dc679b3096953448967f60d3d8502a4efff924711f6acb026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747431, "uuid": "3f759c27-803a-48bf-9a20-8494d8172b08", "value": "BEC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747431, "uuid": "417bd256-4555-4c2a-a45b-9717a87a6d8d", "value": "3072:ekYPUfsgnsb0J2ag/VfvkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0vkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624747431, "uuid": "1a390b5e-8d6d-4216-af7c-20172eb28b2b", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624747431, "uuid": "7b9f1b8e-3411-43dc-9646-54d6c5b865a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624747431, "uuid": "c14dd391-5fb1-493a-b777-800de1d5a6ec", "value": "e5ae718b883501f80566a31886011c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c969bf4-d66c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624704538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704538, "uuid": "26265869-8dae-428e-8c73-8cf1ae9ef830", "comment": "Malware payload", "value": "3d2c9b8d43b681155bcd42156689e0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704538, "uuid": "9e64e803-504f-4d96-b4d1-887e41c8948b", "comment": "Malware payload", "value": "f24b525295374178f81ce9b8a6ab6c0bca5ea718e6286833116268d27f8ec847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704538, "uuid": "910df8ce-a9fa-4018-95e3-6f738dec5c43", "comment": "Malware payload", "value": "6f984499f0956671e00487b84f6eaeb1b52350c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704538, "uuid": "1a538e40-2d5a-434a-b60f-999264333195", "comment": "Malware payload", "value": "29f3641c648e7e6819fdc7bfe510377379cde27bc52fae3e6663ea87e20e0d9fd54488bec6d73b26ef130b1ab87fe6e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704538, "uuid": "5176e615-66da-4db1-98ea-f5405cf1ff35", "value": "D4748C00A6A1C035F6B616F8897AD3AC953D7EE05B6050CB62D4EAFE56382E1FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704538, "uuid": "85a030c1-22fe-46cd-ba8e-201a1401a6b2", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704538, "uuid": "bb50984e-86de-4703-9317-2050dfa4c6fd", "value": "6144:vlw8ChT4xkz6n7hcHLdEc1++p+XMX1p5MnnAfCc5RBff+vYu20ZdtF+ikP:vRi6nAic1pAMlp5Mn5kV2WqXEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624704538, "uuid": "fcd61b3d-fb1c-4c4f-811c-8ed94350d6e3", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624704538, "uuid": "548e0b87-7940-4d11-ab06-054bbbae651a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704538, "uuid": "86719e31-5cc2-4fc3-9795-594fc005bdd4", "value": "3d2c9b8d43b681155bcd42156689e0ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b4485f-d63f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624685361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685361, "uuid": "75bc3451-03cf-4a97-9e0a-97025ab6df84", "comment": "Malware payload", "value": "88ab0bb59b0b20816a833ba91c1606d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685361, "uuid": "d1d3510c-46ca-4324-ad44-b37060353f3a", "comment": "Malware payload", "value": "f4fb42c8312a6002a8783e2a1ab4571eb89e92cd192b1a21e8c4582205c37312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685361, "uuid": "b194a594-5a3f-4fd4-923d-e94400acb2fb", "comment": "Malware payload", "value": "72c09b7789a4bac8fee41227d101daed8437edeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624685361, "uuid": "950f2067-9116-48fd-9863-a704bdc0a367", "comment": "Malware payload", "value": "043522d31b2e44423f69099ecfbaf5c18a83c19cf38e23948515e67301471e5d957060c832e1552544b5dd524b1929db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685361, "uuid": "55976716-397c-411f-9ce5-fd7e133192f6", "value": "1BD5336065E86973CB19B5FB180B7C2193E216C1D535E99F02532BB9A280FB0478FD6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685361, "uuid": "5f536d1e-9437-4b9a-8365-26ac62f7c54a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685361, "uuid": "577114b6-de94-4c0e-8bc4-b2f08a8e1fbc", "value": "49152:AsmhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gxr:6qXpy05Q0N1rsYSZ6BoXh1kkypSH3Ohs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624685361, "uuid": "fe5b3dc2-1427-4330-9786-e6c31bda5704", "value": 2960896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624685361, "uuid": "91b65d27-719a-48a3-9d4c-efbe6d7efc10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624685361, "uuid": "1e680f8d-85f8-403e-95b7-3d00cbb996d9", "value": "RtkBtManServ.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2fdbb3-d6ba-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624738419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738419, "uuid": "7b742f18-35eb-460f-aeae-d114ea12f815", "comment": "Malware payload", "value": "6b7330fdfa23526aac20743714a7956e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738419, "uuid": "a3dc825f-f6d1-4a23-a17a-7fc1ca1117a1", "comment": "Malware payload", "value": "f505d98bdf476da2b324ed587b67166965c23a105efdef507c8cf56d6a1a9574", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738419, "uuid": "abf3be6d-55bd-45d0-9c9a-c2a5950eceee", "comment": "Malware payload", "value": "10021215937520de4b099bd354c35191e27ed924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624738419, "uuid": "f180ea8e-4eee-4608-babb-466cc8562fc4", "comment": "Malware payload", "value": "6f04d38f4cbcd612494224a5abac84c08eb1a5ef8b2fd4b9b65bef05e094dd0d9029f4416bb25c289b03a9f2dee5195b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738419, "uuid": "42861252-adb1-4466-9dd6-2dc90b0b1568", "value": "D403F1D7E51C85B5EFB015A5AE2B4042914B3CADE4849022F7A0807F1BE22F1BA9D5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738419, "uuid": "7dc29aef-259a-499e-91fe-954c0453b2c2", "value": "768:nkJ56p6b4LMXOPAppDyVsgrgepgy52Q8Lw956eKpNDq3U7VW:64p6b4Q+PGGVsgrFz6w956bpN30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624738419, "uuid": "a922033f-d1e7-4506-8d0e-b9835cb62adc", "value": 40876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624738419, "uuid": "76563d1d-9aed-4555-a044-d0432d679c70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624738419, "uuid": "aa279f86-5f2c-4228-a41c-203a935b7da1", "value": "6b7330fdfa23526aac20743714a7956e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a50d878-d66c-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1624704535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704535, "uuid": "844aeecb-d030-441e-ab37-e73ae0d15b88", "comment": "Malware payload (AveMariaRAT)", "value": "a850b4e18c250176d49a77ce4c66528c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704535, "uuid": "d99c3f54-2121-40fd-a2d6-6af5148f668b", "comment": "Malware payload (AveMariaRAT)", "value": "f6e357715fcfc1901f22238ac9c840d4ee4e77a0652037dd70f42c6117fadddf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704535, "uuid": "dc7b604b-5056-446d-816d-dc46a6b24a2f", "comment": "Malware payload (AveMariaRAT)", "value": "ec5d90d406818a40c4c950e58803cc17d1d4c1fe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624704535, "uuid": "cf533312-60ad-452e-90fc-78c3fa68b5e5", "comment": "Malware payload (AveMariaRAT)", "value": "3bdc7ffdec7e3a0066dde72d9634d691f2e2613b7ff37c3764216901448e0d5c6cfaa07fe5aee6b369fd03c68f969e71", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704535, "uuid": "2f61ec40-62eb-43ed-b097-a87900adc5bc", "value": "BFB39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704535, "uuid": "1b8d90a9-38a2-4721-8f12-bc01401fe9d8", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704535, "uuid": "4df15b67-fd6c-4970-8d6f-16d9963e5cbf", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01c:K1VmhaH8EFvW+0OVE0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624704535, "uuid": "d2b76075-ed07-48d1-9d7c-0823ae0b81f3", "value": 111341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624704535, "uuid": "0e6062f6-cae8-402b-acd0-c6b44fcad881", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624704535, "uuid": "65cb9181-b80e-4b0c-aa95-534911b63052", "value": "a850b4e18c250176d49a77ce4c66528c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a7d0a9-d698-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624723695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723695, "uuid": "099c84df-d918-4b74-9df6-34fa741967e0", "comment": "Malware payload (ArkeiStealer)", "value": "d4befb45847d5c541759313114ef26e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723695, "uuid": "9221ced5-d48f-4b9d-8597-a3080912f425", "comment": "Malware payload (ArkeiStealer)", "value": "f8359932a1480eee89d736aaf15b28447624cb2075a8cba8b3893e73b5cb4ae0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723695, "uuid": "2fde51e4-a2ec-4a3a-9189-d7ae5e28e9f4", "comment": "Malware payload (ArkeiStealer)", "value": "bbe7424d7201c1bbfff2abf808831119c7ee93fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624723695, "uuid": "0029f22b-5060-4b64-ad5c-d8ec85045cfd", "comment": "Malware payload (ArkeiStealer)", "value": "d53ddb3a521647276bdf65097ba0ccec44a720bc46d55b17a5992e35709a62bf96fa4387b6518d4325c8fc04fc6d6006", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723695, "uuid": "e75b553d-4eb6-487a-9395-006bffc5eb33", "value": "28E4DF00B692C036F6F201F89D79D3A8643E79A15B6441CB62D9EBEE1B356E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723695, "uuid": "e5d2d4e0-923b-42fb-9b8c-80aac760c576", "value": "1465dccf6e4ac51fee47e91b6181067d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723695, "uuid": "1acfbde4-170f-49f6-aafd-bc875fd5c895", "value": "12288:OBil33faxYt9N7M4rDDLQUce8ykZt2nkiQD6+9nNkE8WZe:Bl/T7xM4PDLQUKyAYIBZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624723695, "uuid": "3bec7195-9791-4fd8-b2e7-0e5fe67c6700", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624723695, "uuid": "b70e69d7-7c58-4abd-891f-b868329bf642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624723695, "uuid": "f969ad63-fdb9-46ec-8448-89c2d25c3ded", "value": "d4befb45847d5c541759313114ef26e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fabe290-d6bd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624739467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739467, "uuid": "29406c7a-0c15-4614-94d5-326a6ac63054", "comment": "Malware payload (AsyncRAT)", "value": "3d6f7d26fe3d241616b2c4487d41c339", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739467, "uuid": "d70e93e9-bcd3-4d35-9d09-9709ea677229", "comment": "Malware payload (AsyncRAT)", "value": "fbceedf8a40ce3a3828b60cc158f755759d7905b54155de3cf2f34389b7161c1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739467, "uuid": "29cc9e5a-e214-449a-820a-44baf22aaa42", "comment": "Malware payload (AsyncRAT)", "value": "26d311eff092c692a4af2a16d12709cf8945fab6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624739467, "uuid": "49a0647d-0bbc-41f8-9288-99390e75309d", "comment": "Malware payload (AsyncRAT)", "value": "f3ebfccacb81ba6a3f02543320624b82a15cacebf9106b9f4548b3bc52ee5169b80d121464578a45deb141231fe3f7db", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739467, "uuid": "87147166-1682-4646-a8e7-e7757987d489", "value": "1E231B103BE8812AF2BE5F7899F22145867AF2633603D54E1CC451DB5613FC69A42BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739467, "uuid": "c35401ba-b5f4-4c42-829b-be0dd439097a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739467, "uuid": "8c93d0aa-de9f-4560-8b6d-73f6591fe8b5", "value": "768:xuiGNTdFHLBWUZiGrmo2qrjO5QyJ4PiNjPISzjbwgX3iWcqcXBjGwkBDZ6u:xuiGNTdBR2IO52iKS3b3XSr1Yd6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624739467, "uuid": "9e1cec24-0a55-4681-9370-2f62e842fd50", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624739467, "uuid": "7ba32a0b-a791-4efd-a5d3-0fa139fe5ada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624739467, "uuid": "8defbfec-5236-42a0-952e-86939b6e4880", "value": "FBCEEDF8A40CE3A3828B60CC158F755759D7905B54155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24dea19-d692-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624721110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624721110, "uuid": "23d63549-2fa1-4ea1-8901-171d946b6200", "comment": "Malware payload (RaccoonStealer)", "value": "e5324811f98031b63d74ec37b2b1ea68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624721110, "uuid": "ba68abc2-7581-46a7-abe8-1fd1ab628a34", "comment": "Malware payload (RaccoonStealer)", "value": "fc75b1ebbf255dbae145950891fbb58632bed1b0788c4eb9a4bc0021ad79e2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624721110, "uuid": "3e856774-d82c-4812-bace-a4a30d1f636d", "comment": "Malware payload (RaccoonStealer)", "value": "78aa9fc9af3e9fac350cf943e30fdf6de4b1262d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624721110, "uuid": "7587e819-b8ac-4231-96db-53bfb8cc269f", "comment": "Malware payload (RaccoonStealer)", "value": "1025d44fa382d29469cdc77eae614f4408c7dcfe2af9590c1cbcf0f3516b68a0ce9afdc2f92cb7cc04674fcacb1995bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624721110, "uuid": "3dd631e6-8fe4-4bbb-8ba0-b6620f254211", "value": "9E55BF413081DC82D1B75BF5C8EFE55043797D5AA129CA0D3BAB32DA1062B93E856BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624721110, "uuid": "513005a6-7e75-4347-8fe3-abcfd5e3375a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624721110, "uuid": "1ffa140c-081d-4cd8-8b18-abfb58982998", "value": "24576:3sXxaIpXhi7BdtAGcz4TYXcWIoGjXCnvcZhoQETm:30pXsNdtAx4TkrGjXCvcZ2hTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624721110, "uuid": "36fc4219-9f78-4ac8-a862-657544726f87", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624721110, "uuid": "2c914fc2-de22-4417-bb6d-ddaae209d78b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624721110, "uuid": "e9ed5bea-fa3f-4285-8a8d-47ee394b112d", "value": "E5324811F98031B63D74EC37B2B1EA68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6a76ed-d6b7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624737049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737049, "uuid": "1f0f9597-9656-4aaa-80d7-292619e57c24", "comment": "Malware payload (RedLineStealer)", "value": "0de0fade97d705af951e135d3dcb3632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737049, "uuid": "b5d38a39-9819-4345-a057-45aef14918b3", "comment": "Malware payload (RedLineStealer)", "value": "fd49e6dce6f942eca67458ec204f62ba0fc0b8ecacb13d10734f897e773561e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737049, "uuid": "ff0d7e81-74d6-4d55-8aad-2a9bda7b538d", "comment": "Malware payload (RedLineStealer)", "value": "200ce72ced4bca18c3da3ce44dd0af829478a9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737049, "uuid": "00d5d0c0-9af4-41f6-baba-480739f103e3", "comment": "Malware payload (RedLineStealer)", "value": "1725bfd7b7f62996018b2f3f509944d5f23945daf980a8fb838d11505d4febccb0a36f1527b2396774461d32364e0851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737049, "uuid": "29d232a0-29a2-4995-9257-70cf5de4b77d", "value": "D9154A5537AA4B05F03A57B43156C9B0E3B5BE16296AD20A4CC03BDB3973BC1CF85A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737049, "uuid": "8cda8efd-eecf-4df6-af47-42ff55321f6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737049, "uuid": "babf1dbb-b75f-49d2-a627-7a56ac04f9dc", "value": "12288:7iDerSTosnFKbf9Kt40uzcIcupDSMxS4ARBpKIZYHYt:76sbVKtSRnS9DYycYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624737049, "uuid": "1485d740-be2b-42f2-ac9c-5c6d9764076e", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624737049, "uuid": "3b96bef9-7749-4403-bf13-e1f22b0bc5cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737049, "uuid": "c8ff5868-935d-4984-be58-0a3858b60de7", "value": "0DE0FADE97D705AF951E135D3DCB3632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd1ac99-d6b9-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624737669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737669, "uuid": "a75f3e0f-75ab-42c4-8d5f-e41db8fbce95", "comment": "Malware payload (BitRAT)", "value": "46653475aa183d9805bd8c014d3d3e81", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737669, "uuid": "dab2f3d1-5542-465d-95ae-db4702579e7e", "comment": "Malware payload (BitRAT)", "value": "fed274cef763ebf2558db00b7e25a4a9e51c986d55ea6c089d32893d666fe29d", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737669, "uuid": "11301843-67d2-47b5-9401-76b2a1fcbd3f", "comment": "Malware payload (BitRAT)", "value": "ac6591ba4b69374e9a2a2c3b38e7e4b8047d1b88", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624737669, "uuid": "7c06fb57-2fd0-4474-942c-efd387309218", "comment": "Malware payload (BitRAT)", "value": "555957e7a3c3c53b8ea66b0dd4d4596eb60090b7790d9c36fd149997e76727f96d932524f030fd0cf4f3c6bb7de368e1", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737669, "uuid": "eb408b6a-fe3d-4e2f-94fe-7d711a6a628a", "value": "0295F26E15F0AE3EF90981B710CB8D0C1EE8AD717A8BFA5EB76E1C510F10514EB0E596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737669, "uuid": "a45536fb-f963-4094-a1d0-bc3318eb260f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737669, "uuid": "4c32378f-d158-4573-b569-f0c2a99e2e95", "value": "49152:dnaVVMxDQa644u0PpzIoMuHR757NqZsdyS:dna4xDQTu0PpNv52sT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624737669, "uuid": "78118892-126c-452d-889e-0bf6f11a9378", "value": 1920512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624737669, "uuid": "13316d95-cb02-4eb8-8cf8-dd46c35295d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624737669, "uuid": "323ff9ea-c3a9-4943-bf90-87cc335165c9", "value": "46653475AA183D9805BD8C014D3D3E81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54dcc110-d64d-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624691318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691318, "uuid": "316d6779-9d87-4a43-83f8-61da9750333e", "comment": "Malware payload (ArkeiStealer)", "value": "b42c5a7a006ed762231aba460f33558f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691318, "uuid": "1a0ef037-0119-4f94-9b8d-96e13040f990", "comment": "Malware payload (ArkeiStealer)", "value": "ff0ded61b02aa7c3a68eab0e7306e12b06093aefcdf4232b82738455d13a1d4a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691318, "uuid": "4fc1c045-a0ee-4c80-b1ec-d695e9603572", "comment": "Malware payload (ArkeiStealer)", "value": "625c43f110300edc49da0b571c8c66c6c6e714ac", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624691318, "uuid": "b0269440-ecc1-45e8-b70d-74f08e0943a0", "comment": "Malware payload (ArkeiStealer)", "value": "eb132ca43cdafc49ab5ca7c91b4864f63daad855c1390c0875a53e97333657801bcb39bdcea2dbbeaf07d455a78d37eb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691318, "uuid": "5b1c3891-16b1-4a77-ab75-35b02fd3415b", "value": "37E4E0006692C035F9F612F89979C37D693AB9B1AB6050CF52D6EAFE16342E2DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691318, "uuid": "648769a9-d80d-4e65-8dda-04a9982dc403", "value": "af0feb22f984df602e15f9b891098ff2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691318, "uuid": "b8e187dc-ee1f-44c3-bb25-b815bff73f25", "value": "12288:wYASXJyEE3cs7o7KpVl9CfUuvxKKLby8iymOoHpGyiYL1:wzSFDg1N6H5Hy3ym/pG61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624691318, "uuid": "1ebd40d2-91be-42ed-a01d-3fbfd0631197", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624691318, "uuid": "08502130-dba4-4bc6-8b08-be3b32d140db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624691318, "uuid": "b02db7e3-03a5-437e-8475-582884960a1e", "value": "b42c5a7a006ed762231aba460f33558f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }