{ "Event": { "published": true, "date": "2023-10-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-07", "timestamp": 1696723382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "abffb87e-fb04-4f0d-917a-1bb05ec27510", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06074164-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714781, "uuid": "543d2afa-f50a-4a28-b093-e5af12bae15f", "comment": "Malware payload", "value": "5bdbf9b71784d64070d94af37e3c3bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714781, "uuid": "9b2bbf42-1215-4454-9749-cc437f02d80e", "comment": "Malware payload", "value": "0205b00f2da0f3d10c7dbe3984081999a5220e965444fbb9338d052e7bbc566f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714781, "uuid": "124f7b8a-e789-48bf-887d-a6181bacea86", "comment": "Malware payload", "value": "22000cf4c093597c2f520d6fc981ab0881ebb72d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714781, "uuid": "34719d2a-8c25-4a10-aa7b-acb5256aef91", "comment": "Malware payload", "value": "d56f77d4027fc1bb60a2c1c8de5fd97f26a2a370dfce422767f8032cf6b5c6388085f6eef9995aadd4115256ed98ceb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714781, "uuid": "cdda4e54-735d-427b-b476-6051ac6f0e1b", "value": "T111653912F5409037C5737475989A11A86428BF443904983B36D4BEBB6FBDFB33D923AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714781, "uuid": "9da8ae0b-3482-423f-85b6-8a7479299f87", "value": "a7b8551f2b2a1c72d52f52d568240d7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714781, "uuid": "b0331def-3721-4e98-8776-591c4c7c57c3", "value": "24576:TEgWYHF4Pwvg1X6aOgJDOX1tSL9MxzO+AY64uiZtEpHpV9/gvmp:TETdYvw6aOgJDOmMYCuiZtiImp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714781, "uuid": "c811d21d-cafd-4941-bc6c-cec44fee3aed", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714781, "uuid": "def072e8-7fa2-496b-84e4-456067740d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714781, "uuid": "10f9f242-afe2-4172-98f9-029ca14470e0", "value": "SecuriteInfo.com.BScope.Trojan.Biodata.23253.29504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa01eeae-6550-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1696710761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710761, "uuid": "8b8622f0-3630-45a9-ad31-e870722664c3", "comment": "Malware payload (GCleaner)", "value": "70e2954665af2b32977bc042e6fd0bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710761, "uuid": "54e5ef4a-56af-49da-a263-decd636fcdfc", "comment": "Malware payload (GCleaner)", "value": "030c0eab77f63f34b1d09730a8d01a6e5c128c564f75e8f24dddf1a9c1917507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710761, "uuid": "716d009f-6b57-40fc-ae35-ce1bc71aef45", "comment": "Malware payload (GCleaner)", "value": "12a72a16c8a94a60e84521cfca467ce50d326f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710761, "uuid": "ff89c7f8-ec30-4d5e-a55e-784924f5fef1", "comment": "Malware payload (GCleaner)", "value": "a2426ba5180af5aa9c1b2b1c5f4439309e559ca50553d67990476574fed66f266d52a802c151d0d041087729474801ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710761, "uuid": "d323a70b-3ff6-4982-82df-fe2f56c47f03", "value": "T1B374AF4267A0B871E5664A324E2AC6E8772EFCA1DE18779B33147F1F48710E1D663B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710761, "uuid": "7b428501-aafe-4312-9d43-1ae75696fe06", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710761, "uuid": "980849c3-0521-4f6f-a77d-6af75ecfc9cb", "value": "6144:nufWK/7U5yaZIGPSG+RZvoi3Wk6VVBPSfPclB6w+:nDi7052NRZX3WpVVBPTlBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696710761, "uuid": "c8a15c42-e308-49cc-9973-b1eff6d571ad", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696710761, "uuid": "c79e06b7-01ef-4fb9-8685-e0fafd98cc3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710761, "uuid": "03c08e12-b948-4826-adcd-5184dc431b38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3502c511-64c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696652583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652583, "uuid": "99361c94-139e-4903-af89-55594cbfd0d0", "comment": "Malware payload (Smoke Loader)", "value": "2fc8b54143ca1eae1fde99dc2620b1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652583, "uuid": "c4e78b54-1052-4f94-938e-069e02164030", "comment": "Malware payload (Smoke Loader)", "value": "050013d717665040dd10226b304f8bcce5ce041b1439d18b3bfa0092624a6374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652583, "uuid": "2b1a975e-afd0-4aad-8f97-88b7d7cec0a9", "comment": "Malware payload (Smoke Loader)", "value": "94661b8e0258361e7762005d8472d4ce9933f0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652583, "uuid": "61d293c0-4f32-4e6b-8e1e-cb3e57ba01e0", "comment": "Malware payload (Smoke Loader)", "value": "0c963f03ed97bb17f0a1f76db26aa2168c5b47c21e85149e6d37b1c0ba366fa28e328402ef375066044e195a84ac3205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652583, "uuid": "66c2acc8-8def-4103-9e13-ca82947de6b7", "value": "T1AB547E13E3F07C61E52247329E2EC2B5772EF5219E69B76A2B049F2F08B11E1D563721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652583, "uuid": "ca04121a-7a9f-408b-834c-013d4507c6dc", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652583, "uuid": "87bcf06c-cd66-43e3-8d6a-0a7f2c2384d9", "value": "3072:g5Y/w9Zxhb4mC5TUDw1bQvq6YrCr+X0yryod8:gK2Zzb4YDw1MS6YEK0yrhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696652583, "uuid": "feade5bf-5245-4b0e-bc81-b808cf2cd062", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696652583, "uuid": "f1df0420-58c0-4c37-bd0e-3d7980bdcb07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652583, "uuid": "ae051e86-e18a-4c47-a217-3a853376209d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a49a2f-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696668283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668283, "uuid": "8fe42247-7b34-4fc7-8d5b-0813325aa10d", "comment": "Malware payload (Mirai)", "value": "42518146c69c731ca838b5b23d2df2af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668283, "uuid": "f009949b-d021-44d5-bd18-0c63bb3b40a2", "comment": "Malware payload (Mirai)", "value": "050a2bf3c47233b50fa2e96a7b2b540443a162e3630e921803c6d00c0c531b80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668283, "uuid": "d7a3cb78-8115-480c-a51e-99089f2ef352", "comment": "Malware payload (Mirai)", "value": "7c693b0618ec12fb20c6436f208454ce2783458c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668283, "uuid": "75766826-33d8-4d48-8545-ff6a8e430464", "comment": "Malware payload (Mirai)", "value": "812ceee7143736af93d55d1fb6a568d3daedbe6988cf41730ce4ff74690a83c39be39ab850460c46dd46799bfcaffda8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668283, "uuid": "f247388f-dcef-4883-9fd0-f56102f0071e", "value": "T14513F175CF18F2339CA04BF2CC3C9782919BBF05DAE53511642C165DF5AA4812DFA26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668283, "uuid": "9b161417-9905-4c40-9ba2-ef5241621390", "value": "768:YiPlDH1T35au71FrrJgQ8RrGXNxbUiFqYOtMJKBJoGj/IBsG1di3U6:YylzN3ou71FvbIGzblytwKBJogIsGTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668283, "uuid": "45129cb4-045a-45fa-805f-5e125bfd33d5", "value": 44376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668283, "uuid": "287f961f-e7b1-402a-9f68-1968967b9dfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668283, "uuid": "7a1b4b82-2cd0-4b87-af3d-ac8eae28528b", "value": "42518146c69c731ca838b5b23d2df2af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c661b1a5-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671295, "uuid": "f852e648-a035-4d00-8662-c9a89a3a3188", "comment": "Malware payload", "value": "b7990768f1499772f1c79af8aa70f9f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671295, "uuid": "e5bd8b90-edce-40aa-9ed3-8a30dc43e32a", "comment": "Malware payload", "value": "0581f90722b5f521badac9b576eb3c41a44b0897b29980da19a6e010452f3e47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671295, "uuid": "b627d453-02ac-46e6-a0ee-fac5c6b6bb13", "comment": "Malware payload", "value": "1d333f73f1c584093b37f6b61c0746c5f5d652e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671295, "uuid": "d929efda-e4a1-46a7-ace7-5bb3b344e469", "comment": "Malware payload", "value": "59c17ff439e32ca21b787e0896820c1ab8b9f2af7dfc77144a08134a628569693e158b36034ad47c219b78f80da8e9ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671295, "uuid": "b19db79e-fc11-4f31-96ac-69896ec0aa17", "value": "T18FF17D8B669C2735C23900BB139F5114680CB3526BDB279C76ACE5ABBE9368D4463E1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671295, "uuid": "55a15ccb-1fb0-4eea-b075-88589ea5449c", "value": "47d22ff99d0e9f4348033704e4bcac9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671295, "uuid": "d337cc2d-d7a9-4af7-a4d4-09ccb9ce55e6", "value": "96:eigNh6ul6NXpXlDa7NDNbKZemVq2a3LEI8uIad1rc0rgyJFC7tCEy6:8kXdlDapDNbGev3LEIB31d5Jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671295, "uuid": "58fa0080-18f1-4060-b655-9701061d4584", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671295, "uuid": "58d30086-d964-4097-a58d-111328e2ae5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671295, "uuid": "ee6589fc-3916-49af-8065-13ca2f00b44d", "value": "SecuriteInfo.com.BScope.Trojan.Bitrep.22503.2742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221f883f-6503-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696677462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677462, "uuid": "9f0cb97e-f07b-4eb8-9c5b-f7070f025ad3", "comment": "Malware payload (Amadey)", "value": "9e8e8914c4edc0d0c1419bdbbab56110", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677462, "uuid": "b427adb6-8423-4939-96e3-63d75f04ff51", "comment": "Malware payload (Amadey)", "value": "05daa945e702ff519d4af6f3cfafdf2a2dfefa71a07f113967f85bdb34778a9c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677462, "uuid": "2de77d51-af05-4c18-be3f-bd98a6f31f32", "comment": "Malware payload (Amadey)", "value": "b461b0ff15785db016c24fbeb8f436dfcb73932d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677462, "uuid": "03a35dc3-8f9c-44d7-b523-046c445df7f3", "comment": "Malware payload (Amadey)", "value": "06db7559dbec098356354967977d49dd38c60aa55c5791a6fc6b55d1d10ea761d64f2fa259c1c51fc09a55bad7fcccb7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677462, "uuid": "b7a73c46-3bc1-47d1-bde6-12bf6bc54de7", "value": "T13445231AB7ECD422CCB47BB118FE034F2B363CA04935931676D298562DB358469B637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677462, "uuid": "1a3d5af8-9917-4458-bff2-6c2e4c76b084", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677462, "uuid": "a3463deb-4b40-4974-94c4-0fba8b8669d1", "value": "24576:/yrwgFn4dBaSprQ28P45T3f2NNzxZ22ErFjFNYG9kUN4O6k7YT:KrwgFn4dBa4rQwG1xZhErbNYR47Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696677462, "uuid": "9ed425e2-a323-442f-a0a3-671d298ab64c", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696677462, "uuid": "943b7620-e7e1-4e20-800c-3472542d6954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677462, "uuid": "e86d7123-0ce1-4553-a81d-8d7a50696c77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96471b02-6555-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696712876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712876, "uuid": "a57de47d-afce-4598-be70-523fc0f275eb", "comment": "Malware payload (RedLineStealer)", "value": "6fbbeba744b5ebd00eaaabbe07268660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712876, "uuid": "74db1f43-14af-427f-98b6-83be949b068d", "comment": "Malware payload (RedLineStealer)", "value": "0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712876, "uuid": "a3bff448-dc31-4cfc-a6ec-5db78fdec8fa", "comment": "Malware payload (RedLineStealer)", "value": "4da8bd7c4b51bacf020e5e0d544a1e3c309bca2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712876, "uuid": "10dd213d-0168-46e3-ba45-9c155ed5ad12", "comment": "Malware payload (RedLineStealer)", "value": "21bdc57e4b254f97ec15d7878dc9693b6bb0393656fa7ae6252ef67d0d93a86e90227a72d158d6257b6a8ba58ebac305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712876, "uuid": "18ef71f7-d6d8-4c17-b768-9079cbb51400", "value": "T14A953327AED098B3ECD55775A4F626C70E31FC138AB8427F23479A5E19322876830767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712876, "uuid": "8f6d5cb6-6fd2-4fc7-8cb4-3218833bd641", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712876, "uuid": "a734a80e-4bfa-4b4e-92a8-81add6976c81", "value": "49152:FtBEZFftMzD4QI3kSJWUyD21XJIUlzp4PJZb4E:StJA1DCJPldO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696712876, "uuid": "2902d759-18f1-45f5-a471-0bb466f64575", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696712876, "uuid": "cedd9e8a-f382-45c3-aff0-315c1e8c2b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712876, "uuid": "1ca79c5d-501c-4136-bbca-95287099a262", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c588f2a-64da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696659816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659816, "uuid": "587ed0e6-19b1-4b77-8905-7ec7f061497c", "comment": "Malware payload (Mirai)", "value": "8555453f96e3209cd9eb241b0be41e7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659816, "uuid": "080bf17e-56df-4fa8-b2cd-17adb2e6ac39", "comment": "Malware payload (Mirai)", "value": "06655c45be74097ab902f4d4c10176d2a7bfd3c9d73ca164457fa394b8a7e629", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659816, "uuid": "eb95fc84-37d2-4658-9920-adff742ac198", "comment": "Malware payload (Mirai)", "value": "145f66ede0c3409c3e057c6f61e2163263d3fa43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659816, "uuid": "54947f6f-7851-453e-befe-7d9fe85de30f", "comment": "Malware payload (Mirai)", "value": "70c4ab96fd3b027c99e3dc559cb74704ceddd408f98d596b800e18391ef1860d1ee2a57b614470b4db189e2872ce8733", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659816, "uuid": "4c5428ba-82d4-4386-9742-d8ff141e9eef", "value": "T139438D37E96E1E74C04641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659816, "uuid": "5d8486f6-45e9-4f7c-87e9-48f275d3a1a6", "value": "1536:Vaa0brW/Od9hlCR3KJ/KYXwKEpPDCMC2+WT:Vv0brWGd9X5JiYypPDL+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696659816, "uuid": "fc41954c-9f1c-4ce0-a63f-cab69035c8dd", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696659816, "uuid": "c3cde4a9-5277-4a6c-90dc-ea9c14628eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659816, "uuid": "14c04e63-42e3-4632-9960-b02bf77b94ea", "value": "8555453f96e3209cd9eb241b0be41e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1f9eb3-64f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696670335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670335, "uuid": "13781c97-412d-4c22-a287-d3425f238837", "comment": "Malware payload", "value": "d74bbe3d8a555c88c07cb9f39d861295", "object_relation": "md5", "Tag": [ { "name": "FlipperZero", "colour": "#31C326", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670335, "uuid": "c159519b-6d27-40a3-bbe9-26b21baf4844", "comment": "Malware payload", "value": "07613cee8b6cd98656dc30ed4b1921591ae6a296b6d6c242f228cfc3ec4dd857", "object_relation": "sha256", "Tag": [ { "name": "FlipperZero", "colour": "#31C326", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670335, "uuid": "ec6b5bf2-d757-4af2-a8cf-6d205c8901d8", "comment": "Malware payload", "value": "55cd066a5dc49f0b3b1d23c822c673f114cb5f77", "object_relation": "sha1", "Tag": [ { "name": "FlipperZero", "colour": "#31C326", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670335, "uuid": "5958ceea-f0ae-40a9-8236-54c55e373a62", "comment": "Malware payload", "value": "329a50de0388bdf72af321b74cc28da547bd237e0203000ebc21c50543a83689ca1dc2ce8b1aa74e5646462607a4ca3c", "object_relation": "sha3-384", "Tag": [ { "name": "FlipperZero", "colour": "#31C326", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670335, "uuid": "9ad71073-3e75-47dc-8511-262e08ff6166", "value": "T13F3285326DC363B1C9F1E2B6DE998005F6964007A516B309F0EC854C1F759C58BFEAE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670335, "uuid": "4d864ff1-1353-4d90-a61b-a7d483a812b4", "value": "192:5RVqJiwQNgxiJyOAeN1MWyaeo1Ls+d4SyRsaK7smwmHTmOG13u17J:vSiUYl1Y0E2G13u17J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696670335, "uuid": "fb869d3d-aee3-4d60-8172-25219a3eedf8", "value": 10985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696670335, "uuid": "a1227017-f60a-4f19-85c6-79a6243a1830", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670335, "uuid": "541e4814-9289-4c54-81c4-e47ffd58a04a", "value": "BadUsb.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b94676-6545-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696706063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706063, "uuid": "7b8e5766-a431-494a-b032-c07d0a2cd4fd", "comment": "Malware payload", "value": "b2757078da63bdef6c36d6d4bff1c790", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706063, "uuid": "2e90dc07-9952-458c-8523-9943287c2033", "comment": "Malware payload", "value": "07b038d48c5f77389b1794ae72390f8f98c18c48a145098daf299e7da583437b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706063, "uuid": "1f4c45f6-8d90-4fa3-a186-646543f02c86", "comment": "Malware payload", "value": "d4a98e53f07449ac42cfa4cbfebae9ec62138403", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706063, "uuid": "72d310aa-b141-4309-bb81-412e6311beb1", "comment": "Malware payload", "value": "48189cf8c341d8c67b29b167d575421046ae29aac869188531415e7b23d4a7190ac0b1161d37da1354fd7e811918fa21", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706063, "uuid": "8b617ee9-7ece-4fce-b0ee-b1b538cedc5d", "value": "T189F633EBAB2D2F1BFB679A3161D02D94948460D43E2DFBE33144D4258061B477F88E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706063, "uuid": "382e84eb-2f5f-44aa-9308-fe711a77509e", "value": "894e9af68b9b6947ee7b06afe8dfa47d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706063, "uuid": "6d6ed145-56d4-4b0e-a9a4-c24a2877a0ff", "value": "393216:68Dch0Umf8Jm11Xy4jOdEZIsLlord5ps53WL/oQ+k4lrr8KA8l:68D1UpSZy4jcEFxoJD2EHL4Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696706063, "uuid": "a21fef21-8ac2-47c3-9d76-6f54e050b541", "value": 16753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696706063, "uuid": "dab9e880-26d9-474c-b187-b210c138217b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706063, "uuid": "44fd1084-b5e2-4b65-9abb-a6593012bae6", "value": "MaxiGuard.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2b9a66-6547-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696706764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706764, "uuid": "6ad39ce6-eaa2-49a2-adf4-d68a7ef9c7c6", "comment": "Malware payload (RedLineStealer)", "value": "53f956392d80cbc3319b4163597c0cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706764, "uuid": "6cde39b0-c5f8-4a19-a1d3-821b268b29b7", "comment": "Malware payload (RedLineStealer)", "value": "07ee232b57f0117b73385f36e371577424b740da73c8ec8a2ad01117de0cd0b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706764, "uuid": "84a243f9-9d0c-447e-97f1-7034a4aad18d", "comment": "Malware payload (RedLineStealer)", "value": "5bdc7f638f5ee40a4d21b1b6cf74aba54f590e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706764, "uuid": "afcad607-3d64-4686-877a-d9df1b69e133", "comment": "Malware payload (RedLineStealer)", "value": "df90a4ec8ac1bee009dad969c651e7e05470f51a6b5f8fffb8507375cc76ccd58e97088fc4c919111640e546a694c4ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706764, "uuid": "3b7e9071-ff08-4ae6-8e3a-37c73f8af391", "value": "T171152303ABEC9026D5B823B08CFE07871F72BDA399B4C75A1743D95D18B2584B5353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706764, "uuid": "f06b2d57-16b3-4fc5-a98a-660898555b54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706764, "uuid": "4c9b6787-83b0-4796-b6f7-9e2fa5f49a65", "value": "24576:YyCn7zdyiKVr864omxyuSaYrAQlEO0o1W0XPoPOL+L:fIvdyiKV4kOyuSrAQl/W0Xso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696706764, "uuid": "e69ba2e2-cab2-4ce4-96d9-9fba1b906fc1", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696706764, "uuid": "c67f2df9-61b3-4118-bff8-3b86f3a6cd6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706764, "uuid": "f09c1406-e804-4fc4-8545-684040d5a35d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a770bcff-6523-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696691430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691430, "uuid": "4b48d3e1-179c-4760-89db-dba782544f59", "comment": "Malware payload", "value": "fbfbfe6ac3bcda6534dda903e1a14147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691430, "uuid": "67db0bd6-e126-4bf6-9de5-f8ff34db8c76", "comment": "Malware payload", "value": "098c1a2f45387a0afc2d4601207734ec75bf04ec4033f8d2d5dcab1efc67bec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691430, "uuid": "ccf5a38d-8d51-44da-bf30-500391010b18", "comment": "Malware payload", "value": "9d991281dafe9637d4ccdfb3f952b8d135f17c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691430, "uuid": "4be6f1bf-d93e-47a5-b0e4-2bd894015e89", "comment": "Malware payload", "value": "40e5b5c43deba4be1ee2bd2d030839b28c50c48dd2f0527af20d74f222787be35bd741e2b14723a14f1e0c27279bf67c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691430, "uuid": "322a5b3c-890a-44dc-8a37-05e33704ecd3", "value": "T1C4A6CF7B29A73E12E0B0FA353511F9677C362E02C0A5C578EB415A1BBD8D9C0C99927F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691430, "uuid": "81372e34-9d4a-4b89-8e47-554e97184f5e", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691430, "uuid": "68720ea3-a612-4102-9739-4677f482aefa", "value": "196608:tbqP1kwJk0gyDJWHjoLkf/3AuxbbneILly3KG/nLRJeQaDTyKAqwO:t01kw20g6WbIuxPeII6GzDeIKAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696691430, "uuid": "6bb27eaa-09c2-4ff5-88b9-996ff9327a6b", "value": 10410808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696691430, "uuid": "924933d4-0255-4926-ba18-4f3c456a1410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691430, "uuid": "cd689ec0-c3bb-48e5-8824-41576bf475ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3a2958-656c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696722628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722628, "uuid": "faefc926-cdd2-4015-99fb-1d87694a6929", "comment": "Malware payload", "value": "d466bda2f8c5f5fb0595547e5a97d843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722628, "uuid": "f72e93de-23ce-4654-9f6e-4bbdc4e5667a", "comment": "Malware payload", "value": "09bcfef16ebdb6eb335b71ec950e173c7488c0b071e7ad217ef66acf1e9bc5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722628, "uuid": "f52e6b2f-ccc2-4d27-a9a6-f3b088e9edf2", "comment": "Malware payload", "value": "f245ec07d53fbc3a9ee1309a006cac099a8548cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722628, "uuid": "1ef18062-8069-41b3-a012-8798ee25ed48", "comment": "Malware payload", "value": "0eb88e920ed0431795f5c90a7c2779e29aaa8a776c9c81de77d120ad6ae20862ef1512bedc0732e1405bc22845d23e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722628, "uuid": "09bc0378-0ec5-4269-9f79-a3d56aefa4ee", "value": "T152A57F1176FD0B59F5F30BB866BAA612487ABC6ADF11C2DF1251948E0D21FD08970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722628, "uuid": "dae20212-f9c9-4a83-a99d-978339cfa3cc", "value": "ae450531cb5f9358db13baf813ed0098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722628, "uuid": "ed5f7060-cbc0-4879-8380-3fc69f84df94", "value": "24576:A3mP+H6IB15219APGBwv1z0qo6a9DhvhComu0xzc9xrBX:A3z5219Auq1zNo6a3vVYc9BBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696722628, "uuid": "993034c5-f7bc-4304-ac84-266565657fe8", "value": 2249728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696722628, "uuid": "9c4928cb-559a-445e-ac71-4a9f7826c6d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722628, "uuid": "d05b9186-15a4-482f-a225-8c087160025a", "value": "SecuriteInfo.com.Variant.Mikey.154420.4177.25356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa871469-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696668242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668242, "uuid": "88dc5b0a-f1a1-4be7-9bcd-f02e509ab992", "comment": "Malware payload (Mirai)", "value": "b1d9f99f21b38aaf5a37517f5b3c7ff4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668242, "uuid": "95098948-eba8-4250-a2eb-349ec6f29792", "comment": "Malware payload (Mirai)", "value": "09f8b49a99191649ca829fbccc24d69beb19b4538e5cdd1f9aec0c174a98d77e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668242, "uuid": "6f1de647-8e90-459c-88dc-c3eb49c47dca", "comment": "Malware payload (Mirai)", "value": "4fa7a24dfefd5a193e57c8604d9473c7d23924a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668242, "uuid": "3a5dea49-4b6c-4795-9c35-0bf49b4d6306", "comment": "Malware payload (Mirai)", "value": "b8fbbe29b17af960db106429051873f8952883c2692b70820447671a4371cadef00628f9f7f8f8bf93007549b7751465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668242, "uuid": "955f6c00-131c-4614-98f5-1871756064fa", "value": "T175E2D0E483682DB1D8E57A31EABDC781A2931B6D9DAB31313D082474DB670C85B7E143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668242, "uuid": "4584a074-fa43-4874-9cde-fa761dbc7e50", "value": "768:nNgbyODhFwOfeY3K9cFEzzn41cDP64/3Ucmq:nqb5bmY3y46DNoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668242, "uuid": "33af8d54-9cda-4c8e-986d-5c4d78d03f41", "value": 32568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668242, "uuid": "9e9c4ed5-9ebb-4301-89ae-d5057dc6c552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668242, "uuid": "816c1d0a-bfee-4958-b9b1-e0c480e57b30", "value": "b1d9f99f21b38aaf5a37517f5b3c7ff4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85551c0-6543-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696705283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705283, "uuid": "9e2cab95-1e81-4894-b08c-439eed433be4", "comment": "Malware payload (Mirai)", "value": "6aab68bcb264c7991c6ebaf11b6efdc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705283, "uuid": "155743d4-9642-4193-8ec7-7bc1e1727212", "comment": "Malware payload (Mirai)", "value": "0bd6e7db0f0114fad44922eff5e0fe3e2277ffac332d4779b147dd06fb17dd95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705283, "uuid": "56ff9268-1cab-48e0-b372-ff97b4db0efe", "comment": "Malware payload (Mirai)", "value": "1c235aa3b8904d44d2357231b73f5df865a306f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705283, "uuid": "ec6c87ac-8494-468b-94e2-0242f0f544a6", "comment": "Malware payload (Mirai)", "value": "68ddffe440a2b56407722e498074aeb40e06a7d0e5027c6be653ed3f1a7865e24e22e0e4371e078ebea958e15737e049", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705283, "uuid": "72dcb37e-403d-4a44-9fdd-35cb4424288e", "value": "T132532B96B801AD3CFC5BF6BA40120A19F932772069A30F2BD697FD936C321B59D1AD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705283, "uuid": "ad46b657-0967-46a7-b14f-950400c15b36", "value": "1536:zk3O5L9TyGR1og0Zy+sElM08yh+KpqmDekf:zz5BTtR1og0ZyHEq+Smae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705283, "uuid": "1c62a21b-ec7e-49d4-9ef9-b85b66009142", "value": 61284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705283, "uuid": "6a151b2e-c314-4e52-9556-1a1066b6a069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705283, "uuid": "e4109585-625a-4f99-970a-2ce463de6e55", "value": "6aab68bcb264c7991c6ebaf11b6efdc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3110e803-64e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696664173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664173, "uuid": "b1efd2cb-8e22-483d-bf6d-a79fcdd757dc", "comment": "Malware payload", "value": "72248e88976cdbe0e50872f2faa9d4c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664173, "uuid": "5107fb6d-c6cb-4369-b97f-b0e22feafe20", "comment": "Malware payload", "value": "0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664173, "uuid": "1df95f0d-d988-411c-b88d-da96b956d32d", "comment": "Malware payload", "value": "8cb53da115156e4c22ea33841060a360a0779ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664173, "uuid": "cd50cc31-f912-4142-995e-31f0c1ad2fc2", "comment": "Malware payload", "value": "3585d8da92bde8990cd42c7b0ae9158bcfc2b88e3f475dca7e776de21d8e0f9e36be419ff4e243fe0ec0bda149cddc4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664173, "uuid": "a9162940-2fa9-4e44-b4dc-8f198f752763", "value": "T1DAA53311BAE1C8F9E4030233996E337491D1C32ADF1549A367A88B8D2F75EC6C977627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664173, "uuid": "f1956af2-e4e4-4513-a090-addab078a11e", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664173, "uuid": "fdd0d031-2816-450b-a5bc-6ce2144e59b7", "value": "49152:WfxEejd0K4xSFfra+wKcprurLvirPraVCDVpLuat/Z:W+Wd0K4xSFfra+MpruYPragBpLue/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696664173, "uuid": "fadf4238-4220-46de-9bfa-71fd91f406d4", "value": 2264591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696664173, "uuid": "6626c971-3811-4f9b-a8e1-dcd7b74553d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664173, "uuid": "5d9bac43-d7e4-4968-9ece-7cd2666fe384", "value": "72248e88976cdbe0e50872f2faa9d4c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac172bcd-64b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696645911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645911, "uuid": "d0c6f524-8902-4919-87a7-ab2ecd25a162", "comment": "Malware payload", "value": "24c65d0b079f020567862c8e4d583c12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645911, "uuid": "a8b03f38-1efc-44a1-b0d3-fbe1dfbb578e", "comment": "Malware payload", "value": "0cc0ce9302faf11c907504cbde89b2b67abeb975eb230a9dd5b2a8750a28e500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645911, "uuid": "48e25cf1-1618-493a-b589-b748ded37044", "comment": "Malware payload", "value": "13abce8b1c3e42ad89ce63bf7f7a0b92e8ce5ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645911, "uuid": "b13640ad-31b6-4109-8144-69d62256be2f", "comment": "Malware payload", "value": "287122f23b9257e0535c639b9961600fb9e31c2dfa1553663f585da5142d8af6659390939a6645f89f6d4c4cf9cd6ad7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645911, "uuid": "31938a51-d318-4f7c-a8f8-26c71957e016", "value": "T168D33A4AF980AF15D4D921B9FB6E518D33630B78D3EAB1028E155F24A7CB94B0F37906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645911, "uuid": "afd8e509-6f16-4985-8b4c-f1258fc74892", "value": "3072:VCcMoFnciLns7PII139WaYaZgKbO6w2Aywh/:HbFnNnSII7WaYaZgKblwTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696645911, "uuid": "0a210257-e3f8-45df-83cc-8b7449f187dc", "value": 131252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696645911, "uuid": "02b42a59-9b89-47fe-a4d2-3eaf215713e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645911, "uuid": "27c2a4d4-d7ba-4a45-aca2-0fe2bc14730b", "value": "SecuriteInfo.com.Linux.Mirai.4306.28905.17210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fdbb1e-64a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696637180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637180, "uuid": "0c94b67b-358d-4102-9707-d179186e066f", "comment": "Malware payload", "value": "cfd1de30cae16a6c7b5aa5d74ff15a5a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637180, "uuid": "c8b9d2a9-21ef-4026-ae65-42fb5d7db001", "comment": "Malware payload", "value": "0f84c0223414a84ccaae529c25147153a7c12b6427bb9e00d2f2219118657baf", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637180, "uuid": "de553c22-f553-420c-9ade-307a3258f431", "comment": "Malware payload", "value": "e9eb09060e5624616b406376a1edf56f4e2c6075", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637180, "uuid": "02eeea03-2d52-4d3f-bf8e-d702d85c3637", "comment": "Malware payload", "value": "322d9bbf74b06a8342be3f508d67c836e811036c2e0f0666a3b57aa96951c83e340801a6ce2f484d03ea90c2e5b32365", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696637180, "uuid": "25c62658-2c81-4ec1-a5b8-1331e67580fb", "value": "T14D21C20809EA1325D3B3CE39507A6322EA3B7851EEB30F0D009D56862757A51B9A5F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696637180, "uuid": "a30dedfe-1c8d-4ee7-bbb6-ae3933d936be", "value": "12:8D60m/3BVSXzwxj+W+fSZfV1wjVCQiN37+lbYqlbPpm7VI:8D6J/BV+fOfPzFrab/G7VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696637180, "uuid": "c284f565-5bbf-48ee-9b9d-d35a0ac3e57c", "value": 1320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696637180, "uuid": "f2655306-7243-49a8-b922-689e695fc105", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696637180, "uuid": "873e38fb-0201-4bcd-8f52-edf8acec7d38", "value": "191536e1f1133889748b61f78603ad212677ea6a0d8d2717c8171a075f43b47a40535e4a19ff8a33aef126902426e0c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e34a7c-64f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696672524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672524, "uuid": "e884d6ef-1bf3-459b-80a8-b116632d767b", "comment": "Malware payload (CoinMiner)", "value": "37e8afe822dc8d06078c73ab9e4816a1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672524, "uuid": "2d73197c-1754-4035-8909-a84057296d7a", "comment": "Malware payload (CoinMiner)", "value": "127a9938c53791b618ab9c7bebd7cf4213ca8d09edd66ba9b57d890b2d38b201", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672524, "uuid": "c3dd7bb5-0901-4635-af4d-f214f7926d88", "comment": "Malware payload (CoinMiner)", "value": "e4b4b2dfd6a66a1dbea60d0ecbbcc23ccb7e7bcd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672524, "uuid": "dbfb4da2-f2d4-42f8-be9e-023da361a820", "comment": "Malware payload (CoinMiner)", "value": "a0350e46916a4a5dee7b223f0408605cfc0d3472b0fc41ab59d9fc219673df0fda183a601a374b2f1574aafaf1789557", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672524, "uuid": "ee919c9e-e947-4152-b607-ec5a4b8d98f5", "value": "T1FA547E12E3E0BC61E5224B319E2EC1E9772EF5619F69B76A2B045F2F09B11E1C673710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672524, "uuid": "bce772b3-50c6-4d3f-97e7-b31def68ab26", "value": "87f03000e6499d0f071e10e3a4f854c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672524, "uuid": "8935f70c-5726-42ab-936a-aef49a209bcd", "value": "3072:JBnLNZ4GUDwl1uuTwIJjtDuWe2+JKMN9PJ6g6w:bJZrUDwl1uuMIJjtKXLrPgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696672524, "uuid": "0c058c4f-8fa2-4fe0-b46a-ee7ffa13c2cc", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696672524, "uuid": "991432f8-4e49-49e7-b619-3ead49221e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672524, "uuid": "3dbdb255-fd3e-4cf5-8191-24dcd6f44afd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2c5da3-64d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696659143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659143, "uuid": "e2b6d551-b002-4ac0-b473-70c7a975eec6", "comment": "Malware payload (Stealc)", "value": "ca4982bccfd8ac278771661a745cc364", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659143, "uuid": "7f2915a6-1a21-478e-a26c-3b1fce435923", "comment": "Malware payload (Stealc)", "value": "12cd64a6d63eb4c7ae10c011a65ea69f9ce0022197d39cb454cc63fc7e147f78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659143, "uuid": "32d55ce0-ccf5-4b33-9a6e-ff6cdc9d206d", "comment": "Malware payload (Stealc)", "value": "e2b269e7b951e59e47f5d151ecc023a893b9c0b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659143, "uuid": "fc141f0f-3170-4620-926f-a3f89f74ecfd", "comment": "Malware payload (Stealc)", "value": "9493e272087476e8c2b18e350be9f51c17c95ef67d014cc4205dcc96a2d0aacd1b66c2cee6da0aa1eefeb068dc62af20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659143, "uuid": "db2c52f9-c17e-405a-967e-f21c2d5a7fd0", "value": "T19374BF12E3E17C61E52647724E3EC1E4772EB5609EADB7662B089F2F08B11F2D663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659143, "uuid": "03c07bdb-d537-4299-9bb2-b33c5b9bf6f2", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659143, "uuid": "60671b73-01d3-46a7-aa2c-0084c524289b", "value": "3072:4+dBqIZBDFjqGJB6tSmhi00OzMltSxc4QSoz7Meu5xjp+oexinsoQPPgJfJAP/oX:tRZ1FjN6/ultP7rCxF+oHsowgJfiAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696659143, "uuid": "984d27f8-744b-443e-bfa7-28f4a7a1fed0", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696659143, "uuid": "41a060f7-82bf-4c1e-8244-64798ba80cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659143, "uuid": "d6129bb3-1ad4-4f48-81f5-395e72754a6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4399212-6535-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696699290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699290, "uuid": "4eba0d25-1864-4e32-8051-64e3090071d0", "comment": "Malware payload (AsyncRAT)", "value": "944f88260b63cbb6c1cf205fad276fe1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699290, "uuid": "8bdf044f-d55b-478a-be68-2ce566bd925d", "comment": "Malware payload (AsyncRAT)", "value": "1352314ad02728e8bd9a2c847431351a349836c070b496b606118cbc9e4689e0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699290, "uuid": "05a665db-6748-457f-815a-97a933d3695e", "comment": "Malware payload (AsyncRAT)", "value": "6dcc439b767d2dd2299dca69d0ac3c21945c14c2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699290, "uuid": "343801db-b03f-4dcb-ae5f-a128da9fbfc5", "comment": "Malware payload (AsyncRAT)", "value": "d5f60acce8699e6e31e334025a831af6acf109354023d5349049164674624a57d88990f1d39e4194e0b76e8a2a465429", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699290, "uuid": "27b4ce91-e529-4ab4-8df2-43f61583a13f", "value": "T199452350EAE56036DCB56BB104F903631E367CA05E788AAFF355981F0D235D0AA7733A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699290, "uuid": "dfb91624-2835-4610-985a-278926765b48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699290, "uuid": "303b3dce-c694-4449-abf6-50e054c7c78e", "value": "24576:oyhc2ECJfUVZ9nIx1IFQdk8IaH5L+0lC5hbGJTuDUmCgdkY:vwm8V/Ix1IhqZJmGpuomCgdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699290, "uuid": "996a9d71-6ece-4fd2-8e1d-eaaf1487ca69", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699290, "uuid": "9a784e64-356d-44c2-91f2-9f4b05c65988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699290, "uuid": "2c4acc86-bf77-4392-80f7-a4c238dee7cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2a3031-6502-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696677073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677073, "uuid": "26025067-c368-4b70-8c22-6ed36dcf7a33", "comment": "Malware payload", "value": "999d17f66b6e237453ad899d94fb6998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677073, "uuid": "ee45dc51-d7ab-43f8-b548-0e00208b2003", "comment": "Malware payload", "value": "14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677073, "uuid": "70d130ab-4885-484c-93cd-c3fd594b83f8", "comment": "Malware payload", "value": "fec99ee5b5e7d1e1f13ee69208292921a843a0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677073, "uuid": "8892426f-01b1-4fb0-8ff4-383eca2dacb3", "comment": "Malware payload", "value": "45a29e6043d0fb2c3412367425d5a904a1452afcee4b1aeb81331422d4886576b74e3977859761d4af8358f16d99bad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677073, "uuid": "e99b5547-d570-4657-ba12-ae8a03e1088b", "value": "T132641919779A5915C35F4734E0B1644CEEF0CA17A3CAABAEAC0076F49CA37D0A6434E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677073, "uuid": "75c388eb-e35c-44ef-878f-191261adf34b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677073, "uuid": "899f2642-d7bf-4b85-ac3a-4e93e778036d", "value": "6144:UD0AJsZbY+kdRpmXmfFgjYEIyv49iVt//Vzo+F0w3qmsTcKSK:K0AJ1+8RpmXmfFgjYEIyv49KnB5fiLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696677073, "uuid": "fa6add37-0456-4381-95bc-640688202afa", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696677073, "uuid": "ed1f9544-7279-4288-a0ee-64a99be4ba13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677073, "uuid": "9212263b-e708-41e9-b050-4dd91a91f409", "value": "akt-sverka PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e7594a-655e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696716764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696716764, "uuid": "05bf3502-3538-48fd-af5a-0a5039099680", "comment": "Malware payload (RedLineStealer)", "value": "e2199842ba89b675052a0ee15319e3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696716764, "uuid": "37e86681-38c9-4f3b-8b4d-030c695d946e", "comment": "Malware payload (RedLineStealer)", "value": "15121e72dda82fe9f98959b4fe74e6128ebfb6af1115daadb86f976e03c0f3a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696716764, "uuid": "9e33aaee-87c5-4827-9f41-d5673b1e195e", "comment": "Malware payload (RedLineStealer)", "value": "d5d14da75accd51842a41dd02c1a3c792b30b0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696716764, "uuid": "9e2e2c7c-9ab2-4e72-86d2-ffcbe8473cb1", "comment": "Malware payload (RedLineStealer)", "value": "9137bc26579d2fb11d13d3867dbed4723db2a8f283a32559bfd3697280e1e9bf6e086d4f983d27902851a041c23ae838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696716764, "uuid": "d8bb95c2-97f5-4f39-9761-5eff97466335", "value": "T1E585235BEBEE5861D0700F7414FA27832D34BD61AD7692773B49AC2A0CB259821713FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696716764, "uuid": "9a4023ee-e2e0-4c65-a887-e77fb828dd67", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696716764, "uuid": "7275322d-4d70-453d-ba54-8ca97f674606", "value": "24576:Ny5aQ2aOheHB6bkgvIq87+fXJOWGEGYhLfcK4jSSHkkH4UycLOOFuztU+L:oD2aOsB6bk7qQ4Pb3L0K4OSEk7rLOi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696716764, "uuid": "b7d5ab40-ec3f-4f8f-87d3-50f7169b26b1", "value": 1873920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696716764, "uuid": "cfd614b6-402a-4f4e-884f-0086eeb1041a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696716764, "uuid": "6c152149-524f-44ea-b386-e4131a242ae6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755ca50d-651c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696688339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688339, "uuid": "26c8c10c-c247-44da-bf2d-1f19c04788e9", "comment": "Malware payload (RedLineStealer)", "value": "b9448f2f73a72ad6175aaec3a01832c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688339, "uuid": "3ee99632-ff9b-4053-9771-6ae16c5d7a38", "comment": "Malware payload (RedLineStealer)", "value": "15723a4b0e16cc0b8010e35ea3d4bf48c2c291cc247821f701ed6112b2aa00ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688339, "uuid": "4ce58c75-ba40-4b19-b55f-376908365c09", "comment": "Malware payload (RedLineStealer)", "value": "9b751036663e3acaad296d11d05929168d93fc06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688339, "uuid": "c279684c-af5b-4bf7-a5c6-87fcff6dde59", "comment": "Malware payload (RedLineStealer)", "value": "e595f3255eb70ce6d14c81c0444369700d14a477a01b5c882cb78d28cdca0996278d5d0f71bc72b1a7967026f93f154c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688339, "uuid": "ffb34572-a931-44c0-9a8a-c8f503c1324d", "value": "T1697429C42384A5CFCC4F8EF1616157688A70D4C2A557BB53BC8BBCF7386A3549E852E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688339, "uuid": "35aa305b-3651-4528-95fd-55de915d946d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688339, "uuid": "f48f5d39-203c-4c27-925b-4b5b6360d9aa", "value": "6144:CQ8jqq59tK+caE4jP+eQoaDpUkQ5jKbS2uN1avTi:tq/M4jKG5jKbS28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696688339, "uuid": "2200c564-9a32-4c56-a068-c7c66f19a5af", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696688339, "uuid": "bc600184-b53a-43a3-bd44-86a31126fd38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688339, "uuid": "245fedf1-a975-48ce-b551-c46b91d78635", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2125e0ab-6517-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696686050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696686050, "uuid": "a1dda8bb-8ab6-4f7d-ba90-f70ef6fd07fe", "comment": "Malware payload", "value": "a5fd0f6673a6f3d5fc8485c733c75a8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696686050, "uuid": "a55c32bf-85b9-45a9-a6f5-27960e14e92a", "comment": "Malware payload", "value": "1797520918cb55db9222692f84948344e9de21dd0a94ba118c54574d9e47f4b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696686050, "uuid": "4c0ec6ef-97d1-4421-a71f-8b6c746d4cb7", "comment": "Malware payload", "value": "e26b63c7177ff6ff048f11971afcfea622d3206b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696686050, "uuid": "04a96750-ef30-4ea0-9360-65f8f0d1e833", "comment": "Malware payload", "value": "05c177d66a5a2b485ddde24d3de4cdb0c642873aaf0bdeb885f6fa34b35379767e12b66e013a106266ca463a9d3a9e46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696686050, "uuid": "2143da4f-b2e9-47e2-bd67-e23a854a0c3f", "value": "T14F4523A1ABDC5566E8B21B714CFA03632E307DB34E7047175B45CD0A2EB2AC45532B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696686050, "uuid": "8958f86b-73b5-47a1-8f77-3c895553cdeb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696686050, "uuid": "e51a9033-a13f-43f9-af43-c4fa710a9786", "value": "24576:+yKL3YbdTj+Oa3XdDTB1qdioH+cJdXIqmi5cm98XBfDH3:NIIbdToXhTIdecJdIq5coKBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696686050, "uuid": "3c30c97f-80f0-4763-8184-5473c148bc3a", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696686050, "uuid": "5bf3a927-fde7-46d4-a842-eb3d13f508be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696686050, "uuid": "bb413f69-b70a-409c-86cb-18bbcaa77c8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628bbabf-64e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696665544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696665544, "uuid": "212532cb-74b9-4159-81d2-267327023bda", "comment": "Malware payload (Formbook)", "value": "90f56eefb533c21d5a62577184244aa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696665544, "uuid": "640ad1be-5d4e-403c-bf00-d2b235e81f3b", "comment": "Malware payload (Formbook)", "value": "180fce98cac3dd64109fcf09745194ced61a15c25ff1e698754105dde6586a58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696665544, "uuid": "29bbac75-8872-4506-928c-0f0242440abe", "comment": "Malware payload (Formbook)", "value": "bab21f9682bb038b175a87f9c50026acffbf5150", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696665544, "uuid": "b341b8c0-1952-4beb-b549-1d4e70ad204a", "comment": "Malware payload (Formbook)", "value": "286720735e2ea83b97086ef23090ccdc135626c9230ad09240e55b82fca31316cf0c56ddd36f1d7ac726e8d99d656c76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696665544, "uuid": "82412df6-d020-44e0-8587-1d0f72aca44c", "value": "T11564231477E0C0E7DA2361306D3E2AA2BCF6F56824B46A4F5700AB685C71B5DCE6D7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696665544, "uuid": "8d5703ea-3d08-4666-9130-64ad7dd9faae", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696665544, "uuid": "4287a6e5-d2b6-4b6b-a432-7a28c9294eb2", "value": "6144:pXFKo5l8qf7SO9mj/WYpA2X+wIsT6P3rTwOiNxiM9orMhccGEV60:pXRlYjfRITPb0OqowSSM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696665544, "uuid": "d32684b8-bcb3-48d8-a59a-65ecb5cae13b", "value": 311061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696665544, "uuid": "54e2ecee-12f8-4fdd-8d66-f013f765df0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696665544, "uuid": "8867d992-9cc4-472c-956b-cdc629ac057e", "value": "90f56eefb533c21d5a62577184244aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13042cbc-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696663693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663693, "uuid": "1f824964-9dba-4160-847f-8b4eaaa20a0e", "comment": "Malware payload (AgentTesla)", "value": "cd5462b5fd310e95362a9a37ba227c49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663693, "uuid": "a4641aca-9bb1-4cf6-b078-e7e64f2e86c6", "comment": "Malware payload (AgentTesla)", "value": "186d9848000eee5393ff0a5ba028b48fc0e6b01997ca0cdf139b4a41e0360975", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663693, "uuid": "007a0241-0830-4bbb-a7eb-5d996e176542", "comment": "Malware payload (AgentTesla)", "value": "566dd93a2362c987b753ec8326240abd7ab44058", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663693, "uuid": "cb5516ca-060a-4336-a999-6551e67c1b45", "comment": "Malware payload (AgentTesla)", "value": "4dcabdc679c56c2508fca201e894cbffb52049004b0b763c89c71754462e25c20aaba6d96f5687adef5bd254d09c634c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663693, "uuid": "dc1b43df-1c8b-490f-9303-cdf099fce93b", "value": "T1BAE433BCF6D5E7A3D2DF85B953D26698064E3F2016AF440BA03358FE24871A1AF2F550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663693, "uuid": "b13a99f8-10b2-4a13-869f-8eaa0e0fec31", "value": "12288:+PP0xnoGqovOZPg9kSVEHguwtA8IyQAAyN8RdabGaeNOQft57vT0Bcy7xg:+EYoW1owxwFcLCAZL8pxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663693, "uuid": "abec6e88-9504-4b7f-8384-328a53fe52dd", "value": 697293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663693, "uuid": "cb640427-7696-4ae5-aa82-b28bd5c4162d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663693, "uuid": "02db164a-c342-412e-a145-36ffa2d54ed6", "value": "Axxom 0011.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c892e820-6539-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696700934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700934, "uuid": "a9456ed6-7a8d-40c1-9ae6-d3b9f7324d27", "comment": "Malware payload (RedLineStealer)", "value": "ccfcbe70349871ba0e753e69eeed65ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700934, "uuid": "7774fc1d-34c8-4725-8a06-009f89db0d43", "comment": "Malware payload (RedLineStealer)", "value": "18a2c3469e294200de2fcbe08426fb816a3d76e0fe1b8e6ed03a1a371cbd2687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700934, "uuid": "8db6b679-59be-4b8e-92b5-9bff8d9d8adf", "comment": "Malware payload (RedLineStealer)", "value": "d1147cc01bdbac028a6339ab2d62b3e66a741f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700934, "uuid": "8d94e512-7f56-4f13-9dd6-0c009116a9a9", "comment": "Malware payload (RedLineStealer)", "value": "a36959a854d257873de738c210b1d27943179f9f1ff83e2b1f53511a910b1cee404f74b8567b94522ee0687646615cea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696700934, "uuid": "8ebebb21-054b-4e68-8cce-ff740e8600dc", "value": "T1DE452316A7E48096ECB51F31C8F713E7263A7DA26970D7473B084C4A1A73AC0B52776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696700934, "uuid": "34d92f15-cff7-460a-9508-1ea35afcba15", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696700934, "uuid": "14641a15-af43-4a9e-8ba4-356ab7f817e8", "value": "24576:fyZWtkdZLUMkDCGIpMLjqS+0n2/cjG7yh1+Si:qMt2TxnpM/zNnjHh1+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696700934, "uuid": "a061af3a-1ba2-4a7d-ad6a-8331403779b4", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696700934, "uuid": "49e6f291-0aae-420a-b00c-0a8e7d5468ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696700934, "uuid": "96301787-23a5-4c1d-8a79-94789e71c72b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52d6e1e-64d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696656690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656690, "uuid": "35b98e4b-1f25-425e-9c04-8a2440f4d46a", "comment": "Malware payload", "value": "928a93187c05d2377ac12b33ec0e381b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656690, "uuid": "983236cd-3fa5-4f43-a883-e20056bd951a", "comment": "Malware payload", "value": "18f472d4078b2a42c591135baca75d1c723e740a7103d060c391845084ed9c24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656690, "uuid": "ebbd73ab-7830-4559-979e-f22a53f114a4", "comment": "Malware payload", "value": "2d58850cc83122159a98d3a4c410a182189dbea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656690, "uuid": "74d1573b-cf56-4474-8b61-aa2930521fb8", "comment": "Malware payload", "value": "2f64b135174e05ae2fbe280a3b7f06d353b6d4c5dbbf0d22e31a7f143077ffa20c5ed829dc7e8db7a532d75c2d5db184", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656690, "uuid": "a0568f67-3ba8-4e3b-8e24-c931ce2ebb02", "value": "T15CD3394AF980AF15D4DA21B9FF6E518D33630B78D3EAB1028E151F24678B94B0F37606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656690, "uuid": "0bb0f103-5597-4e06-b11e-f0ebc3446abb", "value": "3072:pbrInf4DciL1s7PIIm69agarYcULYjZuL74B:Fgf4DN1SIIv9agarYcRjS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696656690, "uuid": "d726ed58-0d26-4f72-9ebe-3e35a2131317", "value": 133340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696656690, "uuid": "a2fff1ec-0865-4330-af0f-73139d2c4d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656690, "uuid": "f1e7aa33-6d7d-4081-a807-165d04c02d00", "value": "SecuriteInfo.com.Linux.Mirai.4306.29723.12836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b5a620-6501-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696676554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676554, "uuid": "ea891622-168f-4c6c-adac-397dbe4c302a", "comment": "Malware payload (IRATA)", "value": "158dff75cb050fb0b25bebfda9435360", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676554, "uuid": "b8f4646c-b70a-4e4f-ae15-85488cc9c1d7", "comment": "Malware payload (IRATA)", "value": "19a1fd1c00ae3ea2fad864d1fb6c07b3d4381fcf098ea7d33ca7acb46264a9c0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676554, "uuid": "abb2c76f-8993-4957-8189-0a3a00717fdc", "comment": "Malware payload (IRATA)", "value": "7052db4efba3c8d1dd98d50c57d7ae04e00dda95", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676554, "uuid": "45b81e52-fa62-4ca9-bb00-fdb4ba44aee0", "comment": "Malware payload (IRATA)", "value": "d6b22e16ef1b2bade469ae7ff5af5e5421f7a9a3f8b4eedbeaac8fbd112d459986a1021f27aa5b0223fb8b837f4c5c8b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676554, "uuid": "5d66ab27-2faa-483c-a0a5-dcecc290a761", "value": "T1E8D52393F73AA81BC436D13221852736655B5D28CA02FB4B794477FA38BBDEC4B812C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676554, "uuid": "c808645d-b1ba-4ee7-b98f-f96ebc261e6d", "value": "49152:hEBYKysS6HgvqFnynF/T3EMfLapzyaJP3ahlNIzuF8WB8+MgGHrShU9LACw8:hSTpAvqFULhf2zzJRz2y3ShcAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696676554, "uuid": "204be2ce-5f22-47d8-9c37-87bc8a82fc70", "value": 2756685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696676554, "uuid": "75773fea-498b-4f31-a3d3-a25eba7b1030", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676554, "uuid": "9d76c8b8-d076-4f9d-b52e-0c23f512aa19", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4922568-64d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696656689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656689, "uuid": "0360c2ba-b87e-4489-8c81-cfb9432feca4", "comment": "Malware payload", "value": "9a5506e963a9294ff6acea0cd15df7f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656689, "uuid": "560cbaac-fb35-4eb6-bd0c-785e5a9d6e73", "comment": "Malware payload", "value": "1a256266fcda123deef364fcaa5887dcb5539439942da01c7ae8605dd260470e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656689, "uuid": "1ffb84ae-dab5-4256-a81d-f66f390a6921", "comment": "Malware payload", "value": "12c7808632c690c6b48ac9c762bbdbcfbaaaff8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656689, "uuid": "b9936ba7-d0dc-4135-ba78-8ad7af6ab6cb", "comment": "Malware payload", "value": "ccba3908001a84871f4f367586e34b9be332f4ab2531a5983ca30ab2b2e51e430c92b6e9bfcfefa0519f2abad5405ea1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656689, "uuid": "efe42f60-fef1-4562-819e-b5f2ef053e61", "value": "T1D5C3494AF9819B15C9D61179BF2E518D33231B78D3DBB2028E291F34AB879570F3B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656689, "uuid": "f560b3d3-77c2-447d-814c-ec5a6e437339", "value": "3072:Cv7uIuidKciLps7PIIHT42aal+H8Qym72:eaJidKNpSIIHTXaPcQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696656689, "uuid": "8b9ed05a-70c9-49f4-8934-78029a810d7d", "value": 120348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696656689, "uuid": "42e555ae-0591-48d6-ad87-88d56cb3172e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656689, "uuid": "33af7f3c-6267-420f-abfe-a451cd46b96c", "value": "SecuriteInfo.com.Linux.Mirai.4306.29189.23766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d42271-64aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696639533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639533, "uuid": "223937a0-2d43-419a-9be3-34420cc70d41", "comment": "Malware payload (Gozi)", "value": "33ddb8880db29cac11e05bfc30bcec6b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "communicalink-com", "colour": "#2A4CF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639533, "uuid": "649250a3-3ee6-4409-a792-7670be5c47f4", "comment": "Malware payload (Gozi)", "value": "1aa20713c9af2eeec3756392dca573d39bf5fa8d18a14087d67cd39f07509eea", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "communicalink-com", "colour": "#2A4CF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639533, "uuid": "4f36bdf5-8f21-4e9a-aae8-7d370a4067c4", "comment": "Malware payload (Gozi)", "value": "fb90dc44ba4b8f6b356735bd46231e6f99e15b62", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "communicalink-com", "colour": "#2A4CF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639533, "uuid": "e55df65e-69bf-4f31-a58b-77d79fdf31f0", "comment": "Malware payload (Gozi)", "value": "dceaee82309443967858fedec9f688d5f00a59f55ab26eec2dcfc0d869e034526623f5d66bc4ecf1609fbe31884c49c8", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "communicalink-com", "colour": "#2A4CF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639533, "uuid": "21d4747e-7a8a-409a-a24f-1755f294fb65", "value": "T19E54AF23A3E17C71E5624A399E2EC2E4772EB8214E59B75A23585F3F0CB01E2D673351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639533, "uuid": "f502da4b-25e3-4b52-bbe7-c58cf69a99a7", "value": "2d31cbdd8d752ef8c57cb740fa025cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639533, "uuid": "3a371e47-be4b-420c-b609-9a1a98e7517d", "value": "3072:/yktbYYNGzHPg2I1eWy9O9El/pjBXDzrFEd1Uot:K4YIGz4ToTHl9BXz6Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696639533, "uuid": "a611b733-ec83-48a7-8e79-2d2b0317e733", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696639533, "uuid": "08dd17ae-3f58-46de-968c-22e46817786b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639533, "uuid": "9ba6f1f6-a38d-4cff-a5a0-758e0d8cf2d9", "value": "putty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0b9b8f-6501-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696676865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676865, "uuid": "b6db0b8e-3866-40e8-8667-37a8abfc05ae", "comment": "Malware payload (AgentTesla)", "value": "43a1c22ace9660ec7712ae5945aca29b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676865, "uuid": "f3725a63-8b28-4ec5-97bd-c962d516fc0a", "comment": "Malware payload (AgentTesla)", "value": "1acf701fe129149fc33c5431899d83aa64fd31ad0b241ed83ea8ab1673eff6db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676865, "uuid": "792f5bda-6c3b-4fee-af4f-8dcf2212d8b7", "comment": "Malware payload (AgentTesla)", "value": "bcb203aa5d7d9dbe2c4c8432363df66ddf730bb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676865, "uuid": "bd9771fd-1b2b-4c88-a035-ffda00b49e56", "comment": "Malware payload (AgentTesla)", "value": "63a58c1302a7925a7d1684691107cc88f1da959a80f775d1247bab3fd4ea38ec373edf6bbb725e8398faad8914697e7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676865, "uuid": "2272bc44-a2e9-477b-a461-392396828ebc", "value": "T183342A8C23C8A162CA7D0EB294B21A4A17B8D2579343E7FF18DCF9F53E8635166061F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676865, "uuid": "e299c490-42fb-4428-a397-277c1473b9e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676865, "uuid": "63ad05d7-e3ee-487f-a562-d6bb2db85797", "value": "3072:i6saMlcywEZvwjoDWqbipZC/FG4m06qZh0C6flb5nwVmlR22oqcepEn6uuV9gCs2:VuOewjoDdiwG4m06qZaXfS+R22vsc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696676865, "uuid": "a0ed7371-6b6f-4e99-aa58-8cf89994addb", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696676865, "uuid": "f0a2055b-57ae-4349-abbe-3b28744bb9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676865, "uuid": "de259225-3266-4500-82a1-118ffa1be44c", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0459e3c8-653d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696702323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702323, "uuid": "a9f81f5e-e25e-4932-9498-c8782307e3c9", "comment": "Malware payload (Mirai)", "value": "b484bf4709fceaaaa3a868fd84ce47bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702323, "uuid": "aca5cd60-c490-4559-8e54-eb78ef85508e", "comment": "Malware payload (Mirai)", "value": "1c28dcb048e28a5939a2f67f2fb0df3f1ff97fe7f98164f7b1dd4278e1d2af82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702323, "uuid": "b1929a4a-aae0-48bc-85f8-ec9115d48067", "comment": "Malware payload (Mirai)", "value": "e8c7f1e5f16d372897db4292f83ba4595b6b50b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702323, "uuid": "bd3a7788-389f-4ae7-8519-e3b18f67b217", "comment": "Malware payload (Mirai)", "value": "39a83450d638a967be5ec05528bb7d2394770698fcd72be940ee1a0dedcc59634c30a5c9bedc0bd32deefeac234e7fce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702323, "uuid": "b4ad2706-628c-4e3f-93f1-11ab74667198", "value": "T166432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702323, "uuid": "c9ba2ba3-7b5d-4f53-9dc6-b4fb0de97ecd", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwx:RqtmZPuutfbltZFBSJsBcfDSTFI+BEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696702323, "uuid": "947264c7-bc28-4d27-872a-962fdc22af9a", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696702323, "uuid": "5e405277-1118-450c-a394-7eeb55aaecd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702323, "uuid": "c09dceed-36a9-486e-92ca-2397272e650e", "value": "b484bf4709fceaaaa3a868fd84ce47bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd856cf-6543-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696705265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705265, "uuid": "7f679280-a5fc-46cb-8dc6-c509c06d0d4c", "comment": "Malware payload (Mirai)", "value": "48d72422eea56e8d02d36c8286e8e9bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705265, "uuid": "340c8472-70da-467e-a63b-368340696bc6", "comment": "Malware payload (Mirai)", "value": "1c62de69a6b9d4ef6d32114c589e2b6c596496f44c020f04efaee26d33565f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705265, "uuid": "03f9f827-b2a5-4ce9-be58-88098682c02b", "comment": "Malware payload (Mirai)", "value": "1eeae2e804e39c16fc157f32c524db5a886e2df1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705265, "uuid": "3b762407-7f4c-4e43-ae74-ec5ed92978fd", "comment": "Malware payload (Mirai)", "value": "f24353741f240b6b1788624d1e5de8252d9c86c9e125394fbf3824aff04030117c87a484809aba355e4e994b49c9aa8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705265, "uuid": "ac94f751-d016-4f1e-a00e-dc5e82a0f87c", "value": "T153730946B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705265, "uuid": "de48ecce-6247-4cde-9e27-f5e614185acd", "value": "1536:iNn3N/UWjwGh8JzFIcwMstHCfI5WzR8ZvNmSVrsYOZzlIJil40e/Cpd42+:6/UW9hozFIiod5WoY0ry40e/Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705265, "uuid": "0ed2ca0e-5357-4998-9afc-424d7a7a398d", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705265, "uuid": "865a9452-5f45-4df8-97c3-5a1f2a8596c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705265, "uuid": "f7f2136f-6ca8-4a38-81b6-da76b7de62ac", "value": "48d72422eea56e8d02d36c8286e8e9bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1196828e-64da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696659825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659825, "uuid": "df867ecb-023b-488b-98f1-beeb7f655c3e", "comment": "Malware payload (Mirai)", "value": "09e7bd6cc6389325968d66b15ec49d9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659825, "uuid": "eacc79ab-16ee-4583-8650-6b0d75c33fe8", "comment": "Malware payload (Mirai)", "value": "1d5933e15efead553ea9aa8113f9dd37b8f8d54e64aabade0691f47d176a0f2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659825, "uuid": "54e9991b-b4a7-45c3-bfca-c76fed6afe83", "comment": "Malware payload (Mirai)", "value": "63b99b85878b768f8f4abe87b42a6ee7c59c3bfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659825, "uuid": "fba6c7a4-4113-4491-a2a9-6696332299a8", "comment": "Malware payload (Mirai)", "value": "18bd93aad155cbee455fc60f9927e667bbc505c58729f84c157c8d21f4d7579015b39e612cfbdc033e5784f0f3a75b74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659825, "uuid": "ff4c5d0a-a4df-4004-9f0f-0b45566b3f9e", "value": "T174534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A9671E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659825, "uuid": "8a260e3c-8a6b-4637-9866-2c70dd353091", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EMXO/p9OyDQvSFRMNYL6FV+tg6wWr:+5HAdOmGyNtTAdKOyUaFRMNae+aTWU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696659825, "uuid": "ef68df32-a524-4ba0-a62e-6f232152acce", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696659825, "uuid": "abda0f42-bb0a-42e6-af78-5c71335ed5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659825, "uuid": "4c215292-ac09-496e-9d41-cc6aa23bf956", "value": "09e7bd6cc6389325968d66b15ec49d9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2302c48e-6508-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696679611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679611, "uuid": "67bb189d-e90e-45bc-b66f-a760bc46f1a6", "comment": "Malware payload (Smoke Loader)", "value": "e837cd0206f7f078271bc891339d8db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679611, "uuid": "bfd4f9f4-1ef9-49a4-896d-5e8064a64f87", "comment": "Malware payload (Smoke Loader)", "value": "20a32c84351434f658a3afcbfc2619272b34319db69e28ee80d96ade9a90baca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679611, "uuid": "2276cba5-8afb-45d0-8a05-3d1b5fb7bbf0", "comment": "Malware payload (Smoke Loader)", "value": "222e8b21de2f8bdd7243f269e0193c6dd7af56da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679611, "uuid": "8b1ce880-faad-4eb0-be60-bd6532baecbe", "comment": "Malware payload (Smoke Loader)", "value": "c98e49ded787a3280cfa05334d251391f825a89df626bdf1d9516979ae90de2c62063ea5cd76e9e389d22da1d45c297c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679611, "uuid": "f75b98ed-07c3-4ba4-bc57-89e1cc3316f4", "value": "T1CA547D02E3E1BC61E5224A329E2DC2E4772EF521CE69B75B2B545F2F08B11E2D673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679611, "uuid": "fe531132-783f-4c84-9962-e3c7bcbfd859", "value": "2c4e40871558ef3f015b1de82967c478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679611, "uuid": "c217f78f-c986-472b-86c0-3bf9c3974a32", "value": "3072:DZFX9ZO2ePDst+i6zDGUAbcJf3QgjtIdhNZJU:FLZhePYtr63HogjtIdlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696679611, "uuid": "005d5095-6a34-4cc0-90ce-d924e37cdbaf", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696679611, "uuid": "e484470f-bc22-467a-90c3-0708d39682ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679611, "uuid": "b6086694-accf-40a6-b978-53d02e6e4909", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2c6ac3-64a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696638955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638955, "uuid": "e09579b3-9412-451d-92bd-f91594bd1355", "comment": "Malware payload (RedLineStealer)", "value": "a13a19f1d95a4c246dbeef6ce1696c63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638955, "uuid": "f53460f4-41fe-4fa0-bb2e-de351cefb66b", "comment": "Malware payload (RedLineStealer)", "value": "20c50f9e921829444ccc682b1a7df8c584b34c5589eca6d0b5aef8e153ce1b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638955, "uuid": "743861e9-30e9-4958-afa3-9b22c710ffbd", "comment": "Malware payload (RedLineStealer)", "value": "36643f3df73c09231c1acfe1bfa4aac9e0c6dc4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638955, "uuid": "87bce088-274f-4a87-9f45-220f50d73e40", "comment": "Malware payload (RedLineStealer)", "value": "72a20d5871546c45ee34713bec4f99a678bc249920bd5ddde89b7c3b1de95022a859045636e73702399b6d81d63abca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696638955, "uuid": "182261e0-1768-4c48-9418-62ad160e36cf", "value": "T18E452313D9E81472DC7A17349AFB27D71638BD124A75C29B3793AE0F0872690E639363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696638955, "uuid": "d9e3c12c-ffe7-4ca5-9a3a-482b16f90f91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696638955, "uuid": "d566bb57-0381-44db-8e7a-9520ddecdef8", "value": "24576:oyawf2a0W+Qv1q/5iHxnKSuECKEkgFDVz3nAjnpn:vawfZaQtq/5OxnwXKEJXz3AF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696638955, "uuid": "3e8842a0-259d-435c-a271-51d34b7d8b51", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696638955, "uuid": "f214f384-d1c1-49f8-bb64-41ba8a81f851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696638955, "uuid": "1e73b16d-4d5d-44c8-bf57-587f1cc49a58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc79119d-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671306, "uuid": "71912398-b485-4302-9282-e5ddf13f1920", "comment": "Malware payload", "value": "40cbed5458778c172c94ba4f1a52d8ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671306, "uuid": "b842db1d-ba6b-4f01-a9ff-3c486b8a733e", "comment": "Malware payload", "value": "2347f81fa51a1c6a4740cc336af20ce4ef27db5fe05ca3f4e568e4a5e3b2bf6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671306, "uuid": "b6ce1dc8-6596-405d-85d0-3567baee7c7e", "comment": "Malware payload", "value": "536d949fe758b5fb7f1d9de3570e7c5823bbd0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671306, "uuid": "b7cd2c23-54ac-4a8c-9d62-4a9f132db184", "comment": "Malware payload", "value": "ca3637216e1a357ee86e2ea5173cdc1389922825c1f0bf6cad8d6686c4aea85e43424442eef3dbd0f36af32a47af1c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671306, "uuid": "f8f908df-fd5f-4ccb-b2e1-c4be8c9e54fe", "value": "T1FB957D21A5E3809AE4710670C9FAE675A7367E44672582C3768CFD3537B1AC098326FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671306, "uuid": "fe7491bd-1168-4a53-9d45-79a3c48a4fbf", "value": "49152:KZAUW0V6l5Cf4s8pl50O/hw/wQTvYvWBmC8F9:K+HC6l5Cf4s8pomhw7rBmC8F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671306, "uuid": "965f71ce-53ab-4c62-bcb1-a69ca55e8d09", "value": 1921024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671306, "uuid": "4dcf80d5-2c39-42a6-b659-3704c3a4b299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671306, "uuid": "5169b0fc-5bed-44ad-8d57-e738c9e2c33e", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.17463.29869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9814830a-64f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696670788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670788, "uuid": "2ba79195-93fe-46e0-ae70-78be645cf1d4", "comment": "Malware payload (RedLineStealer)", "value": "8fa754c9cb1e9e019401fe728a0ee25e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670788, "uuid": "0cbe0a11-8a83-4d66-9441-7cfbf9f30c10", "comment": "Malware payload (RedLineStealer)", "value": "240ccc0c7bf6ac7109f56e50f57149eec22aa69f5afbbc77353f73d6424a3120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670788, "uuid": "34edee0b-c8ac-4dd7-80ea-d878add66f73", "comment": "Malware payload (RedLineStealer)", "value": "891ed72ae215695ff2730ae22ad96918c1ef4323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670788, "uuid": "f88feebc-784b-4174-803c-6abdc030699c", "comment": "Malware payload (RedLineStealer)", "value": "3ab77bfd83d8e7c8b8c585182d6d335bb227215c9f1ae003527c734f52a90c62ec7eae7e0f8d68f6c58ef57ff2c91e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670788, "uuid": "f20405cb-4099-47f7-91ca-add84644a921", "value": "T110452353EBD95072C8A527B05CF702D70F32BD698D18425B2752AD0A4CB32D2BA73767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670788, "uuid": "bbbfd676-629d-47db-a861-32c597897f87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670788, "uuid": "d3a0823d-3356-4bb6-9cb5-3a260739aba1", "value": "24576:nyP9YKqMvXaaHsIf0v1OBUTiNJGoCpSKWj0fI:yeKqg7zf0SUTaxCpS10f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696670788, "uuid": "15cde7e3-51e6-4829-8514-6a46d9244bb0", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696670788, "uuid": "6cd41717-db30-476f-ba55-7ccac412a151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670788, "uuid": "56ecb188-bbcd-4883-b4ad-5fdbbbb5f8d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c13737-64e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696666622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696666622, "uuid": "efd16f26-72c4-4368-9f1a-ec22ea4c33fd", "comment": "Malware payload (Amadey)", "value": "caf47d69e0564a80234abf65c6770ba1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696666622, "uuid": "ba5245bb-f65f-4148-921d-8b2f61bfad1d", "comment": "Malware payload (Amadey)", "value": "2551ee7ecef46324e5d148e00e7b349a4f6356619481c8d7414096306eca379f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696666622, "uuid": "d27f8f0e-82a4-4526-969a-4d937bd8174a", "comment": "Malware payload (Amadey)", "value": "31451b8bf6f594e9e77a546724c2824e401c6b9a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696666622, "uuid": "1ae7a630-0478-4391-9ce2-1b56aa643f5b", "comment": "Malware payload (Amadey)", "value": "36c82f0521c2fde14f8bd21875d0e71f82acfbc9ab41d3abffa3b894dc4147b5da00529f23341623743652200a4655eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696666622, "uuid": "a5bb85af-690d-4ac5-ac49-61dff5074729", "value": "T17E452342BBE54532EDAD2B746DF703C30A35FCD789B482272B858A1E0D726D066753A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696666622, "uuid": "5b461d33-1ac9-469d-9709-4ecd8ab55db7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696666622, "uuid": "d3503a31-9f4b-475e-829b-6cf217ba05d6", "value": "24576:wyfjE2KFvNyypRW1HCFR3Xy+0ll8mJNQ8:37E2KiypSiFR3g7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696666622, "uuid": "d081e602-22f3-4628-bf16-c5a522a993f1", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696666622, "uuid": "4f8a87f9-3835-4a65-a315-4d831311aa52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696666622, "uuid": "66b9dbe3-5cb2-4548-814b-91471887de8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210758be-6554-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696712250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712250, "uuid": "b62edd82-2c83-4dca-9cfe-99982f5da118", "comment": "Malware payload", "value": "59a6064c91e21880c301d9854360bb6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712250, "uuid": "ef82af7a-3e69-4209-8de6-2b27fce2c5ec", "comment": "Malware payload", "value": "26b6fb3571fb7d2929cecf0c63324aa220a50326bd554b0901aedbf48387b836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712250, "uuid": "409a6ea3-2fe4-4ff4-8fd3-c90916781fdb", "comment": "Malware payload", "value": "dc1872c1f9de93c91cf9dd5b591fad2506332c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712250, "uuid": "31c76ba4-e7e0-483e-ba36-d8fd4918796b", "comment": "Malware payload", "value": "937261acd1c6f842ded26d430ddf2dcf1e7593bf6db2c0540c3912463226c977a8e857d6835b35aed7728cb8945eaaf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712250, "uuid": "036c59e0-cc72-40ae-a2d8-bd263dcca386", "value": "T195548E4363E0BC75E5664B325D2EC1A4372EFCA1DE58679B33686F2F08710E2D562B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712250, "uuid": "39a3695a-571a-460b-b7cd-803f4e9604ee", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712250, "uuid": "8238c0bc-9ab4-411c-ab97-a69751eff7f3", "value": "3072:OZcIaOtMtWzHeirygydg1uBLk10ays1emYYtPwi1WPp7w3z4Z:ycZBWreirGdEuBNnbmLNwi1WPxMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696712250, "uuid": "d750aa9e-dabd-4f39-b918-b3aa8142b0aa", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696712250, "uuid": "9172745b-2bf3-4e43-804e-9f1100d9995f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712250, "uuid": "5c9ba49e-2f39-44ce-a402-e1e1c7511d1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3fc3cc-655b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696715406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715406, "uuid": "a9d08ab2-5b68-4e0c-8441-2e3f4474ffcb", "comment": "Malware payload (Mirai)", "value": "34623d06353e5a660e097f37d4a3e86e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715406, "uuid": "39111880-2be9-4522-8a94-e3a7b1509f6b", "comment": "Malware payload (Mirai)", "value": "28933b227a6d7b138f6fc4034c1b694f662d626c8a4825a33cfe7b4a61c4db51", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715406, "uuid": "79eee7da-f433-49a7-a8bd-ce57ccc48c86", "comment": "Malware payload (Mirai)", "value": "76624fbe189b2e7693bdb6544783f3cae74b1fab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715406, "uuid": "9f596581-90ef-46b1-b9db-c89736504c59", "comment": "Malware payload (Mirai)", "value": "a8a289838e516d7435baa777a116a70691d4d503582e0bfa6fcef68f28cfcf1b6ba0251f925f67f82cf210140486a4ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715406, "uuid": "2fdba613-c9ab-4b68-8606-4eed931d7e8f", "value": "T171E2E16F078F4A8DED48B1F7ACCC708248E6A55233BB4F625B2918B731172D541F895B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715406, "uuid": "3bc3dc57-5a1b-4bbc-8ba5-e61314c51036", "value": "768:xq3yhi2rg98FdmvPyQw7NABkcEf2VyVVtXLkPLmP+okQvKC:KiFdmvPgACcEf2VOkPgNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696715406, "uuid": "8c7fa070-52b1-4dde-801c-7fef59a800eb", "value": 31344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696715406, "uuid": "be3e0ee3-4f11-452a-a3cd-482951299467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715406, "uuid": "97009e48-acc2-42a2-916d-2dc66e8fc82f", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15337861-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696663697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663697, "uuid": "8a1188b3-9295-4460-a959-770f179c2102", "comment": "Malware payload", "value": "4e95a58d5b71bc6c71c2b70ccf23c816", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663697, "uuid": "e411fd47-1a55-4cf0-9787-21dc3c67accd", "comment": "Malware payload", "value": "2a2184cb7455e4231ab83dd3454758bff33cc39c577d246a5edae3ec9d41cc93", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663697, "uuid": "442d9e81-48a6-4ada-828a-5eef62766253", "comment": "Malware payload", "value": "2550f42303b06fc4428d9d1ff794eb9aabdd4414", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663697, "uuid": "0e2e3133-5f18-4396-a4ae-3ee985793492", "comment": "Malware payload", "value": "c34f3702ed70a668eafdfe8ecaad25c5041669175125bd4f3332107f05e3f27e71f454adc7964115582aa0d0779c5afe", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663697, "uuid": "af2df772-c153-4a28-8f37-8372283eed01", "value": "T1EEE109DEC53B0B68C35E2437805032418626FE1E53CB1A06A9B06E7C99B76E3574E294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663697, "uuid": "d412adc3-1fbe-4021-af9b-b78489e48aaf", "value": "96:jNdvn3uZtYcTjjMhVVCvkwQEeGIRf3UNa22ZUgkxikRFotHYuL99vrlsi9uHIz:DvnAtLfOV8vdQjm5g+1RYYuXvprj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663697, "uuid": "de3a79dd-b30c-49ba-9808-d4ab482b6b47", "value": 7166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663697, "uuid": "48619065-a1b7-4789-bf10-143366218e60", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663697, "uuid": "3279819f-4d2c-48d5-8842-cd4caa17ac72", "value": "ROCH-NOVA ORDEM _PO-674394.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb55f20-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671304, "uuid": "32668601-daeb-42dd-a1bc-4149bf0e3cc1", "comment": "Malware payload", "value": "6bbc22fc29248e49a9ec8419aafc54cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671304, "uuid": "2bb2e2d5-614a-40e8-a441-ee3488564238", "comment": "Malware payload", "value": "2a680eabdb7f8a94a0e1ab61c182924f516d5b7cfa753e00d62e2c7faf4deeb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671304, "uuid": "3c03967b-2641-4adc-9355-145646f5098c", "comment": "Malware payload", "value": "6f1290469408088a3924b2700255cf4da5af9d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671304, "uuid": "358541d7-cc7b-4e1d-a57c-75d164d840c5", "comment": "Malware payload", "value": "c0e11d5d47c5b3b9c2a436268016c807adcccd60ecb3cf40e31e96c7d362d05fc5f9f0ba48e29cd95c96513ade7998c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671304, "uuid": "0d77405f-5eeb-46e5-a2a4-3c1c5563ad4e", "value": "T1BEF12C93EDE1C8B3C55AC9BD5D454934E5326E3177E2A2D36FAE580DCC242804BBCB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671304, "uuid": "e0f0bc1d-5895-4fe6-b153-7654909abc24", "value": "192:nwxfRq8HebguuREnZXbzNbotbFtZKN8lryN:o3HqsREnZX3Qt02gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671304, "uuid": "c43a3ffb-df8d-4b35-af7b-42880c162822", "value": 7522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671304, "uuid": "0cda2a8d-dac5-4a1c-9783-f7c95c0ac656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671304, "uuid": "7e463d5b-0e60-4204-9731-67810fa83d73", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.24973.7965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d70cc2-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696720317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720317, "uuid": "66853742-bde5-4649-8d28-be2edcdc1f9a", "comment": "Malware payload", "value": "e674688f489f2e6dcfdf18af1ac37858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720317, "uuid": "f5ee2c28-2bc5-4ed7-9f2c-62df4a31cb9d", "comment": "Malware payload", "value": "2e16414b9a060e10b673f184cb2b09f163c05eb8c3e7cd2d0b87cb7b6f72912c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720317, "uuid": "4487bb62-3733-4b7f-b5d1-db3d2105df99", "comment": "Malware payload", "value": "269430f3fce8699d09b1a5e8919c70ef89d6ab08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720317, "uuid": "8ac9bd9d-17dd-48d3-a7e0-d39b59d4b612", "comment": "Malware payload", "value": "677fb5fffaaed86cb82d50a9835f4836bb9c85d8e46e8e6aba37f14b400eff0754a128abaecfd7cad42483438e0c783e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720317, "uuid": "412f9837-42d9-4d60-bf47-5634f36a767b", "value": "T1FBD50F283F816F23EF2D81B7DA854506E656C656E2314B4B10F367F9710E1036B8AF6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720317, "uuid": "b9cfb63b-38d7-42ff-8c63-32a8df5e14af", "value": "49152:KuPKYM3alrj2U+qo8dnKkL1/wKXsWulwToGnMMTbhpS6RIgobKPpmPJQS/GSuyKy:QG1PpBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720317, "uuid": "82ba7085-8b41-4dd5-82bf-9a7d3e1116ad", "value": 2958848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720317, "uuid": "76e3c806-526e-4e01-b90c-c158c6d45e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720317, "uuid": "e42b2c4b-5270-469b-a7d0-6ac008cf4921", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b4193e-6542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696704609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "f06ba64b-d1ac-45dc-bfda-8232d0b54e0b", "comment": "Malware payload (Mirai)", "value": "d1dcaecd3ba2c6aee8f10f94f6d9e581", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "dd43b6aa-34d2-42d7-b7b9-424532a70700", "comment": "Malware payload (Mirai)", "value": "2e2bbf55fbbaf3a89292d8bb5f023eb35abc359a906796e9d20524cae037cd15", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "ca2532bb-8487-4402-a72c-0c7e85e1749a", "comment": "Malware payload (Mirai)", "value": "7880367d1c6522c4ba632f8b365dfc47c4c538b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "87998f0a-5fa3-4af6-9b2b-8422a1854412", "comment": "Malware payload (Mirai)", "value": "242e7ff62c70e4128e18ba665a3d2f4f0e57e3bf22098ec3ef9c2213a7ad5df5e825d9f310b93ba405b0b9d54a44bd25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704609, "uuid": "15381b36-a163-4191-b3c5-abde1501ff34", "value": "T1D843D655B8C15A6BC1E423BBEA6E518D3331A3F8D1DE7217CC111B24BAC952F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704609, "uuid": "1466b21c-8d94-40f3-8bee-e7db63fde5df", "value": "1536:ThZQUE6+KYyXI3L5z0CI7rwQD3lG9WnSfxuyd42+:ThZgMkoCI7FD1G9MSJuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704609, "uuid": "3800cb8f-2913-4cd4-acf2-1cb50dcee237", "value": 55556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704609, "uuid": "8c854cc5-7773-42a1-94b4-ff18feca9eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704609, "uuid": "213d7454-3e5c-4f46-bc60-aee5d554bc2d", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f9005b-64da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696659829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659829, "uuid": "4c1f5d42-05f8-4425-83eb-d807424bb1b4", "comment": "Malware payload (Mirai)", "value": "1582ab684171d2129a2cdc0722b4062d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659829, "uuid": "7adf5756-434c-437b-afb6-ca2f0eeff808", "comment": "Malware payload (Mirai)", "value": "2e73231edf4a582f9be5b64e7ba51c846c87d7c0eae4c8fb6f6598249989c844", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659829, "uuid": "69c64549-2e40-430e-98f5-b21283a090e9", "comment": "Malware payload (Mirai)", "value": "a6c47beaaf698bcfe7c966dd0b3ae31bbdebe88d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696659829, "uuid": "ef5f9f3f-0020-441c-ad78-4332aeb02e7e", "comment": "Malware payload (Mirai)", "value": "664432c9fcd719899c6cff80b79d4b3581cbd44b6df4aecf991ed93b429a501ea9be10f3bfe31eb133a52db47fe5b847", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659829, "uuid": "c90892a6-e217-4235-813f-84c798707ef3", "value": "T15C633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659829, "uuid": "3b813722-2ecb-48bb-9f75-e9f6a64b7aa8", "value": "1536:lGRaTYmol/hGIAs4PNvA7QlGm75123tStXV:lya7hJ5GmVD5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696659829, "uuid": "981876bb-2b95-449b-bcd8-b9b858b692da", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696659829, "uuid": "fc736e48-8184-4624-b4f1-5a1ebe05cce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696659829, "uuid": "709290b7-1842-42e1-a618-8524e05b1914", "value": "1582ab684171d2129a2cdc0722b4062d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc206fe0-64c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696651092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651092, "uuid": "0b154d67-f2a7-4416-b91b-3cdbdad64c17", "comment": "Malware payload (Amadey)", "value": "686afd2a2d783cf0934b497a6a362b6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651092, "uuid": "0bfa460a-d276-47f3-beb6-b51572475b6c", "comment": "Malware payload (Amadey)", "value": "2f010466c5ea6352d6a4c0f1d0cce95592c124900db7b3c7a3e3340e0149d768", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651092, "uuid": "8b5a086d-7ea7-44d4-9e91-6d94aec6f445", "comment": "Malware payload (Amadey)", "value": "b625263b63543e6ced3cc9057ca1d8a26e67cc51", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651092, "uuid": "e9ee834e-ff72-452e-bb78-3ff3cbe00ba5", "comment": "Malware payload (Amadey)", "value": "51503ab9e28beb3b7d4b0ca1d26c566daf624a192caa465bbb877b0c581791e03b3ae213522dc99a69123f78eec0c68d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651092, "uuid": "878846d2-b78a-4c1c-938e-1e4c1a48ecb8", "value": "T123452312ABD54066DC3A3F741CF707C30A30BD628AB5421B6F95A94F19F3AE1A432767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651092, "uuid": "c63feedb-998e-4ff1-abca-9d055a8345d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651092, "uuid": "a5b0a17e-8b45-4f84-b35e-b3c0761fe2f9", "value": "24576:uybXjRlG68ZvaUB25KUkoK8/QH3gVlSrrdj1bd9n:9jVf8Zv/05Kn8/CalSrr51bd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696651092, "uuid": "5dab34c6-22b5-443d-85a8-6cdfc3b02454", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696651092, "uuid": "82739739-013c-495b-b08c-315581ca21ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651092, "uuid": "534ccd49-8beb-412e-8d45-f2fb6b19db66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23dac91-64a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696639022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639022, "uuid": "7699ed11-0010-4264-be48-b8c5f4ed38ab", "comment": "Malware payload (Smoke Loader)", "value": "df95396ba8fffdf42752ab8429c0e55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639022, "uuid": "05f9aeee-94bb-4bc7-9955-6acb6d3c54e9", "comment": "Malware payload (Smoke Loader)", "value": "2f1b76c93a90c8f8f6464c5b5d73fd7fbcae5ffdea517bd05226e7c80824bd98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639022, "uuid": "7b72f604-52f6-4809-ae57-2e60b2dee08c", "comment": "Malware payload (Smoke Loader)", "value": "f87f6b108dc03884ddfd30e9c2af6d98c67ce492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639022, "uuid": "b3bbb9f6-f203-4ac0-a0d8-1cf2b6a39775", "comment": "Malware payload (Smoke Loader)", "value": "bac75133a303749951c12481ca6b35f86d045e0cb8968b8753961b6d3a16d2e3f775d9e4988e14f5b30a5d417fa3d64a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639022, "uuid": "010ec0a8-cd79-4606-bc84-40e45f6d3d3d", "value": "T15F547D03E3F17C75E5224A319E2EC1A5772EF9608F69B7662B149F2F08B11E2D663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639022, "uuid": "09911de2-53fc-4e42-b02c-db249f4da5d2", "value": "1a1849e713c02631190c15fdd13fe404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639022, "uuid": "f7a5e801-5cb6-47df-97fa-79ff8f6ee6f2", "value": "3072:bof7OwtZwRAss1auHPfGMRl5LO65G7YegK8:IfZIAssVvfDR7yeOcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696639022, "uuid": "387bf42f-0b72-47f1-a937-fcf7a5d59f76", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696639022, "uuid": "f9b0f87a-7137-4a3c-af92-ac6ed5194d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639022, "uuid": "af620977-05dd-4704-b752-902a09a04ddc", "value": "SecuriteInfo.com.Trojan-Spy.Agent.13999.24767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c469a747-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671292, "uuid": "ddb759a4-0ef8-49b9-a260-6e7ba26d582f", "comment": "Malware payload", "value": "f838980b44a056f52f28244549af77c7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671292, "uuid": "dfdf1029-95d6-4acd-b093-93618855dead", "comment": "Malware payload", "value": "3154f0fa40afa43b9c106c6c7d4c2ba01232053b9087e5fd8348a84e385a3cd3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671292, "uuid": "afb255d1-f448-4240-8357-744018b0aff2", "comment": "Malware payload", "value": "343f7ac119056c5a896e5b72ce9398217c619d63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671292, "uuid": "f5675286-c023-4f82-89be-589f1749fc02", "comment": "Malware payload", "value": "ce3b60cd84aa379ee558f1e76584282db13088e15fed08ffc41388786ff866fb0c061628dfb574ab7c0caeba39fe1a99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671292, "uuid": "e1fb7aba-920f-46b5-b655-65110d68fcfd", "value": "T14B247C1172D1C076D2AF02794C67872827BABE11CBB5C28B7F94BECD5FB06958E25306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671292, "uuid": "73f5f30b-509a-4fb7-9738-93e613da35bf", "value": "14f39becd91bcb6b59af3b0423504a4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671292, "uuid": "43ac1e97-5af4-48b2-b57d-6da0dc3659bf", "value": "3072:c/+qf0FPZKbdueFw/p2pfZpEpQJOnkVi2p5aKvtdwvTyJ5C:s3fwZKbdNFnpfHEi/0GpnwS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671292, "uuid": "e25d2535-52fd-44a8-86a9-1e3296932b55", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671292, "uuid": "fa578d8e-f6af-4689-a112-d8a71286e086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671292, "uuid": "359e28e1-633c-45cf-be0b-20f03413dca8", "value": "SecuriteInfo.com.Trojan.Win32.Antavka.24067.25133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dfaa30-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714774, "uuid": "0e5fdeeb-353c-472f-a2f2-91be654b0c4e", "comment": "Malware payload", "value": "917a23b5cd516e7600c6f19a3932159d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714774, "uuid": "d8c5a97e-3d7e-4735-aac1-6f0d529ea8b3", "comment": "Malware payload", "value": "3232447d9d94e640ee551934a158ec114b07ddab0ecf08bf5a2f2a43d38a79b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714774, "uuid": "67c36b5d-0738-452f-b764-e618b0650e5b", "comment": "Malware payload", "value": "88e2c2d51149d9db75ca8b0bbdbd4dd751c87b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714774, "uuid": "c281cc3c-65f4-42eb-9040-0116626fe044", "comment": "Malware payload", "value": "013d1b15f64ec812ec072f4c05434e356b740ca09cf1186675a979310c79d2a5637f0a916b897e11d892d97ad5a61367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714774, "uuid": "a406c154-fa43-4dd0-afef-f682b8a24676", "value": "T13636AE212651C077C2323F3AD75AA3F9A1ADDE31CD79424789953F387A304D2692A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714774, "uuid": "3f05da34-6770-4da7-ac35-219a1e42bb1e", "value": "b0fd8a5fa5ac0af1fb760c12f732c9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714774, "uuid": "c8b9050a-8f57-4268-8043-fa826487ad1f", "value": "98304:gIFBO7DngSKXwbR47/R7thY5G/gzS5/W0dDTvB0xgxi:gRnf4z0G/gzS5/7ixgxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714774, "uuid": "7d1dcb68-b358-41ae-81e3-2f1145bb46f1", "value": 4997632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714774, "uuid": "6305235d-dc4b-4b19-b6fb-7fb8616a7350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714774, "uuid": "5110682b-fcc6-4244-a30f-a31de584eba5", "value": "SecuriteInfo.com.BScope.Trojan.Sdum.20711.4955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80135200-64c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696651421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651421, "uuid": "632c83d5-edd5-4796-a040-b427e5ec4008", "comment": "Malware payload (CoinMiner)", "value": "bfa4eb9f0f56dd7039448a2a6ed62e0e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651421, "uuid": "c0941ced-c577-4861-8095-e947c740fa49", "comment": "Malware payload (CoinMiner)", "value": "3442b626e35087c5314d21d9f29210341c5546379f7182d8ec8676098394a676", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651421, "uuid": "10d229bd-74ed-4caf-85b3-c9983544e6ef", "comment": "Malware payload (CoinMiner)", "value": "dbbf1517dd7a0540517d1ecf7f187e5cb9687900", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651421, "uuid": "8e2d7a9c-0056-4853-bb53-fd60d5a37556", "comment": "Malware payload (CoinMiner)", "value": "57a140ca546839ebaa0ead39585b7354d353e2476652ddcf5cb4cb890c1b119deb3dcf4813124690ed6fa6ba5617101b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651421, "uuid": "4054df5d-1ea7-4823-93ae-3883b48e02a9", "value": "T1D2547E13E3E17C61E52287329E2EC2E4771EF9618E5DB76A2B085B2F08B11F1D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651421, "uuid": "dec83507-c36f-49e5-a259-4a9da0dfc1e0", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651421, "uuid": "664c2110-ac67-4ea5-b419-e777c46306a8", "value": "3072:j4JN9ZGKd4jfW2Gn9P7MUQl4TiN1ICYrI06lhK3uKoK8:8RZdd4jf29P4MONJYrV6nK3u5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696651421, "uuid": "2ddc2899-d188-4b94-96af-ca7ba5895a59", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696651421, "uuid": "e523154a-72c4-4de0-9469-6dcf162e70a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651421, "uuid": "43357bd1-a577-4670-b631-4ef92c3da1fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29504d83-656b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696722142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722142, "uuid": "658ae71c-875d-4ea2-aa57-be32f970b351", "comment": "Malware payload", "value": "4a719fcc98f4dfc887163f3992b8e5ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722142, "uuid": "83be91e4-d064-44a3-bbe5-af1237a6d961", "comment": "Malware payload", "value": "345c000baebcac07b3ef4000440cb28d3787b59658c17a4fc1a9d5f44444e8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722142, "uuid": "e080c62f-bbd8-4924-8db2-42864abebbdf", "comment": "Malware payload", "value": "e49bb230b1c38f03df637d970509b64869f0e801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722142, "uuid": "e781c431-0b90-4502-b36e-fb7452c41ce2", "comment": "Malware payload", "value": "e6545a73fdfdaa53e95d56e3c51b26d53f0659a18218b01bce481cced3c803e9952c5e4e8ce5881d571e85a711c14b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722142, "uuid": "b88594db-8855-4d0f-afd8-56a97ae22e35", "value": "T1A09533033BF88273DEA12F3168F943872A357CA6A938982726647DD71DF3640593239D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722142, "uuid": "8b8370eb-aa00-49d9-9a95-79d4fcf471a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722142, "uuid": "7f3503d7-88b9-4d5c-9824-3ba82de52192", "value": "49152:JSmHZgbiB6N2jc5R1sS3bR3KZSCNGq/P1soq5Sr:4iZgWw+C1sobRBMG21soz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696722142, "uuid": "66586384-d771-426e-b27e-a47fa25db884", "value": 1902592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696722142, "uuid": "67802915-4e40-4197-a27c-49c9a52907dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722142, "uuid": "b18b2ffd-7355-4bee-b625-e6102998e974", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deffdf11-64f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696670478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670478, "uuid": "e1f77f5b-357b-475f-b96e-5844117ef78e", "comment": "Malware payload (RedLineStealer)", "value": "462cbce168a80b91b2c14f5ea975fd85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670478, "uuid": "f8fe7e86-de16-45c0-998b-2ebe4fc4c0b1", "comment": "Malware payload (RedLineStealer)", "value": "34827a66a28b9fad1b1f0daeb1f4d15185942df647207305d94f00e6be2a689e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670478, "uuid": "4bac32f3-ef6a-41b6-8bb3-f508ed254651", "comment": "Malware payload (RedLineStealer)", "value": "4b3fa5b34b1b20578f4e4175c5beb59485456b70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696670478, "uuid": "a96df3d0-8e03-4b8a-b015-dafcb548e683", "comment": "Malware payload (RedLineStealer)", "value": "f534bf31a4d3fd25bdba3934fe80e78fb3ff30ecf373dd0798c51c2f7c37f3fc0b2c48a3468cff71fa38c57190ae9f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670478, "uuid": "693da97e-f135-46e1-9121-dc13a091ad2b", "value": "T168A44A00BDD2C07BF9A3597225888F752A29BE65C3E9C5DB875CFEBDCB9058207E1142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670478, "uuid": "562804da-1c08-4401-bdf5-bb51492df328", "value": "06ede52fcc31e4900f4f1a7060fce645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670478, "uuid": "32716c90-32a1-4530-82c5-047e0e6a07cf", "value": "6144:99oToLkbRalPXkmJavrR25LAOB3cC5d2U+mSQvmu54G5QB0MKa8osbktmIX0p:99o+kNalvBnfZwQvMG5QiL3gtsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696670478, "uuid": "a5c5be88-3246-4f86-803f-4980f63d643c", "value": 468424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696670478, "uuid": "a0212642-906d-466e-a890-8f9b841706f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696670478, "uuid": "1b120b38-739f-4578-96dd-d7cf0650b798", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cacb73-64c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696651368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651368, "uuid": "b3d8bd27-acc2-45b7-bc13-8f056f711e06", "comment": "Malware payload (RedLineStealer)", "value": "38c00f3dbe989174579203220c7de44b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651368, "uuid": "cb395a86-ca9f-4b7a-a54f-8d3586ab7fd4", "comment": "Malware payload (RedLineStealer)", "value": "354d51ea315aef152ea91d36ec8a6a799b743c43ccf383187ff28a223fbe83c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651368, "uuid": "66190f82-6594-492f-a652-b01287ae529f", "comment": "Malware payload (RedLineStealer)", "value": "67be09415db4aca841cddb6e3d1d6b44044d6cd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651368, "uuid": "0dca61b7-9be3-4a6f-90a9-ab6ef0c9e193", "comment": "Malware payload (RedLineStealer)", "value": "4352b27263d019f2a730c845300d83713d017bb0d0122dbccfa37dacde6a705c95626108c8f34e2d1eede17ea77fd911", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651368, "uuid": "0f49b30d-6476-49a6-bf8d-c80bad9684cd", "value": "T11FA35D20679C9F19EAFD1B74B4B2012043F1E48A9091FB4B4DC194E71FA7B865917EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651368, "uuid": "7ae05d1f-aec9-459f-b442-b833cccc3098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651368, "uuid": "35403faa-c19b-4a61-b9a5-86c341ac49cc", "value": "1536:xqsK1tqzClbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2u3tmulgS6pk:f2tAyYr+zi0ZbYe1g0ujyzdsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696651368, "uuid": "40ea167f-c36b-4c70-bb9c-834fec1aaea6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696651368, "uuid": "ef06247a-6008-48a1-9c81-ad56599d60f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651368, "uuid": "c8acac12-32dd-4e04-a3c7-bce1b702d3d0", "value": "38c00f3dbe989174579203220c7de44b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0b2fcb-64c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696651362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651362, "uuid": "cfc114fc-ec61-4727-aa95-5b3072da7966", "comment": "Malware payload", "value": "5399d7a2060eca17c4c1648fd6b09505", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651362, "uuid": "649d5f0e-1fff-4e9e-b6f0-243a5c2aa250", "comment": "Malware payload", "value": "3751dae5d0813f6ec2fcc253c65854ddad340be058b199f4eb0a540bbf878efe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651362, "uuid": "d2397565-a047-4502-bacb-9b14432eb391", "comment": "Malware payload", "value": "e809cd291f45ad73bfc0ab35b3c23883f4f4eee9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651362, "uuid": "7b4d0aaf-63c2-48a5-8c9e-03dd9ab279f4", "comment": "Malware payload", "value": "fbd1de2cf47b235dc25c36f2f256678d86915b1ec68444ea2793fb5c501d8335050912ffdf511d7a592987f11f865441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651362, "uuid": "95c60c6c-a8b8-4684-ac80-2e72d938eb1c", "value": "T12E05B603BA4786B2E2891733F79B1C04B361D983732BD60B748E23651D5BBAE9C65707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651362, "uuid": "9d81fad8-1bfd-4717-89cb-9a9f1c17b13b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651362, "uuid": "2d9ef124-6ba4-451f-858d-424d17bcac2e", "value": "12288:Xv4dLIwm2JMSzEM57yLx2j5xhvFTyTFiPVZqsXWryQW0jy8oWRfzp0KUu:XvAEw7t5HFmTANZqsXW2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696651362, "uuid": "0f650423-a87a-43c6-9d13-5f0df164ff2d", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696651362, "uuid": "2443e930-e2ed-4996-9851-6daab6e6a8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651362, "uuid": "17b68f7a-139e-4fc9-913c-9f1dc67f5a37", "value": "5399d7a2060eca17c4c1648fd6b09505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699cbc8d-64c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (EternityStealer)", "timestamp": 1696651383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651383, "uuid": "5fa40b8f-b43f-4c34-8ac2-891e5fac0683", "comment": "Malware payload (EternityStealer)", "value": "242c47b16c8755e72d7d1fdbc9ff0f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651383, "uuid": "b0c0f4f6-cd95-484f-9ccf-94ff31b81b9a", "comment": "Malware payload (EternityStealer)", "value": "3898dfa5cb6bbc6d6c48c202d31333d3b214d0f2ac7c4396eb54d6ed09bf24ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651383, "uuid": "d7adb874-9785-45e2-88e7-0ea1c2b74521", "comment": "Malware payload (EternityStealer)", "value": "445486022335d121378877268cfc5a0625b53e4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651383, "uuid": "d7133ace-7d04-4e84-8454-8bd1bbbbf6dc", "comment": "Malware payload (EternityStealer)", "value": "b90d5af865604a071b09cd054a38611a6b7a57e2e9a3493131a177e3e7ea07de7ddcce9d6b2e0dabe089208c8095d0b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651383, "uuid": "eb6745a7-daa9-41c7-b111-d6e88b5815d9", "value": "T1087498287FE07B29E1B4253DCC371333C3A402570F177317A98A7A952A52169DE87AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651383, "uuid": "b8d7a6cc-61a7-4da5-a1dd-f47f4a0a5b9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651383, "uuid": "d651d0fe-11df-4500-8372-4d2b1f5de9af", "value": "6144:ge1/duat9Ej/QUsovmgk17/G1aQx9pf7IWbhrC:ge1/dUso61gVRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696651383, "uuid": "192068e3-897f-4256-a858-5d8a57ccdb5f", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696651383, "uuid": "c0ef5e3d-80c1-49ba-9736-95a3cf07881d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651383, "uuid": "2634d557-0448-4cee-b617-87a470439b08", "value": "242c47b16c8755e72d7d1fdbc9ff0f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3819a74-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671290, "uuid": "71334208-2647-40e5-9919-83a4f1a48176", "comment": "Malware payload", "value": "f0986f3eb64de19559c2320ba14ac012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671290, "uuid": "592e6a2d-b195-456d-b0d6-ba5eb231d8b3", "comment": "Malware payload", "value": "390f254d9fef5568f547a261d45771a7c064140ffc691a999792d3ca8af7fb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671290, "uuid": "ff9df97f-abf3-4909-a684-2492fd48d0fa", "comment": "Malware payload", "value": "e96f0bdee230eae6a6e17dd92fd7142983e4d383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671290, "uuid": "d3c1143f-ad61-45c2-b44a-22a8ba90e681", "comment": "Malware payload", "value": "10739b4b060fd6ba83634db3823be05d07861d2d9e7bdb745a410663c7d632b9c69e0d0b68b8f1b6a3ac2d43484ddaeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671290, "uuid": "242e73c8-9b0a-4890-b0e1-f55b580a2b3e", "value": "T18484221E3E5D52A1D328083B08DF8B944582CD4878094B6AD8F6FDB8DD393C4673E79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671290, "uuid": "9dc002a4-787c-4245-8b05-8f85f58cbc8c", "value": "23615023d461e78d0629dc17085ae148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671290, "uuid": "a2528995-09c5-4db9-8f19-b7ca849b6dec", "value": "6144:Ei77ayqrHvgU/cQ8xBNIGdE+zQKdUE3VuZKTTm79P4ykRpG5VECl/VIs04jCMxCB:NnUHlctXN1dl0KL3VPykRpgn75KX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671290, "uuid": "896b5562-9557-4eec-a6d9-32aed56bedbe", "value": 406321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671290, "uuid": "5e278e36-1806-4180-b3e7-5eec6c67f17b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671290, "uuid": "d2648673-7d1f-4962-aa7e-3fa348ec3963", "value": "SecuriteInfo.com.BackDoor.Pigeon.72.4480.3742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa31e52-64a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696636835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696636835, "uuid": "de187e1b-088e-45d3-8c9e-ffbf4f30423a", "comment": "Malware payload (RedLineStealer)", "value": "09ff819312925a24f0752e9cea555abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696636835, "uuid": "0063cadb-a120-486b-bcb0-5f7dba121702", "comment": "Malware payload (RedLineStealer)", "value": "3a700cc77084729901039c49f5ce20aff74e0d376937af51b6c89d0c1c955e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696636835, "uuid": "c332dbf8-1962-4c25-88d3-74c82db53bd3", "comment": "Malware payload (RedLineStealer)", "value": "65904c02ef36df0310f7c15b1adbb85e1df03209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696636835, "uuid": "a3dae4d8-4b4d-4e08-ad60-4c75f4ec13e7", "comment": "Malware payload (RedLineStealer)", "value": "e381c5cb5fcfa1df8155f007a45bae988055f742b5bd5e7198b03cb38fb0bec01b4176c2aa6d43f4ecda96110c954e3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696636835, "uuid": "5a69dd0b-a4d2-462f-84c1-74fa21c6b511", "value": "T182A41252BBCE92C5D4B989F9EDB231942335766A1011CF3F5F8B209A28427548763F3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696636835, "uuid": "af760da3-e77a-408a-b7ea-e9448dc55a2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696636835, "uuid": "d1775a8b-5941-48a4-9e9c-634daa9e5fa8", "value": "12288:mOxB5W/Oh0SeADjGv/sIvZn3b8BpzJgVeA8jMfE8:1bW/OhSAQ/Bvlr8H+8A8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696636835, "uuid": "eba227ef-23c0-4024-9093-effdfb18dd19", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696636835, "uuid": "f0d4c0de-c5dc-4d43-9850-8c3e3680efac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696636835, "uuid": "dfe4a67f-1610-483d-9e0f-753ae444089d", "value": "09ff819312925a24f0752e9cea555abf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d404af-64e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696664184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664184, "uuid": "c7b0e838-d013-41c0-b791-0ebe2e2a248a", "comment": "Malware payload (Smoke Loader)", "value": "6060cc7853c91eeba98443063819fa4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664184, "uuid": "3c10730a-d674-492f-92ca-63e37f94d470", "comment": "Malware payload (Smoke Loader)", "value": "3ae385541e4b73e89a72f72cac99bcedcc8770c2877d19809abad5d3d72fa1d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664184, "uuid": "938771ae-b154-4848-8fe4-d1ef88d3d42d", "comment": "Malware payload (Smoke Loader)", "value": "644cceb80ca69b92e4cbe60e056208ac22a9555b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664184, "uuid": "e9fbbc58-a569-45d0-bbc7-600481bf35b9", "comment": "Malware payload (Smoke Loader)", "value": "7a70415c89bac432ecee95a9325bd952528073a7c2bc9db4fcc9158b676ad44e2dfa26cba7d3fc32157677354b08a299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664184, "uuid": "b4049590-ed0b-4715-820a-15f03df6a7d4", "value": "T17C547D13E3E1BC25E5224B329E2DC2E4772FF9618E69B7662B445F2F08B11E1D663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664184, "uuid": "4bdc0fa8-f2b5-450e-ba6d-ea4d5a57f0a8", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664184, "uuid": "ea16f96b-108b-445a-b7c5-f6e407b1a5c1", "value": "3072:26Qz39ZtaQPYolOoniTSqXQMIknelXphWgFVo22:2hBZYQPYDXQmnelP/FO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696664184, "uuid": "2765bb40-6d89-4799-a242-87502f73be49", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696664184, "uuid": "4493bcf8-7907-45c6-b234-364c8d0f0e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664184, "uuid": "f5607807-d225-424c-a968-116a05ef0311", "value": "6060cc7853c91eeba98443063819fa4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bdfc54-64ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696667674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696667674, "uuid": "11d5848d-8afc-4295-a87a-725197661d84", "comment": "Malware payload (RedLineStealer)", "value": "528fa26e8839197899dd400b23fc9de0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696667674, "uuid": "437d2fff-ab2d-4b70-af2a-757fa97022d0", "comment": "Malware payload (RedLineStealer)", "value": "3afc41bbbf923e4edefa836845da58765faf2ccc3195ded7549e8a5b283338f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696667674, "uuid": "9871c879-957d-4b33-93d8-35c487da1078", "comment": "Malware payload (RedLineStealer)", "value": "b0a792f0d4dc3015214d813f43c7f3e4d86f16cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696667674, "uuid": "6b12767a-839b-4810-b9c4-6856b7d62833", "comment": "Malware payload (RedLineStealer)", "value": "773fdcf6f5e56812d18fb3731cb9b3deea52e97e2b499c8734560e64731b57c4228d56b9ebec8ce2fc1374cf668a3abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696667674, "uuid": "c80a9815-073f-4789-9e42-dfbe54b5836f", "value": "T16B147C9E70AC9FEAC861663FBD06F27D261A31316A050D712E4A73BD6F279D321163D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696667674, "uuid": "9078535d-bd90-4740-ba5d-396f2fa50671", "value": "562e65e023e87b36f1380397f644b9df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696667674, "uuid": "19bcc672-b547-43ac-8dfc-01802c0fa863", "value": "3072:eFg9x6PIzyBximjjvi0iiA0oa7wZkJzKu2d2X6iJT8Tija:eJzH/RiiA0odZkJzp2dmtJ8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696667674, "uuid": "aefa0eb1-2bc0-43a5-8a2b-81ac16c4fce0", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696667674, "uuid": "b03b5307-7a13-424a-8758-064703be13cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696667674, "uuid": "7126b6e4-10be-4e8c-8c5f-b5b7c03c96d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58993437-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696671111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671111, "uuid": "0ffb7573-9458-49e2-894d-70160c545b7d", "comment": "Malware payload (Tofsee)", "value": "cb25c30681ac9808f26edacc23d99110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671111, "uuid": "9cbe13f2-b1bd-4838-ad00-6d8f520b9ec0", "comment": "Malware payload (Tofsee)", "value": "3b734d1db10fbd52a9756d301199801492767453ee8d901282c29318beb2766e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671111, "uuid": "039fbdb5-9843-4c30-9ec1-7d8e058fb281", "comment": "Malware payload (Tofsee)", "value": "cb1e1276e731425af5b3b3ad40574f36dce28358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671111, "uuid": "5f870752-1590-4cb9-8fcc-80a2ab4589ce", "comment": "Malware payload (Tofsee)", "value": "a696180888ee1816168aee531321bf53eb85a8dcafad50c222e00fd419d8cc9596c0d24b17a46c4434614268c551d1f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671111, "uuid": "8d3d44d2-e4a4-4b3f-98a5-18b863e52f1d", "value": "T141548E13E3E0BC21E52246725E2EC2E4772EF5618E6EB76A37085F2F09B11E1D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671111, "uuid": "313b6f4f-cef3-4db3-b61d-f372a94790f3", "value": "87f03000e6499d0f071e10e3a4f854c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671111, "uuid": "89e81a65-8fd7-46d3-9edd-449ffd4b312c", "value": "1536:oh/wZtapA9meeDgZUX5TmpsAzCskMeIzUZrxGH+13QxTC4z60mLDcgndsFp10b7g:oWxL9ZGmbzhmsy38zRebnwyCAHHIP/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671111, "uuid": "11d17946-b967-48ad-897d-6357c8667aac", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671111, "uuid": "8277731d-c36b-448e-a4d0-8d80bebcd6c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671111, "uuid": "48356ebb-02ef-4840-b104-3eae1c230853", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457fc96c-6515-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696685252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696685252, "uuid": "787a2c2e-3f96-4f80-9023-ea18a830584a", "comment": "Malware payload (Smoke Loader)", "value": "501f391a4759876dcc08453569900304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696685252, "uuid": "56972853-a6d0-485c-ad97-4eb1fde14a89", "comment": "Malware payload (Smoke Loader)", "value": "3b944039d60e3df7103088844f66a6000032d806bd8673a6bbdef4023adb6652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696685252, "uuid": "16dd937d-4a44-47a4-890e-dec4218d30cb", "comment": "Malware payload (Smoke Loader)", "value": "255bad85738b6804e4191777c54c55493e47bdf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696685252, "uuid": "a17379f2-4fc2-4af0-87e9-e0ea54b1ab0a", "comment": "Malware payload (Smoke Loader)", "value": "61d0ccc3e90ea205f61d06f41230ff62faf16bc1b010b036342629982088e26b07e0e99de4bf6a73a13f615a59a6139f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696685252, "uuid": "d028fa7a-facf-4b63-ba6b-760f56033eba", "value": "T10B547D13A3A1BC21E5264B324D2EC2E4772EFCA1DD59B79633687F1F08711E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696685252, "uuid": "4c320d28-34cd-4e6f-9dc9-64c6e440957b", "value": "4cfd395e0c2ad689fbac27e2423e7395", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696685252, "uuid": "ff445397-b177-4ec4-bbcd-6594b0324946", "value": "3072:awpjOWpTMHNG28mIedYCSy1+i7rFWVKZXXnqtzA8o7rtc4a:9QWhMHCmICYPyIcr6KpXnukrhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696685252, "uuid": "46574c8a-bf92-41b4-8a89-419639541ee2", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696685252, "uuid": "56936234-66e6-4e37-84fe-ea04640ae467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696685252, "uuid": "b40b9b14-b324-4501-aec8-be8a8e414c23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac9c2ec-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696720158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720158, "uuid": "0255d769-cfa0-491e-860b-80e0f438e0f5", "comment": "Malware payload", "value": "286ba835430dc6b599ab603029d42032", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720158, "uuid": "4e2a81d1-2fe6-4e5c-8705-94d2233d0148", "comment": "Malware payload", "value": "3b9db587d4d84f8595904e51b93835bf3a62597b6bc6a3b113d563a95387e7f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720158, "uuid": "3cedbc7e-c848-433c-867e-46f765354ed0", "comment": "Malware payload", "value": "7d450dd575595f7f4f708595f5321c0478c8a4b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720158, "uuid": "44266ff9-1694-4b0a-a6dd-a240537855fd", "comment": "Malware payload", "value": "9fad3911758eef9a23162b4e8ca88bfe509f3d1003c368318eb4b0433f6fd9bd0d1e402bb8d2f41d54c443f891c3369a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720158, "uuid": "57f784eb-7835-47f5-abcf-2b01091b6fa1", "value": "T1EF732A55B8815B22C5C5127AFA1E128E332317FCE3DEB2139E205F24778696B0E3BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720158, "uuid": "1ccd6097-4c51-47a0-aa42-e79482b0cb9e", "value": "1536:gMn03pCLDuC4w+uPX1saTWFQNM0iV24hvau0DC5YYIUJF:fnPFsac24hvau0DCyFUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720158, "uuid": "214e5055-77a9-4e73-86e5-75971effb7fa", "value": 75328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720158, "uuid": "0a1adb76-657e-4895-8252-ba66cd275d53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720158, "uuid": "848ae71b-0859-494c-aa82-eb10f93a69d0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4185627d-64db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696660335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660335, "uuid": "8b22015c-a183-49eb-98ae-c1b4a4c470c5", "comment": "Malware payload (Smoke Loader)", "value": "e79af3a798e4a6b69dc0e00e20666c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660335, "uuid": "b726d650-0b98-443d-b6d8-fa302d93e2c9", "comment": "Malware payload (Smoke Loader)", "value": "3c258ed46041141a294c68b2de32dfc67d39bb77a9a3e53542f8547ab0aaea83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660335, "uuid": "e6459a33-1584-40e3-b18f-41455d372674", "comment": "Malware payload (Smoke Loader)", "value": "f84f2d86d2a6722cb010b7b49ba80acff95cce10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660335, "uuid": "913af2d6-6d16-4d0f-8b42-9c82efcd1fc2", "comment": "Malware payload (Smoke Loader)", "value": "36430a25abae8a058a9f28339572b5e245ba157c9cfa8c39c582b3c5a890542616097499ab657dbd30b006c144b30ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660335, "uuid": "c63846f2-239b-46ed-b46f-42907a23489e", "value": "T1FE547D13E3E0BC65E5224B328E2EC2F4761EF9609E6DB7562B485F2F08B11E1D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660335, "uuid": "dd80bf46-3ea5-469f-9cac-1033de9d1e03", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660335, "uuid": "90dae2e5-dba3-4d31-8e33-22963cfc897e", "value": "3072:aE7w9Z+xh4FQGalui6QrhAKwB6b8uJReVsh6P7zfldapDxKCrost8:BKZWh4FQLuJfB6b8uJRX6zzflgz0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696660335, "uuid": "7b1e3ae9-7dba-4cec-91d5-b3963def420e", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696660335, "uuid": "a1c71b00-923b-4516-beaf-6fa2994fa8a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660335, "uuid": "fb91c687-80f6-455c-b8d8-2fc178202355", "value": "SecuriteInfo.com.Trojan.DownLoader46.22030.3918.4945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb4e1f4-6501-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696676891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676891, "uuid": "8dccdfd9-0f71-4e60-bcb5-c39649107089", "comment": "Malware payload (AgentTesla)", "value": "0d411b236bd98538c262e62ffb4514cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676891, "uuid": "5a90241a-0051-432c-8b9c-f501b8cdcd62", "comment": "Malware payload (AgentTesla)", "value": "3d05ef193ab32091f134ae8d979362476b89d05f65908fc60973f5393aacf6be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676891, "uuid": "3e59e9d9-575d-4fbe-9727-7482b380143b", "comment": "Malware payload (AgentTesla)", "value": "43942d6e76f1b948bce80b81278dd76e5f7fad1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676891, "uuid": "c6706096-accf-49ed-b686-387fb40e017e", "comment": "Malware payload (AgentTesla)", "value": "cea4d5c24aa7ec62da94437f7af2711c3396e9b5347627b2e3ba12a284656df32b5739cb56a8582c47c9c20d7b6a0571", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676891, "uuid": "b264033b-2740-43cf-abfc-98a2c78ca418", "value": "T175A31225723449B0E9442D063A136792DFB6EA89CFDCC329E6223A37F5B142DA53117F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676891, "uuid": "47598894-929e-4478-b135-0a4a2fe5d6d0", "value": "1536:yVxRvvsMgrKH6gUmhcgSJahxON6WVf5tJ9M4KkFXvTv2t6S3RORLZa//VZKoe:ypc9BgUmygSJahFWVfTM4//Te/ddZKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696676891, "uuid": "20f2769b-07f1-4335-923d-382e5610d320", "value": 99940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696676891, "uuid": "85ec7f97-7766-4021-8b67-c67679624daa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676891, "uuid": "175927ea-03e0-493e-b3c8-f8f3bcf2a169", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0476e971-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714779, "uuid": "5f4b38d3-446f-405b-a4c1-a5a0d9ce1621", "comment": "Malware payload", "value": "40ef13f737d29e56b3427fa1701277c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714779, "uuid": "a2ee6e98-7e37-4b36-b664-e1a57028dee9", "comment": "Malware payload", "value": "3d3b25d37c91079d05e757a5f5c648ff1a6b81a7cb748ffa09d1e6539fe5de17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714779, "uuid": "cb027a89-acc0-4a75-a576-37ee81386b9c", "comment": "Malware payload", "value": "395f9ccc223d6214d98b0366deac7669e101625c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714779, "uuid": "9f64608b-f179-477f-b8c3-a45b7ec82b69", "comment": "Malware payload", "value": "2c74f962ae07f3b98e33d6a28c1f64fb814fbf318a0e8778c9a1713debc063e7088e0954d1d3a1a61fcd68daa1a8f92a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714779, "uuid": "a8163d90-d8a2-4763-9eb4-80f6b92786b0", "value": "T116135C8138C048BEE01321F616B61FB57D7264B41360D9E7A7B46DAC6F70ED68A78723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714779, "uuid": "9bebcc5d-ff06-4fce-8eb0-d97f21021249", "value": "6a30b2796b293360b975ca9d84791871", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714779, "uuid": "56a67bcc-4250-4cb0-830b-325ccfdb125b", "value": "768:2r0PM7jsCSuOvrq6vBEP6Cgy3nAQHAZiTeQ4tK2L2W/3wwKIwTzk:2rCbRBvrq6vBExgy3nAQdTeVwW/Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714779, "uuid": "ae7120f7-403c-4dc7-84b0-77d052ab85fa", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714779, "uuid": "4f5ca43f-c5dd-4f57-af20-7d07319ca8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714779, "uuid": "050afe05-5ee9-47f7-9393-c169fc90f6e8", "value": "SecuriteInfo.com.W32.Generic.AC.225E61.tr.23753.11042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd9e1f9-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671279, "uuid": "dae124d6-7614-4be4-9ee9-3a7502907327", "comment": "Malware payload", "value": "341198b61f24b4a9ba6b3ab063fb0caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671279, "uuid": "ce37a2d4-233d-4ba3-8b79-d71022dad30c", "comment": "Malware payload", "value": "3e9b961a87775c038243f862be7f34b5c6440c0d31fb84f72d6fa0e3944a5e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671279, "uuid": "44821e28-8018-427f-8b86-320d571e23a8", "comment": "Malware payload", "value": "49e14e3cd535289824ae9614f063d440b54ffef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671279, "uuid": "3ef7a8f9-8fa5-4894-9839-bfbe89d60c62", "comment": "Malware payload", "value": "884b073f0c2e92073f4031c7f3cd00acd59c55c339980ac6a6e3f9fc05329e8a477a2e9694785270d3e514758b9372dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671279, "uuid": "c96c3e9b-fb34-4f02-a8ba-be4e9e94b528", "value": "T1B8F46C3AF6F260A8CB8539B10877B3755E69F9418F65CBC37216D91C1F3AA805A3B131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671279, "uuid": "52ecbcbe-7924-489a-9b2c-a9d8658ad6eb", "value": "6144:vFvyUoaODsU42mugzXTvqLT7nXtf+VXLLU/uPvjL7l:vFvyUO42muCa9iXLLUmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671279, "uuid": "4ec58970-11d4-46d4-ab21-ba47afd22ce9", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671279, "uuid": "d043be17-7dae-4fa4-997b-9bc58178a86c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671279, "uuid": "849a78cc-946e-4df5-b1d1-1826be800f84", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.6191.8345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387b9cf6-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1696663756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663756, "uuid": "a0314f36-5c32-4373-89aa-01a1fc5c35de", "comment": "Malware payload (Rhadamanthys)", "value": "c14293904116ecf16d85fc0656fa9ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663756, "uuid": "0d305b06-665a-4578-936c-401fc32c328d", "comment": "Malware payload (Rhadamanthys)", "value": "3f57344f1e9e5cbd8af2a623c444cbc6b5bc3d94bbe56ddaf22f0068acb13ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663756, "uuid": "89863a83-2f77-419c-8047-3e19be2a8d7f", "comment": "Malware payload (Rhadamanthys)", "value": "ab3ea5eb854351ac1a465849582b2d925f360718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663756, "uuid": "ed529442-fa2e-4841-bf8e-3be7689485f5", "comment": "Malware payload (Rhadamanthys)", "value": "535a89bcf0882335b1b2f4599109e9a0aad9b7ec8c6bd849cd277942fef26f8acaa289f9bf4bcfa0bb776d6a5df650f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663756, "uuid": "b0523e99-5d3d-4be2-babb-71dde3832f9e", "value": "T12385AF4EF7BA41E5C1BEC0368952EA1EF2B1BC576B3483D75A61A79A0F232D05C39311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663756, "uuid": "a99e0214-a6c9-46fa-9081-02289315f408", "value": "a638f6b413d02de0f382750aa46eeb04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663756, "uuid": "e9023c2b-ff5d-4743-ac3b-734860fcc912", "value": "24576:wH4G8P8VYPjxxT6qrkVFUrFrg+tsaBS/wRPtNZ/pqhi7fR3YM8LRMz50lw:vG8P8VYrmzaBS/wRpxfRz8LRMmlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663756, "uuid": "43d75ee2-edf7-4bda-81c5-3d50a7e15b4c", "value": 1722368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663756, "uuid": "a0103b5d-a692-4015-8b22-0627d7bb1622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663756, "uuid": "8218fd20-f6c1-432a-adf4-458bbb881a4d", "value": "c14293904116ecf16d85fc0656fa9ec2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0f47db-6501-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696676858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676858, "uuid": "52c19ce8-ea91-4d74-90d5-76d5f9a82081", "comment": "Malware payload (AgentTesla)", "value": "f021658c81cceb741573a692190c89e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676858, "uuid": "5216006e-7b9e-4097-9865-4c0228944cd1", "comment": "Malware payload (AgentTesla)", "value": "3f7ead74c326c43eac141ef10446eb0540a8df73270ddf75eed483c98e419d02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676858, "uuid": "ba64308e-7fc6-458a-8907-3cb8e9e3f8df", "comment": "Malware payload (AgentTesla)", "value": "d37cf3b82f810fffc1f7e2846473e19a9ed2e610", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676858, "uuid": "4705d442-8a8f-441d-bb7a-44b4f11c867c", "comment": "Malware payload (AgentTesla)", "value": "5443941cc32a78e9eb86e837bb2be01d0e473c785ccc9d3ee59f03700c19e33f6532da9603c2a487eee771039b680eaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676858, "uuid": "88d2ef57-3856-40e4-b64b-6242cfb1d552", "value": "T1108312CED21C7820B0775F3ED50154933FA9F87AF5E0B92C4594FDDAAE812140526DA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676858, "uuid": "90c6a3ec-42ba-4e36-b24c-01c7c255bc93", "value": "1536:cV+X4dFk7aQGPd6CzMPu71IKFifSYJHp7JfjgXbKTI1lsa4LQTCDUKIbDioVkg06:cV+XDWQGcCwPOILJLTTI1lh48NKIbvq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696676858, "uuid": "713e6093-7719-405a-b8e6-c99d6e403763", "value": 87866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696676858, "uuid": "fcb4ab88-d6e0-45ef-b1f7-be80d78a6b1d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676858, "uuid": "666f7d9f-e102-4c29-957b-b83f3eae0e2f", "value": "DOCUMENT.r02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519a4f89-6556-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696713190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713190, "uuid": "a7fcd3c7-257b-4526-aba2-6ff5831f772a", "comment": "Malware payload (Tofsee)", "value": "e2dc486d4a3d5af5052eb236ff0c3d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713190, "uuid": "32ff34a6-e0a8-4536-b860-7b336dab3ab8", "comment": "Malware payload (Tofsee)", "value": "400e730d88a031976f29527edf487159a4fd50702c657a2517678c70cdd1b7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713190, "uuid": "da7fdeca-1e25-4eb3-9d0a-5e01c621be45", "comment": "Malware payload (Tofsee)", "value": "7383776bf2a64bd5d1c99b116ffec759ab319834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713190, "uuid": "a465eb14-90ab-4dce-8296-66c3796024b4", "comment": "Malware payload (Tofsee)", "value": "96cb0cdb8faf0192045fc34fc51d0624be2835e634336cc7a5d895d2111e395e428c365e74a3cd5884256a7bc773dccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713190, "uuid": "5859aa13-2c71-4c21-acda-573ebc29d773", "value": "T190547D43A3A1BC71E5664A328E2DC2E4772EFC91CE68679733587F1F08711E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713190, "uuid": "808b8ac8-78cc-494e-ad10-1a42987d7775", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713190, "uuid": "df5d0cbb-049b-407f-80e2-bb976c3cc868", "value": "3072:Cau1HZyD1WCagoqNJxaEx0lBJPMLnsmACWL+kbzjaa7OIp4Z:Ju10WJVqXxR0lBJUDsm7UTbnaKZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696713190, "uuid": "3fc86c13-b73f-4185-85e0-5b25f35ab822", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696713190, "uuid": "b29a1b05-7d40-401c-9c08-ecb558f70363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713190, "uuid": "ed0722f7-d688-4dcd-aa50-0652b686c98a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844151d0-6551-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696711128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711128, "uuid": "30ea33c8-77d3-4799-8d9c-636dfe55ad8c", "comment": "Malware payload", "value": "6c6733c150e4c18153f335594e15aa62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711128, "uuid": "13e111d4-f8d8-4a87-b566-28b70514eebc", "comment": "Malware payload", "value": "4057f33885b360e27e1dd37296a0a5579f55c90e9c6c0d75cf38ee46b3fe6bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711128, "uuid": "348a87e3-28a7-4f7f-8021-4697d6abdf9c", "comment": "Malware payload", "value": "0570983b5f14b249b2ee91f312d7021333c54748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711128, "uuid": "ac1298c9-baa7-40ef-9cd1-fbbd3ac2300a", "comment": "Malware payload", "value": "5838e3ea36c9d69aa99f9cfe028b39c3f7a968526bcaeaeade6df1b5ad32e693d5477c55e4aa1b3d4f853737dde0667e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711128, "uuid": "602a0309-1735-4b8e-8dfb-e236ab58deb7", "value": "T152547D1363A1BC61E5624B328E2EC2A5772EFCA1DE6867D733583F1F08711E1D662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711128, "uuid": "27a7eb78-6144-4f68-9d7e-74c8a36d0514", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711128, "uuid": "823ea3b7-96d2-4ae2-990b-67860676f6bb", "value": "3072:HZtxlihIdtWTluDUxjnpRyn/ptqLOHhw1+ymdWC+Z/7r3k4Z:5txYwWZuDUxjnpikshwky8WCyjTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696711128, "uuid": "e39a68ee-64d0-4286-9a2f-a3ba5ae686ae", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696711128, "uuid": "f0c64a9b-b7e1-4bf9-a9c9-b21e309da240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711128, "uuid": "c8fb0927-af5d-47a5-bda3-cc2022600e45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37255800-6523-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1696691241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691241, "uuid": "a9529606-a9ff-4fad-ad6d-674296eb2317", "comment": "Malware payload (njrat)", "value": "3947a0556c4159f49b9a7f9d23e2b4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691241, "uuid": "ee469590-8d2c-42f9-ac6c-657aaaacfcbe", "comment": "Malware payload (njrat)", "value": "40f07bdfb74e61fe7d7973bcd4167ffefcff2f8ba2ed6f82e9fcb5a295aaf113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691241, "uuid": "b4f84292-2070-4191-8e44-272faf06533a", "comment": "Malware payload (njrat)", "value": "3ee1ee149ba1d4eaa8c638334d2b3233fe5ee2b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691241, "uuid": "4709e4ab-6f59-4f28-bc86-b0da8e5b6707", "comment": "Malware payload (njrat)", "value": "c3699bb6c905a0d01b10b769db87aeb37ac1c3303f78786e8e2c600255314c93a586738d16d8ce79941daa0759cf1e74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691241, "uuid": "e0ac04ee-b005-421a-8310-1781ec54ae07", "value": "T156E208067BE94215D6BC5AF88CB313214772E3838532EB6F5CDC98CA4B676D00645EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691241, "uuid": "7e38e0a8-47d2-4c7a-8c37-c7a6750b8656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691241, "uuid": "8dabc157-6709-4d6c-ad60-e6d35fd1a7cb", "value": "384:L0bUe5XB4e0XFOZzw0Q0mS03AWTxtTUFQqzFx4ObbV:oT9BucC55dEbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696691241, "uuid": "0790f578-ac2a-41d8-8ff4-a61a5cbee0e0", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696691241, "uuid": "48f2d0f5-033c-49ba-afa1-09bedecfd178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691241, "uuid": "d1e56032-1bbb-44e5-8776-ef2c9637ae58", "value": "bQ0x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192a6889-6553-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696711807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711807, "uuid": "9c8f5ad5-5592-495b-91d0-3cbd4c8df234", "comment": "Malware payload", "value": "32f8b45f474b865f467d8b657d5b748a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711807, "uuid": "73cc1179-d3cb-44be-b219-ff9dc1773aa4", "comment": "Malware payload", "value": "410da34b3374d4ef9d2aa1ce5bbfdca410b54db6c41b405d1e32b294a9658940", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711807, "uuid": "3baf2cbd-765e-4d8c-9305-74a3b10e67dd", "comment": "Malware payload", "value": "fc75620fb5876782902df46014ac226996c41e08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711807, "uuid": "6f0fbb01-fbed-47d7-a21a-c4addc84f7d7", "comment": "Malware payload", "value": "5eeafd49d4d9518e49c31bbb3ff6eea0d8a58af4939677f374dbc4b85ef5a6d85b75307e05c2fa562a1a131e562a584c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711807, "uuid": "01c68db5-ce22-4ee4-a27a-904603398ff4", "value": "T10653F119AA5DE697CDB421B0F2FC1C8335371EFED5657BD1A011DB6224A0AA30AF7183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711807, "uuid": "4716806e-65d3-48ff-8676-e314dc2aa944", "value": "1536:Wl/R8RMOn6K9Fx2lWAzmm319LPibtt7sREk2EG4wOE:W/63nl9F4llimXLPm7RgwOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696711807, "uuid": "ccbd7493-9b0e-422a-8e34-d042bae29947", "value": 63132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696711807, "uuid": "c3cecb09-d724-438b-8541-8f47d0edeb1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711807, "uuid": "04a98c31-e068-4a57-9cd0-0840adec2d41", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b98b6a-6549-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696707689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707689, "uuid": "7f41c99e-ea59-46df-a603-4c4c16b2b6d3", "comment": "Malware payload", "value": "16379ee7c2278d4eaf286b1264c35d19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707689, "uuid": "ec95b496-efaf-445a-84ce-f2602363027b", "comment": "Malware payload", "value": "46d22d0b1ff8ee435595ddef0148e11ddce34cd536cbbb70b3fba1150abeb8f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707689, "uuid": "ac6a7ee1-a4ff-404e-aed7-e250e6fd6ff4", "comment": "Malware payload", "value": "1fbac8f9d6d5157e4933ab198a10eb13927ec0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707689, "uuid": "7d92c4de-79b2-4333-b9b5-be5d26afb604", "comment": "Malware payload", "value": "35f82d18c59da840a7b4131550ab066ca6bbf0043e35c0c87c9ca2b59d6784ae9f6caeafad0535d90b9450ecc0e5753e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707689, "uuid": "40e2a97d-4186-4f7c-9711-6e1376518311", "value": "T1EEF62370E4F38066C4B244378565D67216AC8C15437AA7D3E2D0BBBE68F76F02ABE15C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707689, "uuid": "8de982f3-c795-48f2-b916-5f501c50689f", "value": "f67c2d48a0d9fae633478c7ae08a5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707689, "uuid": "5d9a657d-1370-4ef0-be1c-c5e198b4d80e", "value": "393216:UzwRI9j+eZkiGxsujFXs3M+UPgJkFqz5re6:tRI9jTeKM3gk0zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696707689, "uuid": "76e3152d-8531-4073-ac83-903f781a74fd", "value": 15424713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696707689, "uuid": "393b6371-8cc4-41d1-abcc-0787ad5754c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707689, "uuid": "cc0db08a-1d16-4ea8-88a9-e2c919e6e332", "value": "kozel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cb3143-6531-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696697406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697406, "uuid": "6aedfe8b-c277-4974-9385-6f40893c17ad", "comment": "Malware payload (Mirai)", "value": "ccc3fef485c5e09d102495661e6c4a7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697406, "uuid": "d842ff60-a8d7-4ea2-802f-01ac9f74e431", "comment": "Malware payload (Mirai)", "value": "491c39a66453e148c678e7ec9a336b35e257f9b058219e9f0365761a8d8bed77", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697406, "uuid": "29ae2193-2009-4677-9a3d-b283ce7d675e", "comment": "Malware payload (Mirai)", "value": "9608d7ccd2493e733580da020aea9260aa83fa2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697406, "uuid": "8f85b762-fc58-4b15-b6ad-cc571333e74a", "comment": "Malware payload (Mirai)", "value": "5584be3e01f8d385a3405eae3e96b5031cbf6ea8123c638a47081ecb4abfe21b006f1fffb26c9aaef88ed4eee060e73b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697406, "uuid": "20f005eb-fe1a-479c-b6ba-d887e73a4de7", "value": "T198230271890E9EB115303C76DE999683BAF12AB2C6673013D6280B3C3F757531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697406, "uuid": "a53a24a2-bd32-47be-b40d-81195ac4b046", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b339q3UELbUXfi6nVMQHI4vcGpvA:gECFd+A6YHAxGLRQZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696697406, "uuid": "d85f9c95-a1c0-4c66-9ee0-576c5c4d3140", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696697406, "uuid": "3f279099-14b4-4220-9ead-0ce542dc4281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697406, "uuid": "7012134a-21a1-4a61-983f-deac91b65da0", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadd7cb9-6543-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696705287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705287, "uuid": "2e952b3a-ac51-4652-9670-de50377a20ab", "comment": "Malware payload (Mirai)", "value": "fe4d811472f5f240117194346b1e71ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705287, "uuid": "bb3d3909-ec1f-49f8-8573-1910df51031d", "comment": "Malware payload (Mirai)", "value": "4a902bea6508766c8959d04343dde1bf9fd634b5aec5e97c7fa7031b3c537e09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705287, "uuid": "6877e64d-6881-4e2c-9e71-187735a061bc", "comment": "Malware payload (Mirai)", "value": "eb5d3d2e17355e5ec844173ed2c75414577837f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705287, "uuid": "ef4ee693-66cd-4ecf-b8a2-681a28085bf1", "comment": "Malware payload (Mirai)", "value": "e6070d63934e65ac22c4b8107af5d00dd14a3587b080cad3d8ce1eaee056e471aa15931a40bccf8817c0c1730a33ae48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705287, "uuid": "1af641bc-3876-45a7-9a8f-bdfaed6c6019", "value": "T1FA838116BF601FF7EC9ACC378AA8170528DD611A31A93B75B830D428F25B25F55E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705287, "uuid": "a216c712-a5ce-48cf-b1fd-53de903902c9", "value": "1536:LsMhLMLiQvlHvBo/AopJpLwA9Z5lsi3d42+:LsMhLaZZvBlA9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705287, "uuid": "02e0db16-fb1c-46c6-bd63-fe527978d521", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705287, "uuid": "0f92cdf0-9288-4ca9-a5f8-67b24b35c501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705287, "uuid": "8a2a0f55-bfdf-4cb1-98a3-a1757d6fd876", "value": "fe4d811472f5f240117194346b1e71ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c40cbe3-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696663682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663682, "uuid": "a47d9766-5a06-4daa-a56f-d21a15dc66d0", "comment": "Malware payload", "value": "d22a87be19d0dc6f92b2659e22f0728f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663682, "uuid": "ef5e99f5-7fe1-4968-8775-32879858d0bb", "comment": "Malware payload", "value": "4a9a12e19325c0f54b43b0eeca1b6a63cabf4f0aae994392853da9fd7875b181", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663682, "uuid": "967a4cc1-7cd7-4861-83e5-d86ad37645b8", "comment": "Malware payload", "value": "1a537170d25fea075417180451176f595199cb79", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663682, "uuid": "2efed5d8-c537-4450-b29b-b6e5720ec44d", "comment": "Malware payload", "value": "3dadd03a7569ebbc3e9ffbca2ec126fbb69f5858af3faab08c9c45fd2092b9e09be7ae45cb81d265f1b275c18bb1dae5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663682, "uuid": "41c7413f-6157-460c-87a8-7e5cf0daeea0", "value": "T147E433C001C3466FFAEB8577C29EBE0EC165F1525099E0A6C432C6A8A57F3AD1F90797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663682, "uuid": "85064b12-bdf0-45c9-9cfd-f1a927227cee", "value": "12288:IX1zMs8UpkflcpUCQeBNb6pMQyDq0044B/UNaTZkf+hFV6PqM4v0bZubI:IX1zDpooNdQ1/UNSZkf+zVfM4vou8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663682, "uuid": "11b3fa5f-0154-4ae1-b618-c86682a9fc21", "value": 712563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663682, "uuid": "35ca5956-f394-4f10-b497-22b8491db667", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663682, "uuid": "e0f24cc6-29c8-460e-b930-86d887177b3c", "value": "file.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0419c9-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671283, "uuid": "21f8db2b-6689-477e-b71d-67f24e480174", "comment": "Malware payload", "value": "1ddcedcccab8ad5b15bbe8269477a33f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671283, "uuid": "d78fa58e-e0d1-43cb-aabc-76cec3cca2db", "comment": "Malware payload", "value": "4b388875cecaa59200e97c6972754380507a652784056acbe0e67269f907f2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671283, "uuid": "445b858e-af1a-4073-8f24-33d6fc327b93", "comment": "Malware payload", "value": "bea39608ae44113b08714d6f2b8d25fd37ee644e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671283, "uuid": "fa503555-6f00-43f4-82a2-efc1fb5cfd2c", "comment": "Malware payload", "value": "51adafe24fb178bf833bcf6aa1e2e5cf40f43aafb9ca51730bc3c4179c241b00f474c8467d88c142d79c7d18c1e604e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671283, "uuid": "ff888e02-2db1-4596-941b-4379db1a7d6f", "value": "T158A36013FF588056D1424E75087A4762AB24ED3866444B0F7368B93EFCF61D32DA63EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671283, "uuid": "7e2cf304-03e5-4598-a0c3-d1a7b00ba0dd", "value": "9d912927146fb5d8e6500de4d84c3ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671283, "uuid": "24e1ca67-3bac-4333-ac5d-c3def0dcac72", "value": "1536:gi6Aw25OnV6xcoWvCgWDN7sAMrEk0z2RI0:gfA+Mcj7WD5ZMrEk0z2RR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671283, "uuid": "5f5018b7-8186-456a-a667-dd72d6080561", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671283, "uuid": "e4eb0285-80e7-4c72-8d5c-e7b604bcb4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671283, "uuid": "7e2b3291-f02a-40ec-b13d-beb94c51b2af", "value": "SecuriteInfo.com.FileRepMalware.12262.24434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ebbc9e-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714773, "uuid": "edd247b2-a653-45be-aacc-497bc6b0317a", "comment": "Malware payload", "value": "ce95240a02366bbdc2733b4500c26e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714773, "uuid": "87d00a90-e2be-4368-a9ff-5a722ff2e0e1", "comment": "Malware payload", "value": "4c933822a03227f551a37c56d22a364ac4c9acb0a5c719aa8fe5ace639a4cfed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714773, "uuid": "839d0db5-0d43-4ff8-bbef-ad62d680f343", "comment": "Malware payload", "value": "8adc64d85f276a8f6bef29bacb9a23ebe8c8aed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714773, "uuid": "7a4e73c3-da10-4a9d-af25-f5ca22f0d12e", "comment": "Malware payload", "value": "ce23bd6367332c7c40dfb520238cdcd4996d3e0bdede5adbabb02af756afea5fa8e5a80ff123b45091636c1c067a9253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714773, "uuid": "1dc0a855-f0c2-44a6-b1bf-de5d80808f08", "value": "T15C561A15B700C21BC8637BB1C74E96C55691B7647C30A45B36D81FAEBBB1AC27E2B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714773, "uuid": "bf52cf8a-6ade-42ec-b77c-7a39d7115a28", "value": "d4b26238bdaf3434a7e69ae3a4e5cc29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714773, "uuid": "0a9faf97-3e3a-4cd5-aa88-3989ab3df5b5", "value": "98304:VXkFElo0yWLTygOLxVZ4L2+nyViM0VaWSD67e7:SFElo0nLTygOLxVg2xViZV1S27e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714773, "uuid": "933317f8-8aa4-4134-bafe-7cfa7def86cc", "value": 5999616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714773, "uuid": "1dd1b713-2d75-4431-80b8-e4e351ae71e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714773, "uuid": "bc90ad51-f892-4052-9a7f-a899ff79bbc9", "value": "SecuriteInfo.com.Unwanted-Program.004d38111.13756.11476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8c2fe0-64e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696663523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663523, "uuid": "450197cb-cfd1-46fa-bada-c92fedb8ab60", "comment": "Malware payload", "value": "a6269ad0f6a5fdeab347e9a5ec96fe03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663523, "uuid": "b90f34ea-287c-482e-a7dc-c50da02b1817", "comment": "Malware payload", "value": "4d3e97d569a8f73108112d0adaa55c9c679fc2a432875ac76db1c7c566ba035c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663523, "uuid": "586b37af-f05e-44a2-b4cb-2f1a67a4c72d", "comment": "Malware payload", "value": "726b20e5b383076efba4dcc5226e43502bc7bbb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663523, "uuid": "f033d733-1f7a-4c23-a778-cb8c47d3c310", "comment": "Malware payload", "value": "302ce1d424386fc8cae7008476641c66ae1b891ca6ea3b070b94c818307a9b60a7d48980b067f7fac2de87140aef3042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663523, "uuid": "a1187e6c-b167-4287-9eef-3dc7a066a9b2", "value": "T1ABC41820BA95C436E6B3DFB34CB886676C2C78D10F34D4CB62841A5E9D775C26A31B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663523, "uuid": "6871129c-3797-44e5-86df-a1bff5ea1b3b", "value": "b42856b54645aa24809a30270d5556cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663523, "uuid": "6b16f3eb-268e-4eb0-9f30-dc91f9546253", "value": "6144:+wV2zb9+pn3BjAVkFVWwKgWfK948r40OZuW0SEkqZt8DPozcv/4Bx1ErHm1AIQVt:Di4pn3BCkFVRKgWS948r40OZhNhfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663523, "uuid": "7f013bac-572f-4546-b2d1-6ef40ad3fb83", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663523, "uuid": "998cdc24-e203-4f6b-942d-d1e0dfd16430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663523, "uuid": "e925f05a-0256-43a7-877e-24d90e9825ae", "value": "a6269ad0f6a5fdeab347e9a5ec96fe03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d4a498-6525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696692117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692117, "uuid": "3312556b-9aae-4dac-9556-7bc355ed8a11", "comment": "Malware payload (RedLineStealer)", "value": "c42c2c9bbdb02392544f277a6de26d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692117, "uuid": "37cd0d30-e9aa-4927-b50e-4d0b32abc00d", "comment": "Malware payload (RedLineStealer)", "value": "4f90d97f3ef33851bba630cb781820f861144c97b7b962363ba18ee9bd72a7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692117, "uuid": "e1bab17b-fe58-47b7-8207-764e886770db", "comment": "Malware payload (RedLineStealer)", "value": "5b8a093dfda47c32086858bc21a7e68096ce7dd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692117, "uuid": "6d209537-d0d9-4291-8afb-936bb115eea4", "comment": "Malware payload (RedLineStealer)", "value": "c8efe2153d7a87e2b124e7391bcde389e28230b6a6552c3f476e7eec5cf16a1e377b02483a1b05855daac250cefa2c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692117, "uuid": "15660da7-e80a-4761-a908-22d935d80376", "value": "T10DA44BAEF2D2B425C1350B3917948ABDCEF86D44CBE63597D7A48EA70E305807E34DA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692117, "uuid": "aee638ad-27d9-4fd5-a0cb-22f1df62e139", "value": "06ede52fcc31e4900f4f1a7060fce645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692117, "uuid": "e0b4568e-6672-4300-a87c-157ea09ecde7", "value": "6144:j9LT/LkbRalPXkmJavrR25LAOTGaAs1Pu8Y8XCpCoCrItDMpDQ3EC0p:j9LPkNalvB9Gps1Pu8YCrItDMp6Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696692117, "uuid": "d09f0704-079d-438e-a9f1-88574dd8522f", "value": 468424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696692117, "uuid": "036483c1-987f-4473-9cc2-55ee9c5d47af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692117, "uuid": "1f12aa90-836c-4206-9c50-2e1496fbcb4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff986ef-6501-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1696676814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676814, "uuid": "3f57defa-baf4-4db6-a9e3-8cc770a493ab", "comment": "Malware payload (PovertyStealer)", "value": "bd72bf76dafdb9c92bb7037fb0daac51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676814, "uuid": "f1a899dd-0663-4173-b082-02bf305ee8d1", "comment": "Malware payload (PovertyStealer)", "value": "4ff962e91f04db381460c62243098e7f30749f42112e187470535b3097b70585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676814, "uuid": "d84f8478-6f1f-4d18-ae3b-155714ca6625", "comment": "Malware payload (PovertyStealer)", "value": "b4de7b3a08453fa4c8aebcd4dffddbcffbb43fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676814, "uuid": "8f938fa4-7978-4b1b-b123-d87e121b5a95", "comment": "Malware payload (PovertyStealer)", "value": "e795135208cf6ee99ef38af013437b34fe7658260c3083c24577653a467de66b59b29c4e15d3916fb26fd9d7ac31bc94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676814, "uuid": "ad853b92-971c-4958-b7f5-b3719ee39a10", "value": "T1A973BE617880E477C80341F51874FA456E2EA8301722D3AB7BED03AE5F732E9992D75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676814, "uuid": "68f959ee-89be-4512-b81e-d73ef7e2a960", "value": "562e65e023e87b36f1380397f644b9df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676814, "uuid": "f3bc3194-52d7-49ef-9f9c-e9c13a61f554", "value": "1536:1Q4VxgEgDW1K6PNtP1zyUkvpfnl54I2HuDvt:1bLgD36PBzyU6TSux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696676814, "uuid": "48680aac-1d35-4198-9a65-5d375471904f", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696676814, "uuid": "e0641523-7e8e-440f-bdbe-33b21f957173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676814, "uuid": "fdf4622b-e055-479f-9922-e516cb1d1d3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548242d1-6542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696704605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "baf710ef-9f4c-4928-bef2-33a65736fd25", "comment": "Malware payload (Mirai)", "value": "01da57005f63163720b9b02c5e920e26", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "93acae2e-0754-4c4c-92c0-2e45416f59df", "comment": "Malware payload (Mirai)", "value": "514cae9d74376701eb499251de0ce8748b318a0bec545193462a57c6c35ac27e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "adda5d6d-1221-4db9-b71a-d491d7d73d0b", "comment": "Malware payload (Mirai)", "value": "a7bac649d9fa100fbcbe86f82e01ee7ddfec9520", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "ed3de596-dbd7-4a1d-a2aa-917acce4faeb", "comment": "Malware payload (Mirai)", "value": "cadc6e4dba58116563fc4fd8a38a37a51d9aeb83e6fde446c877e11529c81af2abdbf99089835c25e5742632ac2bd2d0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704605, "uuid": "538cc5ae-fe95-45ed-a02c-1b2611822eeb", "value": "T170244C82ED409E13C5C62776BA6F104E3332A789E3EB7106CE185FB437C6A5E5E67105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704605, "uuid": "57a4849c-ad6f-4260-ad78-fa775c017604", "value": "6144:wm+/0w7X1TB38B/y7DopJQE456r9M/9Tup:wm+/7XlB3cy7DopJQSK/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704605, "uuid": "0c0c6704-47d0-4c87-951d-03b15bee9d76", "value": 209900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704605, "uuid": "d0c4ebd1-3074-4c49-acb6-1114a6017fa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704605, "uuid": "bdf6a738-2216-432a-9357-06e144907632", "value": "yourbiggestnightmare.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdb0b45-64e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696663654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663654, "uuid": "71075a7a-ac9b-46d3-9c85-3d3804e3c155", "comment": "Malware payload (AgentTesla)", "value": "eb3083d315db0aaca42f1530c9cc9cc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663654, "uuid": "753015a5-5309-4f33-83a9-ff46ee84b471", "comment": "Malware payload (AgentTesla)", "value": "515eb49efbbe1af396aba6b66f949fb4e26fae7ac72edb359c253cdf22b58cbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663654, "uuid": "8087a240-d59f-41c8-a2bf-ec3564680215", "comment": "Malware payload (AgentTesla)", "value": "874687d1b95ab5e40d21e8f36d2d487787e232f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663654, "uuid": "51dc7e4e-4523-4629-975d-48d799c9ec14", "comment": "Malware payload (AgentTesla)", "value": "072967b21c976675c58a704a2678684820f7167f439e9a7958320d99e9de8bda028ad1d44432f9171dc3022e5ff0f633", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663654, "uuid": "5311aecf-f6a0-4066-94a5-4ff94f6a8718", "value": "T1AED4231AB8B4D98FC3EDEDB5650E71480E1119A9F9B3E74E079D1D9CF3982D0A30A1E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663654, "uuid": "49e968f8-092e-4659-9c35-880c07a937ae", "value": "12288:ja3Ji2mRsqWNYjed0Q4+OAgm1Uv+GdyDMcyZHI5mHENw6I63Z:6RmRsxN4ed0Qvizv+UyDvyZH8mqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663654, "uuid": "c91f00c9-2a85-483f-ac5e-b0b8bb77826d", "value": 603000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663654, "uuid": "685a2c2d-cc8f-4b34-8354-077dc2152d46", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663654, "uuid": "46c1e94b-d323-4818-acb0-f0875fc78414", "value": "Order enquiry 9313.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3637191-6543-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696705274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705274, "uuid": "3e00823d-a79b-4b7e-927f-9f89c5b59cfe", "comment": "Malware payload (Mirai)", "value": "4cf03a0fcbc2cfe546e21d8b54d43a81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705274, "uuid": "9b757255-07ee-4338-a75e-5439cbb2c334", "comment": "Malware payload (Mirai)", "value": "52bec15e4bf9c3c623d1a2c8191336dbbc31eda3834fc04c00ef57c0bfb4db6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705274, "uuid": "42b5be7f-28f3-4258-ba90-6b7b86dd419b", "comment": "Malware payload (Mirai)", "value": "47fd0a7e59caf01d459a6703f29ae8be6b85bf10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705274, "uuid": "eebafe9f-c229-4c9e-a9a9-fd8540eb25b2", "comment": "Malware payload (Mirai)", "value": "ef4c4aa59c2725611531248ff220a6ea87f59642346a0c45a9315e1adf4e0769a322f3b14bda5f3158d215be29fd3964", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705274, "uuid": "89951650-0e2e-4dfe-b834-93193e88f153", "value": "T153434B03332C0E07D9A61EB0353F06E093BEF95126E5B686294FDB664639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705274, "uuid": "077ca9af-1d41-4877-8328-582a8b2864a3", "value": "1536:Sh8NNT8jRu5ve1R/y550gRt0HGMqd42+T:Sh0YA58jgRkGX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705274, "uuid": "441ddec3-b5b3-4a70-ba96-28fd0ada2598", "value": 59952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705274, "uuid": "2f3e52f8-75b2-4a94-b548-106497ffdb16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705274, "uuid": "348aba43-8200-4e6e-ac0f-9f14aee04ef2", "value": "4cf03a0fcbc2cfe546e21d8b54d43a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1418df1f-64c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696652098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652098, "uuid": "82d2f873-4e8a-4dd9-9ad5-7111685e1cde", "comment": "Malware payload (Amadey)", "value": "39d64fb7feaca5d0d338f7237b85c9b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652098, "uuid": "4b2aa0dd-a485-40bf-969e-e864e8054c42", "comment": "Malware payload (Amadey)", "value": "534db8e5a446ab66708493ab8238d7a808cae18cefa2300a20ae35957a280c57", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652098, "uuid": "0596f1c1-a0bb-42e2-9012-64078e1b20b6", "comment": "Malware payload (Amadey)", "value": "2e2fdd9a079f71f265e68cb0380cc6fa4222a689", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696652098, "uuid": "cf58b74e-6659-4ae4-aca8-2b611e9d27f8", "comment": "Malware payload (Amadey)", "value": "5a328fad31721d6c4cb1e9e02e5480786873222a5ff544f2c5f066141443690beb3048df3fa8a79812f2470270834767", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652098, "uuid": "63981306-95a8-4de4-9a2e-c2c9889ad294", "value": "T109452363AAE09126DC6513748CFB03D31E71FAF18A34939B6681590B2DB27E472B1397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652098, "uuid": "f1754320-2e7d-429b-8ca4-2433709da79b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652098, "uuid": "0b03da43-fe02-4066-b563-51f7d3bd9297", "value": "24576:dysijtUPNM/HcUoSMBE7SbEp7Jf5Yzh4YwKqpjnOX9/HP:4sipUSHcUoSMUpxezm9hnUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696652098, "uuid": "eafa22cf-1bfe-4084-b622-82611f00c0ac", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696652098, "uuid": "167ebd8c-2d84-4b60-9231-da0c3e6b8021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696652098, "uuid": "4ab95e37-51a9-427a-b6e9-5e477ecef687", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b71002e-6535-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696698979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698979, "uuid": "a0cbaf08-1734-4fee-b1e5-a768b96ffae6", "comment": "Malware payload (RedLineStealer)", "value": "a8e83cd5f5fb425f38e9ca05094670e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698979, "uuid": "8841e5ab-d52e-4bfc-93d1-820c774912c6", "comment": "Malware payload (RedLineStealer)", "value": "53a93577991f5ff457ce602fbdb133754cdbb3b3d73300aeacb5640819a1920b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698979, "uuid": "73f9c71b-2b4d-4d1f-ab2d-9e166bd18d1c", "comment": "Malware payload (RedLineStealer)", "value": "1fd388d74bb7c1c89f0664cd912bc233b6e1142a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698979, "uuid": "427885a1-e1d2-4cc6-bdce-b5b3b3f9cedc", "comment": "Malware payload (RedLineStealer)", "value": "54058065320319858499635e9d2a2d4403e4d404a563c1b0edae54777dcbe801a81f1c05a139829535f0503a5b9759f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698979, "uuid": "523a6635-e0f6-4658-8061-34ed8a8139b0", "value": "T16BA44CF168D5443DC876057B8FBC76B3AB387C2437E2DEAB6B1506A80A702C6D530766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698979, "uuid": "1a634a29-5ac3-45a5-a732-9c2195d3396f", "value": "06ede52fcc31e4900f4f1a7060fce645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698979, "uuid": "fcb9088a-50ef-4b0c-bfd0-013fab26a89e", "value": "12288:M9E2kNalvBKICCbcOMWkE6fDJNB0F3QjXp:M9E2Nl7cOMWkzAQjXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696698979, "uuid": "ff54fe3f-bde0-4fd6-b876-8539d6a41d85", "value": 468424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696698979, "uuid": "36e6cd5d-4cd0-4eec-b0db-73b863c0e50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698979, "uuid": "16e56625-b58f-4ed7-8660-e297a44484ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1047db4c-6557-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696713510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713510, "uuid": "3a5eeff7-3f79-4d0b-bcbe-501b025dd927", "comment": "Malware payload", "value": "67722a457caad043616041026db142a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713510, "uuid": "459eb03e-b2b2-46b5-ad18-865188b3e64e", "comment": "Malware payload", "value": "53d10bf98c4e290949b6efe10418a674c737c837ad85fcd47baeeaaa8d72ddcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713510, "uuid": "ac230199-82c0-4b60-af42-0e1b3b2caccd", "comment": "Malware payload", "value": "b3dd01f71ccceaa08316f41205cb5424657a918b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713510, "uuid": "d9288a55-f814-497d-a6f1-ab79d0cbcb09", "comment": "Malware payload", "value": "a7fa063f3dee64c7a8e51d5d9803be8095fd5465b1738d3ad5928c0b1bc6198cce493033d6be7de774c31ccd43a9d6ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713510, "uuid": "a843daa2-348e-4490-859a-1f3c367fcdb6", "value": "T18B74BF43A2D1B871E5268B325E2DC2F4772EFCA1DE68779B22287F1F04711E1D562B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713510, "uuid": "02f66c79-a223-4070-9e1b-99dd9983e705", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713510, "uuid": "2c169b4f-f998-4b79-9937-a359c2bc2797", "value": "6144:FsRW4Qc+N500ltmewMKYO+U4oxOrc8fVZT2p76VjxeTNAZJa:FH/cc504mpMKYO/4o4XfVYp7QNeuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696713510, "uuid": "ef804bcf-9117-4c0f-afc9-458408d29c35", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696713510, "uuid": "87f74e24-8214-48e6-8a2c-2f011487fe92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713510, "uuid": "63791d59-bb47-4db2-96bd-aba1c0e0894a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a1e01f-6542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696704607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "ac682516-39f0-41db-b52c-fa55c2b207ef", "comment": "Malware payload (Mirai)", "value": "d114b6e116051e39bfae2fdad1185397", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "34aa644e-920b-4d0f-b9ab-993799798d8a", "comment": "Malware payload (Mirai)", "value": "543daa4e62f44faee884a4ef675c84701a8b16b2beb442686d54af69ee470508", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "07a99c77-777d-4d23-a368-4add892a2d74", "comment": "Malware payload (Mirai)", "value": "928fe0512aefb36e44972bc43ffcc7aac36b07bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "1fb8f864-0193-4926-bd3f-6212db380af8", "comment": "Malware payload (Mirai)", "value": "10e242225ac7d93fc13e9056356111aa0e60f30059049a61bd67ccd79c413a6336915166e9a2e093e0f320a8db8624c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704607, "uuid": "a94bf8c7-86d8-4ebc-833b-af755ff5bf0c", "value": "T154C35A89E5C3E5F6EC004A78346B9F31D977D4BF213ADAC6E7E86D32A815541C1032AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704607, "uuid": "d57618eb-8d89-4494-bb87-58bfe1a6c7e7", "value": "3072:rbasBpElV9cT2c4ZnF4JfwmvS2J7oCHL5bljpL66yH8:/as3ElVmT2NF4qCS2HbpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704607, "uuid": "a9b9addc-8e89-4706-ac60-43ebc4e633eb", "value": 119696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704607, "uuid": "46cece14-99d2-4c47-968f-02262a838e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704607, "uuid": "0c1bc012-5c75-4489-a313-80a29e454287", "value": "yourbiggestnightmare.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c359dc6-64b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696642448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642448, "uuid": "d22250e3-ff83-4faf-a116-9b4114485345", "comment": "Malware payload (RedLineStealer)", "value": "b8c27f896c4241196c357b8aad465ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642448, "uuid": "a2d05ee2-162b-4522-ad6f-58b3cb0c0ce7", "comment": "Malware payload (RedLineStealer)", "value": "545dfa973a3c7308627b21d1c230d58323bf08fdf8e0a31fdf4efaefd5f2fa12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642448, "uuid": "e307d6c4-3dbc-4e58-b3bc-f9e2ddc6270c", "comment": "Malware payload (RedLineStealer)", "value": "245ecb42a5834d2271d40832d911228e8d9db132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642448, "uuid": "82a90201-f34e-4fdc-8b78-8e318803f8d8", "comment": "Malware payload (RedLineStealer)", "value": "748b806572d9ff212088a60a5a7023833c094d56b36ef55263b76fde3c1bf38d3fce6c54e84e6a916e05329dd2516216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642448, "uuid": "1c0a1ce5-13d4-4907-87ac-54877fdbe915", "value": "T1E2452347F3E48667ECB427B16EF753830939BD938879864B3790590E0EB22E5593132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642448, "uuid": "d9541e2d-b2e5-4c15-a55a-566b5a0dba01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642448, "uuid": "669af24e-3af9-4394-a984-54f873d691de", "value": "24576:jy02AO7vjhLtmTYaVz0muri1iz5afeLaa6HrJo:20RT9Imq5aE6Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696642448, "uuid": "7672c848-aa04-4dac-b9e7-3c22d569d391", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696642448, "uuid": "dd07fbe7-7d4b-4dd5-afc3-55be656e02a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642448, "uuid": "daa87c8a-d516-4994-88b7-636423f12e30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e34022-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696668263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668263, "uuid": "db9bf596-f861-4add-8e86-8a938c037f8f", "comment": "Malware payload (Mirai)", "value": "ddf894ec46b4d85890e396692ac35ed6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668263, "uuid": "5d895ff9-0eba-4ff7-b04a-2fdf3626ad17", "comment": "Malware payload (Mirai)", "value": "559c467d4434b286cd529f10b40f7544cb0b42265b368d7b70cb4a5f0bc24f27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668263, "uuid": "6b26b699-89e7-4406-9bde-d1512fe46ca3", "comment": "Malware payload (Mirai)", "value": "1b226fce31bf7acd85b802f725c079bee81bfd81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668263, "uuid": "18c9dfd8-8285-4365-a3ee-84dbc414ee22", "comment": "Malware payload (Mirai)", "value": "2455ff99c3ba9cc4c0be52caab748bd10fff17a969901a91a57d6e3789b1a09ca638d287d08e054d75a59f279c1a97f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668263, "uuid": "31d56858-1246-47b5-b668-88bb997323ee", "value": "T13D2302145712EAF39C6D3132FD1881A37AA859FCE4F218F130909A1AADB2114F5EB53F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668263, "uuid": "289a5d36-3087-45a6-8011-5d4bd58f8163", "value": "768:MQgWaJILZuieRphTHisSgv1KXS6nifrv9aGXDib/3xPj7JtkPGOQ9z5C1iI5q3UX:MQ7EI9veRpdHfZ6WrldDibPxPjltkKC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668263, "uuid": "ded7a907-5a70-464c-ad46-faa98f3b35cb", "value": 48700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668263, "uuid": "a343252d-8989-47fe-9801-9a3fc1977406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668263, "uuid": "d2ade062-1e2c-472c-9c45-29af0a085cc2", "value": "ddf894ec46b4d85890e396692ac35ed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6983b0-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696668269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668269, "uuid": "4880bf77-b14c-449f-a511-cb48c81f25fc", "comment": "Malware payload (Mirai)", "value": "11dca874b366f58e401741abfa23e1a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668269, "uuid": "94001079-dbe0-4ab4-9d54-29a831ddc076", "comment": "Malware payload (Mirai)", "value": "59ed70d1c0baf69fafcc70e8eb64c14e7e89eaa0b81dab625363d0c82d0f330f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668269, "uuid": "ba1bb9e5-a091-4fdb-98c9-095ac611fb27", "comment": "Malware payload (Mirai)", "value": "30ca7bbc5f86fb3101a23ce2257204d1fb1f428e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668269, "uuid": "4f9cf6e8-e11a-49d8-90a9-27284f5976b6", "comment": "Malware payload (Mirai)", "value": "f212c5f5e0cedd6b9d2a58fff28fd1a1a7ee3e593bf38f82dce7adc8b2b8dddc6fe510d9f7cca06cf04e98f62bbf147b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668269, "uuid": "9459f738-8c25-4b9a-9dbb-80257124d0fa", "value": "T1686302806A5F7312FDF2A874B4B3023162067F65E068761E512A0F3CB78B69DE272D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668269, "uuid": "1914d0ed-a801-4aca-9e14-0db14d99e994", "value": "1536:Xsw7bvuKgFK01e7Ya2LUPwepSn9Lyv+0S2Rmte5Qo8Cx:Xs+vcsLPwe4tknSWm85P8Cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668269, "uuid": "816b962a-18c0-4b10-910e-e4dc7e305f2e", "value": 71472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668269, "uuid": "99b67d0b-bf36-4f3c-8ab8-73770b03a05f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668269, "uuid": "4ee93cec-67b1-463b-94c0-507d6ae522c0", "value": "11dca874b366f58e401741abfa23e1a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a30b32-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671294, "uuid": "45c81203-886f-45a7-9582-2c0c5625f87a", "comment": "Malware payload", "value": "ffb8bd64be66838b6301d2b88270440c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671294, "uuid": "141ee429-1683-4deb-8cae-b4be0b64d733", "comment": "Malware payload", "value": "5bf8dbbe1ce911685aa86d0a42f8d7ffc85b8b664660247b39fba8bbdd48de65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671294, "uuid": "ff33cf59-8686-40d9-954b-01c969325f55", "comment": "Malware payload", "value": "142a2c3c1da95272d830374e23fa69c466adec57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671294, "uuid": "47b423bd-5867-43e5-b811-0281d18be940", "comment": "Malware payload", "value": "29439c3f9e6e516e281e7971002f281d1df6b9c12d8d25c7ada7dea1d0d5c33ba1765ba0e0be77666b733cd7db98e91b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671294, "uuid": "5b13df4a-b005-4321-a215-dae8826287c5", "value": "T116358D26B2A14437C21317388C1BA768BD39BB51BA2965573BF41D0C6FFA201753B39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671294, "uuid": "9b68f0f0-a581-4a8f-a558-387998427411", "value": "12288:MIQim/UZhdUiBFipOeZD334ck/ULoA0SBQ2uD4FOFfzG+llmi4Ns1snogTl:lVXhdVKzZrLkcZvvImi46sno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671294, "uuid": "58cfe1d4-270e-46ee-8559-5c9b14e452b6", "value": 1131520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671294, "uuid": "86250fae-2b7a-4d92-9682-4eba8e1c6cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671294, "uuid": "8745ba5a-eaf1-48df-92af-1650e2172ad0", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.11446.30167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fed376-64c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696649421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649421, "uuid": "32e2eb34-fd03-48d9-a120-41565beccb5f", "comment": "Malware payload (RedLineStealer)", "value": "1d1518a9801441d54e382bdbaba1653f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649421, "uuid": "82932e48-5179-4e48-914b-76d24ee9ab10", "comment": "Malware payload (RedLineStealer)", "value": "5c988db3f7270de0c92cafebe19ca8f89b7af85269679cf65693325cefe6a7d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649421, "uuid": "f65276db-8058-42a7-bc92-206a08c6ab7d", "comment": "Malware payload (RedLineStealer)", "value": "20df3dab0de5bc11f3d13e8d5483687a44152c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649421, "uuid": "3feedbad-0fe4-4a6e-96f9-ecbe14907404", "comment": "Malware payload (RedLineStealer)", "value": "f01d32c03e19ba225a88de10a300bee78165c070d01450a820341ec696111f226c73f9893f8bab1f704c564d93a1f1cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649421, "uuid": "77d088e1-1ccb-4ffd-99c4-2214c337f32b", "value": "T12674F7016BF54A9BF3EF3BB9A4B449010F78F406A4ABD70E16A460FD1D277409E68763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649421, "uuid": "551ce74c-a120-4351-8c9a-99de80468c7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649421, "uuid": "ddaceb3f-376b-47a3-979c-10084f7ddf0d", "value": "6144:bJJEUHVCfMovRp0Gqpjjuux6RIni1326LVj16L:yRdLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696649421, "uuid": "d0cf315c-2df6-4583-a0b7-3d9d0dc51430", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696649421, "uuid": "c7551a96-52c6-491c-a0a4-5c3ae84c6c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649421, "uuid": "2b428973-391d-41e9-9ae6-81bfe69560d5", "value": "1d1518a9801441d54e382bdbaba1653f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3561091d-64be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696647859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647859, "uuid": "3c1febec-3abf-4cbd-88c3-3f23eaa484f7", "comment": "Malware payload (RedLineStealer)", "value": "b4dbfafc61561eb0cba635f1da979d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647859, "uuid": "b9e65576-0106-4a39-9c61-2ceb1fec2979", "comment": "Malware payload (RedLineStealer)", "value": "5ddcb2d54a68d43d740791a408c842be01784123bab7b158ef44e525220650d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647859, "uuid": "e11db4d0-a2b2-498b-aee7-5df206749846", "comment": "Malware payload (RedLineStealer)", "value": "ba3c953f699da66eaa311d603532c96b411ac48c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647859, "uuid": "68b8aa12-7ddc-427b-9e16-69fc52237569", "comment": "Malware payload (RedLineStealer)", "value": "a17ef907c62485a5fea8863eb9a28ed4356e4532ff9ef7dd5cc7372a1e376510712a60e7bca4ce0f66dc9dc02f40f824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647859, "uuid": "f3ef5c6a-944f-46a1-a356-17ac330dd0d8", "value": "T17C452322F3E05133DD3A2374A9FA13C30E36BC965D7843671B51AE9A0A716E9D134736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647859, "uuid": "06b1e033-7d21-4446-b1ef-59a4d7c771ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647859, "uuid": "9c8cfeeb-df3e-44ba-b7e4-daf9b75ad761", "value": "24576:8yf/aWDXzY9LqmQxBPFEO8e0mD34hMqjvwlHm:r3aeDY9emQxBKRe0YZqjIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696647859, "uuid": "da5ea50e-2841-49d6-9885-ee9a60395cdd", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696647859, "uuid": "3ad820ee-57af-4795-8861-ed2df821e3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647859, "uuid": "5221112f-240d-415e-8f01-dfcd94b896ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275a96d4-6500-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696676182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676182, "uuid": "fc203610-2351-4c58-9d49-8ccaa0dcb2c9", "comment": "Malware payload (IRATA)", "value": "71914e263e48282fa43dd2e77f2bcfd5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676182, "uuid": "6fb7d225-1176-4a6a-b447-b77be0e57fd7", "comment": "Malware payload (IRATA)", "value": "5f1d12a585c72b9fcd8244a50402be0ea8a084ccba9daed6b2f481037b69d0b4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676182, "uuid": "98f419e4-a2f4-4b70-9697-90c78532b2a8", "comment": "Malware payload (IRATA)", "value": "a163ccd5cbd97db2ae1c7b7f4f80d5d5444198a8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676182, "uuid": "32d34151-6d8e-4d86-a83b-8da4818ec09c", "comment": "Malware payload (IRATA)", "value": "d340f48919fec34a3078862c896c4ef20a9c81666e7a9889eb2b071bdc8759bf2cf2a09124550535e22ba73d65f5c7bf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676182, "uuid": "6004e789-8b62-4842-86c0-0331541cf8e7", "value": "T165E5337BDCD3FA36E58FE37A4529A013298C43211618EA3D2B51C0E81AA7D5C2F5FD94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676182, "uuid": "7b42e59d-2ea5-4260-af7f-ce304131c86f", "value": "49152:mDtXj6mu5RhrZ/GKgRgKxVQYbZuw+jf5TTrJMESZVxQ4s/Ip7f1hJ:mhX2/Zg6YoUBX1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696676182, "uuid": "96d616fb-28b2-42c9-8581-e5174db2b239", "value": 3119486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696676182, "uuid": "f0b18937-0181-4848-9cfa-94ac8c78ca9d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676182, "uuid": "69204236-c00b-494d-86cb-f0241bb2478e", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c792e308-64dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1696661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661419, "uuid": "ae6efd37-6108-40bf-8500-f78b7fe44721", "comment": "Malware payload (AveMariaRAT)", "value": "e1aed2186c2fc048eb593ec27ef0cfb2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661419, "uuid": "1163cabb-d99f-4581-bcf1-c36673aafdfa", "comment": "Malware payload (AveMariaRAT)", "value": "6010250377bc7620663ededfbb57e36554ba2c5b9580d24b5fbcca56d7831723", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661419, "uuid": "a840534d-e85d-4d91-8ac4-0dda2f4a6561", "comment": "Malware payload (AveMariaRAT)", "value": "22a772e9b6cbac6bd40a1cff5d93977bb71d3f79", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661419, "uuid": "1d46551c-5ae6-4889-82d6-890de3561d3f", "comment": "Malware payload (AveMariaRAT)", "value": "9a12259d0d9153c5d6bce8503dbf4809581f903ee15eb702ef92d778c9e22fb67d2b145ad2037f9e4cb207d31ac3050c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661419, "uuid": "d6148187-6982-4d52-960c-1cb69e843c51", "value": "T1BDE49DAC355479DFC85BCE76CE942C64AA60647B830BD203916319DD9A0DAE7CF242F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661419, "uuid": "c1d74d8a-6584-46b9-b192-55419889bd6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661419, "uuid": "5daa034c-2a01-4f04-8c37-904a3e1cd179", "value": "12288:PFHJEw+ayHGStC824qc27s9Gw3cOmxYSG4vSvfu7H+9ExIaARLYf/PobkA0ydU39:dHJX+a4GSWC27s9GMclYoau7HcEAAg0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696661419, "uuid": "971266dc-ffd3-44be-82ff-d6143c6426f3", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696661419, "uuid": "8153dd28-bd88-420a-9ea1-92887933f325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661419, "uuid": "8b8c6aa4-7b77-4191-9a59-a481d007bfc2", "value": "estatement06102023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b4ceae-64ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1696640454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640454, "uuid": "8aa47417-0a17-4497-9084-153a3dc6cdd4", "comment": "Malware payload (Glupteba)", "value": "5171e89741f041663c4a91a90ceb9c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640454, "uuid": "0e827c3a-e385-4802-b718-27f8ac50feab", "comment": "Malware payload (Glupteba)", "value": "62a510237e5fa4597e618e752512cba0651aeb8e7a5f29f71aa6f573a8aa5db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640454, "uuid": "62450883-4c10-4867-9afc-a08c8b5efc5c", "comment": "Malware payload (Glupteba)", "value": "45fd7438461a1cada912769e455127818b3abe50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640454, "uuid": "0f5a4dec-5f4a-4669-b4af-a2a0a2da0495", "comment": "Malware payload (Glupteba)", "value": "5807ef729a7b9f3657ff09dfcbeb10f1123d1ce4c0358f19db43f2f5e60146f4021bcbe0bca97de9d4d1211453307a44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640454, "uuid": "eedc8c25-acb0-41a7-b25c-18062077152c", "value": "T13A8533D2BA2241BDFCB55B7091EA18CF6800AE8FA4D8877D2367C1B4791BF641E191F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640454, "uuid": "5f94b37a-e7c0-4add-a528-bdfe1dcff4f0", "value": "10f1bd31eb864aa4f02738deca4b5815", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640454, "uuid": "af0afc38-011e-4d1f-a1f7-801b3f14e6f5", "value": "49152:qYLlbuLcsuQYRwGDFUpVm217qx1bJ1fzlE8K4k5qzeG6b:qCb4uNF6m21mx1ZNdNeGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696640454, "uuid": "d430f26c-fb3b-4138-9a15-1f11cb3d9d44", "value": 1822944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696640454, "uuid": "ef19b7fd-af97-490f-af15-2e06b3add137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640454, "uuid": "4933f5b7-6aa3-42fc-86b1-cef8cfda29e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ffd25b-6522-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696690758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690758, "uuid": "9dbd3174-81e2-47c8-bcfa-008a7157de0f", "comment": "Malware payload (RedLineStealer)", "value": "c386dcab17d0c2b2b006ae2b66b474cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690758, "uuid": "69a942c7-520c-4572-958d-f92689d59e58", "comment": "Malware payload (RedLineStealer)", "value": "6363733f64e0d2f2a219368944b995456d5518ad62e03a7c7d2f296326a2d525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690758, "uuid": "b400d2d2-c345-4e4f-ab2e-2b864d5447ec", "comment": "Malware payload (RedLineStealer)", "value": "fc61288f2852010937256a07d2b079ee83172101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690758, "uuid": "15780fb0-c1da-4e4c-8594-0b0ddca26f77", "comment": "Malware payload (RedLineStealer)", "value": "de3481d71536faf77b3112671172697dcb97e255ad68d470e24b1fce48598c464da38a61b4450ceae2f0b2c25295432b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690758, "uuid": "4800555f-85ca-4a20-940c-acf61d66a13a", "value": "T19545230A66D88067E8FA2F7498FA22430E36F9425D79831F2F51EC1D5FF26949974323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690758, "uuid": "8eb07e1d-5f24-4cd6-b649-a306c1749d30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690758, "uuid": "51bdd5eb-654b-403e-ad34-15d7e0d4e2a4", "value": "24576:ZyH3WKjFI7qZu+yzEDO4c7aGyRTyVQFF6M6iq2XS:MH3WKZI72hy4DO8yVQF96iq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696690758, "uuid": "f94094ad-e755-45c5-8382-a6e81d281cf8", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696690758, "uuid": "27e853ae-02c4-4145-bd73-92a0ac7658cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690758, "uuid": "47ddcd25-e93f-41a1-b541-5639d5d932fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00022bc-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671285, "uuid": "e815b9d8-625c-4f79-87a4-66cb59ae7e67", "comment": "Malware payload", "value": "8a466bdea095850abf1e1516e0cb48e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671285, "uuid": "8c50ba51-1586-4fd3-84fc-993004f55507", "comment": "Malware payload", "value": "63f3096d1b9f0c2d04c63de4a1597f95cccd64bc9b1fb714e9f6d63d5e0dba6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671285, "uuid": "e5f5b0d6-d52a-4f16-8283-7fd502077661", "comment": "Malware payload", "value": "c16eddc669ae56d021d05c55aced0cca7e675357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671285, "uuid": "42cb6940-b87c-4c51-ac18-fe5595f7ba61", "comment": "Malware payload", "value": "cdca29a0e345be77a70e2b5b6cd59627cc3958f71bd01a56c0d578c394d51675f7910b785900ff6b9fd5a87ca1ed8992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671285, "uuid": "92830238-65cd-4a83-a476-c13d42a40d2c", "value": "T1F835060AFBC0CC3BD89159320A73866675F7FD927F14D34B6988322E7E3319269562C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671285, "uuid": "aa2db26a-ec03-4e3c-82fb-2b065723ef10", "value": "3ad4bbc20613943457e6042f373411ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671285, "uuid": "d2c86dee-dc76-4677-bb70-9e674de5db70", "value": "6144:XSfrbBWx+C87nyKLYMMPDICn9RWvxXdr5eysEf8aJx2relAF4N+y/86EfMsBx80a:v+C3KLYNF9RWhdNKEEfreq9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671285, "uuid": "12133c47-fa8d-456a-a610-ddd25c38332f", "value": 1112835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671285, "uuid": "fd508744-4d8e-4668-b8a7-47c4fc20b21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671285, "uuid": "a6a8c2a7-5af2-4ca1-93f0-830c2a3dc3c0", "value": "SecuriteInfo.com.W32.Agent.BOR.gen.Eldorado.24767.17497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9255c685-64e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696662618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662618, "uuid": "453e0954-b23f-4b5b-8a84-c2cc33ab2719", "comment": "Malware payload (RedLineStealer)", "value": "89d924607d725b91630b4ad28de21154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662618, "uuid": "b3968fa2-d43d-4305-b642-8514c0463af8", "comment": "Malware payload (RedLineStealer)", "value": "656c85b9459c11981349242d3eaea6021a5aac2e536b86d702bb8ac81e7ba8d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662618, "uuid": "585fbc25-3228-4844-8809-278182bf840a", "comment": "Malware payload (RedLineStealer)", "value": "5c92a960856e88d7c6126851a52ea9caa785bf89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662618, "uuid": "002bce20-7c5a-4a45-8a29-53eecf7de1cc", "comment": "Malware payload (RedLineStealer)", "value": "773bb884c47b30d3b61acf3f05ae426be102023ece0295c3fa78926b9b932f04f30199e14452f5134cd3726ab245b754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662618, "uuid": "068a25c6-f791-42e8-a9db-8e2710efe2c1", "value": "T116B45B44B18BD223DFCA49BE94D6B74019A8F87A1BC3C5F7E64B002DA45EBDA051709F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662618, "uuid": "84ce6bc5-ded7-4661-831e-8003aee81775", "value": "f206bf4934412e0139dfd76edfc7dab0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662618, "uuid": "500bca3d-9105-491c-b4f8-4c1d62d74b21", "value": "6144:Fm2M7P4vYTrhR45hDaP4YOiUBkPJPMPiOvtG7oS06rd50JTmDbjLlCZHzWVkDwLq:Fm2M7PnRghDQ4YAhiAM7ok30cpIW87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696662618, "uuid": "53891a28-e7bf-4c70-ad5c-66e9f32e4d76", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696662618, "uuid": "67fa0e2c-9580-484e-99c4-3f640ab58d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662618, "uuid": "c9750956-8d0f-494b-9e14-70d1aa61bf9c", "value": "89D924607D725B91630B4AD28DE21154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17917cee-64f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1696671432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671432, "uuid": "dd587b0a-b6bf-4771-9e99-ff9506598e80", "comment": "Malware payload (GCleaner)", "value": "93ebac23d004441f2792c36b731845c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671432, "uuid": "77b49007-2436-4c4a-8e5f-4b24aa25d03a", "comment": "Malware payload (GCleaner)", "value": "658d9ea4093e492a0f1a8cc6e054e65d2ea30f22fd179b1e1ca58c17618690e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671432, "uuid": "3c65ad15-6da8-4822-93d7-94669d4259c7", "comment": "Malware payload (GCleaner)", "value": "1fa7dd46ebea5b4c476d97d5126f021dcd9ea69f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671432, "uuid": "9d7e6f22-0f59-4e1a-a8d2-d46e92e9297a", "comment": "Malware payload (GCleaner)", "value": "8285ae059b4d7314c1aa4108405f7dcc179c2830a03b412e58b451568de0cf3030056c6d952078194d33c661276e9fff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671432, "uuid": "71732055-0d15-4574-bc66-6df122cf2b0a", "value": "T16774B013E3E17C61E5224B729E2DC1E4761EF9618E6AB7672B185F2F08B11F2C663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671432, "uuid": "e2afd516-eb89-4eaa-be80-730ea804cc6b", "value": "87f03000e6499d0f071e10e3a4f854c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671432, "uuid": "561e4c8a-6ba5-47f5-a259-9cb07297323c", "value": "6144:gNZ8nMtxUX84p2nxG0FGebTmCuNQ8g1WKLe:oaMvUX87xr9bKQ/1nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671432, "uuid": "f2e1a373-bbc7-4078-8de8-4b088ea82f9d", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671432, "uuid": "848162d4-ad62-4a0c-9e04-e9cb0bc823c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671432, "uuid": "e73660f9-045a-4115-b5ff-349f89002a08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55df6c03-64c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1696650920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696650920, "uuid": "e49c6633-2d8a-4d73-bc54-f1811fc48352", "comment": "Malware payload (LummaStealer)", "value": "1e61b9efe36ea4bf87ff08957fb32fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696650920, "uuid": "1cadf6be-70dc-47fa-a2f1-c4a173a695fb", "comment": "Malware payload (LummaStealer)", "value": "68d9362e5c72da78824957e8e3fadc58f334b70e6764e01ced80027c2bf9d4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696650920, "uuid": "94d4f3cc-79fe-4724-a6e7-69f3cc04bbbe", "comment": "Malware payload (LummaStealer)", "value": "048495d88b2dcff88428e10be78abf3e8209cb5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696650920, "uuid": "1b66f11b-853e-4a86-95ae-1aa8c9b8d1ef", "comment": "Malware payload (LummaStealer)", "value": "2c73b0742b46fef30ddef10ef17549bdd18946a279091ba7f69e58cb858e8b7f7016cbbc82ac10451dd47cc5f68ab08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696650920, "uuid": "836aee17-944a-40ea-9189-9b94193e276a", "value": "T14165AE9138C4C571EDE2307F42ECF676966DF0A00B6549EB029BA7EEE7B05C22A31547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696650920, "uuid": "9f94dc1a-d0a5-47fc-93aa-3e96a6509bfb", "value": "42aef08c45d96174570f708223d1e053", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696650920, "uuid": "d50b3917-9be8-4fb6-8646-26219fdc3e69", "value": "24576:L7Pj4cj6bpLUniTzjTy2fLwR03EAHoDpQxtRLKoH8MuJyKUs4c1xFOn7KHiEoSWv:3r4NLUniTrMxFOnWH3oSWyErzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696650920, "uuid": "503d7e7e-9450-4387-9464-989b53a5b970", "value": 1473480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696650920, "uuid": "392499e0-3194-4120-b84a-c3250ae2e24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696650920, "uuid": "950f80e5-961e-4135-9e59-0ac44598e81b", "value": "1e61b9efe36ea4bf87ff08957fb32fc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b190b39a-64e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696663529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663529, "uuid": "46ba1f5e-8ce5-498e-ab6a-2d0383e7bdd4", "comment": "Malware payload (AgentTesla)", "value": "408069741e9cf649678375ace4870161", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663529, "uuid": "4f13a473-b013-4279-b4ad-8c802c777ae8", "comment": "Malware payload (AgentTesla)", "value": "697efcb5bd9de6a2276d18ed0426e6be809b3d463ab38b8a8d62404bfafb1f1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663529, "uuid": "3a512498-87db-44e1-a3d8-3eb185371130", "comment": "Malware payload (AgentTesla)", "value": "18b3665b895d49e284d1ae83eacc1fb220cf74ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663529, "uuid": "908e15fe-3900-4625-a2f2-c386bbb2e460", "comment": "Malware payload (AgentTesla)", "value": "f5727297873b564098e489dc4b562d25e75efff6955091cd29658b9da1df3d85fae59971653de1b36b65cbebc08cbb1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663529, "uuid": "4e3e9e13-7027-4f10-8e9e-dca69bd48863", "value": "T1DD84BD2035FF945CB2B37F521BECBAE98A6FFBB21616911D2540030B9A76E44CD92731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663529, "uuid": "30c6ad4c-71d8-4ac9-a3a9-3ba2e9708cf7", "value": "3072:WJJJJJHmEuPM23ApVprvQhCRTThUb3JJJJJhJJJJJIJJJJJyJJJJJlJJJJJFrnnP:s3nrrxThUbJrnnNlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663529, "uuid": "28f4e2f1-b8dc-4157-84e9-f384bbaadc9d", "value": 375074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663529, "uuid": "6ae1361f-6998-49e8-b359-9333b758debf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663529, "uuid": "ab921335-5d4f-421b-b9dc-a6395c219d82", "value": "Segundo comprobante de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defddd08-6503-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696677779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677779, "uuid": "0c12e331-8534-4ced-9fe8-5f20a8cdd867", "comment": "Malware payload (Tofsee)", "value": "9f38fdbeb892839b9ebfd2adb1a5336d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677779, "uuid": "66384237-2e7d-4ed9-a299-a7d1f2efd394", "comment": "Malware payload (Tofsee)", "value": "69f5c3e085c768e07e35c6b66d2c95aff939eb52affefb8fc4d28d4ae50ae792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677779, "uuid": "15f952e3-3d0c-4722-8962-6cfe6acfc2c8", "comment": "Malware payload (Tofsee)", "value": "ea2db9b8250f1aae418df2b98e45bc231578c04d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677779, "uuid": "34091051-324e-4532-b1c5-d01e348221a5", "comment": "Malware payload (Tofsee)", "value": "b35104a2c82303d92ffbc99dad8ff0d5c99a0c2bca239b5041c72be748a4824ddd4c529f8be8f97d5d092055f6215317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677779, "uuid": "f9d37b41-30c2-4797-baa4-b64c912e9c61", "value": "T13A547D03E3E0BC61D52246329E2EC1E4776EF5618E69B76A3B485F2F08B11E1D673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677779, "uuid": "dccca346-007b-429e-9ceb-ec8e55e8bee4", "value": "2c4e40871558ef3f015b1de82967c478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677779, "uuid": "2f5d1a64-438c-4c60-9d5d-43a3bb3e33cb", "value": "3072:o1IX9Z12tP9QwsPFq3+xGb5jroIXPRnASj86V1oThbiZ75U:uyZktP+dPIOxGbxZPRntwM1oT275", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696677779, "uuid": "9d21877a-4d6c-4739-be12-4c1cf455e3ec", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696677779, "uuid": "072e38b3-d644-44f1-a644-c67700026218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677779, "uuid": "73b1c53c-692d-469a-9d81-02794f340301", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4fa89a-6536-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696699652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699652, "uuid": "28a23a4f-7cf5-4b73-869c-17b33066b5c9", "comment": "Malware payload (Mirai)", "value": "417239c0d88ede0701607b4f66b287df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699652, "uuid": "bf247f8d-b6eb-44f0-a267-972a8bbb7c12", "comment": "Malware payload (Mirai)", "value": "6a024f039f19dbcac917bb3fac18333e3e4e8d8ff6c8a87227f431e2fb74e264", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699652, "uuid": "b91ecb5b-82f6-4028-8c8f-eb74cc922e0b", "comment": "Malware payload (Mirai)", "value": "aa3edbea868610b6c7d842e47ea917961e9d46af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699652, "uuid": "902de88e-4868-4849-86d2-c8aa8e41d8e6", "comment": "Malware payload (Mirai)", "value": "86b54fa0ff924512515c9c4e5c36153668403835f3cf5eaef56414c83461309abedda9b90093afd86fbeac56b12b85a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699652, "uuid": "07330212-159a-451d-9cef-0325cb1a7338", "value": "T18C330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699652, "uuid": "e95d3bae-fa2b-4198-b72b-84776bcba7c2", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oG9:r/hqaJMDg9eqK806MHdkfQX6HuC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699652, "uuid": "9b8b35aa-0933-4e95-83af-a857d88e32d3", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699652, "uuid": "cae33670-dc89-4efa-8c12-cd1069894972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699652, "uuid": "ebe73c46-d9d6-439f-af13-5f2110f8786e", "value": "417239c0d88ede0701607b4f66b287df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a14c98e-6553-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696711808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711808, "uuid": "40099aed-c2d6-4a91-b3c9-f0bdd7a73d45", "comment": "Malware payload", "value": "2db0069f236e730076f72aba676dade4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711808, "uuid": "6375565a-9406-4d51-9a58-3dee318430f4", "comment": "Malware payload", "value": "6adfaa00edd30bcd44593a60fd4e08fc4179827fc6b89ae44fc5021c8b75c665", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711808, "uuid": "b89abaf0-76e9-4bf2-a943-fd9ff816fe88", "comment": "Malware payload", "value": "df9c7502114981b485bf3beb77004a3a2c5f1461", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711808, "uuid": "3507c3dd-954e-412b-8900-38d36b0ed7db", "comment": "Malware payload", "value": "0d0d1199bd1421b02bc6083e1532676ae02c352b3d7cdb17ce65e908c6f3be164a2c2cd47c73b24d11f98f43e5cec362", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711808, "uuid": "593014e4-eef6-4af0-bf78-b2bd3d449919", "value": "T16FF2E12513A6A437F7D03CF2F87CC30062CB25E5BDD66B9306A4990C46C2A967EFE651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711808, "uuid": "404ca519-92c1-4b58-bd91-61e1a7013f34", "value": "768:FgNSK8OxF4/oeDE1Z57CsBDzYRdtlj3oze83Um:FgAKSBA1PzYRTlzij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696711808, "uuid": "c1d5f776-7631-4c4d-989c-e5615cc90f9d", "value": 37128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696711808, "uuid": "37dc4331-1566-4a78-9691-1c9cd64907e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711808, "uuid": "db940efe-7c69-44ed-b19b-9ca3fcc4ad2d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66ca3f4-654f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696710433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710433, "uuid": "14f61807-e743-49cc-996b-220caf2fd1ac", "comment": "Malware payload (CoinMiner)", "value": "a251f635ee202207302c7cc522ef1906", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710433, "uuid": "fba3f001-ad28-44dd-9f87-4c51731bde36", "comment": "Malware payload (CoinMiner)", "value": "6c55c2e2205c5e1c1b4b0cb90a5f283de32b8eb845d7f8e681370f656d06599b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710433, "uuid": "5a20c83a-2cd4-4ef3-8d3e-0dff282d4a25", "comment": "Malware payload (CoinMiner)", "value": "43f3d67c302851a85d993c7a3d2d5daccafda072", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710433, "uuid": "f133b853-5441-4e68-a601-36a2c8435f17", "comment": "Malware payload (CoinMiner)", "value": "9b1691eaa7b579af32e677154380c5e2ab6c9053f5b2311928420135b02e9777d1a826fab706c085a93fe64f4ec268b4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710433, "uuid": "6ca92338-3ceb-46c1-98a1-c3549fe6caa1", "value": "T159547D03A3A1BC71E5664B329D2DC6E4772EFCA1CD68679633587F2F08711E1C662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710433, "uuid": "ccce95e5-d7ee-42e3-9398-7eb9158e52ef", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710433, "uuid": "7b739538-69d7-4d36-9eb5-fe5c72429fa2", "value": "3072:8ZY1GQLytWjDubHieIWEXjSCH7UZu3iv+xzJ+YRm7Qr3M4Z:AYUfWHubJNokUpzJ5RO0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696710433, "uuid": "6306c432-ebb7-4d9e-8711-d08eebe08a31", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696710433, "uuid": "84f7f341-8840-4d2d-bc9e-7de06dea15f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710433, "uuid": "9efb7f97-4d88-477e-bf3b-fac2c6c1a9d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88984f4a-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696720154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720154, "uuid": "e2211f3f-a952-4e0a-93ba-d0f0de6b45a1", "comment": "Malware payload (Mirai)", "value": "4ee290e77ed87409c9ef534a9d739452", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720154, "uuid": "d12be9fc-17ad-4db8-a573-f75711c2d927", "comment": "Malware payload (Mirai)", "value": "6cfb7b60b86fd16d87092a5f1a97bbc27197d6f7b3fa556d123a2e25b62208a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720154, "uuid": "243057d0-25dd-460d-bc59-b2a5954756f6", "comment": "Malware payload (Mirai)", "value": "3f7c97e2a4589dfcbf3aa211c64680e3b53efb4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720154, "uuid": "728005df-a3af-423b-973f-8d983edeea06", "comment": "Malware payload (Mirai)", "value": "ab666bb07b78052bf85d14e213ea5d12e0e2b68b15cf0c195a912f225cfe8f77f12a008e329bead01209f64c54b38163", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720154, "uuid": "be0fd51f-0aa0-4e44-a0f2-caafdca6fd0a", "value": "T10063D73BFA12D13CD18782701AEF89A1B472A1FC5332515F3B9227663C516855C1AFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720154, "uuid": "c1741212-46ce-43e3-a4dd-af9f94caa2a1", "value": "768:RCY9XfM1vcrdyb9l97pFn8CYFl2rg1GUHEm2Xa/Uc2+FKENwiNqOaCBK5zCe6h:AYVfO0ByPyLyXqUx+FKAwEWzOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720154, "uuid": "9af3824a-b7f7-4f28-b61b-12496dfe97c8", "value": 69280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720154, "uuid": "d15b427c-78a7-41d5-b6d6-805076a127df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720154, "uuid": "278d7618-383f-40d0-a98e-c9c9f5b050c3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6265b410-64d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696657384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657384, "uuid": "3c416bd3-46fb-4670-ab1e-d347ff4b0eb8", "comment": "Malware payload (Mirai)", "value": "16652892ad2fc3be4ece4fd60c9f4dd9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657384, "uuid": "319111fb-4a1d-44cd-b3c2-60504bcc990d", "comment": "Malware payload (Mirai)", "value": "6d6402e58d8df390525b9b071c200ed6f820c74d4e8163789cf861d15a1a045e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657384, "uuid": "92bdaabf-c593-47be-8fe7-c4cb118f6332", "comment": "Malware payload (Mirai)", "value": "a804050dc27333045b3bb6a368322419bb185f1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657384, "uuid": "d49197c3-9812-4e14-bbce-2dbf3947c544", "comment": "Malware payload (Mirai)", "value": "5add892ca694cb2f26d64e1f211f47a2d079250d97d976b0e612b34cf838767f5089bd2371eeffe1148c7277199e0933", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657384, "uuid": "a967d701-c6fe-4810-8d47-101446b4c216", "value": "T1EAE33B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657384, "uuid": "dac8510d-75fe-4620-8768-e1591269c740", "value": "3072:iJLceVpExfBxcUagHbz4NfU9J/NIe1F4kXMknM/9YnAY:iJLcdmUagHbz4NM9JrH4kXMEM/90AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696657384, "uuid": "9224231b-6eb3-48e9-984c-58cca79eea6d", "value": 150610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696657384, "uuid": "c7c0f5c3-2e66-4675-8d83-5ebdde5fdbd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657384, "uuid": "a185a05d-7155-453e-afd5-9b73d41498f0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fcd65d-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714776, "uuid": "7c500ddf-7ab0-4c52-a0af-8445d013a3b4", "comment": "Malware payload", "value": "e22141ffc74538428d08e671e99b32e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714776, "uuid": "485ea4e8-d61f-4c55-9f7e-26d3b7550f05", "comment": "Malware payload", "value": "6e4b2489bfea42138fa8464f910d08012e57e0659f25243ec544e2c07a3e58b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714776, "uuid": "cf7b348b-fa86-456f-a9e4-59a355b810c7", "comment": "Malware payload", "value": "1a466f1a554dbae6b4573dcea3ec91737da98781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714776, "uuid": "12a04215-7690-4f87-a5b9-85f85d6f71f5", "comment": "Malware payload", "value": "04a871cc5211b24996509de4a7f42a8bca5c7d5efbfe40530616f7a911392909c6389dcfdd174dab86fc33d543abdf35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714776, "uuid": "2147b735-a925-44a8-b5a6-2b24a6240966", "value": "T1E9137DC134804C7BD41372F616B91EB1BD7259702764D9E763B06DADAF30AD28A78723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714776, "uuid": "2a19640e-a384-4fb0-8680-ef07e0f2370e", "value": "65d4de9971e542941b35f36d46916526", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714776, "uuid": "5c3c513d-d50c-41f2-8b81-b3be5d72f30c", "value": "768:sRpFGOM/LjZSjg6vrjnoSiK+zLTBxSuGeqmxP0WVGMuAIPu2y/gK63WRVw8uaEzr:srFp3j7vrjnofzRxS3eqmxPcMu1Ty/IA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714776, "uuid": "e8ab9fae-c249-4104-96a3-c964d9e64537", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714776, "uuid": "be6d26f5-5baa-4e43-94be-5776586fa9a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714776, "uuid": "cc97dc22-7354-4491-9b04-0622955648c9", "value": "SecuriteInfo.com.Backdoor.Poison.27988.14466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70242547-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696663849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663849, "uuid": "6cf49d4c-ee0a-491c-bc04-6176c0787885", "comment": "Malware payload (AgentTesla)", "value": "00db3e5c86df70cda3df5cd168572834", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663849, "uuid": "33b9500d-896b-4d72-92bb-e900d26a5d86", "comment": "Malware payload (AgentTesla)", "value": "6f2dc5f3e1b216281fe09bdda656a72d644dc72ab9062724c8ca625846d87339", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663849, "uuid": "c2e7a613-efa1-47d3-a04c-55c0e0fb4dfc", "comment": "Malware payload (AgentTesla)", "value": "b79d36218b68b06950d4d42fa66db0f8e78b4fd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663849, "uuid": "c0792db2-72df-41a2-aad1-becc15e33f25", "comment": "Malware payload (AgentTesla)", "value": "0d30b8c92756d6400f218a04860d59ee5c1baa14a5d548ba718f55e9af26a3d23b5ff79dbb053002d63ca1c43d82662f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663849, "uuid": "7a2ea135-0210-4b43-bcec-767794e2bbdd", "value": "T1A5948E01FBCC22BCF3BE6739346071C64A3EFC5AB409975DD18226869877709D4A1EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663849, "uuid": "6295473d-62bf-47ae-bd09-f698747396b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663849, "uuid": "20b0c0d9-eaac-48b6-9988-c1db8c21bd6b", "value": "12288:EFjChvXpPdHSF64iODO+7L5vOAKF17YGsa2O:Eg5PZSFhBDO+EAiYGsa2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663849, "uuid": "ce9bf6d8-3930-4ecc-85b9-40754b4e233e", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663849, "uuid": "ea3874fd-112e-44e2-b46f-4a2f85359d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663849, "uuid": "00cddb8e-590f-48f2-a391-446f8331eedd", "value": "00db3e5c86df70cda3df5cd168572834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7cf747-6541-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696704107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704107, "uuid": "7be0c5e4-a2b2-41d6-bc31-834aad8f254f", "comment": "Malware payload (RedLineStealer)", "value": "45a9a36dea6e000e3a70f9042314ed92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704107, "uuid": "20fc2d93-a29c-40df-8e80-d09b1d75d5da", "comment": "Malware payload (RedLineStealer)", "value": "6f8b4eaa1affee39c8c9c21e0bd33cb362db61ba86e5fca762c58fdcda1d7196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704107, "uuid": "b3e0ce4f-3cbb-4f89-a2f1-3a3e39d2c731", "comment": "Malware payload (RedLineStealer)", "value": "607b1aa721853548648fbe0b2d47bfa923e74022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704107, "uuid": "182ab9d8-93c5-4418-b41b-ab14d3507510", "comment": "Malware payload (RedLineStealer)", "value": "d606747d02cd2aca10e9326a1058945b7caf1dc0ffbc5f446cb4d7e8474597f16a9b2ae26f0d76efd11b7201a24af7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704107, "uuid": "1f2e66c0-d6ef-4fbb-896b-04f589410095", "value": "T182452352ABE84235E5B927B089F307530B3AFCB54835635B2780AA1B1EF3254753672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704107, "uuid": "aa483f9f-10d1-4120-b0c1-80dd62982611", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704107, "uuid": "89d36e89-6a09-4c11-b2e2-fc54f7de9a9f", "value": "24576:qyu7rtdTn8ancCiLLyB/2THN3JEUEQvX7fYP:xErL8aTiLLy2THV1X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704107, "uuid": "d523d2d1-3332-4f95-83b2-6e6a5a2f504c", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704107, "uuid": "1b723863-6bfa-48ef-a603-6e6defb59d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704107, "uuid": "333d6226-a5c4-4717-8f09-add9e580fb4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7397f1bb-64dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696660848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660848, "uuid": "4cc87200-2f68-4cb6-8ad9-ee4eb77ee43b", "comment": "Malware payload (CoinMiner)", "value": "a0cf16008c72aa6b647e0de0cd9cb321", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660848, "uuid": "880b31f7-ee57-464f-870b-0d0dd1a2b7c7", "comment": "Malware payload (CoinMiner)", "value": "7093f0c69fabfb504d19ff90bfcfbfc89c0407dc4d46fd6c965118d2f3e827c7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660848, "uuid": "d4f5418d-eb71-41e5-b15e-3b80ace615bd", "comment": "Malware payload (CoinMiner)", "value": "23c9b27bb1da57ec5b115b6dcd132c26b8641a2f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660848, "uuid": "4769f5f3-9f86-4042-8167-957419ee858f", "comment": "Malware payload (CoinMiner)", "value": "7a5789fd3f0cf556948be1b11a5e4fcb70e19d9ae60b1408771eb083dff456f8554c51b14a2647c1521bce3a476ffb24", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660848, "uuid": "11e1905f-71d2-40a1-8f80-13846a888b56", "value": "T1BB547D13E3E07C21E52647728E2EC2E4772EF5618E69B7AB2B445F2F08B11E1D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660848, "uuid": "e774b7ab-f10e-4a8a-9185-22c27fa463c7", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660848, "uuid": "f0f1ff0d-11d0-4d18-9a29-0994e4fdde49", "value": "3072:DMHH9ZMCuP+EqJjvbJhZMTLXg9WKp/+SNzPb+geof2:o9Z7uPBSJhZMTbg9WC9lPb+glf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696660848, "uuid": "a27ef91f-7755-44f0-9bf2-e402d4eb8830", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696660848, "uuid": "acef401b-f403-4216-88d7-edd86bded407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660848, "uuid": "cada67a5-d78b-4bf4-ac55-35c4b1dee0e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0731b3-6554-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696712560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712560, "uuid": "188e1677-3b36-402a-96e6-5558e71837c1", "comment": "Malware payload (RedLineStealer)", "value": "9cc8a680a80daa1e8b0f8e029aa2a95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712560, "uuid": "40444e2b-aa95-4eba-b27f-6e92cef43a11", "comment": "Malware payload (RedLineStealer)", "value": "71580dae1707ba6cf9590f966cb9f3af646f413c2f418de864da8f2148b76b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712560, "uuid": "7d278e25-a1dd-4575-8182-6a68f5794e70", "comment": "Malware payload (RedLineStealer)", "value": "55e98faf01da5ab3777c149c34cafb87492bc6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696712560, "uuid": "9dbf3f34-c9e6-4cbf-ad50-d4427dffe102", "comment": "Malware payload (RedLineStealer)", "value": "ab9cb0bff0e0fe69b5dae59ea165d0c098f8b6fae63c4220fd016fb876a6592ac30656e4335350881cec127a77ac09af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712560, "uuid": "609a36bd-33f1-4a0f-9857-34f69afc793c", "value": "T1B5951A1172FA1B59F9F34AB856BA6621487AFC6ADF15C7DF12D1508E0C30AD08970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712560, "uuid": "46b854b5-2f42-42d7-982d-b4c6a6614525", "value": "ae450531cb5f9358db13baf813ed0098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712560, "uuid": "5355ebe6-073c-408b-a528-2038af691a43", "value": "24576:EWNAiWVXhOFtIBknwPTVa1K6a9DhvhjQ4d2l:ChOFtIioTVcK6a3vhQ4da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696712560, "uuid": "03a9923e-3e0f-48c5-98c1-6da5a7ffaacf", "value": 1938944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696712560, "uuid": "d0e58f19-7a67-4e63-8bb2-409b2dcfa119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696712560, "uuid": "bd98bdf7-8740-47d1-8b69-6cbe0186dc30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd27d067-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671307, "uuid": "b2c18534-0a53-4663-a53d-1c53965ee41c", "comment": "Malware payload", "value": "1df6bc237bc348d3f260886ebef0d003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671307, "uuid": "d9e00010-5cb0-42af-a63b-f71d90bcea61", "comment": "Malware payload", "value": "7219ff17497f0fd381c61c84e2b8904fe830a354d465e7d6759605c0e5185f16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671307, "uuid": "56857c64-54cc-4f4b-8fce-15f2c46bcec1", "comment": "Malware payload", "value": "746c10af0915644a04de327d2f842dec32976e52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671307, "uuid": "08a533fa-9243-46c0-883b-ac3d4f1c46f4", "comment": "Malware payload", "value": "2f86e5074f3302b1b2e5f8aefd12075246de71d7caa8d32f2d5dc77833b32522d7fb7b19e9eb5bfceff2c1eb63f35445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671307, "uuid": "18b4d6bb-93e3-4e14-9a2d-18de1955a809", "value": "T1A0258D11B6E280F6C65919300CBB6776AA36FA0A4F158FC36364EF1D2D331A19E36356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671307, "uuid": "e4725b3f-cb1b-4433-bfa8-8e7c619c0521", "value": "12288:MRkOJbwykcndGUCX+qzPbGg71b4rXggO5Q0:MxDk8dGUCXfPbGghb4jAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671307, "uuid": "f24da624-168e-45b4-87c2-4d28d4e4229d", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671307, "uuid": "cc205f15-9b26-4a1f-963b-24850d40c254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671307, "uuid": "c4431dec-53ee-4242-ba3a-1aeac7fb4ded", "value": "SecuriteInfo.com.Variant.Zusy.429385.27302.17861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24697a3-650e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696682509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682509, "uuid": "e6384559-3482-4d01-8b28-6460ce5b7601", "comment": "Malware payload", "value": "891ef2e163c91056a7d9e6b055805fac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682509, "uuid": "bc561dce-3310-4135-80a0-e58acdb4ef02", "comment": "Malware payload", "value": "722add658d005191ff5ba3cbd61b1c37c072c7a64f4100daf8a2493f0deec566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682509, "uuid": "feee77b6-bb21-4169-8bd2-f3e1587b15b9", "comment": "Malware payload", "value": "a3e73fae909694dac218096f5992aad510918282", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682509, "uuid": "a9b24422-3eb7-4cd8-8dc2-d20efc573b57", "comment": "Malware payload", "value": "542076a494694ae62b8e242190b71ac553699527f68583ba145966945a057d4107727fa28091460e182d6728a3103c4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696682509, "uuid": "31dbe0d3-7c95-4601-9ad5-29e638fc8acd", "value": "T1394329AAB4009E7DF95FFABEC4160A09F524336045930F27A6BBFD932D731649C19D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696682509, "uuid": "8dfc3cf8-7074-4678-9a9e-1fc7a03d6918", "value": "1536:Xy9rOCPCgPhG4kO0gOlIVtr2dnIpLCd8C:XqrOf5W3r9peP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696682509, "uuid": "60386d9c-2671-4ff8-b790-98e56ba92222", "value": 56576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696682509, "uuid": "f436c52c-0ec4-4cb9-b6bb-a848f8ebf69a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696682509, "uuid": "3688ac24-a9f5-4cef-b7d9-6513d797d1fe", "value": "891ef2e163c91056a7d9e6b055805fac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7770e9f-64cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696655486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696655486, "uuid": "7a27c358-3e27-496d-9f22-6768851722de", "comment": "Malware payload (RedLineStealer)", "value": "c3f14e7c4a030e3e04f5a2f39ac47719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696655486, "uuid": "996a8bf2-e0ec-4f5d-8834-cb092062f811", "comment": "Malware payload (RedLineStealer)", "value": "729ced7e1ca8716458e60ca05d15f6ca7edd8b7d2b669fb0c1c85f9455a666cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696655486, "uuid": "e68110c8-726e-4272-b502-3710617ac96c", "comment": "Malware payload (RedLineStealer)", "value": "97b4115f34e85be2299ab6e5d46dd0149fe0210f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696655486, "uuid": "715cb899-d49a-4e5a-8d19-1f71fa83654c", "comment": "Malware payload (RedLineStealer)", "value": "69b068a7212df42ae793f732f1babe89854f4e6c1bb63df7aaeeaebfafe0a86c9096ad4f38376feb9cbdd3abe5247cf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696655486, "uuid": "4b9b8a64-dc5b-437a-bf8b-b5a1b6a16238", "value": "T11F452363A7E14572CDB6377428FB13C70B327C620EB8829B2B915D561DA1BC46630BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696655486, "uuid": "00797106-38fe-4a06-be13-22b9f6786c7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696655486, "uuid": "04c0654e-bbb1-4b21-ada8-04214f4924f4", "value": "24576:wylo/tsb2wpkvzQVPmi5rMSmNzjg/BkdSULqMTyu:3G/tywQVdZMSS+CgULqMTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696655486, "uuid": "8e84f0b4-c7a9-40a5-9c01-de598172edbc", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696655486, "uuid": "7efdfe01-0354-4867-9250-2efed20cfa0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696655486, "uuid": "b5caaea3-ecf2-4892-b79e-f63e713d85b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a032ab05-6514-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696684975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684975, "uuid": "8883decd-202b-4c08-8e34-4275313fbb90", "comment": "Malware payload", "value": "c93ec8d6765cbb012225868d48b067b2", "object_relation": "md5", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684975, "uuid": "849ea1fe-45e4-4ae8-88c7-e3d5fcfcc9a4", "comment": "Malware payload", "value": "753df2f1c7eb08b442236d226c2342a9f8f69939014de633dc9b11f16f7bd899", "object_relation": "sha256", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684975, "uuid": "e2b4a232-5e37-4716-b2c6-3344c3996794", "comment": "Malware payload", "value": "c1a61eeb386aad01a1079af923e9144d9ee21cd5", "object_relation": "sha1", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684975, "uuid": "9c7a5da9-a7a2-4d00-ab86-b374da1b3e62", "comment": "Malware payload", "value": "ddecd9cf0b44a8ac50e5bd5b76e1bf88cce4d24ddbe26d6292951c5fcea97d6eb04bd6143bca87516997a58dc2792054", "object_relation": "sha3-384", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684975, "uuid": "ce11e24c-0d5c-4548-a538-1691051fc84b", "value": "T1ABF2BFC0976D932DDD5200F1A1A3163B35186EF4638F62BEA7C4ACE9553F1D960A5F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684975, "uuid": "31b59301-6e06-4b46-90f3-1b46a03dc112", "value": "768:23hrM+RHAUqYpNSIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:GxMKgLo8LKtd1PBkQD4UtFceWnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696684975, "uuid": "4ae4c7df-3b07-4f21-a38c-469d122bb28f", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696684975, "uuid": "a9b585dc-90bf-40c5-b611-1cdb1c685d84", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684975, "uuid": "705732a9-8a8d-469d-bb79-6b4936c3a616", "value": "2c5640ec5b28ece97d73a22374116fa607b2094bb1ffe97ec1cc71c21f20c178_sc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0511b9fe-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714780, "uuid": "85724faa-065d-4da3-a9e5-8aceb184d56f", "comment": "Malware payload", "value": "96748718dcd5f0b062f37938f51a0fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714780, "uuid": "f5942d42-9e08-4346-a4c7-4ff0c710812d", "comment": "Malware payload", "value": "7796299a047d845ad87b24132b7bb8b337979e3e8abf22d68a9194bf24e6a88a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714780, "uuid": "9851c461-e422-4edd-aef8-9e17e25056f9", "comment": "Malware payload", "value": "3ba0b1bcf944c5f05537180048a2fe21cfc00f36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714780, "uuid": "695aa2ac-ec6e-4945-aea4-8666f5a61912", "comment": "Malware payload", "value": "faca106a65fd9f696fe7945af18044bea6a80d913ad99c587da624244251282be2955e534bc086c9799314076a7dc733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714780, "uuid": "39abb5e8-8977-4775-a427-96fea2cad7d5", "value": "T1EE136CC134804C7BD45372F616AA1EB2BE3119B42760D9D763B06DEEAF60ED18A74723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714780, "uuid": "6f61652c-597f-476a-bac7-6c10243c2aa5", "value": "620197f0e1bacf23fbd22112cd833d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714780, "uuid": "69ec2765-d28e-4c80-8a8a-48a85a12a997", "value": "768:UBp1qOM/rDdS86vrrnoSiK+zLSBxSuGiq65H0WVKs+EIPu2y/gK63+Rklzr:Ub1NLXvrrnofzAxSXiq65HYs+xTy/I+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714780, "uuid": "297d6f50-cae5-4d6c-9d83-e456557f9230", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714780, "uuid": "0ea5aaa2-8564-46f4-a89e-d42f3aba3c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714780, "uuid": "451f1f83-ff43-4b2d-94fa-7797cdb443c0", "value": "SecuriteInfo.com.Backdoor.Poison.31461.8631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d5173b-64cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696654274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696654274, "uuid": "ecf61b79-c60b-4a75-9f73-25cb443ba2f1", "comment": "Malware payload (RedLineStealer)", "value": "40f8c9b783dafe611657de0877078c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696654274, "uuid": "cca1fb58-5ba5-4724-92aa-79fbaf122dcb", "comment": "Malware payload (RedLineStealer)", "value": "7846841f8cb7a26fe831e00ff46e21a7661b1741598f38b1d6ed077a727db700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696654274, "uuid": "1dc2638f-0787-47dd-a6f4-1ecf817ca9df", "comment": "Malware payload (RedLineStealer)", "value": "980b09d52dc6e8c397259f08b710c0ef20f09cc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696654274, "uuid": "0072595a-e58c-4ef8-840c-fbc4460156f5", "comment": "Malware payload (RedLineStealer)", "value": "c2f8bba4642d3082ff8790b2f9854acfb5b6e2f419681c622349ea1c18a23f3d38dad83d97633f9ca32502bdf239923d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696654274, "uuid": "860bcb74-26b3-4621-b73a-7c6a0c001b29", "value": "T1C4352303DBD58031D9A537712CFA07C70F72BEA69B68425B3782ED554E722A4F4363A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696654274, "uuid": "2af61c96-1d17-426c-a2d0-523e0d703452", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696654274, "uuid": "eef6dfc1-265b-4880-81db-36b0becf3af2", "value": "24576:VyB7BQJjDfb6NpLkvyqmtyIaHCfZlvFjeYRGSJ9m3Aylw/JB/c:w1IPONe6qmIlCfZDg7A1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696654274, "uuid": "a0da236f-f4cb-4c18-bd76-cb3a54948b37", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696654274, "uuid": "1cb4f347-765b-4a2e-a45c-63f12c3e9edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696654274, "uuid": "c80c5755-989b-40cb-b150-6078fc5835ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad39792-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671303, "uuid": "9304fec6-2571-41e9-b884-1f4a6a38fec2", "comment": "Malware payload", "value": "17b4277d78411ec43c920f3344ffedb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671303, "uuid": "d53d48c6-58ec-4639-9ac2-149ba7001814", "comment": "Malware payload", "value": "7a94e3cfefdfd7280691d85f9ed723d356e39ebcc4b27f65b263972eb7703004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671303, "uuid": "cad3a174-6755-4b9f-ab2b-c6a078d8fe5b", "comment": "Malware payload", "value": "4665a6504323eb4c7ab3de0c0778dcb4ffc399dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671303, "uuid": "2d1ff972-d28d-4792-b5e7-a5b40578e109", "comment": "Malware payload", "value": "bb82191477905a8308c356e96decdcae1fbd03f3e063a4125b0728274ad46036c2d9e80ddf6be25c7666588975213621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671303, "uuid": "fe70b688-bac7-44f1-87d7-2357c3ed1be9", "value": "T17F85CE29E292C46DE4BA09B18637563D88E9BF524BF2079B17D7CD1D057A4A0CC3B327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671303, "uuid": "5d4ad1f7-6933-4e4f-a67a-7afb6cae3ba1", "value": "24576:yM4dz/ufrMg+aOAVa6g9ffbTEHLfKep9QnzDOe2wi2UtIc9U/324vRLiHXhPh90d:kmfrMgJ2fcszDFgPUfqhPEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671303, "uuid": "3c93b40a-e5bc-4ca2-bfb8-79166f8da044", "value": 1851392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671303, "uuid": "25f7712f-bd5e-4f8f-a4b3-50a19d492995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671303, "uuid": "81d5ab60-834a-4fde-a72b-2129f74497f9", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.17159.214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89badd85-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696720156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720156, "uuid": "a376f156-54b8-4ad1-8953-ca87d09e3b26", "comment": "Malware payload (Mirai)", "value": "fb879617fb46fe72ba254d7467528b39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720156, "uuid": "02a06d56-cd7a-4114-849c-65474644da9e", "comment": "Malware payload (Mirai)", "value": "7ab59a7d5c7bf5d099eebd068f3ae96065cb1eb9556170d31fc9e81f99ca352b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720156, "uuid": "425952c6-0f38-4655-a8e7-a97a574d028d", "comment": "Malware payload (Mirai)", "value": "8e6295e3603bba0c28fbccff027540693b33d3ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720156, "uuid": "aaaf7946-0baf-4dfd-8936-40c83bef35de", "comment": "Malware payload (Mirai)", "value": "fd8bc2b1adde89fbe73374bddd421ab1bc1efded9027f532d109fdf3d2e5d44c31155bce5f6531de46e422c0cecd74f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720156, "uuid": "8253791e-4c14-42e4-bf4d-f5b7adf1a33d", "value": "T140E32B56EB414B13C0D61775B6DF42453322ABA493DB73069928BFF43F8279E0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720156, "uuid": "31d7821c-5756-47b7-9464-77e0399ee3b6", "value": "3072:texYytTENamqrxP7Xlw7Sg6sf5UIyW6IoM/9okz6+9rI:teqydoamqrxP71w7nx3yW6vM/9K+1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720156, "uuid": "6b9518eb-07fc-4afa-882f-c8125b6fb842", "value": 146578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720156, "uuid": "1f385124-dd9f-48da-8039-c9ed48ae5a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720156, "uuid": "c9ca9758-40bb-4730-8286-091042ffa0fc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e785a9-651d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696688714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688714, "uuid": "f5cc1b58-6a83-41c5-84ae-07d6a49e0ea1", "comment": "Malware payload (RedLineStealer)", "value": "058f485bc3d4365188161ee2ca044fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688714, "uuid": "e12caaa2-80ef-4673-aeb4-5e145c49f040", "comment": "Malware payload (RedLineStealer)", "value": "7b0fa8d096c834828531e39e8f42f992c3a4974ab55e30d21cc25c03661f55d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688714, "uuid": "0b410492-c84f-4b0e-b5da-45d3614663b5", "comment": "Malware payload (RedLineStealer)", "value": "c0edc34a9f5750167a298240931306d11a43ae03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696688714, "uuid": "bcbfb923-b399-4d9f-b645-6f763bce745c", "comment": "Malware payload (RedLineStealer)", "value": "9ed1b018995de28c26b3aebb8228e6d8fa4644fc45dd9a6f3965f27885b07112bb9698a45696924cebbd5c76c9730baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688714, "uuid": "d0e41484-537e-47cd-8cb2-57e64b8cd299", "value": "T1E2452312B7E95062E8BEA3704CFB47432F7E7DA05AB8934B67419D5D1C33644AA32327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688714, "uuid": "5ea193b4-659e-4aba-9df0-fee26c951bed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688714, "uuid": "b8d514d1-be70-4b1f-be26-e97f4ae3d5a5", "value": "24576:pyqFMmwi94IHK2Kz8X2PUiPkUY/VGW7h5BOonroB:cqFdwi94IqO2PUiXsVGSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696688714, "uuid": "7576f722-417b-46bb-bccf-8fdc2a4d34d1", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696688714, "uuid": "b351a01a-ba6b-4f89-a6f2-973cb573251e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696688714, "uuid": "29fdaee2-116f-4bdd-8fdb-e41852540b23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49903e77-64ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696675810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696675810, "uuid": "748db588-4e5c-406e-95b4-acf67220e0e1", "comment": "Malware payload (IRATA)", "value": "4634d2665f8349cb126119f5ee6023e5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696675810, "uuid": "1ab534ab-50d0-43de-bb54-ece2dd983d21", "comment": "Malware payload (IRATA)", "value": "7ca2de8ef3f42106fa3a0ba0c7b6d1cde0b30a5374764e4d150982152f9e03e8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696675810, "uuid": "12426b4d-892c-4ef2-90c7-aa4b0a878bba", "comment": "Malware payload (IRATA)", "value": "420dccbf55e94d33fc633f7b0eb41a12c624de77", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696675810, "uuid": "2168d7ed-e0d7-4846-a08f-b9e2a6f98524", "comment": "Malware payload (IRATA)", "value": "950f7863ae91cf2f3fb7d01627f67129dc13d3f280eea1c56fa4373f83a62b8a28e742c372b3eee51e42c08a57021c99", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696675810, "uuid": "982b9d5c-5b37-4f8c-b497-56565c7c7d82", "value": "T177D52243F269A41BC8F1C37225A52A3511374D1ADB43F74A391C73BE2BBBDE80B96194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696675810, "uuid": "be944c82-f62a-4df8-aed4-111275e5e601", "value": "49152:9/jsWXkkbeXfQLR7+2L9Jw7be6SffTeFe2oEkVCBqQyD9S9Mg0gmQIEmrggF1BC+:VBXkk6XfIR7TL9m7K6aek2oElyDz1ggR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696675810, "uuid": "e02985fa-2857-4329-a1ab-99f89996c6ec", "value": 2834535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696675810, "uuid": "0b4d956f-0cda-4e34-93c7-f68b1ada769a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696675810, "uuid": "6f64f119-25c2-49c1-9186-5cd98c2a9616", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1764b7-6520-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1696690018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690018, "uuid": "cd663f3f-d229-4077-a800-c90ba876f6a7", "comment": "Malware payload (StrelaStealer)", "value": "a6178457045cb789280212cb42673838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690018, "uuid": "cbd45f6e-24fa-4b4b-b897-006892bece63", "comment": "Malware payload (StrelaStealer)", "value": "806345cafc7b457a4db43eb7872e1366cada2f75eba357874498368d22591b1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690018, "uuid": "d2176202-e0b0-4323-8611-ee9a5196542b", "comment": "Malware payload (StrelaStealer)", "value": "efcb112c1b8b6a339451f0e22201c5afdf2f081a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696690018, "uuid": "0ca7a6cd-82e8-40b4-822b-483f9cbf4219", "comment": "Malware payload (StrelaStealer)", "value": "2f8282e5c539e5905e9acb46a2338cdba414640ea73a8d1f6421b692b4267c6db1a02a588be2bbed4153093e94fd616c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690018, "uuid": "8bcbf732-c04a-4dfa-9511-eb9a41167efa", "value": "T1E7547D43A2A1BC31E5264B324E2DC1E4772EFCA2DE59779A33587F1F08711E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690018, "uuid": "2bc4693c-844f-41dc-9db9-aa3ef0032565", "value": "4cfd395e0c2ad689fbac27e2423e7395", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690018, "uuid": "0d03ce4f-ced6-4fcb-921b-cfc50bd7e546", "value": "3072:qveiOWDZMHxcA7/YCY/khAnfAnXDALd7WLt64a:qeWFMHxcAY/khAnwzARG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696690018, "uuid": "5f0effd6-67b5-42d0-b5bc-2728e43851b3", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696690018, "uuid": "ac48e5d8-a0d7-402a-ae6d-5e09ec2441de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696690018, "uuid": "21346ee0-2ba6-460e-9824-d7c6bc698389", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95aeadf-64e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696663650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663650, "uuid": "849710d9-076a-44e9-816f-0a3fca9a5bc9", "comment": "Malware payload (AgentTesla)", "value": "76b8e770e43a86225100af1d6c453db4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663650, "uuid": "2a36ac28-509a-4404-9077-bc4e8e024af8", "comment": "Malware payload (AgentTesla)", "value": "807a4939c263c7dac20c558e287011049b23dc998c3dcbf8efb897b25b3bcf26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663650, "uuid": "aae87efc-f4c1-41cf-8c51-89cadf6f3ff3", "comment": "Malware payload (AgentTesla)", "value": "4d26cba976150a545fdc69952fe6313882de2534", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663650, "uuid": "9c1ed3fc-6b59-46b7-9b98-2e1e50a35959", "comment": "Malware payload (AgentTesla)", "value": "a239792a2cf7961187d300616253d2b887baacd224b379203f154ccc2fafd0f1dd03f077d0c1b4353f72d0002fca091f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663650, "uuid": "cdc2254b-d80f-49d9-80f2-b0146b85e8f7", "value": "T196D423373CAA399174E278613AF95B8B1F72B1D627B34102DEF06C6DC54B2075B6A10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663650, "uuid": "ab0c9d8c-893f-4645-a8a2-9ad9e0df0e5d", "value": "12288:15i06UfOHz1KSEW/z4vIArAVtUL2ThnvHkhyqgwsgU1jJB9NzsWhxI+9C:fUdEWEvIAkML2TRHkZlEb/Nzs/iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663650, "uuid": "9e6d0a4f-bb37-472a-955f-15e12240cb52", "value": 650798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663650, "uuid": "1a2eab3f-c001-4ceb-a9c8-1952104d8900", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663650, "uuid": "b5b5fb34-19fe-4284-a6c6-46eb0658a956", "value": "NUEVO PEDIDO - AM0004.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be4c576-64b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696645293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645293, "uuid": "881e9359-dbdf-4430-81fa-0b38da521b15", "comment": "Malware payload (Amadey)", "value": "7ba1c3824b789e54533c70c4debb3375", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645293, "uuid": "1c1d95c0-bf2a-40e1-8044-00109f0f08fe", "comment": "Malware payload (Amadey)", "value": "82cbb7caa8e4d80cccf83eb4e3c557c93044f2d5f39f7db1e4ae60b1a4dd3a15", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645293, "uuid": "c1f37ede-d7df-4913-bc12-cbc5e87aa27c", "comment": "Malware payload (Amadey)", "value": "e433f9c19b7c4ff2c2e86412d21368a7ba3a4581", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645293, "uuid": "f6672620-f093-4c5b-8bfa-8342df72e1f4", "comment": "Malware payload (Amadey)", "value": "6277370388260ab1a2e1a14f870cff141e0b0f2704af1daa7b2788740a9a706cb200573e0a1208444401d98e38151b01", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645293, "uuid": "d4afc941-e74b-4642-b424-010dfa366898", "value": "T12045230297E69166DC3933B0A9FB03E30733BD705AB886523B45DE0B5CB1AA0A575737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645293, "uuid": "7c3f11df-f25c-4fd4-b121-9e6530033615", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645293, "uuid": "d158e83b-58b1-469e-8926-cedadaaa8811", "value": "24576:WyPa4gFHwWiuy9OnyD4m/jLCwkV+zrLwHf99s9YhUK5w4KcwAaI:lPa4gRwWioyDlfCwY+zrLw/ouw4KcwAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696645293, "uuid": "2c5b0444-fd65-41df-984d-6ca7cc7a8c11", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696645293, "uuid": "45da4434-9c8f-43b5-9756-3dbacd848398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645293, "uuid": "4a79da72-08b2-484b-9fb8-718d01f67f85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67bd379-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696668289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668289, "uuid": "34824de7-695d-4c9f-a51a-4f415d680db7", "comment": "Malware payload (Mirai)", "value": "dd32c1d18bd212d79f8b44f3ed3ad034", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668289, "uuid": "16961773-e0fc-4abb-aea6-1273119ffbfd", "comment": "Malware payload (Mirai)", "value": "8400972cb81bd41229a00bd45e3b643d7e86d930bc41c1849dc5c079fd547726", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668289, "uuid": "6003e59d-76e5-4eef-9840-420d82517e35", "comment": "Malware payload (Mirai)", "value": "3a92898552279e895474041a045ad4313b9a0a14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668289, "uuid": "ece1266c-fe2a-4496-9f0c-b7706f273d43", "comment": "Malware payload (Mirai)", "value": "372ce4274911a19869cbaf476ace0ad9c8d46c81dc72da83733697dfa2f2f2f4ca6901275d65324cbfb11e181418cf81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668289, "uuid": "46e7e5ab-bcb0-40db-8ab1-9690882c7f1a", "value": "T1D313F195B5E067CBC24C603B7DBEAC9F8441A306D2604C67EBC1B637E869ECC1A05322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668289, "uuid": "0b06d417-2007-4083-af5a-ea6fe7c0362b", "value": "768:5zViU8OuEAcj/T6qi3w/QwXLpfngLLzjkDTmfCTh9+hZ1H1cCnbcuyD7U0yqH:JV4XQjGLiQEp2LzqfyPJnouy8PqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668289, "uuid": "3e1dfe4c-3333-4393-a7ea-c0d2995aa165", "value": 44600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668289, "uuid": "6449a9e7-9c4e-4d07-b5d1-6bac7388658d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668289, "uuid": "9ed77c41-adfc-4215-98e6-d97702864951", "value": "dd32c1d18bd212d79f8b44f3ed3ad034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bae5346-6544-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696705369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705369, "uuid": "c7d865a2-38d9-46f5-9835-243e135f61d4", "comment": "Malware payload (RedLineStealer)", "value": "54010bc4f89e9bb75204ace5484c3d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705369, "uuid": "098a0088-6b23-4a4f-9d5f-4f1b956525fa", "comment": "Malware payload (RedLineStealer)", "value": "840c23be3bca1e7e9f56449b43cd749bbf1ae171223c0f78911a5f0384d8a029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705369, "uuid": "29bf0ed7-4409-465b-b366-9024ab17fa3e", "comment": "Malware payload (RedLineStealer)", "value": "d8453dbc9d615d3c0b413fc464a6c4a825d37c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705369, "uuid": "ef508f85-373d-4d0d-9632-aa1a5512b1b8", "comment": "Malware payload (RedLineStealer)", "value": "4270b82dd1653f9c187b2ecd5f40f7ca63939da650821c3b388c9a5480c2f9d9f5c17daafb7a9cc8c01121389839a8e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705369, "uuid": "d279b8a8-788c-4467-8dd0-5e320570a645", "value": "T11F3523077AD45937D8F11BB088FB06871636BDA30975975F2B82D80A6DB3A90B13533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705369, "uuid": "1c7ec820-e294-4e08-bbf6-b72ea4dcd455", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705369, "uuid": "0f1f74da-a52b-4cc1-af74-eab1a94dec99", "value": "24576:SyRxZQ5jXXfLml8lUju2642LmkjQew7EACFJ6:5R3Q5jHSpjuwL+QbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705369, "uuid": "6a9061e2-0fb2-4afd-be2f-d23f03cfb535", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705369, "uuid": "a0be8f6a-801c-4fa2-a526-23304b778730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705369, "uuid": "b4824071-208b-4fd9-99b1-725d68556b40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df529740-6544-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696705697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705697, "uuid": "fcfff57b-3121-476b-8094-7d495afd504d", "comment": "Malware payload", "value": "7abdd998bba53910b91abe24a135ce8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705697, "uuid": "0bbe5588-f87d-49e4-ae8f-03024ba06ce2", "comment": "Malware payload", "value": "8462485220bfcba052d89e06bb3eaf38343b92bc246e391050f6019e70dba6a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705697, "uuid": "cf001148-8313-45a5-b408-68fc9e24c919", "comment": "Malware payload", "value": "8f0d72b5457a29d0198187cda217bb50bfebccb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705697, "uuid": "2fb93a82-2f6f-4018-b457-819bd8fb86f2", "comment": "Malware payload", "value": "65a26400256ea6f4e1d88e67aefcf6feada0fac102141e77fb92e3fc32e4f05f1dc59b5cedcc2d28ce6db4d9478609cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705697, "uuid": "7eae45a3-a572-41cc-8ebc-83d651ba7f4a", "value": "T13CD63302FAC04470F1216B79A578D5A3CEFDB9532A7A475FC3E846BC9620AE15231E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705697, "uuid": "4d27b12b-dca7-4923-a3f4-74ac0438f391", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705697, "uuid": "40a7078b-12a0-4e47-9792-9dccea74766d", "value": "393216:TCB0tY01MpTdSXpiEKYI/KEmKbXvD11KMxILDT:TCKupoXp9KN/fmASkILDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705697, "uuid": "fde05385-51a5-43c2-9ab5-e92d4843e2be", "value": 13257052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705697, "uuid": "b8099991-df84-436b-8253-848f286acce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705697, "uuid": "74e93ca3-bcf4-49d9-a753-7393a5f24269", "value": "WinrarInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590da460-656b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696722222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722222, "uuid": "bf66b288-3efb-49d3-8a4d-a3605a5a4b6e", "comment": "Malware payload (Mirai)", "value": "5d363398abef35acbbf418898606ed99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722222, "uuid": "81d5d281-7436-4c9d-ab09-8a317417c73f", "comment": "Malware payload (Mirai)", "value": "84fc42ab3a17ff17bbaba975e40ec41413f890ab2a1e883cf486ae408bbbcab8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722222, "uuid": "49f30da7-e1f8-46d9-8c81-f9c08d33a2af", "comment": "Malware payload (Mirai)", "value": "98c990ae00e2f7786fd17537ada73db787d24597", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722222, "uuid": "faa1f27e-76e0-4e9b-bdc4-e552cfc00991", "comment": "Malware payload (Mirai)", "value": "4929d8a29c3d328c2c4e679b00ed96acdb84c8200fa470a783aaad80880d45de537dab8d8a747b187993ba4e0db60a2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722222, "uuid": "4f4ea6ba-ba26-41ab-b438-eac54d7fd33e", "value": "T1E5439D3AE8266E54C18A417078648F351B23E1C0A343BFB716AAC3B56483DADF904FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722222, "uuid": "6dd50356-2167-4beb-84b8-2a62b5d93d51", "value": "768:VWajVY89Lum6cWGadw1uCpD2mK/t/4GaeoCXeO+C5CWZDfNAnfwEEI:VWahY89ic1ua1K/t/ShCN+C53AIEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696722222, "uuid": "c7acc5aa-1e41-4e28-995d-e0545dcc7935", "value": 55408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696722222, "uuid": "c3afa749-897a-42be-b090-02a5f14ae421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722222, "uuid": "52e23747-a89a-4dbc-8f6e-4f45cabe5e7f", "value": "5d363398abef35acbbf418898606ed99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd6684b-6557-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696713885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713885, "uuid": "e454fc72-a850-4c37-8d2e-477b2101658d", "comment": "Malware payload", "value": "1fdbe8b4d15689aa3d88664929b6fbac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713885, "uuid": "8e3dc613-1815-4492-a496-159bfe25adfb", "comment": "Malware payload", "value": "8655e31b935f2100b47a54fb2a90ed499043d5b0f57fd18e0dcfb71bd51cd471", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713885, "uuid": "ccb9379a-ded1-457d-a84e-f99bcac447fc", "comment": "Malware payload", "value": "971142c753fe42683da806fc330e05dffc646fe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713885, "uuid": "6c6a5145-c45b-498b-bec8-51554f758eb2", "comment": "Malware payload", "value": "146ad2d333a2e577f6f0d3d2cb9eee3b7ca8abf8bafdcd19f471b596ac836817ad06697407825c2e9b1144c7ad00b086", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713885, "uuid": "8eb7b476-70db-4536-8d99-9fef302e6c3f", "value": "T16103F10CD8372549EF9A9EB820ED03415FCE6045B664EDCF87575E88BFB9103BA48878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713885, "uuid": "8b5d8720-2d31-482a-aa2e-176648a178a9", "value": "768:mzZvp81hWmfYM7DK+0iAHry4CAZzrdzZ/oDFKjqPrtaIY464WRY:mdp81QuDKaZVAZHdzZ/+FgisJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696713885, "uuid": "1d9c78a1-3ea5-4892-a056-436df96388eb", "value": 39684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696713885, "uuid": "09156691-dea1-4ec5-aeb3-5a65318bfaa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713885, "uuid": "9d3566fe-2e01-4e07-af6f-1df24d98b682", "value": "1fdbe8b4d15689aa3d88664929b6fbac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b3becc-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671289, "uuid": "84562591-ff73-48b7-8885-6067c9c0c826", "comment": "Malware payload", "value": "070e68008ac71c89c34fc27ea3b0d2af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671289, "uuid": "2a408c2e-1011-4660-aea7-490f7bc8002a", "comment": "Malware payload", "value": "86e3b35754b5a0f450257fa62ad528d0554265bf69db185e5601853d23d8a950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671289, "uuid": "d869faeb-64bd-48ab-a00f-7a2219a20a4e", "comment": "Malware payload", "value": "0508a0e78cf5957e893b4d0250e470a73577314a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671289, "uuid": "4d7c119d-3fa7-4da5-8510-d26d2974923a", "comment": "Malware payload", "value": "5aea2a034790b46a6328c86cb54050ed0a9f4420365160b4705dc4e1907a6696368f3162d194cb1f015ac85b5e000464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671289, "uuid": "7ed87928-0e34-43b3-808c-8fd205cae5ae", "value": "T1BD64D5393FDBCEE6C05D08394CE68A949962AB404F5FC6072B5862AD1D3334C6DEB536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671289, "uuid": "7f646110-d617-4678-88a9-84ef73b3b528", "value": "821c455b475c3595aa1e4e6ad93e77fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671289, "uuid": "86e5b1c8-7555-44c5-a594-01a5b4cae7a3", "value": "3072:XkcyOo8yOSuRtr9ndhjvvpqd8IsNsTbFz9cRf9SvkrckTr6SATct+LAkcUrRLnLb:XdiLAkcUrRLnLMtrfoxSW1cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671289, "uuid": "5aedde93-2b2c-48aa-9a95-7ea560fc3fa4", "value": 320725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671289, "uuid": "f4e452e5-581b-4fb0-ba2d-1931b2287173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671289, "uuid": "fb3d16d9-839c-44e8-b327-c3e55282fed9", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1355761.14389.18303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5599c96c-6542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696704607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "e3699193-6ed5-4a6a-826c-4a380250fc9f", "comment": "Malware payload (Mirai)", "value": "50dd3a8858eeda66a2be3a30485c5c87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "06006907-291e-4d98-b7e5-d607a6216100", "comment": "Malware payload (Mirai)", "value": "872b3442323be1e2714f3fd95f496f11235aa2751f0ad0ef9e57584beb863028", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "134a8f40-a43c-4c67-ada3-8817b97052f5", "comment": "Malware payload (Mirai)", "value": "473f82d60caa6cf24882e25da60520f1993e67ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704607, "uuid": "9aa8b28c-266a-4de2-9a0c-27676d6daa8e", "comment": "Malware payload (Mirai)", "value": "589bb2bf703744a4df03ae58f46ecbeb5b9468122c1b555c91b87f65d89032d6a4c31609619b5e519b3e78648eb84332", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704607, "uuid": "d9ecb011-0c0a-422e-b50b-fcc9beb125e1", "value": "T1FDD35C46FA418A13C4D517BAFAAF4149333297A4D3DB730699185FB43FC67AE0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704607, "uuid": "5a7597e2-c56a-4775-9ca6-e21869d8e0c6", "value": "3072:n0aiBeoGuBLBTdeYiTK9ZjTzDtErmKrHUAMM/9rMYj:0aiBrGuBLBTUYl9ZjTzhEtHULM/9wYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704607, "uuid": "9df9d10a-f281-4aea-b1ae-e25364466659", "value": 136314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704607, "uuid": "4010403e-a162-43e1-ad9c-c7006bec613c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704607, "uuid": "4d2996ed-1f2a-4415-bd54-24c985c36ae7", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d789451-6519-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696687011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696687011, "uuid": "9d6fbc1b-6faa-4c3d-939b-b981f2995f7f", "comment": "Malware payload (Smoke Loader)", "value": "30a5c10202f5091f352cb176521b93b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696687011, "uuid": "1917a2b4-ed71-49fa-a539-448794beeda1", "comment": "Malware payload (Smoke Loader)", "value": "87b5205681aa539b5bb588b1ab1afb06317a89bf306df3f72305dc26b1ce0fc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696687011, "uuid": "f03c56c3-1c17-47f5-9ff6-f21ad1fdc459", "comment": "Malware payload (Smoke Loader)", "value": "4a053cae59c6b635f681afacf61f3e1b8ea46452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696687011, "uuid": "df2be45f-1825-4f6d-8dc8-e1e87e96aa4e", "comment": "Malware payload (Smoke Loader)", "value": "20d8ab205c8e6ff658514afeeefd5e915d641f1421d9797d657a2a7fba82bf23f5bcf3ff6a87be18c76e68c5dcb3f9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696687011, "uuid": "4417b380-affe-444f-9a0e-a080f1769856", "value": "T19D452353A9F40523E97713745CF603A70F3EBEC5A8B452D71796AC0B28726B0663237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696687011, "uuid": "3aceda88-1af3-4e72-bb19-18760a5eaa84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696687011, "uuid": "0177ed6b-3be2-4b0b-8d86-b68cc228191e", "value": "24576:Zy7S2UZqU9IEJX/qz42LC+0pND4oow1+N8tPg00B:M6Zq4JX/q82elbD4s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696687011, "uuid": "14fd0977-ae68-4e90-acf9-5f21c88a7785", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696687011, "uuid": "0d161471-3ad3-4f7f-b2ba-452620d2ccc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696687011, "uuid": "8dc3c80f-0425-4fbb-bd31-f5fe6bc61a12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0710a6cf-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714783, "uuid": "e0a13727-4645-45d1-98da-fb820caab723", "comment": "Malware payload", "value": "1b33edc88eb0056b1cff46f66cf04eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714783, "uuid": "5f3b8ff4-8b23-4f60-98f7-cf3b58a195a9", "comment": "Malware payload", "value": "87c3f7ca20c49702a32d856ec35f865b56dd957ee6abb73b9c12c22c18cacc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714783, "uuid": "9b2a395b-2336-4a1f-835a-b9f1584c4a58", "comment": "Malware payload", "value": "19b84b739b281a37eb6d8f0fa667b132cb5c4417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714783, "uuid": "aa4601ae-a4e9-4d79-af2b-b472d8d9d589", "comment": "Malware payload", "value": "cca7c3797dcd05079150f9878ea1c7ab399b418bae456f65909f7c380c76150d99841af79d081a298287467fd886462f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714783, "uuid": "4fc28557-9cc8-4655-a906-6ba99c832015", "value": "T1D7C53358E9103B79CAB34AB137DD9D085BC66E463DD46062134B33A23BFF8345A3B466", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714783, "uuid": "9a3ebb66-cdd3-42f3-926c-bd6f0d99f836", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714783, "uuid": "356b5e74-1d6f-4699-b4ba-c4f7fb765720", "value": "49152:qfWUxr+XTp0tF7fsK79m35RV0SdUlshub18ftDn4R4/PoGJ6FRKVPg7SX94Wf:qfWUYXTp8eKI35RiSd3hub1cnesPkFUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714783, "uuid": "4b9555fa-28c6-4a17-9f88-76899565e881", "value": 2690366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714783, "uuid": "0952be11-7951-467b-905d-c8eb6db7f7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714783, "uuid": "38eb5df9-b086-4b7b-837d-229dbe0d4c22", "value": "SecuriteInfo.com.Downloader.DLoader.21719.8384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26bedd5-64aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1696639586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639586, "uuid": "945afd3a-6c32-4891-9f93-5f205f6150cb", "comment": "Malware payload (GCleaner)", "value": "1860ebf427dccac7292813bb1fa12e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639586, "uuid": "c589eef4-b643-437e-b78b-d69033d30ff1", "comment": "Malware payload (GCleaner)", "value": "87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639586, "uuid": "972fc7bc-3f18-4583-8c5b-656f11dd8601", "comment": "Malware payload (GCleaner)", "value": "d889765ae93d9543ac9725345ab3814490d176a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639586, "uuid": "1d27fb6b-a811-4a16-bc03-0961e877b94a", "comment": "Malware payload (GCleaner)", "value": "5adbdf81fd9e10719e3afb0b43cc3f5a2209092235073e0bb9fee749174cfeb0321dcd8e457aefe289e315e692b82dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639586, "uuid": "16552440-5761-4fb5-9246-74209b754635", "value": "T17174AF03E3E1AC65F5328B319E2EC1B5762FF5519E6DBB562B085B2B09B00F2D663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639586, "uuid": "91843220-6d0d-4655-927f-dcb071798c35", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639586, "uuid": "d6eb0210-55f1-4680-8f5d-fcfb11f3c43e", "value": "6144:aMGZ2bjyNNGhGwfAe90daIOT7DGDdJtLYL:RUwjyNoGwxMaJQ7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696639586, "uuid": "4bdc49fb-08dc-4476-a69c-8c566e328387", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696639586, "uuid": "0a8e8eee-68ac-4549-8304-b047e0189f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639586, "uuid": "430b0dab-d470-476b-8e1d-eb2792e38d82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6492898-650b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696681200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696681200, "uuid": "fb11dd36-1615-4295-904b-5c019c4a3198", "comment": "Malware payload (IRATA)", "value": "98fa31b6bad3e925742469b2ac9ea949", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696681200, "uuid": "83dcbb4f-3fcd-495c-b52f-3a280b62f673", "comment": "Malware payload (IRATA)", "value": "8a198276e504c169793b01a8ca42fd045670c64f670388076e773c8faa9f867a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696681200, "uuid": "4d2f8277-e5dd-46f1-b662-0c2a9eae25e8", "comment": "Malware payload (IRATA)", "value": "211debe45b6d3c92f631fde1d2e37ae5d449a409", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696681200, "uuid": "7067eb5e-6c0b-42ad-84da-1f4a0ac00a10", "comment": "Malware payload (IRATA)", "value": "f768768a7330aebfba27f395f5c8347806c31f371e6f36919bb441b5525ab9f13b77711847b7df92d7ca71a46de34f92", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696681200, "uuid": "d4b66e35-8a67-4f6f-8c4d-a10eb25467b0", "value": "T118F59D87F7D5A85BC4F3A332817552A6514B4C268B83DF836D04367C29BB9C02F5AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696681200, "uuid": "26b22001-adbe-42bc-acce-03546e03081d", "value": "49152:UPSQWc/ktinEJkJLIET5HrIL/yFgLCrgDaj1WZCssQLL+Gt:sd/xEJkJLpTdgLCrgD018CYyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696681200, "uuid": "a06558f7-eceb-492f-b379-47dc2d5808ec", "value": 3569618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696681200, "uuid": "d0dbf98d-032a-473d-86ca-7ceaef452af4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696681200, "uuid": "102f0091-ea53-4fe6-9191-1f57a483dc71", "value": "dex.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b34399c-655b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696715407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715407, "uuid": "6d11dd7c-ee8a-4f40-a6c1-9ca8f106b3e3", "comment": "Malware payload", "value": "6020def18187ac0881148cd9184f6a95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715407, "uuid": "2ede16ea-4743-4bea-a453-f83ce6d302e7", "comment": "Malware payload", "value": "8d637b037df2b9dc0bbbea4a98c1beb798c175cedbdee10bf220178b49c3c5d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715407, "uuid": "548fc0a8-f7e3-4c11-accc-30982835f750", "comment": "Malware payload", "value": "f4c6336d9f2975af46039c2e3de0194ded3fa56b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715407, "uuid": "15258cd9-106b-4316-b805-77d70b4a1091", "comment": "Malware payload", "value": "937c2b886fb28bd81b456f9aa67cce1f198f09885e9fe91641ea3464d2b8095e733d7a5b579facea71de23e79ec0ed85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715407, "uuid": "8e560ceb-d5d9-4c3c-a162-7f7165ac7479", "value": "T17BE2F1FA6B0F6492C5B02E72DBCA868063574EFC78595295270442B4FFDA0C2EDA1393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715407, "uuid": "cd37df92-11e9-44fd-a3bf-d4f3df8a6f85", "value": "768:+fXLxMgYCPpm/4ir9BXz4VlW/OJFHdPY2R4aIpOZTBt3Uj:8XLxMtCRm/z9BXz4Vl5YK4IBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696715407, "uuid": "3d1367fe-bc3a-4e2d-9385-d4c4a91a35fe", "value": 31904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696715407, "uuid": "d0e94804-ac48-43f8-bfdb-ce3e517cd602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715407, "uuid": "07e5729b-822b-431e-a9f6-48b3a93f9b5f", "value": "z0r0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebc1ceb-64a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696637084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637084, "uuid": "09955271-0646-4285-931f-50ad2d47622e", "comment": "Malware payload", "value": "fb391d0cce99eb4b3d05c621b41c089d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637084, "uuid": "eab27950-205c-42a5-bcf7-2ea43c0a259e", "comment": "Malware payload", "value": "8f544936fdcdde1894510215be22377351decf67e007237dcebb0689b9f6eb26", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637084, "uuid": "b747e715-a97e-4c4e-8ff4-234babe4c634", "comment": "Malware payload", "value": "ce45f19190ebcacc315b516e9d56226f22e33fbb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696637084, "uuid": "9319bffd-9beb-4f57-9175-5b14b827c002", "comment": "Malware payload", "value": "af2a0e500b9009c7d3a2c74e3ef9ffb054ec5e917da8905a05885aff6b800051ddd939d314d289e014af8aa2014b2b9e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696637084, "uuid": "63698474-3498-4dbc-8478-8cc2683408cd", "value": "T1EB949E02B2D44637E5A702315A6BE3614B79FC244B72851F719CBD1E3FB0680667BBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696637084, "uuid": "ce005488-7a04-4cce-95db-4320f12dfb98", "value": "6144:ql0BdnDWYShSozBDu1zSqWH1jVn9nQ/EP3AzxjS4:ql4DWYqS8xkSTH1nnUqAzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696637084, "uuid": "0c8ca612-1e81-426d-a444-936672eb6aa8", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696637084, "uuid": "40897476-2324-4711-8ea5-97d7ef150cce", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696637084, "uuid": "206e9c1d-ebf7-4939-affd-784c16ba4a88", "value": "f890e2264ba23658686ecd43876740d31ca4f670cdd440b2795788de471ba882e133a01cc3da9e9f26b5dbf3476dfec3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5aea4fd-6502-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1696677253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677253, "uuid": "4e2a9076-75f2-4513-a45f-85d417a06417", "comment": "Malware payload (RemoteManipulator)", "value": "18031de0de98a42fde0535a86d1e81ee", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677253, "uuid": "aeded388-7505-4c15-90e0-441fc71f075a", "comment": "Malware payload (RemoteManipulator)", "value": "90cca38c74a458bfc7247d87b266637a3ea867e650d703025b07845d774b5184", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677253, "uuid": "ff98d97b-a538-4a51-8789-423537a96777", "comment": "Malware payload (RemoteManipulator)", "value": "f80a0caf4f2c2d3c528e90270452f6cb2db53bb7", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677253, "uuid": "588cb097-46dd-4056-b467-64ff7924437f", "comment": "Malware payload (RemoteManipulator)", "value": "fa7ba7771fca5cafa247bf8de72c18beee8883241833577282bcf92112b72bebb8fbb9a9206c533db3a8b9a0ab63f238", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677253, "uuid": "eff78e2f-10cd-4bca-90c8-d1a55c5ca527", "value": "T1C966330D52D42320DCFB2BB43CA5535B093B7C414BB4431BA69A9C7A58725EBADB2733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677253, "uuid": "7a03c037-7549-4fef-921b-fbbf219c6ca5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677253, "uuid": "6c415d61-c524-4365-9044-0e640eaa8f52", "value": "196608:KQM3Vt0OravySIOd2vstZAsrK5k46O43JWBM:Aj0OrSj0CZAsrK5k4A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696677253, "uuid": "52988a13-0716-4b78-8403-552c42b39663", "value": 6996480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696677253, "uuid": "0e2b491e-c357-475b-985e-a46201f4b512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677253, "uuid": "48ae368b-5208-42bd-ae07-6bab00ca972c", "value": "BUILD.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08400961-653d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696702330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702330, "uuid": "8a538f2c-818c-4cf0-beb3-2d23b117d846", "comment": "Malware payload (RedLineStealer)", "value": "e9c5b36d7d606477f23c1d7219469d71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702330, "uuid": "7b83fec4-6c0e-4aab-9b70-0c39646a071f", "comment": "Malware payload (RedLineStealer)", "value": "90e574804204b26a7a56a54d56f44660131015bd4f4dbd58e42717634cc442ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702330, "uuid": "0fc3e4d3-ae32-4734-bcdc-9d5b4ba32cc0", "comment": "Malware payload (RedLineStealer)", "value": "f937f68c214b7f3f38c21595de2dbad53e46a254", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702330, "uuid": "eb765924-d5b0-434d-8b5f-8280c0ca7aca", "comment": "Malware payload (RedLineStealer)", "value": "3cf69f09697c220f96ea62c937263b78a24f88c580944b90ae8da320f228cbb8ba48d365e65295fe7918bfee29b093c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702330, "uuid": "df9ad465-892d-4c54-9540-9429ef5f725c", "value": "T1AE844B6CFE6066EEC92083BFE82DF65BC7A665338156435D97D3360DD713076220AA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702330, "uuid": "9b3de315-9d0f-49c2-9c0b-1ca785c43a39", "value": "1bc01dfa698246ac804f970d5000ac59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702330, "uuid": "d661de9e-c3c1-419f-8d93-ed874f192b49", "value": "12288:NjUoRUzA/vZoMecqF2ksaSwRobhNnfwBlZRvB7Kpve2Jg0YBmgMyl361+5XFWQFB:NKSJQmy36yHU9q9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696702330, "uuid": "64690e5b-cbe6-4f5a-b8fc-3459f0e8c59a", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696702330, "uuid": "a875218f-355f-4675-ab48-cf1181ef041c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702330, "uuid": "8f3ecebc-d0f5-4bec-aeee-50ef3fae3ba6", "value": "e9c5b36d7d606477f23c1d7219469d71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d0ccb5-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671299, "uuid": "8ffe628a-9a9e-4c14-a23f-3e9d3523bdbd", "comment": "Malware payload", "value": "ee6fdcaafa7812341f8ffc774eb174df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671299, "uuid": "9ce2490e-2692-488e-880a-372b60bc76d9", "comment": "Malware payload", "value": "912c7862289ed0e63f8617f075c9479d90190e3dd1b5a173ae43cc58d95c5b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671299, "uuid": "292b6ebf-853d-415d-8409-60215f922418", "comment": "Malware payload", "value": "18dd64d375aecf93b2a0fd5083ba92579a6bf086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671299, "uuid": "1987eb03-aa5e-4421-a143-7af74dd473ac", "comment": "Malware payload", "value": "a95a20218c2e64a75aa226e3c20d1f3822222a473eeec81b11703f993c8dfb9718f992a8c003e178a8808635ae10885f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671299, "uuid": "578eba24-5e14-4fb0-a0f2-567421c2ab41", "value": "T1A0C2BF3A539A02DCFEA46E7511D92DF35926F5624902928F32C00D1FCB776DCE98631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671299, "uuid": "441454b0-60a1-47c6-aac6-01f9d9c9745e", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671299, "uuid": "300f07dd-dad2-47c8-9891-dd6e8c8c84d8", "value": "768:CR//5pzhAMbwBvF7QceDSjbjPoMU4Y2O6:A7FAM0LQqvPm4T9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671299, "uuid": "6f5bf882-e918-4795-8617-cbfc8341a161", "value": 27652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671299, "uuid": "d22afa9c-622e-4750-a677-96e448d12fed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671299, "uuid": "17eb9978-b0b8-4a70-9cca-ba40002ea454", "value": "SecuriteInfo.com.Trojan.VbCrypt.96.16835.8046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b859fd4f-64db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696660534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660534, "uuid": "65d126cb-9c07-49fd-9b14-118defe8cf8d", "comment": "Malware payload (Amadey)", "value": "97db5929795af713a29da7ee311097b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660534, "uuid": "e91bd94e-cb7d-42e4-a115-4502769f3bae", "comment": "Malware payload (Amadey)", "value": "913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660534, "uuid": "ccfc45d4-e3c5-40de-924c-dfcf7b4efa81", "comment": "Malware payload (Amadey)", "value": "4edbba98c44d3e0871144507e076afca15bb34d2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696660534, "uuid": "47b3c61a-26c4-4194-b3fa-780c09ad7e2a", "comment": "Malware payload (Amadey)", "value": "5881c70b8387df9ced37bc507d7f72eb3e00e1d34fb1216ed6165b8df6e895a9a7bf837eafdf192d9358c6720a2abc0a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660534, "uuid": "c0063ef6-bb23-4fdf-9c49-4f63e2840068", "value": "T14F352302A9F8E832DC772BB019B353C31B32BCB14A74D7173B85AD5E1DA2A51A531727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660534, "uuid": "2e578054-79bd-4600-ba4e-133d18a55c2d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660534, "uuid": "3ab5e47b-ab99-4574-a36d-fcbc78b19979", "value": "24576:lyLFc4gILHSFdApaMPP+3jauS/PHOb7LnssG3Ge1:ALMLdM+zauSHYst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696660534, "uuid": "d4b202bc-b658-4c6a-8200-4d39486ccea1", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696660534, "uuid": "db2d2d0e-e573-44fd-98be-2553b5b52253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696660534, "uuid": "0fd60d22-c161-42c1-a035-533226ec1d35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43652e05-64df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696662056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662056, "uuid": "976ea6de-0f9e-4939-952c-576c1759455b", "comment": "Malware payload (RedLineStealer)", "value": "d0f37ca66179f1ed279745d5d73e1b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662056, "uuid": "5d149998-e038-42ad-86c4-027877e94169", "comment": "Malware payload (RedLineStealer)", "value": "93745272364a8000241c359553e46db0356ab76208024ce69fb7d7351c1502bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662056, "uuid": "6f5dd4b8-8ab6-4d3b-804e-e8861970cf7b", "comment": "Malware payload (RedLineStealer)", "value": "cbb61aa8b456e1fbfc52bb34ac420fd7b7276acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662056, "uuid": "483f3d61-90c4-4bfb-a3c0-7cfcc8591df4", "comment": "Malware payload (RedLineStealer)", "value": "f6aa6eed1b5b62c2e20177be5ae8d2e6ca767887cc0fa9b55940955fca8eb2b6550756530f24b82db74940dbfa4b22b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662056, "uuid": "8308d13a-5af7-4a22-9fa7-c05df7f7ac45", "value": "T1BF452303A7E84032CCB527B15EF712D31A31BC928EA9C35B7BC2591E5D72AD0A925773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662056, "uuid": "3245f0bb-469f-4199-9da3-c2691b9b0679", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662056, "uuid": "04e868d2-bff1-49ab-990c-ada484d9f749", "value": "24576:TyBpXX9MTmHCVA+9xEX7Cx43BoKNdS7MxoIBdkVQMCAYVsiW1:mKTms9xw71xoKNdSUoqMCAYV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696662056, "uuid": "62954c94-3659-4871-a67c-16f61e49f5a0", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696662056, "uuid": "2ee5f421-f84d-424e-9d91-c965e792b35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662056, "uuid": "6a51f298-3b1a-4f6b-8a19-72838d53013b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb8cf3d-64c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696649507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649507, "uuid": "dc4c6af8-875d-48a6-b3d8-8b07feb2a21f", "comment": "Malware payload", "value": "46da7bdea73f8824a20572dcfbbd0d81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649507, "uuid": "71289e7b-ebfc-4222-bdf0-de96993721ba", "comment": "Malware payload", "value": "93974f79a69f5899bc24788a5064b3f4663a12179cf6e8cb9e7781470c0b494d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649507, "uuid": "120d03cf-386f-4cda-8916-aabe237f92c8", "comment": "Malware payload", "value": "02d19f47c470e99444fe5ddab353196fad72f265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649507, "uuid": "59e4fadd-2dca-4456-bf3d-c40992b466f8", "comment": "Malware payload", "value": "39889596ac6acc22c3739515f51e5af306a665a989111ddfdac105a086708170e38f68b47118ea3352f51b86d542fc24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649507, "uuid": "751851df-192d-4d0d-a4ec-5bde8385f982", "value": "T1E1B34A46E9819B15C5D61179FF2E518E33230B78D3DBF2128E195F20AB8B95B0F3B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649507, "uuid": "9e959fe3-97d1-41e3-a616-8e7da5c29006", "value": "3072:WL1/jJaUuciLks7PII+tILagQnJi1oZi:wrEUuNkSII+tea5Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696649507, "uuid": "dbb4b696-4767-4abe-aad0-513f4ddaf3b8", "value": 117364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696649507, "uuid": "f2a90778-dde9-4238-adfc-9e8b688e27c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649507, "uuid": "dfd3d8dc-975f-4192-854d-da3e1048b69b", "value": "SecuriteInfo.com.Linux.Mirai.4306.25591.29286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1149d4c-64e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696664925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664925, "uuid": "5d1f24c9-62e0-415b-9c0d-a07c0abe6770", "comment": "Malware payload (RedLineStealer)", "value": "296f35d62c2257cd413d51f024c75a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664925, "uuid": "3d685b13-80a9-447d-ae75-c1f33accecfd", "comment": "Malware payload (RedLineStealer)", "value": "94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664925, "uuid": "7046dad1-5a41-4199-91d2-6c6607dc8080", "comment": "Malware payload (RedLineStealer)", "value": "e82beb9695d098dffce98113c13b740cfdc3ff89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664925, "uuid": "b005da29-2ee4-4b90-a036-37bee4f872e7", "comment": "Malware payload (RedLineStealer)", "value": "9398b626db8014c5a52eeb41c35d3963f51819611d8ff6e19fed0a19ba3286907ab46280440e9aab2e75797813d59ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664925, "uuid": "322cc6db-af23-4575-a6df-a619ba8c3729", "value": "T197452312EBD44573C87827B058F743AB1F31BD65463883973B82BD2F0D72696A13276A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664925, "uuid": "1376f468-a057-4b17-9010-42b2c936390e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664925, "uuid": "c6638dc8-5fcb-4bbb-8085-02d0df3ae637", "value": "24576:OyxDRxeJHNtApa0ti0Th+01D6FhmtuIjqCn34j+qBr2EtNFQZ:dnxelNtApxi0Th+Ughmk/Cn3WJIEbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696664925, "uuid": "6781999d-968c-4ef3-9787-89d624c4d4a2", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696664925, "uuid": "19561abd-3c7e-49f0-94bd-96e270739b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664925, "uuid": "1c9d401a-37c0-4535-a1d7-c35a11d83758", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028281ac-6525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696692012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692012, "uuid": "8f5c595a-06f2-4f96-a987-52a7f307a2dc", "comment": "Malware payload (RecordBreaker)", "value": "b6a79214394a0cbdca1a79bb7f3fbfda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692012, "uuid": "ae6d760f-5bf6-45ee-bce4-f99b39ee2ba8", "comment": "Malware payload (RecordBreaker)", "value": "958722fd42177a0b4655b7a8d6e1b7fd205e5ebfc22255fc0f2558eda1ece0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692012, "uuid": "c5b6f175-c49f-442f-b8e2-c15173420f41", "comment": "Malware payload (RecordBreaker)", "value": "52c51f61cd3ab9597827162c3030b6fcff39ae9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692012, "uuid": "81485b4b-75fb-42a7-b22b-e791fc3faa9a", "comment": "Malware payload (RecordBreaker)", "value": "b27fbe7a5112d5fa51f8045d284256a8382d460a16de273cc04d99265d227144ca257be01a676e34720f3fe868f99e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692012, "uuid": "9a9ab806-d394-476d-ba5b-48df28546864", "value": "T10E367E64FF501127EE83536B9CA14591A63CD111F702E224E59E036DE6832ECD3BEB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692012, "uuid": "8f4752dd-dbd6-4b59-884e-7372e7d74550", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692012, "uuid": "b5c24d08-3008-42d6-982d-107b1f00be0d", "value": "49152:Z4VIxoeQOSWFdin2IVvjm/yw3mAa3/jFPP+EhEyh3cow384AEDiJUdoKtYlQuWpP:Z2IxoebxdOKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696692012, "uuid": "ea1bbd67-480a-4c84-a4da-9aa009f46459", "value": 5001185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696692012, "uuid": "d1fd9e53-5b53-487b-be8e-fe6eca8e261a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692012, "uuid": "092eacb2-8f6e-4d8f-b04e-abda6443c3d4", "value": "b6a79214394a0cbdca1a79bb7f3fbfda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d510cb-6543-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696705270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705270, "uuid": "d507ecc5-7bf8-4a9f-810b-1388a5d1d781", "comment": "Malware payload (Mirai)", "value": "ea43fc9050245ba0931d14f126f19bf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705270, "uuid": "fadd4a88-946c-4eb5-a647-3f0c8e02ed4c", "comment": "Malware payload (Mirai)", "value": "96be9d7b349eee1e7832a089a1d9ed99890a6f5ae77dd540fc35117f39872d1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705270, "uuid": "60160438-e987-428e-ac8b-04da5d4d73aa", "comment": "Malware payload (Mirai)", "value": "a2e3984389247a4c05242e79a59f07295b64e76c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705270, "uuid": "94201f32-3d93-4add-8ece-f93ec95edac3", "comment": "Malware payload (Mirai)", "value": "a6e046a0d410f331418c9849095147a4ee14d698ce0c1892acfdc8ace922ddd30627fb4bd130fb6734b1f3e7d3822742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705270, "uuid": "38e10680-55d3-47e7-afee-a19720094f87", "value": "T14B53E681B8819A17C5E422BBF96E018D373563F8D1DF3216CD216F6476CA82F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705270, "uuid": "ed77277e-6848-4ea0-992f-8d924ee3a051", "value": "1536:ePkVxqFS5J+DNMvh9VAQhAZAlG9WXiYbd13d42+:ePW1RlAZEG9Ai+d1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705270, "uuid": "ea4fc690-8eeb-40c7-beb0-996523e86ec5", "value": 64376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705270, "uuid": "002f17a6-609e-4cbb-87b9-75a4b5670656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705270, "uuid": "597a67a5-e833-4b0f-8866-e30ed7a0ef6b", "value": "ea43fc9050245ba0931d14f126f19bf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc287e9-6543-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696705295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705295, "uuid": "ae07bd56-baf6-4da9-9ac2-70a798260002", "comment": "Malware payload (Mirai)", "value": "7d6091fed6e14606ef7163a1003e9c94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705295, "uuid": "57db48e3-5fea-4390-8cff-b0d859857114", "comment": "Malware payload (Mirai)", "value": "97bb95c7841f174b68699a41122a567dec2bb64ec055d2f4ff08c9b6a4b62fed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705295, "uuid": "a6fbf600-3899-44ce-82a0-8c79a840bbf0", "comment": "Malware payload (Mirai)", "value": "6ae7b8db12ccfa9d8f517d7fcf1a0169668b86b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705295, "uuid": "da3b8bbd-b04e-49ff-aa36-ef9657b3ac45", "comment": "Malware payload (Mirai)", "value": "e016a7f8e888d0424343de8cbed04bbc804daec6df70d08513c6af0d8f684797ea5ac09692e5fa66229722372ad1652f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705295, "uuid": "3babfce3-af60-443e-a716-1bfc98df60da", "value": "T17F337E36C87FADA8C5448638B8214A342F63F50481A7AFFA9B8187655047FFCF6583E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705295, "uuid": "f091e3e3-ad98-4d8e-87a9-b8aa8b1dbe31", "value": "1536:JVcvDdIszISNwtd4IFZLxRYOpVu3yf0KAtCE2d42+:UvD1zISNFwOOOyf0KIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705295, "uuid": "05be5eb2-7694-4440-ae22-160d2a066efd", "value": 55112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705295, "uuid": "26592eb6-cded-4dd7-ac8f-43d66a3151dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705295, "uuid": "ec2d96f5-ad9d-4635-9f18-eb3be664a9f0", "value": "7d6091fed6e14606ef7163a1003e9c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02833c72-653f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696703179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696703179, "uuid": "3e09aa7b-99e9-4a85-8f98-80731f527103", "comment": "Malware payload (RedLineStealer)", "value": "b67a74f1967a14ab53be707c2bd10b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696703179, "uuid": "5cc99a69-845c-47f8-a384-a0f2d5a4ecdf", "comment": "Malware payload (RedLineStealer)", "value": "9873fe7b640a6df3dcfd19acd91f99b3586bae538bf527e0fe9b2e0619bdca5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696703179, "uuid": "59042b8a-f95f-4c49-9b3e-697fc9babdde", "comment": "Malware payload (RedLineStealer)", "value": "196ab308f036ac9bddbe051a8180a0fdf93372fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696703179, "uuid": "d5b30bf3-e35d-4397-bbd5-a783b6cbb163", "comment": "Malware payload (RedLineStealer)", "value": "41bd6e1238b5be1e25041273bbf2d45430a5a8d03f89705a5c633c527188ccc7cc64bc1dfe45f056db0e22a0274715e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696703179, "uuid": "c622b079-dc35-4d6f-bc5d-75de94cc6b12", "value": "T196452302A7E854B5DCFA2BB054FB03DB0A3A7DF55DB643172342E84B19B3684907276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696703179, "uuid": "2d308d1c-df5b-4011-8e32-e3dbdcce7be7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696703179, "uuid": "bc320269-abd3-45a0-82c1-83ef45c694c7", "value": "24576:FydjRUPvefQucGci1Pn4VEIQTxA+6MQk24fRz1iBYh:gUneoucGcdbFSfRz1kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696703179, "uuid": "98872082-97f9-4dcf-9372-8e6acd4a834d", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696703179, "uuid": "e6077806-7e00-452a-a9e7-1b8c0314446d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696703179, "uuid": "69d7313b-9f50-4da2-aa10-4e401adc4354", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428348ad-6523-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1696691260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691260, "uuid": "d0a42b14-bc1c-481c-be18-0c96efca3320", "comment": "Malware payload (njrat)", "value": "68ba6d9812051a668115149f195b1956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691260, "uuid": "0f03b953-84fa-479e-a568-3a4630eb0368", "comment": "Malware payload (njrat)", "value": "9877fc613035d533feda6adc6848e183bf8c8660de3a34b1acd73c75e62e2823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691260, "uuid": "7ecfeea0-9686-441d-ace2-bfb1d76b2a59", "comment": "Malware payload (njrat)", "value": "e106690c140bbf6de3e12f5cecaae1a4da3eac21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696691260, "uuid": "a1213c48-7d29-4d46-9eec-3397231b0e72", "comment": "Malware payload (njrat)", "value": "906535598cfbea696298586bb0db666182930384ded61e13ff2b2b7967d33beb69b1c36d1c2d286c345b81247e1a7273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691260, "uuid": "8eb97d4d-d162-4466-baa3-602ec1cc2fa7", "value": "T198E207467BE94215D6BC5AFC8CB313214772E3838532EB6F9CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691260, "uuid": "5208935b-17c6-4d0b-8653-bc22b0324e2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691260, "uuid": "ae96a3fe-d72e-4697-9855-ce1efcc7cc85", "value": "384:80bUe5XB4e0X5Ob7w0Q0mS03AWTxtTUFQqzFZObbt:pT9Bug455dnbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696691260, "uuid": "0bf83b41-fc84-4d3c-aa38-19ce7254e5b0", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696691260, "uuid": "3d8e387b-6033-4ee8-9731-d3e6511f0afc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696691260, "uuid": "531d6266-8887-4b3f-9b7b-9efa379964fa", "value": "bQ0v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb5d441-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696720160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720160, "uuid": "76d8f430-8dfb-44a3-a934-024190b97f63", "comment": "Malware payload", "value": "9758ab9d649d7cc477a6a4ebc578d1b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720160, "uuid": "12a0510e-8969-4501-95fb-1cac8871e3da", "comment": "Malware payload", "value": "9c62bc328a2e2dcccc238b94b0d95e6e0f115b8e3976b292764f0c6bb48b19bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720160, "uuid": "34c995da-a6ff-4d9f-be53-33578d9167df", "comment": "Malware payload", "value": "c26116356091cd9e8ba6037f964aaac2e997102b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720160, "uuid": "4780f264-7980-40a5-be0c-2cf1f1dc6fc2", "comment": "Malware payload", "value": "80737528919ba8eeb103361051047d00add3c0dfe576b9dfe18a671e289c43241de3c41a4272d91be3459f3ec8c58397", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720160, "uuid": "b40e6a9b-ef08-40ff-bebd-277d05856ebd", "value": "T114533A55FC819613C5C5127AF69E068D3B3663E8E2DA7207AE225F20378B92F0D37E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720160, "uuid": "91f889ec-0f7a-42bf-9ff9-170b0ab9d7fa", "value": "1536:qpcyZmjwrynLkZkpMPxcdvFyM0HXUy7dUE:q+ycUo6PxcdA3UWUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720160, "uuid": "000b2401-f0c7-4b44-8b5e-9078a60991eb", "value": 63040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720160, "uuid": "4f084fd7-a469-4cd6-88ce-8124024e9ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720160, "uuid": "e43ab866-3a75-4302-9039-b2abd6b295c9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5795f478-6530-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696696879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696879, "uuid": "8555c405-e995-4062-8423-547e52860d20", "comment": "Malware payload (RedLineStealer)", "value": "4818a5792e8bc82da501991c05e25066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696879, "uuid": "07bf437e-4f59-4dea-a334-609d55b0fa2e", "comment": "Malware payload (RedLineStealer)", "value": "a1da11e6d5799b905f7f39799a63be6c9f1b9eaf7166737ac384c843fc0db448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696879, "uuid": "aeaf9e1b-4fc2-4fa2-91d9-db934aed3621", "comment": "Malware payload (RedLineStealer)", "value": "23385012508199431ebdb3ebc12d67bd44d1730f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696879, "uuid": "0302d557-c566-4d74-a1e4-c86ac1d931cc", "comment": "Malware payload (RedLineStealer)", "value": "af55220d89c5408458bff1138f6fe6befaf030111211fcb3b5790a79cee48317b1d9406e100252110d971ca9617a66d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696879, "uuid": "e1809fba-3db4-42ba-a374-3cbb9168e2dc", "value": "T1C9548E03A3A1BC61E5664F324E2DC6E5372EFC91DE69679633187F2F08710E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696879, "uuid": "223754a0-8e39-491e-850e-6898e0917c9d", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696879, "uuid": "df050a5a-93cb-44e0-a1e1-a6e800ff4afa", "value": "3072:OZl4auNstWCHe7LptK5sOcEDFOEWMNGnsxSn+w763/4a:ylphWYe7Lp05SEDFzWzsxe+EO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696696879, "uuid": "01917090-6885-4b82-8828-6000e8b844df", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696696879, "uuid": "84baa26d-2e91-4328-b31c-375fa755987e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696879, "uuid": "74e4ecf4-d899-4d70-aaec-81dbf0e6898c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e035a7e-64d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696656544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656544, "uuid": "cbe1b157-d6c8-4952-a47f-2ae901103d00", "comment": "Malware payload (RedLineStealer)", "value": "f646c097913ec9dc3897ec3b5e452919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656544, "uuid": "1def1dfc-74d7-4e83-8407-603ef66eca0a", "comment": "Malware payload (RedLineStealer)", "value": "a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656544, "uuid": "f7bbfa58-33e7-4bfe-9f06-03336212f0c9", "comment": "Malware payload (RedLineStealer)", "value": "0948b7d2f5b0ebcbc5c3b7c8ef29a271abbfa93f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656544, "uuid": "43f4ad2d-5dd8-4173-9acb-9812448980a0", "comment": "Malware payload (RedLineStealer)", "value": "bd407313c41067aa89b731d87b10edc1fb6fbf6e1f612fa424c92803b106964be90915a39fbe6a50e2cd13cb6597467f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656544, "uuid": "31532672-463a-4a4e-ac5a-1127e6072c34", "value": "T158844B6CFCA476EEC62082BFE825F65BD796A3336157435907D3344DA71307A220AACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656544, "uuid": "8239284d-584d-44c0-9b93-3d16bbd9e653", "value": "562e65e023e87b36f1380397f644b9df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656544, "uuid": "6dda8f0d-e493-4170-8b18-b3408a4cffd3", "value": "12288:kDoSU8AcJIoxecqF2kTJFLb1ChbNdP+kfXuBuKUv0HJg0YBmgMylojOPcoDYyFtz:kcFpQmyojOwUPXzqSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696656544, "uuid": "ff9e2fa9-c763-42bd-85ed-abb69c4bea39", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696656544, "uuid": "6c287928-1b50-446a-a61b-2a3df7b4374a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656544, "uuid": "95eee059-43b1-4f03-b119-176e46eba0e3", "value": "f646c097913ec9dc3897ec3b5e452919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6e637c-64d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1696656788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656788, "uuid": "f4d3cbee-23e6-4e1a-ae94-ccd3bef6b565", "comment": "Malware payload (Fabookie)", "value": "428f02bcb39dd6f73493dd55f55e263e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656788, "uuid": "a6614330-1e59-42f1-968f-7faa2ebcdef9", "comment": "Malware payload (Fabookie)", "value": "a302bc1bdfa51e0ff8433b56c231a42e5bce39ad47b7346ee8e3c33e359d55d9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656788, "uuid": "9b850851-f583-4b70-9924-ffa0fd94a21b", "comment": "Malware payload (Fabookie)", "value": "0e0ca90f5559dbfa6d67be821543a0d659b45074", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656788, "uuid": "7b7bd406-40c4-4693-acfe-5ca8a99faef8", "comment": "Malware payload (Fabookie)", "value": "f1f456b65059945f9738cbeb4c7d1794abda2e9c57043dbb28e2beaf93baa65ba6bc23e5bc68dd374747f7ed61ed18af", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656788, "uuid": "2bcdb6be-f595-46e3-877d-7067e6bf3970", "value": "T1C0941849FB7408B6D096C531CDBE8376E2727C831B25930B8641FF6E2FF36216969681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656788, "uuid": "ee723275-10f0-4c67-af41-87600cc88038", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656788, "uuid": "dc6c2c24-0d70-4545-8099-0eb75314e87c", "value": "6144:syUa7AQnwciHMc4oiT4MKBz3I8JiGxerEhgVIXFM:sf4wcAQVrKi6BerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696656788, "uuid": "81c80c76-6a94-4b98-9ecb-e5792f47ed08", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696656788, "uuid": "37c74a02-2c36-4a9c-b297-896cce94e8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656788, "uuid": "1724ed17-b3d6-43aa-8591-87c56199e710", "value": "428f02bcb39dd6f73493dd55f55e263e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da78abf-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696720163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720163, "uuid": "5a8aff05-c6f4-4eea-b763-160ecdf0ce46", "comment": "Malware payload", "value": "eb71eadd47581a14ec115cdcbe741563", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720163, "uuid": "095f6a8d-b15f-4173-aadc-21fe2d5a9d89", "comment": "Malware payload", "value": "a46a758cb57622d7ae3d145224f3d6fa276a7290554c2b533390dae432e1ed05", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720163, "uuid": "aa537600-b4bd-4e3b-bb86-084794470373", "comment": "Malware payload", "value": "3bb92cb5cb762c846202de6e90d2d8ef621cd118", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720163, "uuid": "1a91297c-31bf-4a89-aa3d-97bb7b91a3fa", "comment": "Malware payload", "value": "9f44796303a20b0cae1b1cdac92d39554d403c5e11e5c7c7fd5ad21f2f218846d41300d28bc77e0cf1eed200e6b3ce2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720163, "uuid": "7b454852-9ff3-422a-bcba-e7c2e82c3c8c", "value": "T1F283A61D7E228FBDFB99823547B78E259B5833D527E1D681E16CD6002E6034E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720163, "uuid": "f7baa79e-e0f7-4534-9452-8eaa3f141a51", "value": "768:AOzUpCBNGPGV2VgjIUTsHqiKP8RC4zWDGfZHlohmLxdwyceFeytPNzwUKI/6Lw:7vzz2yj2KP8RC4iDGpTtdfeGPN8UK6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720163, "uuid": "ddea42da-4ef1-4f74-a113-6dcf104b2888", "value": 80820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720163, "uuid": "892cc0ff-640b-41ae-97dd-0887a7e66405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720163, "uuid": "b63ce454-0131-42ea-9fd6-5073e892f6fe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0274d1c1-6542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1696704467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704467, "uuid": "dcf412c2-478c-43e0-b341-7924954faa1f", "comment": "Malware payload (GCleaner)", "value": "304bd02b2e8e3a13c51b44667e69a894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704467, "uuid": "8c1334fe-db83-4093-bf1b-df4e40ae10d0", "comment": "Malware payload (GCleaner)", "value": "a4f2367e3e2e9a8ce919fde4522d4a347e30fa7625ff391b082a5c830acb1a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704467, "uuid": "2798b907-3400-4f56-832b-25473d674546", "comment": "Malware payload (GCleaner)", "value": "34782c16874728a9468a571083cb14e21d8dff6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704467, "uuid": "274d8c6e-5cff-44b2-9ae0-45e27b75d16c", "comment": "Malware payload (GCleaner)", "value": "774c23d170391a0842d49749527f4b4d4a4c4d4516845140b4e14b82ddaf0c53a9661a6ae8290815a57ff9a857185f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704467, "uuid": "30e744fc-9e6d-46ef-a796-5abf98103099", "value": "T16F74AF43A3A0B871E5664A324E2DC2E4772EFD91DE5D679A33247F2F08711E1C563B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704467, "uuid": "b6342cf9-02e9-415e-8fda-ebca94258a4d", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704467, "uuid": "cdc6e89f-90a4-4fa5-82e4-2c20c12a5f23", "value": "6144:k0EWCvjU/uoPJ8lJiY307qyhtv1J0zYpY:kOajO+Mt34B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704467, "uuid": "db439a4e-44ac-4cdb-98c3-91f6f0c0e417", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704467, "uuid": "3d741dc4-1876-46b6-8446-6b615fdf77b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704467, "uuid": "9a6f3b07-caeb-4a12-a8ca-bfcede5c8738", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b2f59a-64aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696639268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639268, "uuid": "87e62efb-f253-4aad-a727-89f731f637af", "comment": "Malware payload (Tofsee)", "value": "88e14c83a39dd3ff770bcb080bea0815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639268, "uuid": "f4447113-18e8-433d-bd70-59f98f96df13", "comment": "Malware payload (Tofsee)", "value": "a559d42362dbf95f455984bf685ac5a6c5b184ec8b4204cfd4973bda07e84d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639268, "uuid": "fb582f99-e4b8-48da-81d1-ed10c8be50de", "comment": "Malware payload (Tofsee)", "value": "7b3aa418d0939409f73b951fd0394bf2d9f5330c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639268, "uuid": "d6a7875f-45ea-4820-8029-4f33a9a52847", "comment": "Malware payload (Tofsee)", "value": "fb769fc156daccad1a7be4113e8bafdeb8d702e9d0ba7a89f44731cdf298c17a5a68caf818b8cd2e56462ca6f82bfd48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639268, "uuid": "2d4e9468-4d59-4f7a-8514-6eaf32445652", "value": "T19F547D13E3F07C21E5324B729E2EC1E5772EF5618E69BB6A2B485F2B08B11E1D563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639268, "uuid": "0d0baa18-1ee4-46ff-8e33-cd5674a50724", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639268, "uuid": "748cac6d-538f-4868-b984-8c13df528c70", "value": "6144:+BZXxk97hkypOpLcheAJXUFoakILRpUq:KBk97WypOpLcoAGFtVdpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696639268, "uuid": "41954678-9810-482f-b60a-f1ea576dcd78", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696639268, "uuid": "9bed78e1-fd2b-4d28-a0fa-fefc10f8af59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639268, "uuid": "36adf0d7-d2b1-4b7f-a948-eb88f7851f8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54608cb0-64d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696657360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657360, "uuid": "cafe7710-bb0d-4132-afcd-7f521f30059e", "comment": "Malware payload (Mirai)", "value": "5bcdd9aaf0e846e29ae1e49da8dd46f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657360, "uuid": "eda288ba-9926-4f25-b360-f07884a05be2", "comment": "Malware payload (Mirai)", "value": "a5f8ec77d9b03c86757e91eec8a059a9820ff4508680915bf0b296b1900e1348", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657360, "uuid": "29838057-46a5-48b8-b47e-a77fcdf57af3", "comment": "Malware payload (Mirai)", "value": "91bfaa5826fec735ac27e124e0aae43e508d1808", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657360, "uuid": "2a89c2cf-eeac-4ae4-a5bb-286fd9b5a628", "comment": "Malware payload (Mirai)", "value": "87507265413e51247268a9dc1b9309a4b76f09a32fa3ddec7af7c461ae70131a9ee84889a2cc3190d2ff9be1395ba705", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657360, "uuid": "dde94ca6-a913-48ca-a4e8-bbe648c50152", "value": "T184632991B8819613C6D1127BFA6E028D3B2613E8E3DF72079E225F2137C696B0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657360, "uuid": "d436b60a-2cc1-41cf-9836-ebf133531cbd", "value": "1536:lZFltOm9joVzraL/KrVmoQ1zvTgWTC3wrqvLW3:lZEBEF1zvTgi4XL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696657360, "uuid": "cd61b4e1-a4ce-4842-8c24-6c7e48d37a4a", "value": 66904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696657360, "uuid": "53e02e41-a7dc-466c-bee2-c957311c9061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657360, "uuid": "afe77ca8-eeda-4638-92c1-518b62138a57", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9300a529-6531-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696697408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697408, "uuid": "6d681691-1d74-4d63-93bd-368dde86a03e", "comment": "Malware payload (Mirai)", "value": "02f79281abebced0b21dcc16c79e4a26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697408, "uuid": "0857a2f1-66e7-41b7-8fdc-ebe2a7db0111", "comment": "Malware payload (Mirai)", "value": "a690844e93684f85c5a6efd6bc0fa0d9aedc0febb5d3c352ee37a8c1965578a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697408, "uuid": "858e545b-7459-445e-8309-7e79ab109223", "comment": "Malware payload (Mirai)", "value": "d9bb9ebfa3f7598e514eb1b2fdb8b2c5669fa1cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697408, "uuid": "1f232787-9d13-48d0-a589-58f3498e24cf", "comment": "Malware payload (Mirai)", "value": "401932bde18b5c0415cb5cce73a4cd72b5bb62f9fae0a14dca757262c33e97600b148d5ee8461aafbd22d3250e856457", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697408, "uuid": "2a743ca0-bbd5-43a3-a3ad-2b3420b70e06", "value": "T162A2E12576A32D65F3ED2C3CC96A831BF9661BFC80F5327579405620C90D24A3E3DA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697408, "uuid": "d6d2b6d2-b7e4-4f99-9e29-32715498b713", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj0hymdGUop5hU:UvQn4j+ZO5fKAlxos3UozS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696697408, "uuid": "fbab95dd-9984-44f1-a301-ff33a5316464", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696697408, "uuid": "a7a9f6d6-3d94-4501-b41b-2b117056b8fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697408, "uuid": "790a1276-42e4-4b91-9ca5-5f8b08af8dfb", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1181f0e-654c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1696709109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696709109, "uuid": "b733e254-b762-4a86-9b30-7a2100a28fb2", "comment": "Malware payload (RemoteManipulator)", "value": "f38747053172b7cbca4bc5d1590667e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696709109, "uuid": "4d0ab227-565f-45f9-a9c3-28edaa844139", "comment": "Malware payload (RemoteManipulator)", "value": "a75e96ed243f0a45b2262b426241d0afadab4cca25635d789d75a2187bdb5a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696709109, "uuid": "1ad5ba5b-6a30-4083-9bb2-e68c85740e46", "comment": "Malware payload (RemoteManipulator)", "value": "bc9865ec689ef7fcf7c7f0ac1efd51bc1a3db4e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696709109, "uuid": "24c5e896-c92a-4531-85fe-6bd5f6b0e5bf", "comment": "Malware payload (RemoteManipulator)", "value": "2ea5446e3ade4e2b1e9c7e4db4ca9fbd99f1a223dedf5368fdc9c0536670d7746f05f03270e8eb0c058e41179f9e0b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696709109, "uuid": "81594c52-b5ae-4df4-97b6-ad57eb6c6395", "value": "T11F073352EBE18825E4FB0B7A89BD1B18173B7C8859174BCD0395F2398C7A34199B17CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696709109, "uuid": "dbb79b2e-66d8-4533-a2b4-fd9d817232c1", "value": "51d1f6a548cbe091a440204f9bfeb14e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696709109, "uuid": "dd641fd7-1b14-4735-a39a-fe323a584c83", "value": "393216:nuDuLKdaU5DhSEehVzL0wIK4PfksLAY3NbyopsjUNMSy/:t9UihuK4P8oANi8rSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696709109, "uuid": "be4f55ad-4f1e-4f63-9875-f6caf0480c74", "value": 17742848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696709109, "uuid": "429117af-1f84-461d-aa36-1bc835c6fab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696709109, "uuid": "2cdaff43-a5e7-4371-b4ea-d08375cb7f34", "value": "A75E96ED243F0A45B2262B426241D0AFADAB4CCA25635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e61fbb-6542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696704609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "1c19d75b-f349-4bdc-827a-63f8cc4b8391", "comment": "Malware payload (Mirai)", "value": "355c7a9a2065232bae1577ba5db82008", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "05c0c40b-35c8-40ea-9989-87cfd54d0c43", "comment": "Malware payload (Mirai)", "value": "a892025c6945de3ec208e7e6f92575a2acb30663825efa1ccda564453c43f4c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "ea80c2ca-a9e4-4d86-9c5c-a14422a5363c", "comment": "Malware payload (Mirai)", "value": "160510635ec55e3800643d06fa80b9c396fc7805", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704609, "uuid": "eefef48a-4578-4eeb-9efd-52f194c314be", "comment": "Malware payload (Mirai)", "value": "4748357af0f5ff034d3bdcd13bfbaacd64f3140ae75e2b301bddd1364fde3c6d0146903462222538e35b556421db15ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704609, "uuid": "9be9f94d-e544-48a9-be39-7a17b951a79a", "value": "T141D32B82AC51EA16CBD117BBBE1F208D330167DDE2DA7142ED141F643ACE95B0D3BA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704609, "uuid": "e5bfd5f3-a15f-4f37-ae9d-14a990916e1e", "value": "3072:nYkU3DRvJnD49YanhcZNru84h3Y/ZGpXM:YH31mhc7qY/iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704609, "uuid": "eb463141-2f8a-40de-9f6a-82124cc22fad", "value": 136268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704609, "uuid": "5847db6f-812c-41e3-aa2a-9302b5ffcd3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704609, "uuid": "8abf6d61-63f6-4385-9cd1-7300758a39a6", "value": "yourbiggestnightmare.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae88ae7e-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696668249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668249, "uuid": "4212efd1-a145-415d-acf2-def36bc0bc12", "comment": "Malware payload (Mirai)", "value": "26d5437d039a28100212a6a485783f48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668249, "uuid": "7944c52e-1e68-4a72-86ff-1a745935bb70", "comment": "Malware payload (Mirai)", "value": "a9e41dc276362d284a8d0151bf0f7406fa8f7f38098aa8887ed1444d342cdc5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668249, "uuid": "1d429035-79a0-4764-80ce-5230de9e169d", "comment": "Malware payload (Mirai)", "value": "176ccb2d3969f97e4158939a55e41670e998db1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668249, "uuid": "15dc8de7-343d-47a5-aca9-a616536c226f", "comment": "Malware payload (Mirai)", "value": "2949b7e9aff849e2bf1c1320c500ea5a2debd77c26d9841f76b778bd2dd8c556ba6be9e6208cb5466d2e0eac334a2095", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668249, "uuid": "861fcd8a-07d6-4be3-af47-8db80c5e35a0", "value": "T11313F20187FD4A88C05DE23E1CFF2A5A2905A01DDE450DF22F58339E16DB7703B99B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668249, "uuid": "1ac8408e-b333-4340-bb6f-f27de90ba13c", "value": "768:4ryy1i4WU+3HDWPlgz2E4W/b7BuffxtsY2oERPWlCS39fMBMa1YBakef+6Zz7tn+:4Z10lqP3EtUw/Mlt+Ma1YBvu+6R5nouC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668249, "uuid": "f6f98c94-0ef5-4583-bc64-baae709af7ce", "value": 43424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668249, "uuid": "58984003-b79c-411b-8e3a-7847b58ab7f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668249, "uuid": "ca7fa78d-0c0b-4a52-97fd-46233d97b8e0", "value": "26d5437d039a28100212a6a485783f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bdd5dd-64d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696657414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657414, "uuid": "280548a6-41b1-4994-b228-ef5a75a1b218", "comment": "Malware payload (Mirai)", "value": "48a73fadcef5ddf3c938842dfd3e2f04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657414, "uuid": "d2fbfff6-e8de-4eef-b713-3690fb838c6f", "comment": "Malware payload (Mirai)", "value": "aac0ad1db2ada17ee8dfc969b1a7181c85ba56ff5ae3f73d6cbbd979949e2aeb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657414, "uuid": "0b5e8458-9da3-498b-a78f-2f068b3c2dcc", "comment": "Malware payload (Mirai)", "value": "111616f0ba65c08c7c066bc60edadcba206fcac6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657414, "uuid": "e08e7b85-12d4-42f0-bcc0-763f4b602808", "comment": "Malware payload (Mirai)", "value": "6158496ea1f555f41732ce2d5d0c4beb6d8e9e95fab10f9307d5ea2c3b347283ab829f06b95be58000f1d41aaff664f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657414, "uuid": "094d50b7-7ce5-470d-83a4-108937980aa9", "value": "T1C083D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657414, "uuid": "a36663bc-f868-47f1-9d6c-3495fc54b262", "value": "1536:iVLyu95KuNkj752dCexuV/8UZlDwfkJ4MYfWX:iVLyMgdFezxu5VD1em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696657414, "uuid": "34314cdf-2ca0-4e3a-9afe-47bc3de7d12b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696657414, "uuid": "be102fe8-e286-447b-9851-d5053d6f2302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657414, "uuid": "2a2e2816-37d0-4b2e-8e30-4f0a3cfa6e38", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946ed36e-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696720174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720174, "uuid": "8d6bbf27-a18b-4cc9-aa31-6cb38aa3e048", "comment": "Malware payload", "value": "87699d8bf134dfcd3e6aefb96efb6bf1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720174, "uuid": "4d602405-d9a8-4347-8cb5-429ff5d495b0", "comment": "Malware payload", "value": "abea96d6f05d906d408afdbcd045fbe4d016817f3135f8590a037e3a3ac1ccc6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720174, "uuid": "507d12a7-8d83-4863-91f8-4032cec712c5", "comment": "Malware payload", "value": "a5333ed2a2490476bd07a116732ce778bbc59bf6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720174, "uuid": "ffc82399-ffd3-459a-9fc8-9ce739d2a349", "comment": "Malware payload", "value": "8e92e904a021ffbd15fa98cc1cf4094719b230b43be4eb887a601b20ee836cffdb2889d6c4168b965dd6184b45a8fdac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720174, "uuid": "776c2dc8-7bbc-4117-9b4e-d90713d1e350", "value": "T163532917B54280FDC59AC1340AAABA3ADD3374FD1378B2AA6BD0FB226DC5D615E0DC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720174, "uuid": "04948d62-d79d-43ff-b466-7518c5d05329", "value": "1536:MVLJS8cRiZJ0iQ/P6Lw2DRYFID+2jDRpSFJ0yxdefTok4w:UV1yYJ0i6P6Lw2eID+ip0THefTf4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720174, "uuid": "b3244b85-5f79-4f15-b556-2cd503c73b42", "value": 63776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720174, "uuid": "e9f5ba19-b345-4e65-a91f-22fdfcf9d90c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720174, "uuid": "c9f2eb2c-8634-4dfe-8426-a81a15bb4ff5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf7b540-6557-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696713880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713880, "uuid": "038e76f6-a452-4c82-a611-d067f48ec988", "comment": "Malware payload", "value": "dd480c2d2b264c55e6e1476cc118612b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713880, "uuid": "bc5a5eee-0e7a-4805-926c-0632ff92cf28", "comment": "Malware payload", "value": "acb4dc2cb8b010b4914d4fc617adc0678089110e779b077d092c846e7f868081", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713880, "uuid": "164401d8-fa10-4695-83be-900e7848c676", "comment": "Malware payload", "value": "8238ada12dd744492744d7c3df4ab452a161b7c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713880, "uuid": "a25fedd6-6e64-4eea-a972-ad59baf71803", "comment": "Malware payload", "value": "e897d16843d0e268e7e4836423103ce5eed3ed69104f27191f84af82c40b9b0a5fbd9c6fed36f3c3f2cae7e63788a21b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713880, "uuid": "6f00c82d-ac88-4b05-8cc3-fd54d56bac30", "value": "T1C203F1A18E86B130ED152EA4FEDC42CF818CAA7EC336756B1F3C4A7CC681846E5F0116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713880, "uuid": "7fffcd89-7406-4dc4-baff-7922804ce6fc", "value": "768:23xagPrixA4v2YxWztDW5T6DTWt0M3iLloCDHgTcrOXDxe4q3U7Jc:23xCrudC9AWtq+61rwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696713880, "uuid": "c4a67c6e-fe16-4e3a-aca8-c1915363476d", "value": 41012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696713880, "uuid": "5f3e1e27-665e-4d4f-acad-492f2364e483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713880, "uuid": "63620620-e480-428f-a66d-e90135904c69", "value": "dd480c2d2b264c55e6e1476cc118612b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ac38eb-653d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696702357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702357, "uuid": "3edd9ec6-cf66-4a74-b462-777cf7ea9bf2", "comment": "Malware payload (Amadey)", "value": "e1b5322c68f0f203022862310572ecfd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702357, "uuid": "65ccb868-020c-4bbf-ae5d-80a0d13009e5", "comment": "Malware payload (Amadey)", "value": "accd1b30ac3771abe7ea74f3861b197855681d69b46b2ab2fd588681786d4ada", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702357, "uuid": "ba708113-63b0-4762-8046-4d7f2b147e0f", "comment": "Malware payload (Amadey)", "value": "ebe826746c8f4fbae34fafc2ef557ca47300b4f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696702357, "uuid": "637c933e-92ff-4b84-b9b2-2f9988daeb26", "comment": "Malware payload (Amadey)", "value": "40e296498b4e6ef85c68c1c3333a02488e906aabe122c86bb6dad6d1db047c237c5b380127bf4ebe782bf8a7ca4c1e33", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702357, "uuid": "15f8600f-d198-432f-9a37-057d568e7003", "value": "T147352322AAD4A473D5A93B703CFB07C31A34BD935938579B2B54AC2B1CB3494B435B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702357, "uuid": "af13b4df-9c35-4100-bcf0-21fff3aecd95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702357, "uuid": "f3383d35-4dcc-4361-93ae-b46eea478c46", "value": "24576:ky9IXS/32VRQTYuROT+QT3V036NzMmcqT:zmif2VRQT4pzV036NzMmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696702357, "uuid": "5b2586b4-cc89-4920-a609-ee54d864f0ca", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696702357, "uuid": "3f25b953-e938-4e33-91dc-1c941441d6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696702357, "uuid": "311177cd-7c89-4210-8410-d90eb2d2c732", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793afaca-655b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696715404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715404, "uuid": "567f2ff3-e11e-4e85-ab79-0adf76613d08", "comment": "Malware payload (Mirai)", "value": "31beb1080e65b5be2ca358bbe378b1a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715404, "uuid": "824ba76c-7176-4eec-983c-c4627b7bc3b5", "comment": "Malware payload (Mirai)", "value": "acdae055535004f2d762e4c82c1737f45e3fb0e6711714dd50e0c5d54330f250", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715404, "uuid": "fbb89944-094d-49a0-9248-d1a683288dc7", "comment": "Malware payload (Mirai)", "value": "477fa888129069b0aa884467a6bf8df7ae5fee93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696715404, "uuid": "baa7fb72-6917-4e53-a300-20b2bad22ac7", "comment": "Malware payload (Mirai)", "value": "bf5b4c8fd4ad993f950cc7fad8a0b67542a811dd5b37893aa9d6e3652edfc933e3ad0be53362951562a35bd2b6bf74f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715404, "uuid": "922f52b8-9eaa-4c7d-99ae-ef133ebe48a8", "value": "T1B5430292BD3DA336F7733E2EC41A8186D48F5B25D84857243B1AD59BBF3214113EEA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715404, "uuid": "737fd584-9aab-43f1-a9c3-4faef8c726b5", "value": "768:hzCc9NBGcF2HsmjPpAS4/cOXKdn/EaTGBL+Shyq3UI7nPsygjuKNAr88JX5YSEwq:T3TjCPr40oKG4M7PNqLNiXSSEcwbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696715404, "uuid": "7461ea23-b4a7-4265-bcfd-4e0c296911c1", "value": 56056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696715404, "uuid": "fefe1845-758e-498a-8cce-7ab84cfed1ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696715404, "uuid": "732a97f8-5eba-4965-8e8f-42c8f218b472", "value": "z0r0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbd4644-6566-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696720161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720161, "uuid": "0fb1a986-6c8b-43fd-9b85-9521aa9c46f1", "comment": "Malware payload", "value": "c915e15438c6b933e7b37b6909656ba8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720161, "uuid": "d36dc095-3dc7-4e9b-9e47-478ebaff4864", "comment": "Malware payload", "value": "ae85b3c4ab37df48e2b49abc778fa787bebf7945a5b4b207ce67fac488672b8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720161, "uuid": "e823a23e-802d-4813-852f-0cc77ca9cb90", "comment": "Malware payload", "value": "e1ec2f69d200a63c4b2875b41aa8bc086a574ed7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696720161, "uuid": "0179d0e5-e1e2-44e3-a58a-561f8d95e589", "comment": "Malware payload", "value": "fb294b662e66cbfbb9a0641d41dc813492b55e38bee3ea8650f821c7b2e17ad2d7cbed0ca7795a95f698c41f7b555ce9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720161, "uuid": "c9d45b68-e1f0-447a-9bfc-495a59dda8f3", "value": "T1C883C609BF610FB7DCAFCC3706E91B0534DC554A22A87B3A7534D828B64BA4B59E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720161, "uuid": "bd3be59a-365e-40b5-a3bd-4000d325dd3e", "value": "1536:fajByj9njlY9Of1Zyeu9ZBlKUXQjhUuj:fbthyZ9X2hUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696720161, "uuid": "872a1d8b-1346-4763-b3d0-bf5d0bcac862", "value": 81396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696720161, "uuid": "85e55dd3-004b-4fae-a984-60c840787fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696720161, "uuid": "353aab0f-c57e-4c6a-b049-9012db396dcf", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f6d6ae-6565-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696719853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696719853, "uuid": "a9e3a74e-c7f9-4bb6-acc6-0464b1852729", "comment": "Malware payload (RedLineStealer)", "value": "e91e9805ef1526c2250fc6811f2faeb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696719853, "uuid": "4a95c34e-1764-49ec-a324-800c7174b497", "comment": "Malware payload (RedLineStealer)", "value": "aee12324d8576a0df5b0e4d4c210dc329ec4ce378e813134e6b856b23a060b3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696719853, "uuid": "a222d0bc-e6e5-46b4-a4b0-ad9c2ed86840", "comment": "Malware payload (RedLineStealer)", "value": "7968d02a7fc5763490d8fa1fb677a080b05a1b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696719853, "uuid": "90988994-31eb-4d25-9081-291092fe6145", "comment": "Malware payload (RedLineStealer)", "value": "ef018157b9fb9e669b485cf40872771ec04b5da8d9616cbcf006f3e32974f3aa5a29cbf33b3b478060e315bdc5f9bd9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696719853, "uuid": "a3018181-cdbe-47d1-a6d0-e1434d9011b3", "value": "T1D99533039AE59027D5FD2F3014B607831E3BBC43A9B5935F2796A88F1EE2380A47536D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696719853, "uuid": "6230b887-63d6-4409-ba77-2d2cd254e9df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696719853, "uuid": "18879d39-e2e3-43d5-8c49-2d7ea5f98b73", "value": "49152:D56gsuAw7/hB6bWiwKs+xDSKSci86nWDOwZfjhZyCsyVc+6N:t6KXhw3nZxDSKSHW97hQCs1ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696719853, "uuid": "c687dd77-1ec5-4c22-a11f-a79dfee131c6", "value": 1901056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696719853, "uuid": "aa73d34c-2998-473a-9eef-df89415ee291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696719853, "uuid": "bfb7e75b-058d-4523-b613-655fe62c2da9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a41530-6561-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696717943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696717943, "uuid": "1a45973f-50a8-4b09-b1e8-dfa4cdbf8c55", "comment": "Malware payload (RedLineStealer)", "value": "1678f1f8ef7ebd09951b66884728ec0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696717943, "uuid": "f3bcfb49-7f0f-4590-a9a0-d7dad6a9866c", "comment": "Malware payload (RedLineStealer)", "value": "af548543ad7798feab9da2e809df4707c7d46768a2dc3b391b762bb543eda40f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696717943, "uuid": "d1fbf09f-3c6f-44e8-9acd-06c5aac68aa3", "comment": "Malware payload (RedLineStealer)", "value": "a802258d1c65fe513e31efecd0bff3b6dc983d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696717943, "uuid": "7da8bb01-0a18-4d54-869f-ee356972e356", "comment": "Malware payload (RedLineStealer)", "value": "1142632a716147ef8362d454c41b731b167a87742664fc35a2eee3477eb6cb92fa0828048977dc74ab5b09772c44eeda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696717943, "uuid": "45fbe396-b1a1-4d2e-bea8-dbc9506c19c4", "value": "T196952347B6D58037D9F8573024F202C30232BC9A657996AFB643E95A897384065BBF3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696717943, "uuid": "446992b1-48bc-432c-bfee-9be01c058e20", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696717943, "uuid": "148ed706-056f-4ba0-a3c2-343328968f78", "value": "49152:hKX5Ydn5i8G19tbFwJfmjtZM+lXOgid7gwVnyIldGdk9DOl:w585i8GYJK5OzfAMdckC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696717943, "uuid": "d7e9841d-c59a-4eec-9868-8bffe5d27bde", "value": 1882112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696717943, "uuid": "c0c38099-5502-4666-b285-c2b55ea58791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696717943, "uuid": "e8795212-f51b-4b30-bb84-c1fb751e6b05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b8b7bc-6545-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696706057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706057, "uuid": "2a2582f3-7c3e-4059-8e35-036610185b8a", "comment": "Malware payload (RedLineStealer)", "value": "f02f7a0b3d402a011da0c663c7bb5648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706057, "uuid": "5d553496-7cd8-461a-a1fa-8cd5616e4651", "comment": "Malware payload (RedLineStealer)", "value": "affe7a0e3150b5dea208e2464cb79b334e63087c764aa69f12b8e70b40471182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706057, "uuid": "393411ff-7f62-42e0-b96d-69b8a8c3e463", "comment": "Malware payload (RedLineStealer)", "value": "421aa88b2c9cf308f59cecffc90cd5d35e05a85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696706057, "uuid": "d2fc138f-be04-4096-a31e-0c84a861ccb9", "comment": "Malware payload (RedLineStealer)", "value": "3e0c9707ceaaf9eafacba0ad11869cdfe19cb252fd61cc9189b8669eb1a4de0b5c0db9e1b5bf4ca8cc4111155764a406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706057, "uuid": "3b36292f-71b7-405b-8e6b-b11de8c7d3f0", "value": "T123452206ABE94633E9B833B0C8F6039B0E717CA619B4DA672B418D6F1CE35857831757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706057, "uuid": "dbdbfd63-607d-42b5-83eb-667da0bc2c7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706057, "uuid": "97bca3c0-79f3-403d-a5f3-3be72a306e11", "value": "24576:YyyJPj2s8pCM9HNSOR90AdfejUCAEiGj3srAnuPWvOtXp9t:fCbQ7SORaAlMUCASc0ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696706057, "uuid": "3cff241d-9a4c-43aa-b79d-c46f557a7c74", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696706057, "uuid": "801cfb52-73f6-4710-9328-17013a6dfe8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696706057, "uuid": "b709fdd3-9efc-4ea5-b445-da9d6d55f131", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fe2047-6511-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696683698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683698, "uuid": "d19312b1-b44a-408e-9c84-53db06c9fee4", "comment": "Malware payload (Tofsee)", "value": "047d0c046d71614770223115c027a520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683698, "uuid": "64a87b5f-58ed-4621-9348-4763e9e527ac", "comment": "Malware payload (Tofsee)", "value": "b097031bfb9e285b91f6f9e7db246d54184df73bdcac2daaac7527d8db4aaa60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683698, "uuid": "602fd2d5-077e-4578-9d3e-2e2adb484f8b", "comment": "Malware payload (Tofsee)", "value": "9f26d906c9dd4d6075824e228435c01ea0990b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683698, "uuid": "91b1dfe4-12b0-4e8e-9da6-ce2aa7433f65", "comment": "Malware payload (Tofsee)", "value": "9e4a1c25a86cbffa8efffcf18513b8889b6b67fe90af4515a6a3a270bc5de2364bc84717b67747863da790f2a06f8234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683698, "uuid": "49fe9880-f191-490e-88a9-67e240830efb", "value": "T124547D12A3E0BC21E5265B325E2EC1E5772EFC91CD68679633587F2F08B10E1D663B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683698, "uuid": "6068d54f-e93d-4a86-a56e-b5435edbbe70", "value": "4cfd395e0c2ad689fbac27e2423e7395", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683698, "uuid": "e6dcf8ec-5059-45ab-9d28-60d9df47f468", "value": "3072:KXC4OWozMH8UsmvjZ0Qy2vPej77GI+tTXvobD7itPS4a:SQWSMH8uOQvG769t8LAPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696683698, "uuid": "8295dda6-d9da-465f-8ec8-da749b4699e1", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696683698, "uuid": "893ec737-8e33-4e56-9f2e-06f6cf83b470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683698, "uuid": "054ce88f-5393-4f4d-bd39-dcd487de35c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f194be-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696714784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714784, "uuid": "9caa3655-c105-4d53-be74-83f24aec54dd", "comment": "Malware payload", "value": "0d01312113f384269b563141f330c83f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714784, "uuid": "159d3680-9b10-499f-91cb-8bc78ca5f2a5", "comment": "Malware payload", "value": "b0d53fb5bcbe071cf9748f93a13a9067c52615f7257f3e6025567c180f094849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714784, "uuid": "b2161757-a85f-45b2-9da8-bf7e56ec3916", "comment": "Malware payload", "value": "7e1a70489aa0467b872ebf3996270edf41554f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714784, "uuid": "2776fbde-9d1e-46f1-be06-36b0f9873fa6", "comment": "Malware payload", "value": "d305926db1ea7bd8c15dfff7220327374f94fa6e1701d3675b296571c011a676f600ea5df3839ec3482a60b190b33f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714784, "uuid": "d51148fd-15b0-4ac5-a95b-c7f750fd7349", "value": "T10416239DEA5187B9F5DA293208AF063E64357FD48B9FD18D9328CFA4843BD70E510782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714784, "uuid": "4ee87def-99de-4da6-a5a8-e6b2ab5aff51", "value": "43064c3f26ad08fbdd86b66cff92ab66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714784, "uuid": "714d77ec-c31f-4022-a6cd-e962105dac95", "value": "98304:X7+S7Uw6qSrXT8TWHoS7Uw6qSrXT8TWHxmd:XiS7UwHS7TuWHoS7UwHS7TuWHxmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714784, "uuid": "6abc6651-b849-4394-b0b0-f556092e680c", "value": 4237246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714784, "uuid": "388db26c-7a9b-453e-af3c-7cbd7e27df3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714784, "uuid": "ecc7b0a3-d323-4552-8fa3-f749c69ff226", "value": "SecuriteInfo.com.not-a-virus.Patch.4687.23896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4caec0-64a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696638153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638153, "uuid": "7742b7f7-9a22-42c5-88f5-2203c961fe06", "comment": "Malware payload (IRATA)", "value": "c5d68490bbda4773ea03caff9f264428", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638153, "uuid": "46ae3295-f536-46e1-9336-4ffbfdee4a84", "comment": "Malware payload (IRATA)", "value": "b1820179fc4818e3939b63113ad5ab22efde2ebae63c1002fc7d90debb59061a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638153, "uuid": "07e7f4a9-50ca-498f-a7e1-e043fee80d1a", "comment": "Malware payload (IRATA)", "value": "ca97d89de7334b9c4b1bb7c6329ae40619edaea0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696638153, "uuid": "71b33f1c-97ce-4906-b27b-f7c883f6a334", "comment": "Malware payload (IRATA)", "value": "cd6c783f9e0fa9c64c75dfd7a34a3f06eb3fddd883f1549b78502b007dbcdb2c75a36b43c4e7ceb7034c2fe6430ae736", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696638153, "uuid": "aae54c28-717c-49d3-a28f-acecf9fb3d35", "value": "T1FEE533D1E882D431F92B0537C195D0B3ABD480FA1A49EB266F5C809D5CE6C925B3FF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696638153, "uuid": "c13d2a38-4430-4aaf-b8b9-4a915ec9f06d", "value": "49152:NPagnrYa6oETBHR8HpolpZRh6zLI/ZwvRZswTxFavs9h3vWyPgLYMJvAkldZHs/p:NPn1zETBRcilzR7gmQqvs9hwJvAk7p1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696638153, "uuid": "184b6cfd-4d36-4092-a124-42fb2d7be4fd", "value": 3118599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696638153, "uuid": "9ab8a095-150d-48b6-829f-2ba7e5a64f09", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696638153, "uuid": "9bf9ebdd-b91e-4d30-9016-1572cf436863", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afea1c6-64d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1696657398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657398, "uuid": "17352a4d-612e-4490-8331-2e68e3c4c13e", "comment": "Malware payload (Gafgyt)", "value": "15c15fc923e9596814f02e63a01d67da", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657398, "uuid": "84c68459-d5b1-45ef-9c71-c2e1a83bcb27", "comment": "Malware payload (Gafgyt)", "value": "b205219763ed4edae6fcf05d6e4b1bb6e480af8454d4a72520ef9a8b98a210d4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657398, "uuid": "a0394464-03bb-495e-84d0-77f80b5b5a57", "comment": "Malware payload (Gafgyt)", "value": "3ca28b04e8d9291f7e9a8a014cda9817ff8f68bd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657398, "uuid": "e4f04c0f-7824-4592-bf7c-6470837a38c1", "comment": "Malware payload (Gafgyt)", "value": "97ef1cb9b42beb73a24e0d882e15dd97b217bfdf402e8580a56999872542f917e056e4eb52d48409bab28d731cfcbfde", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657398, "uuid": "3fe64f86-4bf4-4715-8952-9b0f24441c70", "value": "T176534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657398, "uuid": "eaea67a0-9e13-4bea-b31d-2d49160edefb", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQILiKimfFoktCe3fYRMK:WShU3q7cEDlCK/0DA9i8Fok06fYR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696657398, "uuid": "1e5ccb44-6781-46b2-b3b2-3b4e030d6314", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696657398, "uuid": "ea26c4c7-926a-428b-9c42-7c3f09f5ec67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657398, "uuid": "56e3ce54-5674-4e6a-9d40-de43fc8d2d70", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b4784c-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671287, "uuid": "fc8f5a27-3b0d-47bd-9bdc-641dce00fabd", "comment": "Malware payload", "value": "c75804869308068f5174d1e94e8533c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671287, "uuid": "353aad12-f8f4-4ecc-9d02-d2c62c7c97c1", "comment": "Malware payload", "value": "b5c88487b3b0a724b5d50673e50e27e3ee815a6ed32da81c228db1a5a23f49d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671287, "uuid": "c98d4a9b-03d9-4f62-806b-d14fabb71ba5", "comment": "Malware payload", "value": "80346d98c85189e7951f29a04843a26388d07184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671287, "uuid": "e0205101-a8be-48ce-857e-98c6fb693df0", "comment": "Malware payload", "value": "ca42c98d8b95d88ecafe291d0f2e8ba22c94c190fff640a7ee6ac84157198acd8981ce5f4b22e4938b71921979681d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671287, "uuid": "44b5a4f1-cb12-4a0e-b685-4227005a849c", "value": "T16674F111F6D281F1DEA756B044BA6B099A3AFC101BFAA0D75768368E5F323D0DA35307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671287, "uuid": "2798a080-d3fe-4de2-ae98-594f7c9a7851", "value": "4bfeee7b7b835264b130ec9677ff4591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671287, "uuid": "359229ca-e390-48f7-b7b9-ffdc8b94c401", "value": "6144:7Qp9DDItWtaqw+jaXfOSVJ9ijL3hKaL+kBUnVotDhpBf3LemE2eoomX1:UHfItW0ESZkLEaLfBUnVotTBfymUPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671287, "uuid": "ea0439e2-3a02-46a1-b541-50d57f523174", "value": 360368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671287, "uuid": "aa8ad5ca-82c7-4fde-b6fb-8248db88f768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671287, "uuid": "3fe1ded1-2f9a-47b5-8bb4-7a586f0422f4", "value": "SecuriteInfo.com.W32.S-17d761c4.Eldorado.23277.1313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c82cb2-64d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696657389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657389, "uuid": "54a9e36e-b6c0-42f0-9cb1-e40bdaf80384", "comment": "Malware payload (Mirai)", "value": "d40e732c17d16cf8446147a0d148012c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657389, "uuid": "64b63140-5368-43c7-a12a-38115a36fc47", "comment": "Malware payload (Mirai)", "value": "b848826cccedfa4ca39eef8cb617ba6cd293ca091b18ab885a1aca73f1e25281", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657389, "uuid": "0f7e1a99-2534-4792-9780-391f9d37a7f3", "comment": "Malware payload (Mirai)", "value": "d7c85dddb59117ba41049a6f91a840582c5daab1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657389, "uuid": "0abc1882-f05a-41a0-a5c8-715264774eb9", "comment": "Malware payload (Mirai)", "value": "3e9466c0f214be59d49dd4e4b8cb16c97c34e38ad0c06eba774a9b17f92e90e7d555e1e0b538362c6f7305c280c4d103", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657389, "uuid": "04b0aad0-99ff-460e-8fcf-e1657fb47817", "value": "T1B9730756B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657389, "uuid": "6a0251fd-dc7c-404e-aac8-0e02cddba1ef", "value": "1536:2lnHaxP6XkC/zTkS7IDHtfMwoQCyVacx0mIEi6zTKvcIc+5UYIWy:nxiX1Lgbtfb1VaizTKvcIc+uRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696657389, "uuid": "0d481f8f-c0df-4f06-9b35-333453928317", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696657389, "uuid": "53ff6099-e55f-4754-8880-97194e8f9106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657389, "uuid": "0a75c572-ca1f-488b-888d-e4802e6e3232", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b174c0c9-6559-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696714639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714639, "uuid": "74ddcbf8-88d5-4215-943a-f8d58dae6709", "comment": "Malware payload (Smoke Loader)", "value": "a12f1418bce76730a72bb3fed956ecca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714639, "uuid": "0322c7b8-f8de-4e01-b58f-a93570367bfb", "comment": "Malware payload (Smoke Loader)", "value": "b94fbe4609f164fb43bcf2a48b07b1306d8444e78b35791a5bfafa79bad53472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714639, "uuid": "ff4b21a9-a29f-48d7-ac7e-d423dd405ffa", "comment": "Malware payload (Smoke Loader)", "value": "e5021a973ab11af92de0613cd1340d32d8bdf101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714639, "uuid": "c4fe9daa-cb95-4710-a8d6-5b25baca338d", "comment": "Malware payload (Smoke Loader)", "value": "38c74fa59ca7e706d1ecfb2bc9293d816fc8bce3d1d702a9f1b19e8bba1393c990c326b0f1858c138c0e87e1dffba377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714639, "uuid": "a4620e5f-354b-4bf9-a38f-c18852f51ee7", "value": "T114547D0366A1BC71E5269B325E2EC2E5372EFC91CE59679633187F1F08B11E1C663B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714639, "uuid": "23fac886-10d0-4854-96b1-fca3737a59ee", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714639, "uuid": "4e342c43-da1e-48bd-b322-547e46479f43", "value": "3072:jaidW23y1WTggoVUcDOQKl0E8kI244ro9AEuSiSrBgDyd7dxIgu4Z:eicJWEVVUkKlekI24Icb1roy9IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714639, "uuid": "ea6d05b1-823e-44bc-a355-6182126d71c1", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714639, "uuid": "993be92f-7d19-44cc-8253-84d00fce7ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714639, "uuid": "b1bbf6a9-45ab-4e4e-8ec6-8da9f578f6c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bdd438-64bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696647318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647318, "uuid": "e39e7da0-3a85-4c83-a334-fe6af6624d2a", "comment": "Malware payload (RecordBreaker)", "value": "1b82a2f932ab89b8f53b9621a90f88a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647318, "uuid": "bd094dc3-c0dd-4f4a-82c4-06d986d277df", "comment": "Malware payload (RecordBreaker)", "value": "b981427514cc51902a80d8857ae1ada0bcdec9965d016bfa39f69c760c1d4f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647318, "uuid": "aa829dd6-6df8-4aaf-b418-1f955848c817", "comment": "Malware payload (RecordBreaker)", "value": "687c8ad4f813d69d49c00ad21e9fa079e323a18f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696647318, "uuid": "930c2a76-6888-45d2-8159-728eeabfa18a", "comment": "Malware payload (RecordBreaker)", "value": "4887e7e3d6f53305d482e5093f10af168dea70f666436b86ae6cf02b1d3fdb5244d7453095b47c5d2c3041459894ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647318, "uuid": "1305e643-a368-4b43-96e4-5ffacdf10bf4", "value": "T1BF367E64FF501127EE83536B9CA14591A63CD111F702E224E59E036DE6832ECD3BEB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647318, "uuid": "89c5b969-836f-42c7-ac6c-83da4eeeb9b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647318, "uuid": "10e8807e-0493-41e1-92c9-286655a35bf0", "value": "49152:Z4VIxoeQOSWFdin2IVvjm/yw3mAa3/jFPP+EhEyh3cow384AEDiJUdoKtYlQuWpp:Z2IxoebxdOK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696647318, "uuid": "57f8b9be-4109-4246-8d95-c6fd58cfe558", "value": 5002267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696647318, "uuid": "2cb127d4-df34-48d6-805e-cc46be9a669f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696647318, "uuid": "ebc5613a-54f5-46cf-824d-08a323018b73", "value": "1b82a2f932ab89b8f53b9621a90f88a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c7f386-6529-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696694007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694007, "uuid": "4b55a84d-fb1f-4efc-a981-254b11e5b45e", "comment": "Malware payload (RedLineStealer)", "value": "3d716adabde3193580bc4ccdf780d8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694007, "uuid": "291cb256-c1a3-46da-85c3-410ac4bf5f26", "comment": "Malware payload (RedLineStealer)", "value": "b9db9bb064f2fcebfb5823bcd7ac9387cba3a86cd81186e3f6e8e1e67b3e50d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694007, "uuid": "003523d3-0f23-44d7-9e37-9375c8069ce6", "comment": "Malware payload (RedLineStealer)", "value": "504814f8375e4041033d708818f38a4570591002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694007, "uuid": "68949205-d6e9-4802-aaf7-564e9b70cbd8", "comment": "Malware payload (RedLineStealer)", "value": "b951fac29c078b620fa7ce07c758845d660e99205e0c6309890ba804c9c41cefeb734b57a6a4ed3bd691ef3ae372d253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694007, "uuid": "8139c8dd-f030-4e7e-8394-60bea9c3173f", "value": "T1B73523967BD88172DDB2177089F903D70E307C705DB8872B2B41E98E1DB1656AC72B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694007, "uuid": "969c22c3-fea8-4b67-aa39-9bcb902a5c46", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694007, "uuid": "8f16afd2-9004-456c-9b8b-b40bc9385f95", "value": "24576:HyN5arLYLIlRr1l8HlrcFTREpIllI8ug4wG6Ckp/1Iz9e:STarScRr8HxqEIIJTIz/1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696694007, "uuid": "0f68ac5e-d6a2-4373-9a4b-b745702c722b", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696694007, "uuid": "3ed5d961-acc8-4c68-94da-48c8ddc44df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694007, "uuid": "f675283d-bd38-4c55-b64e-b7a26d2f0807", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339a63f8-64e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696664177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664177, "uuid": "7a14e105-2329-49d4-b385-527a2be9a842", "comment": "Malware payload (Smoke Loader)", "value": "cc8a51fa23608a52ae34e1fd7aa689a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664177, "uuid": "7abfb341-efeb-4089-9e6e-57eec7c8339a", "comment": "Malware payload (Smoke Loader)", "value": "ba6cc47ba3c77d4e86a20e719df06a8f336fe6ff38088b557fc706140dda2221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664177, "uuid": "747a921a-861f-4983-9ec4-4d255440fe59", "comment": "Malware payload (Smoke Loader)", "value": "542a0aeb98e57c50eae02a14ad7961d4870dc717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664177, "uuid": "f8154ab3-8dd4-45ce-a25f-2f9609007a83", "comment": "Malware payload (Smoke Loader)", "value": "f11c5c8330c6d35efa5cbe28c81352010a3b24bbe1d20072b6201c548ac65a41596f7223e43ac3c5747a83412c5c234b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664177, "uuid": "29f7a823-05e1-4010-bb1d-05e17e379e82", "value": "T18744F1E17EA0C872C44B5E719460CBA4EA7F681196A9454BF364E7FE6E303C3932F245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664177, "uuid": "c37dac84-c41b-48cf-84d2-fd00226dd68e", "value": "d3c94bb73994a0063781772af4feb487", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664177, "uuid": "c328c799-3536-48c6-ade8-9856c383a6af", "value": "6144:JQb9QHmOTefLXridPSf2ReDWf4bQzqnxaEzvT2:JQ9QHmOIridz4WfA2qnEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696664177, "uuid": "76e3e501-5969-4965-b6f0-849efece9dc9", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696664177, "uuid": "575a7c5a-6050-4f6b-97dd-25959314926f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664177, "uuid": "ac0168bf-7c3f-4609-9415-e3197aa1d7a2", "value": "cc8a51fa23608a52ae34e1fd7aa689a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2d9662-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671277, "uuid": "52f012e9-866d-4997-a18e-7082b9421ceb", "comment": "Malware payload", "value": "f6da17c9386f1b39f8f3a5f83ab59c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671277, "uuid": "5522b0db-e352-4a8d-bc2c-8fc44ada154a", "comment": "Malware payload", "value": "bb4ec9486e7cb3f8b43d98bd5e478dc3375c7e51df83bb239ed506ae25459e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671277, "uuid": "9af668b1-56f3-44ff-aa06-74183c24bea7", "comment": "Malware payload", "value": "381a0af8f4be33f9b206948b3812f1a2b5fdea99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671277, "uuid": "8c1e67e0-abcf-472d-9d4e-03b739dab503", "comment": "Malware payload", "value": "fb31fc3aa360a2642e21503f4d21b56297d4ec53530a880e5b534ae29db30c708ad4c4adbe254611152f8eac66927bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671277, "uuid": "3f05b31d-5df1-4c9f-85b0-e232eb09ce66", "value": "T1F4F12B93EDA288B7C15DC9BD5C498934E5322A3176E2E2D36FAF580DCC251804BFC712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671277, "uuid": "906fe7bc-2569-4fab-ac45-4bba61f0338a", "value": "192:n1xfRq8HebguuREnZXbzNbotbFtZKN8lryIlc:J3HqsREnZX3Qt02g2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671277, "uuid": "1ed9f8c0-f959-4176-b122-2b0163565a79", "value": 7780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671277, "uuid": "77a6dc2d-f048-44e3-a968-655cf10846a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671277, "uuid": "fa6095d1-f975-459f-80e3-25c8c22645a8", "value": "SecuriteInfo.com.W32.Qhost.0CCA.tr.19510.4095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a698efa-6514-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696684885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684885, "uuid": "6e089b64-b73d-4e89-971c-77680088e8b0", "comment": "Malware payload (Smoke Loader)", "value": "21d319b4fcc6689e9e93508e272637e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684885, "uuid": "b7091d89-7181-40c9-aa87-e8c7914d1d8b", "comment": "Malware payload (Smoke Loader)", "value": "c10bb12607855be812725b041507d5a423f25895017338415f5fc0428aabfcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684885, "uuid": "fc8ccf69-a4e8-4edf-8ff2-1bf1a91265e6", "comment": "Malware payload (Smoke Loader)", "value": "89dba08518846d15d7cd1d062c6fa37d5e7c6101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684885, "uuid": "0c6a77c1-4526-4ec3-804f-461147c1c75f", "comment": "Malware payload (Smoke Loader)", "value": "73c7f307ca909117ad83f1b02d78453767f9c58e782bf03db5fd643f5b00b630a2631caba6db92c0db028c24e4bc4052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684885, "uuid": "30d92126-611f-493b-a434-57ccfedce0ec", "value": "T116E2D0C16B7AA37ECD4400F1F2831526352CBEF93788B38C675CECB6A53E29D406A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684885, "uuid": "0d8ce5d7-6c04-4680-a838-fb77a2a8645f", "value": "768:OAUqYpNSIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:HLo8LKtd1PBkQD4UtFceWnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696684885, "uuid": "54485022-bf68-40e0-a5e0-95261d63b2c0", "value": 31328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696684885, "uuid": "b275adb7-0e36-4d27-8dbd-2b82e825e5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684885, "uuid": "4bf124cf-570c-413b-af73-0f3680022f7c", "value": "2c5640ec5b28ece97d73a22374116fa607b2094bb1ffe97ec1cc71c21f20c178_sc_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ccd2c7-6568-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696721146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696721146, "uuid": "009d8d38-2f68-4bf7-977e-24f719965fd4", "comment": "Malware payload (RedLineStealer)", "value": "8a2b80151679a3116cea6c589f31da10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696721146, "uuid": "e7c37ddb-c50d-4ae8-a558-dbbb5ede355a", "comment": "Malware payload (RedLineStealer)", "value": "c1a864775a85ed8afa97d7f5d08333b275a8dc0b8ec797a9c5cdadd6204f917b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696721146, "uuid": "2136b4dc-daa9-422c-a63c-05ab05d92804", "comment": "Malware payload (RedLineStealer)", "value": "6729038a217d566d8bda046c61eaddba948d751a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696721146, "uuid": "67e51f56-eb17-4034-9710-13f0e9e0bac3", "comment": "Malware payload (RedLineStealer)", "value": "0aab4eedd017b425b228b5eaeef3178fc9f26f8a38d40b6485d9df755a09f574523f6848b790dfd0e54077b716a0282a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696721146, "uuid": "fe07fb37-50f2-4716-9e57-7c6948c48e8a", "value": "T1779533466BE8C032C66567F099FB514716B43A9297E9873E3349CC6D8C73A91CA3037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696721146, "uuid": "8ec8e074-d06b-43b8-a3b8-08ec2486e79e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696721146, "uuid": "c9bf1e70-92a0-4523-907b-6b9b397b92e8", "value": "49152:plMefdgErnVXKQCew4cb5y0d7QafMJKv:7LOmnlKht4aZQ6+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696721146, "uuid": "481b2cfd-e4ad-42d1-a998-12263b2ea98f", "value": 1907712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696721146, "uuid": "48950c71-6188-451b-b800-8536248c6b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696721146, "uuid": "9612c2a5-028d-4683-97ab-57dbc9115c41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3fa7ba-64e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1696662475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662475, "uuid": "3c0c95ea-b4d7-43cd-902c-273beda6290e", "comment": "Malware payload (PovertyStealer)", "value": "b8303120c1bf50b01dbc9f8d6fea45d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662475, "uuid": "0445f61f-4fb9-4d20-b5ce-04d63bdd565e", "comment": "Malware payload (PovertyStealer)", "value": "c1ae35cd9be8a69a397e7b1e24229847a71bf7ff80bf4021429ee9804bf02652", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662475, "uuid": "dfaca4e7-aec3-47b6-b954-63157b43cd60", "comment": "Malware payload (PovertyStealer)", "value": "6c94bd065520ce1fb4eaac4b0479ff6087573cec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696662475, "uuid": "fef8e7dd-37e0-48de-aeb6-d812cf782d07", "comment": "Malware payload (PovertyStealer)", "value": "36692ccaa36c2615d0b3c780353d18343248c50a35c42e67be5dd32bb381fc90012314c1cd6f208e03efd84d87d5e943", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662475, "uuid": "aa010d14-9831-4726-bbbe-8ee2efaf88c3", "value": "T128158E2138C48076FEF220B746ECF67642ADE4B407155ACB06D857EFD7606C27B326A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662475, "uuid": "cb2f5703-c440-4064-a94f-86131d0c6fa3", "value": "ca718aa01950a102e0143611fc1a58b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662475, "uuid": "11b24a97-5f04-4a62-810e-8e1b902f17b0", "value": "12288:qIKpM6POHEEF081OMTAy/Ubf1eAUNtBI9e4fmSuBJuQpgcOmWHNtU6:qIKjPOHEEF081OMlEfUPBIpuBYHw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696662475, "uuid": "84fccd84-b15e-41da-914c-26dee34398d7", "value": 910280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696662475, "uuid": "276eb6c4-f998-44b6-b775-328b0e934afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696662475, "uuid": "c8494274-3797-42dd-b5a1-49fb8d723ae3", "value": "b8303120c1bf50b01dbc9f8d6fea45d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8370bd8-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671298, "uuid": "0a1d7dcf-0758-4f05-9d4e-ae577dccc84a", "comment": "Malware payload", "value": "92479affa2c80c7a257f8a1ccd359340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671298, "uuid": "6f048b9e-682b-4c97-a034-61cb79fc7fb7", "comment": "Malware payload", "value": "c21c2cb5d1ac201e15ee5bd2c5d8a4d5365223f427db2ec810f2abdb30ecc92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671298, "uuid": "f2ebaf3b-5c95-4256-9431-37b1b50098ab", "comment": "Malware payload", "value": "0eaef10ebb54ffc6f384af2c27b8d7ee8202936a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671298, "uuid": "b08bb3c4-b85d-4996-8857-6edc72fadebc", "comment": "Malware payload", "value": "753d699f97333c71a7cab1ab569ea3f7b5badf9330eb837f8a543c915708eb7b28cd7065edc24637bb38c96a10a8cd49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671298, "uuid": "cb34a618-66ad-4e94-aba1-c74e01660a34", "value": "T10794238BFE1C9294EDA617B10C8FAE5401489F0F76221B62987FF45DDFF1384A61AB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671298, "uuid": "136c3c5f-5c7c-4a0f-b4d4-e4e20112ef68", "value": "23615023d461e78d0629dc17085ae148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671298, "uuid": "dc585503-7c35-428f-9e03-231940faf846", "value": "12288:mkyub4GMCt5pIRYgo1UhezypKMnRWbz0xzugx43EAT:EuXtEYLUqatnR6z0xzf433T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671298, "uuid": "ef70d523-c82f-48a1-a957-311f85275a65", "value": 408816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671298, "uuid": "82d0da63-2ece-4c0f-bb97-41b15fb356c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671298, "uuid": "bbafcff4-0cf2-4f55-be05-c3fcd8000541", "value": "SecuriteInfo.com.BackDoor.Pigeon.72.7908.25685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4049cb-6510-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696683386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683386, "uuid": "d0a0e10d-e586-4214-aae4-d11dda1dcd5d", "comment": "Malware payload (RedLineStealer)", "value": "9624c0e0a699413ecad910cffec6d13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683386, "uuid": "b4ed36bc-9a67-461e-8512-46b99e7c03bb", "comment": "Malware payload (RedLineStealer)", "value": "c570c5aecd8d4e97985ad2b4c84eda956e1a7d191eba405486eafa38c515862c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683386, "uuid": "94e57cf1-b568-4600-974f-fcacd8188628", "comment": "Malware payload (RedLineStealer)", "value": "d77eded5e34976b9aac7db66fb18d3499aba8124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696683386, "uuid": "8ab63027-a9d5-4993-98d8-0e7e0cec2ece", "comment": "Malware payload (RedLineStealer)", "value": "9ff372f4abbc1c7f0b815f7140671ad221f1ea52b69947f0ffceac9484d5f3e95cf02c0bd4d55cc2e8b92104aba239f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683386, "uuid": "69e3c0ab-863a-4ef9-8904-2ddf6be85608", "value": "T18C3523637BEC1072DCB62BB1DCF602D30A357D565DB8979B2B81A94E0D727809272327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683386, "uuid": "08220f11-b10b-4e2a-a2c7-fcc2e42fb575", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683386, "uuid": "1ff66b49-5030-4eaf-9c18-837df9cd3693", "value": "24576:ny88OU1BJAAvMIoB6nNEoJThyFKhsmGZlQaH7VEgSGPHyWdf:ywcBJAA0IoB6nNFJThIKnYSabVEgSBWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696683386, "uuid": "64cfd3b8-562e-4edf-96dc-ba90fb5e4796", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696683386, "uuid": "53b01ac5-226d-4a88-ac6a-60b88cb2a17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696683386, "uuid": "06830bfc-624a-43bf-ba13-f1e6ea25e68f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6899d1f-64f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696672208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672208, "uuid": "a7fa747a-b4ea-4a5a-bbcb-65e0050a1b36", "comment": "Malware payload (RedLineStealer)", "value": "f2f9780d438d6d312555bfcc8887fe4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672208, "uuid": "4db5ecb1-f558-4eef-bbc5-0bccc281c8e7", "comment": "Malware payload (RedLineStealer)", "value": "c6ffec0c5d3e02d3c8d882b63b706fa4c722b8d0e0932e26a89cf9720ceae5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672208, "uuid": "627e9eae-e69b-4387-aeab-a2fbed8f1a95", "comment": "Malware payload (RedLineStealer)", "value": "182253b78b538e4507b35b7e228fe9c96e99bc31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696672208, "uuid": "03e53931-5a44-4e08-907d-a1bbe77f5124", "comment": "Malware payload (RedLineStealer)", "value": "a8214f9917e05d64187e98a0b4a2cacea39a5b106b29a346c5772df1bac8047fcd96d72d5485885ba23f8c065c45b619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672208, "uuid": "92ec2257-0d5f-4724-b8a5-119c1b3e0299", "value": "T1BB452322A7E89021CDF6277859F303834A717DB59A35C20377D29C4E1F726E8D93972A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672208, "uuid": "2254a190-33c3-4587-8e50-c6c17a6f3213", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672208, "uuid": "cb59ad96-aca5-48ea-823f-221356fbfe9f", "value": "24576:ryVCIq852jpdr72w6wdiaCAMil6c+0HtKHFWymDkFdX/T:eVCIf52NnnmI6cTNk6kFh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696672208, "uuid": "943488b1-d383-4d5b-9c6d-edf900c2b1bf", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696672208, "uuid": "fbe5e6a8-2f1a-4c35-91a2-de8b45037f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696672208, "uuid": "d73ae601-e21e-42c5-8330-afd497d02d26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a64a62-64d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1696656797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656797, "uuid": "6561e6ab-076f-4e97-ab18-0afe0aee34d2", "comment": "Malware payload (Fabookie)", "value": "637dbce64106ecb582f119403822e138", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656797, "uuid": "f69c4d9d-198b-452e-9458-a8bea0f9c976", "comment": "Malware payload (Fabookie)", "value": "c82c8f3777d5193351ffc815625ad1e03e2816c88a4a4e0fdaf9c1fce8ba8921", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656797, "uuid": "cafd4138-2794-4417-9cec-405f5a0d065e", "comment": "Malware payload (Fabookie)", "value": "da2989852244e0b0a90e8916635ab35c0f4906eb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656797, "uuid": "2e23329c-923c-403d-b05b-0a7c2727ce39", "comment": "Malware payload (Fabookie)", "value": "f175497773b81296186e581f25c8ece43d19231e7d440f7879af3083e8a782fa3cc9426f0e19008542dd2efeda6a03e9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656797, "uuid": "513437ac-afa7-4b23-9800-e003f65d93c4", "value": "T18B941849FB7408B6D096C531CDBE8376E2727C831B25930B8641FF6E2FF36216969681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656797, "uuid": "d980b6cd-9af9-48d1-ab63-dc6faca6cb31", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656797, "uuid": "9e92af6f-674c-4ac9-8b8f-f31157ce6b7a", "value": "6144:syUa7AQnwciHMc4oiT4MKBz3I8JmGxerEhgVIXFM:sf4wcAQVrKi6FerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696656797, "uuid": "41553fe8-8078-496e-ac2b-9c2c02e390ba", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696656797, "uuid": "1f4f344e-a952-43d7-af7d-49646ceb3501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656797, "uuid": "606ea011-9c75-4a4f-baa8-bf68fa50e5a9", "value": "637dbce64106ecb582f119403822e138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9ec562-64ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696640139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640139, "uuid": "a639a428-262e-4fe5-b7a1-ef63f39bb4c2", "comment": "Malware payload (Smoke Loader)", "value": "ccb6c3a863ab67a18d1779011bf8583d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640139, "uuid": "d3aac75b-a250-483c-b21b-58f23bf1b24c", "comment": "Malware payload (Smoke Loader)", "value": "c84537973b86166aa9be5395f16c7669bf92b3e83abfe8f714fd2a75e8635bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640139, "uuid": "f87dec85-6ceb-4c97-9ffe-9eca3012e13c", "comment": "Malware payload (Smoke Loader)", "value": "dc4bfecae949aa221fba749c67b15dee40f91fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640139, "uuid": "bdeca31e-a90b-47b9-b384-25c6ce840f6e", "comment": "Malware payload (Smoke Loader)", "value": "f0ef1461c43ecbf43961ae6cd1c61b32c410f94547dcb271f658e6e061a43c667479a345335b8c36c049d6a71b9898de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640139, "uuid": "c1200fba-9f26-4e11-ad1e-c2c76118ff48", "value": "T12D546D13D3E1BC25E5224B329E2DC1E57B2EF9518E69B76B2B085E2F08B11F1D663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640139, "uuid": "850e6dad-7277-49d8-a2a5-0bec6aa4e918", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640139, "uuid": "2086a96a-b717-4bd2-9a85-746f209d7870", "value": "3072:YgacdZG7phkM3++8RMLKCIkvazbUy6xDzC2IqoM/oP8:jjZihk0OCv6bU7DzLoMAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696640139, "uuid": "db1a5e37-3c8b-45fc-8734-385b22dfaa30", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696640139, "uuid": "15f01bb6-0fbc-4789-89a1-51081ccef8d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640139, "uuid": "0f131b9d-5c38-4983-ab04-3a8c6a08ca5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fe43b1-64c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1696651375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651375, "uuid": "2bfa89c9-0dba-4d40-82e9-1ef1250198bd", "comment": "Malware payload (Fabookie)", "value": "6e45986a505bed78232a8867b5860ea6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651375, "uuid": "53e87437-ad40-4af1-8c02-5029ee188218", "comment": "Malware payload (Fabookie)", "value": "c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651375, "uuid": "e9c0af51-d4fa-4525-b81b-c9063124f408", "comment": "Malware payload (Fabookie)", "value": "51b142a7e60eecd73c3eaa143eadda4b7e64ac4c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696651375, "uuid": "846a281c-4bea-46a8-a35d-74ef4b86a2b8", "comment": "Malware payload (Fabookie)", "value": "c5eb8f1d22a1f2db39913722c1e68bad35381e617a4dfd51934eab990dfbbf3eb758234b58a168b5358d8adf31434ad0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651375, "uuid": "558fa3b6-016d-4dea-a70e-87a93bd5aee7", "value": "T17715AD4377508885E04D45348DABCBB9E6B17C207B2C47A773B2BB4F6E32AD16512F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651375, "uuid": "bde9ed5d-74d0-41c9-964e-fdbe7ae6d330", "value": "de5ffdef0b7fe6105bfe44941d62fcd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651375, "uuid": "d2e29c6f-6a7c-4093-8c3d-901dfdac080a", "value": "12288:K72HTp/D0DpEE3M51qvii3mmm6AV5Cqylkg5ZQnXlV5Za5Za5Zj:GA4JM5kRhAVdcpmt44F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696651375, "uuid": "3651640a-78ab-4308-8aca-886418853ef9", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696651375, "uuid": "c71e9e2d-d8ce-498d-a2f6-4bdb0a39029f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696651375, "uuid": "40b1dcf1-dfb5-44a2-abb5-9cd1bd928085", "value": "6e45986a505bed78232a8867b5860ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908f4cf5-6531-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696697404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697404, "uuid": "b65515bf-0715-4e07-a16e-d04c34a60a01", "comment": "Malware payload (Mirai)", "value": "75807d2fb087939972661a5fd10f5bfd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697404, "uuid": "391b0aa9-4f0e-4727-bbb4-56c79079928c", "comment": "Malware payload (Mirai)", "value": "c97b36752b458b985e178fd48a042d72acd0eced40d32d2f7c25734aa4aa9210", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697404, "uuid": "c370b2aa-4f16-4ce3-b8c2-cc0f241c8e0e", "comment": "Malware payload (Mirai)", "value": "8aae329fcd7e9e28c21473873d7b78ea61cff383", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696697404, "uuid": "91665123-f8a6-4cf6-9b1a-f8c0a76a70d3", "comment": "Malware payload (Mirai)", "value": "a699d1b897e0a9ba6b7a7fcc2b51ca7a9070cd4c3cbb467bd3179823513938843ced8638fe806675ac5712d77d12ffad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697404, "uuid": "b8f17590-1b9d-4e1b-aaee-bedd8812a68a", "value": "T1D3A2E019BF2882CBC832293955E9E5D61397FC62F2DDDC496940C16FB0A33E95830F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697404, "uuid": "8547221c-f0d1-4d12-89bb-0a872b6640a3", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTI:k98o08kxofBE+ZkXaITbp2F2TWul0c58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696697404, "uuid": "58c7e7cc-67ac-4895-b84a-b9cfc1644484", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696697404, "uuid": "6198c84c-e055-43ea-9837-1fb1539231c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696697404, "uuid": "4f2b6dec-69f7-4b37-bbfe-cd9da6477bc3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6ee587-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696668276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668276, "uuid": "c5785dd1-d24b-499a-b80d-6064b46700d1", "comment": "Malware payload (Mirai)", "value": "32536ae99c851c3d080f05a98da1c2fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668276, "uuid": "415d5a8e-3a7c-4cbd-80e4-51ecbb89bdd8", "comment": "Malware payload (Mirai)", "value": "c9a0a91a9600e8e6d47524fe936082658b2763838389a2ff30e3650fd0adb362", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668276, "uuid": "38d75ba0-326e-4cd3-866c-0498fd74ec85", "comment": "Malware payload (Mirai)", "value": "7eae17c293f3974c32f7df8cec5db94542a2ff87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668276, "uuid": "3c0da74d-e04e-4518-97cc-917714c6a03e", "comment": "Malware payload (Mirai)", "value": "ee0ffce4ebabafbd16355bee6fa97294a53708a149b24be46968007b23ddadb616848070af7f2ceaf191864dd4a2d3e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668276, "uuid": "eea8651a-3194-4ed9-b594-203f04cb63b2", "value": "T10E13F286D2758F85F6DBA1B91B705B50FF906F012F75C913F0C5BD92AE22223070A6D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668276, "uuid": "9c78fb3f-0b5f-4fb4-8085-847e4f226bf6", "value": "768:OqpNK7Nppnx9VWxIvWDte0igDbfBDUYfg4gwBTueDxVWCi4uVcqgw0RTWX2:tK7dnxOI0JDb5YgxnXWv4u+qgw01WX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668276, "uuid": "10f74060-3767-48bc-bc29-7835d2537409", "value": 43392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668276, "uuid": "324a93d3-e42c-40a6-bcd8-a2c47152f8b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668276, "uuid": "3fe4cb40-f614-42fa-a1de-10a89838fef1", "value": "32536ae99c851c3d080f05a98da1c2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d35c27-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696663936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663936, "uuid": "f0c23a67-472b-4db3-97ec-30ee7f1e2975", "comment": "Malware payload (RedLineStealer)", "value": "bcf0395d2b1b14291a08534ef016b38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663936, "uuid": "a5aa5127-6656-410d-907f-d4caff280f6c", "comment": "Malware payload (RedLineStealer)", "value": "cb445127a3a83161be3fe71f9442a84eca8a8b19df0308134651b6e484d6d1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663936, "uuid": "3933d5c4-e515-478b-9495-ac01f25f8242", "comment": "Malware payload (RedLineStealer)", "value": "e6b9b74763bea377f85dd0a8a920be96a7557f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663936, "uuid": "2c68cfe9-4453-4670-b1d0-b8132672c691", "comment": "Malware payload (RedLineStealer)", "value": "21cde97e541af8f4587e22c6d72924d67dcfa941cb134afb54e2172fe1a52cd15a228af1f99bda27ad9dd7eb3c784eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663936, "uuid": "d269639e-c7a2-4fc5-8b8c-ad36b8ed9568", "value": "T12A452352E3F04572DD2A377409F707C70B32BD768B70825B2BA1A90E1DA26E5E17136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663936, "uuid": "4ba80a88-f7d3-4750-a990-fde8211dccc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663936, "uuid": "05a3c6f3-17e9-47ca-8f14-4916cb9d6194", "value": "24576:HyX1h872C2OThdDKtP6lWUfimDao6GRGtqbbQVL8/CwGY:SL8aCHgtsffiL2VbeKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663936, "uuid": "3321a033-3883-4922-9ce3-db30ed941efe", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663936, "uuid": "43f5fe72-692c-4d48-b358-8783e0045b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663936, "uuid": "9f1ed31b-da40-4b2c-a935-fd7ddb6200e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af15614c-6536-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696699603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699603, "uuid": "498b1a80-b8d1-4748-9b82-446fa60977bc", "comment": "Malware payload (Tofsee)", "value": "20dfdbd674efcbab44b32d6cc584ad68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699603, "uuid": "f3082ff1-a27f-4b7e-aa57-5058a0860398", "comment": "Malware payload (Tofsee)", "value": "ccf9493dddbd490acdf1a7847a914d2f337f89c68c65c267e93b259efd8b2b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699603, "uuid": "172640bc-505a-448b-9883-526f114d0635", "comment": "Malware payload (Tofsee)", "value": "b80282075938b6914c5961fa26cc93e7bdb47b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699603, "uuid": "7be7dd3e-b878-4960-a104-db5bdee20791", "comment": "Malware payload (Tofsee)", "value": "c2eeb7d04db9c614a9137ad91860d73695b05f1ef202cda1e8b3ed7a78cf00576c8426fbb7d9d755804a69f3958bb1ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699603, "uuid": "afa25ea6-7af0-4108-ae94-8e89158b17d4", "value": "T137547E03A3A1BC61E5264B325E2DC1E4772EFCA1DE58A79733587F2F08711E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699603, "uuid": "f1dc0f1d-013a-4d99-bf32-f04ea9ba0715", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699603, "uuid": "0f8288c6-6ea9-485b-96ba-1483571abbb3", "value": "3072:TZ77mQLNtWbyeOtxcaiiDzSZq6oarZSb2rdbvLJAwdNo9yv7r3O4a:t7K0W+eOtSjA8SbsDLdWQzTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699603, "uuid": "7e44617f-1db3-4b39-b378-a2c255dfeb28", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699603, "uuid": "d4696922-07ae-407b-8b44-04050d483610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699603, "uuid": "786ef465-4a46-4e5d-ba82-1400f01db5a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6a11d4-6502-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696677025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677025, "uuid": "20f8ef2e-b643-4005-9df2-ff601594b0b5", "comment": "Malware payload", "value": "99e3f4b3d360574a16d6719383aa45d9", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677025, "uuid": "a9e9c287-c2b8-4265-b1f9-dede205f4f31", "comment": "Malware payload", "value": "cd88b0664f2839838a32c01e4a8034db005b949b78d7a0c53f339234cccac624", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677025, "uuid": "f2de7117-3b4d-4984-b418-78a842b4d408", "comment": "Malware payload", "value": "14db45b8eda2d6f29bf115856fd375b058b3011e", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677025, "uuid": "f595b4c5-d9a9-4b46-9ed2-1c923e4091f9", "comment": "Malware payload", "value": "2fc6b4d289d0611ff1007075ea0ff18bf4f5ecf7167bed1a08f7f695b3f86312f856a4c874d2829d4936253d998bb75a", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677025, "uuid": "b03004d3-c416-4a2d-ac07-e96baa5d1840", "value": "T1B0F423E9C186392A829ACA7CBF51993B3F22D6C4779610EAE7D971074C36417D10BB3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677025, "uuid": "fdd2681f-f79e-48e8-8901-1d93570f6c5d", "value": "12288:FCntMwv+2vd9w1CuItaZWYBwrY6sbkM+Hv7LfXjX1SB15nFY19GTe4J1zm9Fc2Qt:IawvR9w1CJtibOHTLfD18PFY19UlF0+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696677025, "uuid": "7519a4b2-bdfa-4a67-a8f9-7dfbc003da30", "value": 778248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696677025, "uuid": "14a92739-187d-4660-a0dd-9f477c35933a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677025, "uuid": "ceef9663-1162-486e-9d25-a3d4e496b231", "value": "Yieuot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6316b725-64dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696661250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661250, "uuid": "4676b732-bd7b-41ac-8fb1-08463dcfb88f", "comment": "Malware payload (RedLineStealer)", "value": "5daeba9af00780bc8547105e9bf3085b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661250, "uuid": "9e0ceffb-ec43-4aed-ae3f-fa6433f897c9", "comment": "Malware payload (RedLineStealer)", "value": "cdb95d02df827debe9f841bfd5cb361a8a2d634e2f8ca4bd8c5c767d0d7b17e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661250, "uuid": "098159e7-eaa2-49a6-b60c-a716ef562d4f", "comment": "Malware payload (RedLineStealer)", "value": "1d852fc064015caf7b7095b1ba674ce405578888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696661250, "uuid": "0bfa0ce0-0a9f-43c4-a454-42fddba7f022", "comment": "Malware payload (RedLineStealer)", "value": "f3aa9f2ff3ba4f161b145eba7f9cf63a1f8a0fd6e916baa76ad25b2f1307d8aae31d38e44e0c84dc12ada010b31f9d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661250, "uuid": "5effb659-9e0b-4782-98c9-35869d5a193f", "value": "T10E547E13E3E0BC65E5224B329E2DC2E4772EF5618E6DB76A3B045F2B08B11E1D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661250, "uuid": "9e02407a-d70a-4513-8ba3-4ac7c5871d1a", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661250, "uuid": "50e308a9-1d66-49cd-929e-8e22212647d1", "value": "3072:lSFL9Z1/WDPGRP2uL/kKImU82pGxCmXL8SoE2:IXZsDPGPTLMKI38JxCm78BE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696661250, "uuid": "0c757dba-750e-4c84-8d6c-0eb6e9825107", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696661250, "uuid": "31a34bd1-20b0-4bce-897f-c74219540cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696661250, "uuid": "30893ee4-433d-41b8-9408-5d75a6f49850", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a878e96-64c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696649505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649505, "uuid": "968228f5-40f4-440f-a809-e6443685366a", "comment": "Malware payload", "value": "d0ae91c510055f59f4c3574932b76e5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649505, "uuid": "aa16af6c-2ddb-437c-9707-96bb1c759ce1", "comment": "Malware payload", "value": "d0bf0374cd7967944411ae431caf478814a59e06e31f4424c5fb76b781704ad6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649505, "uuid": "1910c61e-5f9f-4512-a6ea-4071b09fb496", "comment": "Malware payload", "value": "519824a98e4bdf66d26b2f5c98b332e391de8b02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649505, "uuid": "91310620-57b0-4373-b084-6f9c56a48521", "comment": "Malware payload", "value": "fd60b6fc9f9381953fcfe994edc4385fb980be06bddd56e6c9a67eeeb583c97c23f751a93b0ed4d6aaf501cf71f59c20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649505, "uuid": "df2c88f5-1ae6-4f1b-8249-efab39e893fc", "value": "T13DD33A4AE980AF15D4D921B9FB5E518D33630B78D3EAB1028E155F20A7CB94B0F37A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649505, "uuid": "f71e3d4f-06a1-45f3-a9f2-9b8663b23c8f", "value": "3072:vs//9PLciLYs7PIIN8Ea7QM2P+3vspOtB6k:Un9PLNYSIIyEa7QM2PUv/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696649505, "uuid": "27874232-28f9-4a44-90af-19ccc381bbd2", "value": 131244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696649505, "uuid": "2e2d3c4d-394f-488c-a6e7-0b98407ee2de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649505, "uuid": "e92cbd65-7616-4936-8454-7cbdc508fbda", "value": "SecuriteInfo.com.Linux.Mirai.4306.22076.221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6195a8ce-6505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696678428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696678428, "uuid": "9718495a-cc94-46ea-ac3d-ca94586c730c", "comment": "Malware payload (RedLineStealer)", "value": "0b9913d7152a9b02276b4ce11dbd203a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696678428, "uuid": "fd316a77-5d01-4d56-8e6a-256579aea8df", "comment": "Malware payload (RedLineStealer)", "value": "d0c25bf4358adabf4c5320973dbe9bc06e5a9acf46d6665f75ae9b6e31328307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696678428, "uuid": "08c68db9-5e2c-4613-ac23-f307cd347bef", "comment": "Malware payload (RedLineStealer)", "value": "771094f2e0443148fd60e6602125a100d8fc50e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696678428, "uuid": "7b8398ef-a48c-489c-a82d-33268821bed0", "comment": "Malware payload (RedLineStealer)", "value": "7a6c2ac74b1878dceb7a9a99a6f25d3e1294bf811bf07563efd60812c3550e36d8a8e4434289c0f10f3eb5b353bcd83b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696678428, "uuid": "453da057-ffc7-492d-9d1e-c41b6a10ac14", "value": "T12A452312FBE89537D9B267328CF503870E3A7DA14A3C075B1756A86D1CB3690A93137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696678428, "uuid": "3da80483-0f8a-4c41-99e3-b49206659b6b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696678428, "uuid": "33296523-5fd7-445c-b33f-580e2ff9236e", "value": "24576:0ynqV5M2wVtDViLvnP3lewp7NUYLFbRILZJGCX5V+iYVi:DnqV52tDVuvnP3lbpeYxbRILZn+iYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696678428, "uuid": "6bc936c3-98fa-43a7-a87e-577d503bed38", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696678428, "uuid": "2f78931f-b201-45f8-b1ec-93e54b7a1ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696678428, "uuid": "c4fa8fe8-9cd2-4abe-ab6e-3bcae80d1804", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9431d8b-6525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696692426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692426, "uuid": "2eee758d-7e45-40ea-863b-d98fcd9a2052", "comment": "Malware payload", "value": "fedb4b4f2e84ca591af05db489ccf24d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692426, "uuid": "20baf6bb-a7c4-4283-8b0d-a77abe24476c", "comment": "Malware payload", "value": "d1fb471bc313ccf8a344905fd4727bcd8343691ad39833082477a55b4a444420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692426, "uuid": "a1773342-826c-4898-8b61-73c743fe1523", "comment": "Malware payload", "value": "4b73f57a630e1620fc10e800387ceb57ea0a4715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696692426, "uuid": "98f24a03-477a-4cde-9308-ea05893548d0", "comment": "Malware payload", "value": "480e09d6cb1383308f389706f9423ce84b6c41cf2c8b5fda4a923ef7f0addddc2ffe55019a4a354625fca97344d898f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692426, "uuid": "7c4946d0-0f42-4d43-8cb8-0c2f01741929", "value": "T14F452352F7F90673DCF8537050F607571A36BC620AB892AB268994860DB3580F676B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692426, "uuid": "e32e7753-17d6-4ffe-85b1-377d2765b742", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692426, "uuid": "7bae3c95-6fe4-4328-a475-de2db6c60d4a", "value": "24576:FyRb+Roke42wGKtSsXx8wP/a/QIZGtw1KSBGZo84oBZW//:gpUeWsEx8wPiNZGtaYgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696692426, "uuid": "a677cca9-e286-45b8-8866-15ffe8b58f53", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696692426, "uuid": "5e35d8c5-4251-4bf4-88c9-4e5ed5b45453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696692426, "uuid": "619cbc20-3b43-48c1-a416-4795bdc7405f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f79432-64e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696663646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663646, "uuid": "59f390a8-f262-4b0f-b332-d3296f4b32d4", "comment": "Malware payload (Formbook)", "value": "980e6c7bdc869c67769248c534cf5473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663646, "uuid": "2a55fe82-2e1f-4015-8ee9-dc004fb2e436", "comment": "Malware payload (Formbook)", "value": "d1fdb78142a09be2db38f3e704f9cc96649745d1055eef07a702ed674cb4b9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663646, "uuid": "99750fee-fc2d-4d03-9352-0e3b87e72fe3", "comment": "Malware payload (Formbook)", "value": "07745c458e1f91e83802eb77a49d56249de54538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663646, "uuid": "9efb0597-584c-4fef-8f3c-cc031895c9b7", "comment": "Malware payload (Formbook)", "value": "08f2ff23b61580d682933e39556259e3be7ac1b1579abcc5f9c90b5ac8955019d73925836d7cedf9adcd09d9a29e2afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663646, "uuid": "1495e1a2-be19-4122-89c3-96fc985b18a5", "value": "T1D8E4BE5E6310529FE0042B75CABD3E194220283D76D2D7D4B5A73A1BEED9BE7583302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663646, "uuid": "7a9f02d1-7fc1-4c24-a58b-414752960169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663646, "uuid": "8aa43fdc-1686-48ba-9fae-f1be78c8fe6f", "value": "12288:6/jDsEOuu3QssNxoDp5HkVerWPYV8q36Ie0y5mNNyvdOe9YI:6L5OVQsIxQp5Hk4iPexNy5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663646, "uuid": "7630c6a9-853e-46c1-aa25-184ceaaf3abd", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663646, "uuid": "bf4ed029-235b-455e-aa6c-ebce0508d226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663646, "uuid": "664edbf3-2f72-4973-8a58-5655a16edc69", "value": "Receipt!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24d1480-64b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696642136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642136, "uuid": "952ed93c-b08c-40c7-9b07-5ab8a8c30f6a", "comment": "Malware payload (RedLineStealer)", "value": "1039145bb31f96abeeeb586c0cb5b66d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642136, "uuid": "d757456b-24a4-4553-96e2-0bbd72ec53f4", "comment": "Malware payload (RedLineStealer)", "value": "d3595d8ed1b9f2ec77f0c654fe92e8397ffbd9cae6615f87f68fd0442d6229cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642136, "uuid": "0237f73f-c42f-4f54-88ab-6a1561ddcec9", "comment": "Malware payload (RedLineStealer)", "value": "14b27047e953eea43f3d2e7709c5f87474805144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696642136, "uuid": "f2665945-a2e6-4bb1-a51f-3c69d43a1c46", "comment": "Malware payload (RedLineStealer)", "value": "c6c6766497dd63fc5ce87ab1004cebb0765619d8092487d9dd682ea52c6e10abd48e2e37ca34492414cc0821913036e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642136, "uuid": "2bb1d454-d122-44a5-bf90-4d535ad32da1", "value": "T153A44A40F3D145E3DBA5383153A286A028AC322E4B1ADDBB432CFF4DDDD1A55712BD6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642136, "uuid": "3495f2d7-7a35-4a85-90f3-d268a19c629e", "value": "06ede52fcc31e4900f4f1a7060fce645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642136, "uuid": "f9e64cb7-3ab2-4dd8-a739-86e142334d3d", "value": "6144:X9BTBLkbRalPXkmJavrR25LAOrGke0e+Sr7iULvgtKSGTf6ucvRWn0p:X9BFkNalvBRGkev+SbotKSGTf6jZTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696642136, "uuid": "c69abf36-7057-4a5a-9e17-1e3c8dc04e10", "value": 468424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696642136, "uuid": "92c24c01-3a1a-4883-ba20-cbd646ebd7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696642136, "uuid": "36baae46-20c8-4608-b09b-85722ac033e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee820ed9-6557-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696713883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713883, "uuid": "ebf211a1-846f-4b58-a0b4-85d0ea5d1505", "comment": "Malware payload (Smoke Loader)", "value": "b7d643c546fffef74f5b082a1e9ee732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713883, "uuid": "ecccec83-9fc1-425c-b8cf-73eb097f77b6", "comment": "Malware payload (Smoke Loader)", "value": "d385c8dd8a2242e7601b85230d605a49568cddfbcaa890f54859de7e4b6cd894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713883, "uuid": "fd05cc01-37ac-4869-95dd-7f20e64d5cda", "comment": "Malware payload (Smoke Loader)", "value": "b6a4d7acc570819c5026914e0f51dc147268800d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713883, "uuid": "cdc6b5d0-93d7-44bd-b3c1-7b002dc079b4", "comment": "Malware payload (Smoke Loader)", "value": "32b999d7dd151999eff8888b64fd8031f71092842fcf99912e1f2fa726703a224d329f9ef0240d75e2726a8bfcd2da7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713883, "uuid": "1da4bc39-c34f-4cc0-ae59-c046c0e6e7dc", "value": "T1FC546D13A7A0BC31E4665B324D2EC5A4772EFCA1CE58679733587F2F08711E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713883, "uuid": "160c6ac6-c4c0-415e-be1c-02e5fc8fb13f", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713883, "uuid": "1e069361-4059-49b5-b24c-fd5ac155e42b", "value": "3072:Ba8AWa7z1WhXgozkqXrmFXZs7L17muakByUkcDXJ77Iq4Z:Y89UWlVzLqE7LBukhpDXRMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696713883, "uuid": "a253de71-32dd-45a1-ac9f-0e6b137617ac", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696713883, "uuid": "a92df057-0a31-49fc-8adc-b5ded3dd041f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713883, "uuid": "894d284a-e6d4-4fd4-b230-f6a5846aa067", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca81b739-64aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696639519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639519, "uuid": "6bbe4d1a-6274-4d00-9841-176ec71affc2", "comment": "Malware payload (RecordBreaker)", "value": "0e10ea38b2c0569203a5f46efdec60dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639519, "uuid": "1520c08b-6b62-4367-bff5-9ca89ab51c0f", "comment": "Malware payload (RecordBreaker)", "value": "d4224f288dd203d784301459d37aed4a0e908f53b7b60b83c4d7f2b65cc007d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639519, "uuid": "694b89cc-d69e-4d16-aa61-fa5f5a86423b", "comment": "Malware payload (RecordBreaker)", "value": "2a85e47f44d07d52a55095c78b42127e290c5069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639519, "uuid": "9f56222a-5624-4f20-9c00-556a80bd7738", "comment": "Malware payload (RecordBreaker)", "value": "3ba54b4d8f79b3b0e717f1b33302ef389504cdf353b2594761dc93202606f760c6ca85dcf046bb9a4d85a3b9740a6fa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639519, "uuid": "be98fdf9-fa07-45fb-8c94-14e80f6a6ebb", "value": "T10E467E64FF501127EE83536BACA14591A63CD111F702E224E59E036DD6832ECD3BEB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639519, "uuid": "e525cccf-eabe-43ce-bf66-390ab82e4415", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639519, "uuid": "51424b8d-5c63-4912-bc26-c95f171a6708", "value": "49152:Z4VIxoeQOSWFdin2IVvjm/yw3mAa3/jFPP+EhEyh3cow384AEDiJUdoKtYlQuWpo:Z2IxoebxdOKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696639519, "uuid": "cd6d365d-5349-4df6-bdcf-fc05c6151602", "value": 5564156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696639519, "uuid": "e6f0c004-a6a5-4d09-99d4-a69e5ac97ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639519, "uuid": "ccfbbc44-72d2-4bbb-802d-35465ea30a23", "value": "0e10ea38b2c0569203a5f46efdec60dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73092ab0-655a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696714964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714964, "uuid": "662cc23f-29f5-4af6-862a-42d52b0f3687", "comment": "Malware payload (RedLineStealer)", "value": "7b563fb06a365013a39ebe77aba3a149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714964, "uuid": "56fad6b5-85ae-4770-ab20-eadf0ec871b6", "comment": "Malware payload (RedLineStealer)", "value": "d5cf2d6effc479a1f3ce73d982ef695fd61b573db82a980a98f8a36f9f79b608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714964, "uuid": "193a00a9-0cd8-480e-994e-d08401c3cecd", "comment": "Malware payload (RedLineStealer)", "value": "e1c0078b624e22b42de6524c688b1a1d61da2a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696714964, "uuid": "db77a9d1-fe73-4908-9751-00f52e798177", "comment": "Malware payload (RedLineStealer)", "value": "fc75eedbede71e4f418b408e1d0db253fd079ff058c237cc5f5248d3a20a223d00e15c9f1c1f9ae29670f1fe1a865343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714964, "uuid": "ba3cacb6-7e52-4607-9905-0ca05fc26933", "value": "T16D852386E2E45453F6B02B7414FD03434E36FC514EAAA32BBB81C85E4C61AD8997D37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714964, "uuid": "b28419c7-a941-43da-b822-0a3c6cce12d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714964, "uuid": "6dac999f-7e9d-4b45-9c49-0902a4328920", "value": "49152:iZRdhjrzuPxB6gxe+B/5K/IR+rxKa9to4LnFYqipfjzpGe:eRrfuPxwkDKQsVK/UFY1bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696714964, "uuid": "f0ade4ce-4250-46e1-8703-5d941f36a9fe", "value": 1861632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696714964, "uuid": "9050fef7-3272-457a-af4a-ead6a4daca95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696714964, "uuid": "4ac9ea57-d654-4975-a90b-c42b78de9d6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007a4a2b-6507-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696679124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679124, "uuid": "1bb12a0d-ee2f-4187-b086-2a0c4d1c90e7", "comment": "Malware payload (RedLineStealer)", "value": "1c2dc21002ff541d19129bf5f5d2eb9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679124, "uuid": "c63ce457-9b02-464f-8bf6-6d62dcd227a6", "comment": "Malware payload (RedLineStealer)", "value": "d6e089edb9d25dd4466f6c4b1fbdf76bad2d02f617c8175fbdb67b747644ceb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679124, "uuid": "bb1cc17a-a5ac-46e5-b77f-550b372c651e", "comment": "Malware payload (RedLineStealer)", "value": "b1217d59cd0141708d7cbc04f859fb3f6ea7d253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696679124, "uuid": "7c04b8d5-d13e-4584-8aae-f1bcd2aeb208", "comment": "Malware payload (RedLineStealer)", "value": "63c7d4a1e0bfa149f27f77f216b43b9d534e65b9fca1460e9405716f2016c4376b19da306aeacc0056a87b7191f68280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679124, "uuid": "ba9db84a-6f30-4968-b676-6eb4f23c4e46", "value": "T1F0352303ABE89023DA663B7049FA42A30A317D964DB847073BD99D1D1C732D4E67277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679124, "uuid": "4c87fecc-5b82-4a3c-97dc-1088754691fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679124, "uuid": "daba30f4-751f-4e3c-8c67-e0c1eacdfd63", "value": "24576:RyBu1cMrr8N2wc+RtcwLWVf0nwbpj1oUFXCOJEA8lPm:EBu1cMrKtcVf0nwtjydOJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696679124, "uuid": "45d01858-8e42-4019-af2c-d62da1e24b6d", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696679124, "uuid": "50fc41b1-d28d-42cf-978b-944f2e4933fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696679124, "uuid": "628feeff-b218-4596-88db-343a8ee2c595", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf65b32-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671281, "uuid": "777d3370-852c-40a3-84f7-fdb8328d1da7", "comment": "Malware payload", "value": "c92a24278fdef782309c6fa55ee807ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671281, "uuid": "4bb600a3-77a2-4e97-9189-d7b1ff160992", "comment": "Malware payload", "value": "d762457167d75ca5aef0b11ceb5678e3d66a7db92c5703461aad67e1ec345408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671281, "uuid": "58224858-6fc0-43f8-9261-5910508a407b", "comment": "Malware payload", "value": "9bbe55f8957b082af3cee4b413d8846bd4e43052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671281, "uuid": "f434c529-2488-4f0f-82c8-287235fd1389", "comment": "Malware payload", "value": "6b871ceb92891640e7ab05373e7d27a78dd6b05ce1c22a4b48b72c26954e2936a7ae3f73f97554d32ce5f2fce6f72872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671281, "uuid": "0e21f98a-efd1-4a54-a832-1c52c9929da9", "value": "T1F0E48E87F7B391A4C36461F01972B7761A67894E4B3187F362ACEE2DEC32640593B139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671281, "uuid": "5cc9e474-fc82-457b-b0cc-5eed9ddf80cd", "value": "12288:6OdhwL/5NYJDi7LLzOosV3brkwWaSvl6:6O+5+JULLzOHVlUl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671281, "uuid": "f853d925-48ff-4059-9924-405d46613443", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671281, "uuid": "982e70e7-88ed-4a07-8f24-e9b81c761c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671281, "uuid": "9b934ae5-aaaa-4427-8a39-55a9d3f64d7b", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.7182.19625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedd31a8-64d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696657592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657592, "uuid": "0c22fef4-1a6a-4649-ac67-09d820ed6ec3", "comment": "Malware payload (RedLineStealer)", "value": "24e0da23f3e5700f63f73c5acb5c16e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657592, "uuid": "78a922ac-12b9-4217-acca-7188484ef3b2", "comment": "Malware payload (RedLineStealer)", "value": "d846e2702a0957431920f99f02eeb321fa9e69a6082b6de828e8ee951e1aec46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657592, "uuid": "3bc98bbb-027d-4bdb-b86b-ccc31fe709e8", "comment": "Malware payload (RedLineStealer)", "value": "1c6446e2e7fe531be7cc578f0cc530d356aeea30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657592, "uuid": "96bdb3fe-5659-4c25-a009-f0046870f617", "comment": "Malware payload (RedLineStealer)", "value": "e86e7bfe685fc126166d6431f1e8c9fe05cd468df7a3730dc1834684756e93d989e29bafc96b3f55c6d4425fbd07b336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657592, "uuid": "a133bd93-18b0-4411-8ad1-014e2014c5f8", "value": "T17B45231AA6F44075DC6A3B7469F723C30A30BD9149B0428F3F52AD5F4E736A0E53279A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657592, "uuid": "906cd972-d04f-4f79-9f5e-0db637e68b88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657592, "uuid": "3eac9ddf-689f-4377-babd-4172c393a7c9", "value": "24576:3ysGgmsOwA74klKPoGwYDvKZkVe2onAykcwCwg:CsGgpOwA74klX/YDi0e2oBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696657592, "uuid": "33391125-2026-460a-bef3-f5eceb12b061", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696657592, "uuid": "8fdfae07-eb6b-4ac4-b224-cb722681fef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657592, "uuid": "9583dd40-96b5-4aff-8d7b-3f4da495ad3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cc1f9d-64b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696645387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645387, "uuid": "42275ddc-82bd-43c5-90e6-6d02dc07c524", "comment": "Malware payload (Mirai)", "value": "0e5d2b979a9d04edfd7284fd12936f0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645387, "uuid": "e6689533-2d4c-46e2-9153-cd63dccf3883", "comment": "Malware payload (Mirai)", "value": "d8adb37231df65bbd24c09a44f27642622059ac358c38e505c65a9cb671f7562", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645387, "uuid": "288e951b-18d0-44d0-b568-651b56209a58", "comment": "Malware payload (Mirai)", "value": "8f6de70d30a62b959f801e669a553152ee585796", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696645387, "uuid": "411dc6ea-ccc4-450c-bcfd-c30e10d1ba11", "comment": "Malware payload (Mirai)", "value": "9b5f79887a4571e9e428b4ca94cbfbce59262ec563f52818d8b65d21ac3fdf840c7e53d61e359c88a8b571403a6133bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645387, "uuid": "bd9adccf-23ee-4636-93e9-bf94b0b89b5d", "value": "T1C3937DC5F243D4F5E88705B15136AF375B33E0B9101AFA42C369AA72ECA1911DB17BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645387, "uuid": "d179549d-516a-4fd8-96ee-b830038cf259", "value": "1536:/OU4F8UAvSebhzETAyuNbIm745hiAnbMoDR6NA6sSmxYS9tk4Nt7:/OU4KUoPNnyIMm74f99Rb6veFxr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696645387, "uuid": "93a30a02-b110-4920-9da0-9127ba552caf", "value": 89704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696645387, "uuid": "5449a375-c10a-4830-860b-cc5332efa640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696645387, "uuid": "da3c3bca-cfb7-4e61-83ca-5f1187ef4831", "value": "0e5d2b979a9d04edfd7284fd12936f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1352f98-6536-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696699660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699660, "uuid": "e5e09723-7506-4021-b8b1-b73352597bcb", "comment": "Malware payload (Mirai)", "value": "71d04d9252ca59167bbfb17e1ae122cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699660, "uuid": "70c6c5d6-8364-4e50-a2fc-f4eb6680bae2", "comment": "Malware payload (Mirai)", "value": "da9a025466d1be7e46ea22158d93583494873bcf0d7073449f6fff87f87bac12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699660, "uuid": "28e950a7-9ba5-49b0-a4c2-e839b738be05", "comment": "Malware payload (Mirai)", "value": "79ad316459e174a28deaedd90db7f3ea807c63ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699660, "uuid": "c3df86d4-7580-46d2-9ad4-6352fca3bb68", "comment": "Malware payload (Mirai)", "value": "4d85a333d465a34154beaca47ea883f6deaec7450d05d3e0ccfe7fe9bd184e4f53979ab55c9525bcd6fa48b5a3ca16cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699660, "uuid": "6272e925-cedf-4b63-9c60-b3af2745ffc0", "value": "T13E336C36E029DED0C6560134A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699660, "uuid": "2cd3bbb6-053d-485e-b321-7923bcdbd47f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699660, "uuid": "3cb5b508-a7ca-4383-abff-4eb513381cd4", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699660, "uuid": "3399dfba-f897-47a7-b8b3-d9d9143d905c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699660, "uuid": "5ea8b660-b72a-4b16-9727-f33871aafdba", "value": "71d04d9252ca59167bbfb17e1ae122cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a49a789-64ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696639788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639788, "uuid": "044b50a6-a2c1-426d-a08c-7f114e3f6895", "comment": "Malware payload (IRATA)", "value": "9af429f6c91cf177f46148666882e370", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639788, "uuid": "5b5b6c44-47b4-4686-b5a1-da3a4689f778", "comment": "Malware payload (IRATA)", "value": "db066b4abff45d28c8feb0ff2b771fbcba17813966cd5335340154ab63dbf6fb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639788, "uuid": "f7dc2a68-a6c5-4248-928d-4f60757bb3d3", "comment": "Malware payload (IRATA)", "value": "e6b3f3e42b2f6a15ec5f4180f7e0280bb729e442", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696639788, "uuid": "a301882f-1ac0-4ec4-9dbc-822d6717b281", "comment": "Malware payload (IRATA)", "value": "10b6cfd425204dafbc06a8eafcb663c601245ee26a428eac831e73481125f22ed7786fbc1109d0834d15d927206b0772", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639788, "uuid": "879cfde9-2007-45c8-93b3-947a38fff92a", "value": "T100851243FB2AB917D932C1323151263A55465D18CD42FB09390C3BFA2BBBDE84F856E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639788, "uuid": "4014c085-adb5-4522-af11-952a9d11b346", "value": "49152:vs/ikkp7XQoGaRzrLFt4dVR+WLLiTEDGHg/+5KZU:wikkpX6alr3+R+WLLiTU8gXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696639788, "uuid": "7ee60ceb-73de-47e0-a826-17ad0323be01", "value": 1858937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696639788, "uuid": "b60e3cd9-d1c1-40ba-8b7a-ee9445b12a5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696639788, "uuid": "a5c64ae7-5c14-432a-8988-88bc20da657a", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e6cb53-64d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696657369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657369, "uuid": "5713db9e-00cb-4fb2-a14c-d4a316841506", "comment": "Malware payload (Mirai)", "value": "5b8d8aa06f054b004264a07118298306", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657369, "uuid": "d32c4cbb-2abe-4a15-aeb1-0e3d374e3302", "comment": "Malware payload (Mirai)", "value": "db887db596d30af479b6712044d2151a9ce70f3dd564d56319ebe14f76430689", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657369, "uuid": "2b838636-1772-4b48-b44c-bb239e914c67", "comment": "Malware payload (Mirai)", "value": "941f3a9b0df20f2521f65294e91882f7f25eed86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696657369, "uuid": "46316add-661e-4455-87a5-803b8440cb90", "comment": "Malware payload (Mirai)", "value": "9c463696b849502df56d3979987dbc788e46d89934d939d45f831280edd608c02c7478ac779f518fec5f46b5567fa233", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657369, "uuid": "8574bbb5-c5e6-43a2-a0b6-5b35e3a38576", "value": "T1AE03F751BC829A67C2E1137AB66E5A8D336163ECD2CFB217DD204B207AD511F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657369, "uuid": "ebd81509-ec0f-4524-9f39-58680a268018", "value": "768:QgFcCbwsG5f0OlnlUlQOBFdApwA3b9zjWl6v+bJ/9kJXoT2/N/wW:QmbPG5fXlUlbH4pmQv+gJFOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696657369, "uuid": "a4517280-23ad-4ecf-b9c0-25860a644a42", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696657369, "uuid": "36c21d3c-6483-4f48-b595-f53a538fd3a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696657369, "uuid": "a8fda4dd-0d79-4086-82d8-9b07cffe9d29", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a416738-654a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696708131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696708131, "uuid": "88123b6e-7ff3-4191-8e6d-4222d3e8fa05", "comment": "Malware payload (Mirai)", "value": "b029dd3e1c6ad6c36735665b43d1a464", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696708131, "uuid": "61e9dc26-aab4-49c1-b94e-0bc83266cf29", "comment": "Malware payload (Mirai)", "value": "dc8f3abaedaafbd8dba3350356f08609c5f38093fa0b85521115bbf9c19c60fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696708131, "uuid": "0d5dcdfe-e9ef-45d8-acba-b66555b74532", "comment": "Malware payload (Mirai)", "value": "67e156bc4c80e8465df0c42262e00f4dd6cd2b5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696708131, "uuid": "8c87c0d4-9c7f-4c24-b5f8-5dab8d2caacc", "comment": "Malware payload (Mirai)", "value": "65a87be39f4870771ccdd426c9779aca9716639a5051d2b52a8e28a2e7cb6a2263f692c9c22b37f72b344873d0344740", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696708131, "uuid": "68a0b15e-5542-4f7b-82b2-6ba4de929658", "value": "T149534A217A792E17C4E4A07E25B38324B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696708131, "uuid": "e9cd479f-2f0d-4342-8a3c-dc91c9cba9c8", "value": "1536:IDK6bb9lTEFq1X6JySbe5/Tbrv0kCipdYm+A:mKQ27be5/Tc9IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696708131, "uuid": "7c4c7b0e-4fe3-4198-9ea4-e0769319e5c3", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696708131, "uuid": "78b4667f-aafa-494e-8606-548e6c3ee1e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696708131, "uuid": "7aa6b6ca-8018-41a5-9652-15dadf1d481c", "value": "b029dd3e1c6ad6c36735665b43d1a464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e0a014-64e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696664201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664201, "uuid": "51e6e0d1-3500-4ddc-84ea-19a7326a4d02", "comment": "Malware payload", "value": "aa84aefbe4ac178361349160e13d868a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664201, "uuid": "9975d4e2-b29b-4660-86f9-52f11fff868a", "comment": "Malware payload", "value": "dd1c4cb15b4bc643f80ee1e418d2d4dee35ffc3032427cbdf3c27578d42fafda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664201, "uuid": "e1b01efe-1ebc-4bd3-ba8b-ae04ad72c1dd", "comment": "Malware payload", "value": "c6f3f235d09cd083dc11912e25f8add120ef5389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696664201, "uuid": "4b66ea1c-41a9-4859-9d9c-d5d431fcf213", "comment": "Malware payload", "value": "5ab3a6aeeefd1aca4c30e29a946228e4dd1608d137a3b0585234a88924f0fda6bb8017844bcd19654c44ea1ed94e117a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664201, "uuid": "e1cabcdc-7a92-4dfc-b5fd-3a6972176855", "value": "T119163388D9F85829D796D3B98470590D133DA8331900EDED3CE2ADAB167B634FA4F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664201, "uuid": "18910c43-2895-44f7-9ccb-4e4e189db8ec", "value": "8d9da60ab1e5bc81384af66b8d964906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664201, "uuid": "66448239-4171-46a7-8eb5-636b4f788fb3", "value": "98304:PQFsvw/uCgNqaODFC1Zg9sy/f0S1YbWXkq:Usvw/Vgo4LaUoYQkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696664201, "uuid": "fd7da389-4268-4b60-92d4-d10fec2e926f", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696664201, "uuid": "d61478d8-1232-47c4-9b7d-a83304bfc1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696664201, "uuid": "38a2042d-bc0c-4851-87e0-ee0a03543abe", "value": "aa84aefbe4ac178361349160e13d868a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e79148a-650b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1696680919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680919, "uuid": "fa388e62-e7bb-40fc-9531-0164a598c655", "comment": "Malware payload (LummaStealer)", "value": "256db7ccd988a48d7fd97cb1f0edb8be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680919, "uuid": "b4de0ae0-59a2-4cb0-a5bc-a2aede87a5bf", "comment": "Malware payload (LummaStealer)", "value": "dd244d20e5646deac770faea203a978a2955efa2f3be320705ba498fc5b05187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680919, "uuid": "21823fe2-d66e-4bb3-a1c4-98e650ae26bc", "comment": "Malware payload (LummaStealer)", "value": "c77d73ea352e0f9f45ff10822c0400afa6ff75c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680919, "uuid": "d1367abc-3c01-4274-81f1-85eba7bbb2b3", "comment": "Malware payload (LummaStealer)", "value": "2f021d135655e7a1f5e82e4f5acfacea0543e76674248bf532ddb751a302c6e3e2804a2fbde0dd1e2c4f93e6841dcb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680919, "uuid": "35bd9f6c-7cf1-48f7-a61e-a737bff276c3", "value": "T128958D14FBE8E866C3556E79CCECD756F166ACA0AD21C21B3880576D19B13BC4B883C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680919, "uuid": "ba1af374-17f2-4861-baab-ca42ac0ccf1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680919, "uuid": "3f97f540-1c19-45cf-865a-26aee87aa8ad", "value": "49152:SBminKFeZiCUOsh1Jly2rzxQYrpdL3kq6JFhbDEgJ6u:TLFeXUOsh5rzxQYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696680919, "uuid": "c14d1282-39bc-4e65-b5f9-1767a5e85cd0", "value": 1967904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696680919, "uuid": "51a2dd68-cea6-4f99-90c5-6957b750566e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680919, "uuid": "4f66cc63-64cf-4053-b452-008571fd4992", "value": "256db7ccd988a48d7fd97cb1f0edb8be.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77064de5-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696663861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663861, "uuid": "96832d48-2ccd-4eec-91f6-c00c5ac0f68e", "comment": "Malware payload (MysticStealer)", "value": "c16cab1c845d4f73318c21821b3b3337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663861, "uuid": "f5b2870d-07b2-484f-beb5-b1e16ec45fe3", "comment": "Malware payload (MysticStealer)", "value": "df0b9492299708ab0be01adba36a7a6528172c0599a830ecd965189538d0d4b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663861, "uuid": "9b479bd6-9dd6-437d-aad9-dc541d753733", "comment": "Malware payload (MysticStealer)", "value": "01660d42de619ab5497cd40dda2cf79d7b9684c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663861, "uuid": "c996e4e0-3f0e-4cab-b8d8-a58f9cf86346", "comment": "Malware payload (MysticStealer)", "value": "0dea1bc8c482727c5069ec17696a8ae703033b51198fff610aa55a7ca4e565698d98959019171e4499ffe768ce2e0120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663861, "uuid": "80af5635-17b2-4fe6-a2bd-4baff9271b46", "value": "T11184BD1078C1C473C66237310CA6D73C763AFA662B3265EB77684BBD8EB46D0C6B1619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663861, "uuid": "dabdf1ae-41da-46a8-87e5-b2090c40165d", "value": "06ede52fcc31e4900f4f1a7060fce645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663861, "uuid": "12c0427d-4030-48e6-ade3-e6ebe856ba31", "value": "6144:CLCFCH557yGY/fjBximSLB5aAOniJvJuL6z6O2NqT0Kbw9FRfhPzhMm3tNj:CLZHr7yV3OWk9AL6mAgvb1jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663861, "uuid": "479326e6-45c1-4422-ae11-798afcd547ed", "value": 387448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663861, "uuid": "251b9ca9-3bf6-4780-a44b-ed2e85dcd3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663861, "uuid": "7dba74f6-d198-423f-aeb7-74c849388f6f", "value": "c16cab1c845d4f73318c21821b3b3337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9eaf406-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671301, "uuid": "d53fe17c-721c-4fd3-ab27-81d436cab28d", "comment": "Malware payload", "value": "81d8a12c4aa2df66f442a1cddca08998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671301, "uuid": "69f33342-a413-4929-a76f-efed37e45812", "comment": "Malware payload", "value": "e0c2e06d19a8118e975efb86808e1b1eeb821edf66cf2b055620154a2df665e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671301, "uuid": "2608919d-3f20-4ca1-9041-6dd19b1a4878", "comment": "Malware payload", "value": "8ac21c57f8d44c9886a79af39ff03f7eb8710013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671301, "uuid": "901b2d6f-fce5-4f7a-a517-fe6b2e34ac7e", "comment": "Malware payload", "value": "dc5a9deab22462083eab14831d84001e24254de3407481fbb6253dbef24dd4a3d38ddaa105dc9676660047d4149e3144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671301, "uuid": "6c75aa86-d617-4189-bd2b-ac197bb7b4ed", "value": "T17EF53362B3C30E39F9C84E39C4A06985AD2A7CB524F590643F7CCB4E1AF65C39974B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671301, "uuid": "a8f9870e-651d-4d13-905b-3feb21c37b6e", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671301, "uuid": "ee8e5b07-8f4f-450b-95d9-ce9d4815d21f", "value": "49152:FMQt+p2Re4qlbfsDLzbBXYrCUGAoYKyOPal9LG4C0RbtAUHZ6O:2j88hloD1X8CcovfSJGq+kV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671301, "uuid": "ccb50efc-4d2d-44a5-b352-b4737b1e955f", "value": 3389106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671301, "uuid": "0face8fe-d4d3-42ee-a3e8-e620582f12ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671301, "uuid": "6fe7e1b4-ef1c-46a7-bd4e-5420b19f5f88", "value": "SecuriteInfo.com.Program.SrvAny.21191.31856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea76b658-6557-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696713876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713876, "uuid": "ffb466ea-b55b-4c16-a4ad-f1ddf8e6db35", "comment": "Malware payload", "value": "09cdd424edf08adaaae91604000d82df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713876, "uuid": "64a1f746-7bd3-409d-a0b2-8d439d7a577e", "comment": "Malware payload", "value": "e1211fd5d7c8ce7e49b600924929c7d6dee921e7d6df3252ec838ff5f6af33a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713876, "uuid": "ae9db358-ae05-403f-840e-a0e0c0dbb098", "comment": "Malware payload", "value": "3f075a896f693bd4f7ddc19e764c093bcc2ae3a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696713876, "uuid": "8b300ba9-5881-494a-977d-e8c3dbcd8472", "comment": "Malware payload", "value": "a01163808842457089af47b9d9d3e93fdab07dabd6d49c00129d092184e63e115025592ee80c0f4d70a0f3d0db6c2023", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713876, "uuid": "51a7e1fe-f7e3-4eab-88c8-e6010b3631ec", "value": "T1A1F2E161D1DCADEEDE8FA7B1CC6C97E6FBC8CA9CABAAC96162117B10C40116C504CDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713876, "uuid": "abf2b914-2faf-4597-95c2-8bc2a859d453", "value": "768:6TBcrqiyJYiNKVfAsO7Be9Stje09drm1IgK4uVcqgw02NWXb:6y+iWNK5AsO7AAtjeA1m1IgK4u+qgw0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696713876, "uuid": "22ec2026-2207-4f92-a89d-dbe651698e0b", "value": 36624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696713876, "uuid": "ee74a8ae-be65-465e-9109-73b391b1cc78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696713876, "uuid": "457216ea-4ee5-4e58-809a-3f8804afea1f", "value": "09cdd424edf08adaaae91604000d82df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b703b7e-654a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696707999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707999, "uuid": "352467da-8463-4c6d-b0dd-02be538a1e0a", "comment": "Malware payload (RedLineStealer)", "value": "1803be130a5c4869e94081499f7d9a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707999, "uuid": "fa55042a-5ad9-4539-973b-3f2336c8fb5f", "comment": "Malware payload (RedLineStealer)", "value": "e17edee69d728b0d14ae104f4429b632b03274fcbcdf93141af5f36199c6b9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707999, "uuid": "3b51b863-324a-4080-a60f-6e4e9018dfaf", "comment": "Malware payload (RedLineStealer)", "value": "5c9d21ec615741886a2c33ee03bf7ad3c4f8cb22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696707999, "uuid": "229c412e-ebc9-4661-bce3-c01a5372d263", "comment": "Malware payload (RedLineStealer)", "value": "070027bd4e485bd9e42c7e41e0a94438730592a59a99cd81fab2e22aaa45870a1386da5624388402c01d65d04d6526b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707999, "uuid": "336fa826-66f0-4c27-8de0-b7c13662c4c3", "value": "T1B7952313DAE96077D9F8B7BD28BB47430B31BDA51874C7AB1287B49E0C62811E53533A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707999, "uuid": "6188e050-ec55-4e67-ae81-8faed10002a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707999, "uuid": "013d2690-1212-4925-af4a-157335f2960d", "value": "49152:jYa1j9oaGm/bRa6LjkD3m41Jnia+dtzZ8fT:hJoaGwRaSkDW419uJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696707999, "uuid": "020d7599-f4b0-4cfc-92af-2b05cfb479f6", "value": 1889280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696707999, "uuid": "9794570e-9225-4c13-9020-825d9c5acebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696707999, "uuid": "ba3247da-0690-44c9-926d-3ff3623d1e2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a4d079-64b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696644399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696644399, "uuid": "42f07417-6b34-4358-a75a-8a9674b15385", "comment": "Malware payload (RedLineStealer)", "value": "862bc0154e95b4ba89cd345a519b20c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696644399, "uuid": "d9a7fea8-2e63-4f5a-8898-507570d22308", "comment": "Malware payload (RedLineStealer)", "value": "e1a25ebbc444241e1d7dc58095c4a39accafc85f44f5a36b603d92e350da926f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696644399, "uuid": "e428af48-bb48-49c3-8216-be086f90e974", "comment": "Malware payload (RedLineStealer)", "value": "7a076f81bac576c282ac0c483ac484b435f7aa49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696644399, "uuid": "d658f0e7-a4de-445d-af5a-b62169c29875", "comment": "Malware payload (RedLineStealer)", "value": "6797ebbacd6863a4ab8779581bdf964957f781d74f371194f89cbc2410b73940236240491c2aab43e167f76dbd8d307a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696644399, "uuid": "478f4c1b-e836-42ef-b621-ddd566d7923a", "value": "T1C34523139BE05472ED7127B196F707870735BC77CAB8422B3B925D0F2AB2694A031B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696644399, "uuid": "5e068a7a-0f2c-4e48-88d4-298bd6dd0ce1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696644399, "uuid": "30ebfa36-a367-4b06-837d-0804ab8e9f13", "value": "24576:Fy6vVmlr/P0F3p+KnFpP1Krw2+mtL1XEoFt/AEjP/EJ:gXlr/MflFpkk2+C1EoFt/AI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696644399, "uuid": "e4c2ecb8-4704-4730-9770-ba14032492f7", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696644399, "uuid": "351c4892-cf2d-45e4-8b03-b35ad5a65b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696644399, "uuid": "5dc8c37c-c81d-406f-9b05-ca79b6d7c1d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f73123-64ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696668256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668256, "uuid": "f5bb3c11-f589-4399-bb0e-7124c7bc9f54", "comment": "Malware payload", "value": "ef335024006218acc395ddd741e982e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668256, "uuid": "2df4a563-5630-48db-b874-46ae00ef2517", "comment": "Malware payload", "value": "e2e5cab929ece313ea0729096cb56b825cd2d1d3b76554b2402b6ffb6bfdf1b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668256, "uuid": "5eb9bdb5-7d12-44ab-b6c0-add57a607530", "comment": "Malware payload", "value": "5e963ca9bf5f357662d11982f18b3ef4b1ca9f53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696668256, "uuid": "2b295e59-10de-4100-8735-17fa7afea6ed", "comment": "Malware payload", "value": "f118278b9111fa4b51ddeb77cbb7a0953729403c71469c6b46329f3efb0e3703499578334bb0056943c3e923e281f47e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668256, "uuid": "f51dc766-9c92-475a-ac89-b1124c6e2977", "value": "T17123F1EE3DD1269DDF9DDD3782990360DC80A3D526CA568F930188C4C29E7FB794E428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668256, "uuid": "79c40e43-4295-4f75-a8c7-9423dcf6761d", "value": "768:+Jpo71AqXfA0xeFZRB9orghNA+h8bgQw3S3JsgBKIOP7pgbHarCZ7O0HybWMW:+I5A2fA6eFZp/KTwi3JYpgbHTC0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696668256, "uuid": "6b700498-1e74-4e5d-bec2-8ed4680523c4", "value": 47392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696668256, "uuid": "93ec340e-05b2-4e47-b46b-ef452b578c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696668256, "uuid": "465c247f-ae65-4050-a1d4-39616a396821", "value": "ef335024006218acc395ddd741e982e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9ebac6-6500-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696676193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676193, "uuid": "99752ae8-33a5-450d-a9ba-dd5154749c6f", "comment": "Malware payload (RedLineStealer)", "value": "5c2faa33906b83d9763d9a3d23d0a434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676193, "uuid": "16e36e3d-fbae-444a-8833-9578c150908d", "comment": "Malware payload (RedLineStealer)", "value": "e34ae89a36844c63acdb1ce9e7e079965a580628f239f37d47cdf7968f41d62b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676193, "uuid": "180533ba-b196-42a9-ab79-dcbf253b774d", "comment": "Malware payload (RedLineStealer)", "value": "73256e84b2255901bf761273b2769f0e95b8a796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696676193, "uuid": "e0361c86-c9f7-46df-9fb6-22f4924681dc", "comment": "Malware payload (RedLineStealer)", "value": "6f557538e9db1b2cde1fe90c0141893d6466d017d93312432b5589cf5a154e64e57ad05a57c71baaff9deaddb3bf1452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676193, "uuid": "c764239c-dde6-45d8-b9f2-7a6014d61323", "value": "T10E352342FFC18837EA7027B0A8F6019307327DA45DB4975B5B566C1E1C723B2A97932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676193, "uuid": "1e1651d5-c8e1-4a82-9f20-0e58bd1b3f40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676193, "uuid": "d45de8a2-df4c-40a7-b5f6-3d6acc5f0e3b", "value": "12288:KMrVy90d9XhptTOnTFAOk2cFjyPN7+Rg9iabCka6dpitwPIeqdB2wx0jVoaJVU3p:nyY9OnTKOUmPNu8ZdwmP0xcZlA/tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696676193, "uuid": "9faf1547-d495-4544-b15c-070a267e6960", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696676193, "uuid": "77ce2a38-8719-46fc-8fea-d15e9f0b604c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696676193, "uuid": "40236d96-7caf-4177-9bd9-be46d07b07aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0333369-650e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696682506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682506, "uuid": "f2027a2e-27ed-4245-9c77-b3706452fd5f", "comment": "Malware payload (Mirai)", "value": "a21b93e6f10e66dcaec534a83570a542", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682506, "uuid": "5773b7d7-0030-4fb5-8067-e3d7de4ba1dd", "comment": "Malware payload (Mirai)", "value": "e509b95f02a6648a27e68f6f2b99fe60bc52a27b2101cf592de4630a4658f45f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682506, "uuid": "c851287f-2b7e-463a-a1df-e793c027bb7b", "comment": "Malware payload (Mirai)", "value": "52502803ce8fd0a4e615b3593e64950e154a6b9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696682506, "uuid": "7b9f12dd-0add-4aa5-8903-58784906d0a6", "comment": "Malware payload (Mirai)", "value": "a0244fb365d1aae041ee2fa4e8b5d9dc61f3ec06511d544acafffc08e8feffe689fd863d62908e3e00ee3de4d7ecd2d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696682506, "uuid": "dcf4eb39-8f5c-48a0-b705-09c9f050d142", "value": "T120338E76C87A5DD0C24842B4A9398E781753E100D6637FFA569DC7669003EBCF2193F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696682506, "uuid": "9651c112-64d9-4019-8f72-e4e312dc0edc", "value": "768:Oaewt35J82fqyUk5w8XiHJsvukLSna0yJBTDCm55Mtoa9aSC6j:Oaewt3XHbjXDGkH0yJBTDP5rTSC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696682506, "uuid": "4f283496-8e00-4da8-80cc-bb654bc89cf4", "value": 50684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696682506, "uuid": "6a75bf3f-386e-4fd4-a23d-4b0fa7f56d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696682506, "uuid": "25073d61-7c06-44a1-896e-a7624706944e", "value": "a21b93e6f10e66dcaec534a83570a542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6796e9-6536-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696699360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699360, "uuid": "c4383a0a-b78f-4fe0-ab9c-84b62252be4c", "comment": "Malware payload (Mirai)", "value": "6e1d2c20a8e180a66acdc4179a1132b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699360, "uuid": "d47eb261-c020-4486-a60b-486cc7ca0ac0", "comment": "Malware payload (Mirai)", "value": "e6d181a234db9ebfeacc6b52191633d46443551cbbf622feba4faa22e7a54174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699360, "uuid": "060a9173-8f48-44ce-a8c1-74ae6197b97d", "comment": "Malware payload (Mirai)", "value": "296161779cf63fc6650bcfdfad81bbaa61efbdd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699360, "uuid": "ccfb2b88-7311-47fe-b365-0b4431cd6909", "comment": "Malware payload (Mirai)", "value": "553da84c65c0e53147afab62c285d7b3b877d6a5a952294f51dc1ab2bea255b3599868e89235ecbbf49abf27eb7021c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699360, "uuid": "933526ba-5db3-4c42-a5f2-87b9243ad4e0", "value": "T123A2D025D345AEF4DFAF9DA052C2C2C27AE947C7268AC8E240FEBF016506046B788C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699360, "uuid": "ec725a1b-1145-4382-9796-3bda023eb902", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5xM4uVcqgw05VxJB:9RxsSVsMD6xiJJE5zRWNA4uVcqgw09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699360, "uuid": "b3b5a8e7-a1d6-48ff-a19e-28b937b8aa36", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699360, "uuid": "eb6758e2-1a7d-4cf5-abe8-2d1412379258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699360, "uuid": "602b57ad-feee-487d-b36c-1f1d9d229f9f", "value": "6e1d2c20a8e180a66acdc4179a1132b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b644e1-656b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696722213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722213, "uuid": "80999319-f45e-4348-aabc-9fb7a6850891", "comment": "Malware payload (Mirai)", "value": "040dfdaea08fd31372f12982d00044aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722213, "uuid": "cce5a4e8-e6d7-42c0-8617-82b5c3464a15", "comment": "Malware payload (Mirai)", "value": "e87bfa0dd7418d1ccbca74db12b4d09dcffec002941fb32046d401fcc8ab53ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722213, "uuid": "a10edd87-d51f-40a9-925f-349050398afa", "comment": "Malware payload (Mirai)", "value": "1af4c04aca96d56f9f8ce42f154778efa87b7859", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696722213, "uuid": "ee75e188-0243-4a75-bba1-2523b2a73635", "comment": "Malware payload (Mirai)", "value": "2d28c1928bb98a897051fa671f56c7ced500bf1aa0fbed42580d3a146d5e51767c4b3740d1fa19a86f8706ab345ca042", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722213, "uuid": "c83f6987-64bc-4a66-bdf4-c516bbed18b0", "value": "T12DE2D0AE71E5289FDCBF2D76988C67B8A960B280F26E0F4C127D4C457B28643B45D0F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722213, "uuid": "d2cef853-bc84-43c0-a12e-745a4468ba6a", "value": "768:Q0HewZYDeNbsuSxNmHngzAaJh6eqd+RwTzLlIvgPTv5TGvWg:QK7YMstxmP6yxb5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696722213, "uuid": "cdc43622-3580-40e1-bd4a-0a4812ed070c", "value": 33248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696722213, "uuid": "f65b34e8-2a1f-493a-8479-3170be288097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696722213, "uuid": "935374b2-c930-4434-ac77-8a7e0db1bcb8", "value": "040dfdaea08fd31372f12982d00044aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5a8bf2-6543-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696705291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705291, "uuid": "8649e882-37aa-45ac-b0da-3cc245ee74c1", "comment": "Malware payload (Mirai)", "value": "dd7048749be8fc0cbfdc665ae40ee5d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705291, "uuid": "9d8aa240-3673-44bb-9bdf-6ff0ec0ca85e", "comment": "Malware payload (Mirai)", "value": "e89b3c1fa6b6bf04e011731ea27b1353087512693049c890ec4b9ac4c0a83032", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705291, "uuid": "67cde432-4b30-47c7-b3f5-8d752f8a5ae5", "comment": "Malware payload (Mirai)", "value": "1c1eb755822d797c4c698236448501ca76d4d101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705291, "uuid": "85ad8a83-156b-409e-b2b2-14d2a9cb0126", "comment": "Malware payload (Mirai)", "value": "9e2b66b6cb91a99eb92c20b2bbec44bc4468fd601918e49049bf331c4aad282d2e0b4fa9e8fa94aee9535677250bb2c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705291, "uuid": "db32d584-c696-485d-a58f-f698ca450001", "value": "T16973980A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705291, "uuid": "95dd8784-47c3-4958-b50d-8713aee94b6d", "value": "1536:HogWL2T87i8qXc3SEyOlTXLKgLhaV4+6uHO/YQBS/hP9AAZd42+Is:HoB2T2qX49NXLKgLwV4+6B/YQBSJP9/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705291, "uuid": "eb5bd8f3-bf3c-409b-9c2f-a83de7bc1420", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705291, "uuid": "ed38c280-91ff-41f6-ae91-b00c7e33790d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705291, "uuid": "f39869c4-c672-4e9c-8d95-0d180cce2df5", "value": "dd7048749be8fc0cbfdc665ae40ee5d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdc3e64-654f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696710120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710120, "uuid": "5419fd35-6eab-47f0-b791-307272c03e47", "comment": "Malware payload (RedLineStealer)", "value": "e7a275a7a4ff05d6993bae3017313d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710120, "uuid": "0c378ee5-da4e-4e2f-aca0-13a0a3922ec1", "comment": "Malware payload (RedLineStealer)", "value": "e8d98f7ee4457766d87a1886dea6dc4c02dd4589427ad4193cb5ba15262f33c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710120, "uuid": "e1d6344b-b00a-4cec-a3fd-c91dcb265edb", "comment": "Malware payload (RedLineStealer)", "value": "86aa7737b03a7c1081c6f18e26db4d0ffd3f6710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696710120, "uuid": "213ed052-2fe7-4df5-a6a0-8d2045bff0f7", "comment": "Malware payload (RedLineStealer)", "value": "a28ec1f3e8c0393946fd25c37bf67083eaaaf44c48c19bd4fff7708900e695328b1eada25645d3b0c1aa7c26683229bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710120, "uuid": "85a0d34c-914b-44ab-813f-edb6aad387ad", "value": "T1A0953353A9CA0032DDB63BB472F742D71738BC519C35932B1B86DAC948B3ED404B6769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710120, "uuid": "304ec718-de7f-4c4d-b0c3-d1ba3a801b28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710120, "uuid": "7c5761fb-d965-40c9-b82b-ab7b173325f5", "value": "24576:oycYbWeqM7AKd0SQabtXm5bU4yPRELFdNkCzQ3gEZAyTDavsXI7x/Vv9mr:vRSe3AYBbbSbUZgFdNkyIgUTDo7x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696710120, "uuid": "7b5de94e-4545-40d2-822a-ccdfb3e999be", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696710120, "uuid": "306ea876-f246-4bb8-990d-455b58698fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696710120, "uuid": "af1ae8fe-856b-4f51-9d91-0e65be4111df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54838659-6542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696704605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "6986f07d-8fa4-465b-a798-502e07a14ef4", "comment": "Malware payload (Mirai)", "value": "c637dccc7a69574bd1dae0b7b0708062", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "e6f7a382-acfd-4164-996d-4c533a1e33cc", "comment": "Malware payload (Mirai)", "value": "ec4f6da7fe3930949710b8b88ec67cf8be0ee565963c0005174b895cd2cffbaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "d9c7710f-002c-47bb-b378-6f08e8dd8ee0", "comment": "Malware payload (Mirai)", "value": "910aa92aa643a73d1b313f78b5c45eaeeade8f6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696704605, "uuid": "04ad790a-1893-422e-9d14-8821ba144bc2", "comment": "Malware payload (Mirai)", "value": "4607b9ef5b40a9702525eab830cc252939435203b5be1363ca1e3925be4cdfcb10a5fe5ee2cf6f0be08037bfd837bb50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704605, "uuid": "d6d9462b-83dd-43a4-92b8-396963d182ed", "value": "T1E63329C8D987D9F8DC5215712027FB368676F03B101DEAA7E79CAA23BC49B81D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704605, "uuid": "86a22905-f806-4a6a-ab72-a8fb3c22a945", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67Z5P/2Bj6NYcXdZKQDfd:ORKnAvjcV7ZIEJdxZ5P/2taXNHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696704605, "uuid": "96cfede2-ee06-4b0c-91db-adfc666f3bc8", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696704605, "uuid": "d5af949a-2e9a-4e4a-be5c-bef390399dbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696704605, "uuid": "708c3c81-82f1-4d79-9109-26537a2e66b1", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cf86db-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671286, "uuid": "ffc013aa-d87f-4d71-bdb1-0c15ecbd760a", "comment": "Malware payload", "value": "0e4081f0d1799eb480fe71c141e99f86", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671286, "uuid": "82007a06-1e32-48a8-a127-750fcbae6a13", "comment": "Malware payload", "value": "ec7cf7ca0c41190d3756da8ba9e7879093e1a8a02b87adfb695bfc2bbad8c777", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671286, "uuid": "e4004afb-c895-4cca-91cb-3bdf0f955fba", "comment": "Malware payload", "value": "b2e5a2b8200ea7f5b95a7c60f1de908eec53a41c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671286, "uuid": "a057ca41-dacb-49e3-98c8-e162841aaac3", "comment": "Malware payload", "value": "aaba7f31f10af5aa39f903fff9626a7d2193d89784d8219e44e43d517921efc4af1f584a028dbf2265aef783915d85a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671286, "uuid": "d0254e2f-d08d-46d3-8331-cbac5303476e", "value": "T14273DE69CFDB1809DEE6497649B8F10D55DD8FB382A45772B2AC90115CA2EE1C8B0CCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671286, "uuid": "c74faf87-2717-4a46-9f3f-73f8cc162cef", "value": "768:7X0C7nV5TXCetBnjPOJUqKqHAArzh1MkyA5ZAq8V1uPRZIuAaV3:7LLV5jtBbSzhKkbSRV1uPRPAaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671286, "uuid": "802c8f71-bf39-498d-9529-1d98dad9db1c", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671286, "uuid": "d0cd2623-837c-4f73-a6be-3609ce073960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671286, "uuid": "40843b16-c09a-4cc3-ae82-37eb3ca6557a", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.7930.21393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af03f55f-64e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696663525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663525, "uuid": "3786f1fa-de66-4dae-9929-7bf875517e8b", "comment": "Malware payload", "value": "fa289a0c082568e1b83d32eca18f2103", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663525, "uuid": "83d2ddc7-2362-422e-8c3b-eef9c279376b", "comment": "Malware payload", "value": "eceb753907b2daa390bfeb0d8a3ce93b4dcee31c35a012afcc5b4810d9d2d86e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663525, "uuid": "f58698d6-0eda-4f5b-97bc-98d6bc63db3d", "comment": "Malware payload", "value": "db00fc306f64762c9d6ecf8ad347d143d352f381", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663525, "uuid": "e2912805-115b-4887-b903-544b55b4c436", "comment": "Malware payload", "value": "35453810b5aed661caf2603b836a35e82c5dfb5faeaad30dc41fbe9114081f8596dbea6e8471ebd94a58cca47817d03f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663525, "uuid": "14e6c26a-3fdb-412c-939c-927d56738ae3", "value": "T127F3C8557A80C29D330A9FBB6633B5C4D2160B1E99848BC9F148FC9864C6B2BF6FC571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663525, "uuid": "9db4f612-26a5-459a-8aaa-7ee91a4c4824", "value": "3072:1QjUGYKqUN+t7+hIp6otVdIDut5qavepJhvYGkqvAyGCNxkhJjaYSzYVIHaS9t6K:1QjUGY1UN+B+hs6otVdIDut5qavepJhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663525, "uuid": "02a867a1-2438-4e92-bac7-54ab392c5c06", "value": 158172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663525, "uuid": "4d5ff80c-8b18-4617-8e6e-c4ea3463d66a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663525, "uuid": "8fd01270-f3be-4071-ad07-95414972678c", "value": "BLS MAHDIMIDI.user.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced61dda-6536-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696699656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699656, "uuid": "24e342c4-446b-4389-989f-fbe45a34ad6c", "comment": "Malware payload (Mirai)", "value": "262e574d3a1e4aaf76451883227fe276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699656, "uuid": "6c4c1804-b3db-4cd0-b40c-fae105311a4e", "comment": "Malware payload (Mirai)", "value": "ed235f33290f0c6f6bbb125396e8fcb68c6eee17cb11aa99bca46d6b703554a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699656, "uuid": "6bb54a9d-b92c-40b7-ae49-4234acc55f2c", "comment": "Malware payload (Mirai)", "value": "f287b892eec370cbe058badf27e0b0e800e18e90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699656, "uuid": "5a585fde-f68c-48d7-95ca-d45f093107d0", "comment": "Malware payload (Mirai)", "value": "9b598ace315b092a30c02016854a0956ebb83beef3c447d14761736a1ae3154a07f59206b0767d6901e6df5d47326dc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699656, "uuid": "b21164f1-2113-46b5-8b26-250e1777ffe8", "value": "T179C2E1E07B26FA31C4206C3EE52A4D8A7A51467C91FF393764258C35CEC165A63F84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699656, "uuid": "699dd512-3db7-4d64-bd9c-4b05af8c5fe8", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrA9q3UELu6:OKy4qfqoeJdXWgJLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699656, "uuid": "b6503d9f-f7af-41f4-985f-bf067b10ba29", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699656, "uuid": "98a6e1e8-daa1-4ef1-ac7e-56ea799cfc4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699656, "uuid": "e9665e5a-43d3-44dc-b23a-e80c8044bcfa", "value": "262e574d3a1e4aaf76451883227fe276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e3df50-6536-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696699645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699645, "uuid": "3bb35e0f-b7e3-4343-9c75-a21ab10ee172", "comment": "Malware payload (Mirai)", "value": "3973c760699fda42743da2c46f547ccc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699645, "uuid": "e59a9157-7d7d-4c77-963b-4b1c96516bc9", "comment": "Malware payload (Mirai)", "value": "ef14fcd5cd10e055fa92e6c0af25accbd4e4b7b55ed6c2992b993cb663939b65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699645, "uuid": "4bb0ece3-961e-4f61-b1c9-37542b9e7b82", "comment": "Malware payload (Mirai)", "value": "3a444877d1ec2ab690999708aff9947aa1fc58f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699645, "uuid": "fa03d1ce-f976-44a8-bcfe-a9e131ef1660", "comment": "Malware payload (Mirai)", "value": "784f31a1ab63e4b86d22301238e4d4200bad1d5448db2aa0d9d92e4f7d5c6dda8354042d8130d29339f65aa4efe2cc98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699645, "uuid": "9841268a-cdfd-4fc1-abf2-4b6154f5169b", "value": "T14782CF30629B74F4DBF14431FAEE8EC6A71A0BF8D1FC369316586B78894610651F82CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699645, "uuid": "d0919b40-42da-4069-8e54-02a13f9777c7", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa3C4QhymdGUop5h5lz:6GV0P6+kom0tVAoNvm+to1S4Qs3UoznZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699645, "uuid": "a98f90a0-a7b1-4942-a46c-18406682db77", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699645, "uuid": "a8f07a07-eb01-4c8c-803e-6ca04f928fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699645, "uuid": "de2caa73-56fd-477c-93f2-c9a9c641ba28", "value": "3973c760699fda42743da2c46f547ccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18306ad2-6553-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696711805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711805, "uuid": "284ada70-eabb-4945-8c6c-cde81d5f14ab", "comment": "Malware payload (Mirai)", "value": "fabe13042aa32adfbee92677331c044f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711805, "uuid": "3f17cdba-0361-4381-97a5-f34294f714ac", "comment": "Malware payload (Mirai)", "value": "f084ba4041b2fbc57f5997e9f84634f3c78634ff993b0ef821ce89c15a396f28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711805, "uuid": "8d30f34e-6d91-4790-9dfc-783d553aa2b9", "comment": "Malware payload (Mirai)", "value": "f11c02c3278f6f730e3c6948ef4e94e03c641bed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696711805, "uuid": "af1406b8-8ff1-4eaa-9480-8992e42b3017", "comment": "Malware payload (Mirai)", "value": "dedf4c4a5e1971293631c443f350077a605467eb69a791b80c63de662776d4ce593ad3479650d2125f95f43616614c6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711805, "uuid": "140af861-754e-4670-aaaf-f4364a6d0a53", "value": "T170D2E1A1D7B9CB4EC0A5D13A068F690B11A1EE1C19ACD3B627C8327E5D77BB81F12701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711805, "uuid": "3bc02787-2f9c-452a-bb26-51078c3c031c", "value": "768:Bs0RHTX7bzsy+HfSzj9YTu1gAVHiLZkyN977uGnbcuyD7UryqF:W0hX7b9HiSnhiLt9Xtnouy8mqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696711805, "uuid": "82092923-c688-439a-a1d5-d2e304c88385", "value": 29636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696711805, "uuid": "bb13fed7-4d01-41dd-9e44-3690ac34f2a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696711805, "uuid": "ebd05150-10a2-4cdd-b4f9-cd74afa9847d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f56da2-64d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696656688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656688, "uuid": "682c0f09-3d37-40f8-8fd8-734e71749174", "comment": "Malware payload", "value": "01c620fe40bebc576a0d9a7eb490864b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656688, "uuid": "bf6d1920-c0a7-44ba-a4f0-ea9bc5b74e8d", "comment": "Malware payload", "value": "f26eac0f77d25a3ad5d8915c36d64ea6fd61cd1a2a067250e942207744f1eda6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656688, "uuid": "f3d18956-7a10-4177-84dd-a31ed6d46715", "comment": "Malware payload", "value": "d4bca8193b808dcdbdb79367ac688f6f424da36f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696656688, "uuid": "0ef22297-b951-45fc-8fc0-b1cf433fa813", "comment": "Malware payload", "value": "a6d54a8a26c25b26564dfae4bd01f2a3d580389ed4f3ab0f3a89cde6a417aa0caebdc2d4b680920074870241e7826f8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656688, "uuid": "357fe983-da52-49bf-886d-eea809582413", "value": "T149D33A4AF980AF15D4D921B9FF5E518D33630B78E3EAB1028E155F2467CB94B0F36606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656688, "uuid": "303985a4-7652-4958-af19-bf371f2e5174", "value": "3072:E+cR0FNCnciLGs7PIImK9KaogBa6YQY50QD/4B:JceTCnNGSII7KaogBa645/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696656688, "uuid": "c2ae0ac2-bc13-4020-8b80-46e11c979c3d", "value": 133148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696656688, "uuid": "6ab0c9d3-c010-4948-ad84-36d1d4cfd5de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696656688, "uuid": "8f9ba402-84cc-4a60-803c-94b75a72d3b3", "value": "SecuriteInfo.com.Linux.Mirai.4306.18834.31810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0596788e-6538-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696700178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700178, "uuid": "2d3c95e4-6703-434d-83bf-a9f39f46f3c9", "comment": "Malware payload", "value": "599bb7becf556009af70229c4954b6dd", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700178, "uuid": "a19bff0d-3676-4f8b-8e97-52f8a4c86e3e", "comment": "Malware payload", "value": "f31ce6310c7980fd1ec98a273bb6efb569cd141ca87f60cf7e2491012698ebf8", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700178, "uuid": "1cb41e1b-c1e6-4067-b893-94ea0f2ca093", "comment": "Malware payload", "value": "0d5846dafd94d9792f9f7fa9a94146953d6a7ef3", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696700178, "uuid": "bf1b4b48-a72f-4cd4-b4d2-2dd294898698", "comment": "Malware payload", "value": "b095831a4afd614ca68c78750c21ce93a1f52f928dbfc12d28e81130f579f2a9630defbaddd103052ebeb51e0791fcaa", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696700178, "uuid": "5b4d2a65-fee2-468e-9d9b-a7ef6845daee", "value": "T15A51960AFC47D14CAFB9236BED978622FF1B801B5DA2104C75DCC2495F20809A6ACF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696700178, "uuid": "6a3ae891-9944-40b6-b244-59a28d17f6fa", "value": "48:Auz848OjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQBoze:/CWChrffoypvK0elkEYZa5ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696700178, "uuid": "c1bedefb-ad76-44ed-ac14-ffecf50b586a", "value": 3170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696700178, "uuid": "bcc9c1c7-adc0-45b7-8244-08dbd61c8825", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696700178, "uuid": "ae3a64ec-9454-467e-99b3-5626b8ed70fc", "value": "ACScxsev.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745bc61d-652a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696694351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694351, "uuid": "1b0b974d-2b56-49a2-bdea-d048af0eec6e", "comment": "Malware payload", "value": "597de376b1f80c06d501415dd973dcec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694351, "uuid": "79f9ba34-d7af-4817-8028-e6215c6d122b", "comment": "Malware payload", "value": "f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694351, "uuid": "e8035413-f43c-43ee-bf05-737d64017da3", "comment": "Malware payload", "value": "629c9649ced38fd815124221b80c9d9c59a85e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696694351, "uuid": "8ffaa0e0-e47b-413a-9de3-362780d64dc8", "comment": "Malware payload", "value": "3d1e952170d65f401b39c5f62f8d617594343acb74004947a4ccb65d9586b14283fcc0faea88ca1e9dcd42d56c563fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694351, "uuid": "24dabf8a-3df5-4902-824a-3a78542f64ec", "value": "T1A6C34A01BAD19030E273467206798A514A3FFC310BB69E5BB79C491E5BB95C0FB39B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694351, "uuid": "fa7bf333-ba15-4f1e-9d76-54264c2b1869", "value": "0b0d8152ea7241cce613146b80a998fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694351, "uuid": "f936941c-41dc-4cbe-83c9-8d5e1565763f", "value": "1536:Vc4Kvp6PWy/6oU2cpzLWJst+cYsu0TXSkdlgNPldqxFktvVg49jvvck1y40sWjcu:Vc3GJQ56et+cT7SoeNdqbMfN7TId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696694351, "uuid": "801370ba-0daa-4955-b4d4-7d2a3e987693", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696694351, "uuid": "2ec0e2d0-83d3-4cf9-8081-2a8e7fc9ddd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696694351, "uuid": "d9d369ad-28da-46eb-bb8e-75e1f8036984", "value": "f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8265bcd6-6503-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696677624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677624, "uuid": "231806de-6166-4ce3-aaab-60c3174f746a", "comment": "Malware payload", "value": "645ed80c08532d5608aff1e21fc1ed22", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677624, "uuid": "bae434c6-17fd-4f37-b285-28e05231f2da", "comment": "Malware payload", "value": "f4d756a518f1114eb58b06a9c7964b2a1f932e88237f0ab44712b3dce7100ff5", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677624, "uuid": "a241bfac-c818-4869-8de5-45efa7e93f1f", "comment": "Malware payload", "value": "ae3a8517cb3373258ce9bc080c6e49c55a12ed65", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696677624, "uuid": "90aea362-3bc5-424b-b851-4313120b3edc", "comment": "Malware payload", "value": "6593621c855905fc9efe0b01731443871f4c4a6046fd51e7e885d60e267b86752c45598db2bebec57aa435cbaf4f2ea6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "mod-bussines-ru", "colour": "#39E2EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677624, "uuid": "f7dc948a-66f0-46f1-9b17-4c4c9886fc04", "value": "T15D7633C61A106187BF1385EE867174FBC45B36DF274C603845F6B22656A0C4F7EA18EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677624, "uuid": "b8cfcdf0-ae61-4088-ac3a-59720af160e5", "value": "196608:tSgBS6GWjRyZF81C+y3QiX7o2it1QLavQ2q7:tlS6VjwZFEC+ytX7o2k1QLau7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696677624, "uuid": "661470ad-88de-4749-b1aa-717a33cf315f", "value": 7298056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696677624, "uuid": "c0bd9533-ed4b-4e22-b9ce-f65deee2a8bf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696677624, "uuid": "f867182d-dc6f-44db-ad93-447b4a09e6fc", "value": "Murnm.vdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7902ae1-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671297, "uuid": "8124a19e-39ac-4372-8b6c-7cd0b60c4657", "comment": "Malware payload", "value": "c3e9524b2436fff584846b9eaddba3eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671297, "uuid": "d9f93344-fac3-4b90-be41-be39ae089af7", "comment": "Malware payload", "value": "f6f0e3e108fd1c7904d81418ec23b369686bf42afe74d0e8fa31b3efa117c52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671297, "uuid": "3d58c028-fe4f-4602-929e-eb1be7dd3741", "comment": "Malware payload", "value": "cf7d18c5ebaada32aecf3b4c945fb1ab107be576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671297, "uuid": "60b41802-2d07-4a0f-bfce-1eb6597c314e", "comment": "Malware payload", "value": "e45c9d415d0c2f9f643cfedf525e40ae83be41dc75898435be73abaa3ec46104f4d751ef40986437aacbe9d577b48f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671297, "uuid": "b6216650-682d-4955-a5c4-f7146f148c16", "value": "T175063903BB01C137C0B617316E8AF7A9B066BB74AD30954777A02F4C76B26D9AE12357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671297, "uuid": "4d091678-19e6-45c0-b8ee-4e05b7da23b8", "value": "7117c4eca844982b00823d7c1df0bdb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671297, "uuid": "a2a888ee-619a-4640-a56a-9e67ef5fb51f", "value": "98304:JxkOAz+oLAaEUKIRxpMZRxFffIkva/o0juzRqye9pVIVCkIWOJNbWimdoinz4byA:AOAz+U+UKIRxpMZRxFffIkva/o0juzRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671297, "uuid": "0ca86530-9920-4c59-ad35-2766e93c051a", "value": 3966976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671297, "uuid": "ff6c87b3-f2e0-4c76-9c35-9388a420f9c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671297, "uuid": "0aab8f7e-632b-40d1-9967-d740d02f7c85", "value": "SecuriteInfo.com.Win32.Malware-gen.32184.16185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84431e7b-6534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1696698672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698672, "uuid": "c41f5033-c89d-4cd6-9ad6-85705892f992", "comment": "Malware payload (StrelaStealer)", "value": "05ff9e2ad7b0e8d3efbe8b40e7d1d979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698672, "uuid": "1249caa0-6cd8-4c6d-a976-adcc04d88e5a", "comment": "Malware payload (StrelaStealer)", "value": "f787d409487f3708c014ad8ab5165251b7ac2d621afa2d2ec54c8477e67fca3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698672, "uuid": "8a46b4a3-c594-4eab-a445-b0d259925496", "comment": "Malware payload (StrelaStealer)", "value": "f70c442ab0857db23809f0c3ae65c33fb9cda611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696698672, "uuid": "c9116086-7cb0-4a2a-9aa9-48e114d16813", "comment": "Malware payload (StrelaStealer)", "value": "4b61dd71e184e31474b906ba88f9108fb9d14df6115b73987166da325d42310f1fa574e7b5a0c5319cb6d7beab9b47d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698672, "uuid": "fe8281b9-c9a7-46aa-9dd6-ea4e15eaedf2", "value": "T19D548E1363A0BC31E5264A325D2DC6A4772EFCA1CE69B79733587F1F08710E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698672, "uuid": "30a58e19-70b8-4df4-952f-4a55168b46c0", "value": "7c1eb63cbfee83dc3af6e952fc6d57b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698672, "uuid": "e2a0f108-e66a-4409-8161-92884881e99a", "value": "3072:+ZGqW/iitWEGu0yTKTSwJoGTKuj2QOvW7O394a:iGPbWzu0mtwiG2uGeK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696698672, "uuid": "7070c669-eae5-4945-b074-26104811e053", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696698672, "uuid": "b4c0de0a-3fa7-4319-b9a3-6f9211c283fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696698672, "uuid": "5c2d0c09-31fb-4d42-a559-9102827fcf7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc088e7d-64f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696671278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671278, "uuid": "49d74dea-b03d-4764-a701-2c44b3849084", "comment": "Malware payload", "value": "4df5b2c8624ec12b86c7047044ca12b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671278, "uuid": "d9ce118c-8e33-40b0-a7ca-f0b304576b7c", "comment": "Malware payload", "value": "f82414287d2d55fa1c3b6fd68da3445e36371bd29ecd908f3dc655f51f1975cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671278, "uuid": "e7687376-d851-4570-b0d3-24181d4066cd", "comment": "Malware payload", "value": "dc676f3a95adf906e9fa95d018125f2a4cc5e6d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696671278, "uuid": "b2805774-7e14-442d-af1f-dd9a4ba56a70", "comment": "Malware payload", "value": "3d15e9898ef4e507dd2a0dee0327dcc3b879cd01e9e9a656f7b78078ea62d2a49bd11b845f9cdecd5faab3692eb02ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671278, "uuid": "94fda719-42cc-4863-902f-ed1c4dcdf55c", "value": "T1E98423CA6C6E2D10C2779D34139F49069615AF137C864B62F13F3CAADCF6B88184DB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671278, "uuid": "effcc341-9afb-4ea7-8a50-ad0ce8746b91", "value": "23615023d461e78d0629dc17085ae148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671278, "uuid": "f7742051-5c71-46b2-bd1e-b1efd834a7f9", "value": "6144:ETPPdS1gWfjzuPaH7wNqQibnSb5NQ2TiJbgTnLT6JTlgyQZARV2i411nx7CS8UZI:eVwfjaPjibnSNwU6ZS4XQ2DUZxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696671278, "uuid": "c4dfe318-43c5-4269-83f8-dc4801b54bae", "value": 403280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696671278, "uuid": "7f0747c8-9de1-4b89-91f8-1b96faa4e6bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696671278, "uuid": "c1e8f9d6-d4dc-439c-ad29-1a79cb3429de", "value": "SecuriteInfo.com.BackDoor.Pigeon.72.19626.24084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396d05e7-6545-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696705848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705848, "uuid": "5bdc6647-59a7-4d27-88b6-58bc292bacfd", "comment": "Malware payload (AgentTesla)", "value": "905c6dacec04653f241e6c68f7f01a02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705848, "uuid": "dcc4f7e9-c905-4166-83f0-daa3a5077448", "comment": "Malware payload (AgentTesla)", "value": "f9a4e3002fdbcd93464f38fc49bebadbcc0417454c702e8298cf245fc751eee9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705848, "uuid": "e02d80c1-e714-46bc-9a50-9016472de909", "comment": "Malware payload (AgentTesla)", "value": "e4bcf92f9f6f7a9766b68ddaa13af361be1286dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696705848, "uuid": "62bfcbe9-085f-4650-b457-8be93952f363", "comment": "Malware payload (AgentTesla)", "value": "31918d1adc76073769128f88bc56cb98090b572a63b3e65698b83ffff3cd45bd4ca92b92d0c811de9864c8968eb9a13e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705848, "uuid": "57e063d4-f41c-4cb5-b896-92c9ecad2aed", "value": "T1B6E4CF8DA320529FF0152B35CA6D3E1902201C7D7696DBD4B5673A1BEED9BE7183302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705848, "uuid": "f9d849c4-fc04-4416-ad81-9c555d85bc01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705848, "uuid": "40f95262-dead-42a9-938c-26e15a62c30f", "value": "12288:UG+/jlkJUND9Qkie1VUVZeczcvtDgdL82SNNqu+swUJ9U8bl:v+LlQkzURKDgl82SvH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696705848, "uuid": "8bf50cd7-b9d5-4f43-944a-ff387c52a3aa", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696705848, "uuid": "4f17362c-f257-47b2-8af6-12f41ed1aed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696705848, "uuid": "4717af01-041c-4026-937a-b751c8178161", "value": "Release pending bookings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d464d9-64ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696640614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640614, "uuid": "c7d5c780-2768-4736-89e3-f252f190e52e", "comment": "Malware payload (IRATA)", "value": "c0044f26a24a126d939cc7dbef411944", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640614, "uuid": "7d5ae842-877c-42e9-ab94-4fe670b01805", "comment": "Malware payload (IRATA)", "value": "fa6147cd22aa43857617285a26bce57f36fb2c36f3e93d75155920761a476e7e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640614, "uuid": "4ab161ea-c416-457f-babf-c1705963b2b5", "comment": "Malware payload (IRATA)", "value": "05a87296da5c02ccdd4db2a0c6dbd582c12521bd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696640614, "uuid": "41d4c2d2-64ec-481d-bb94-81c6bd104774", "comment": "Malware payload (IRATA)", "value": "8fd7f8825b70645459cdd7f6f1caa027dffeb57c52a9f0d90953d445c280fd0ce8ec82a9b3bad80e871a77c8e6e59bf0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640614, "uuid": "8efaaa4a-2435-437f-b17d-d24d92646f5f", "value": "T116D52343F376B85BCC36C17166442B39412A4D198A42FB5B7A0437EA24FBDEC8BC92D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640614, "uuid": "9d8ee596-3456-4971-9b80-16b8d738bc17", "value": "49152:INEPkk97X4D0ujvLyliAyFGLQ3n4mKY0vGqKW197jltH/YbXQZlep5grKJRUKPCE:WukkdXg0ALylkFGKnXV0vIW1dRB/Ybge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696640614, "uuid": "18c14b33-022c-452d-bd97-154be3057606", "value": 2916969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696640614, "uuid": "d4029042-23ca-4a38-8d51-92bc02bae437", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696640614, "uuid": "a99a7d46-d73e-4b05-b395-478101e790b6", "value": "sahamedalat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd640340-64d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696658503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658503, "uuid": "c8d735a0-747a-45e2-9f9b-57d20cfd85aa", "comment": "Malware payload (RedLineStealer)", "value": "0761b6afbd2f620a7ae66608304f4968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658503, "uuid": "95958a96-3aac-4468-b2ce-408ac51888c8", "comment": "Malware payload (RedLineStealer)", "value": "fb72346658c6324519e985e0f09bd1133f50e511d3d50afd301f53161470eaf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658503, "uuid": "d795ac0b-575e-4353-b9ea-a893ce75a0d1", "comment": "Malware payload (RedLineStealer)", "value": "d599a1562fd0adf8d723366f94943991f58046aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658503, "uuid": "d0d80ce7-f2f4-47b6-8a27-5cf382c03c0d", "comment": "Malware payload (RedLineStealer)", "value": "e7d230d292321fa6deee9b52af248112cbd3d55ef2d16bc8f6b2b8e1b2ac00bec0289e229236d7c8b2a78827f2e4d2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658503, "uuid": "1e81a64a-0eb6-4418-b480-9e97519100df", "value": "T1DB352322EBD99473CCB837744CFB135B1B72BC628D7D834B1B12AA1A1DA16A1D130727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658503, "uuid": "660f92a2-1ca3-40af-9929-0a211b06ada4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658503, "uuid": "95153ca7-428c-4f69-b3c3-f943985f42a9", "value": "24576:My6cCzWnWPLC1forv0S1PPOz6tVm7O+DAPPm5lnx:76LCWPm5ZS1O+tVnyAPPm5ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696658503, "uuid": "02614ce7-7318-4649-baa4-f482491cc3b6", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696658503, "uuid": "b89759f2-dbd0-464c-a7d4-72de3f33bcfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658503, "uuid": "bb720ab3-3065-4676-b706-15bc87351145", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba377de-652e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696696215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696215, "uuid": "e7af8b88-9c48-43ab-bb0f-8ccc5953c2e0", "comment": "Malware payload (RedLineStealer)", "value": "41ca65efa1a298933923b23406a87abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696215, "uuid": "a5fc6842-6968-4343-a1f2-3be6b82e000d", "comment": "Malware payload (RedLineStealer)", "value": "fb86b95c0e2009a719118d660b07d07a823bfb8a74ebb87a5c769433ac7c9751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696215, "uuid": "92c4c122-3dec-4560-bfc9-5d0798e756fa", "comment": "Malware payload (RedLineStealer)", "value": "8b195a2c100c0268972807ad53e0b732d9df9865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696696215, "uuid": "0ee54157-3b12-48ed-a141-9678b9efd040", "comment": "Malware payload (RedLineStealer)", "value": "131d0e61de53b5135d1461c0e1b8864645bb02e1aee5fca27d446c976efc0f9f604e6bc57db9da4710f2193c00319154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696215, "uuid": "18882428-ebd6-41fd-bd03-8bf88d2359dd", "value": "T13C3523135BEC9072DEE53B7058FB17930B36BCB25969835B03828C1A1CB3591A277B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696215, "uuid": "6ab563e5-0e89-469d-9e34-0265f21554fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696215, "uuid": "4c836383-9ef6-4fab-8234-499ad2b3d822", "value": "24576:Vyd9gDJeB65I0jte5zU0aLpfptUu72PvT2LLWkVG:wDSJeB65IwWzilTUu72Pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696696215, "uuid": "a026410a-6120-44f9-9656-9c0ba06b1e8c", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696696215, "uuid": "f7b6f674-5fd0-4f1b-8037-aaf10d1f4dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696696215, "uuid": "b5786ab3-ba6d-4355-9cb0-71cdcbf9dd35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae8ba23-6509-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696680295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680295, "uuid": "ba107a8a-01f9-43a7-bd11-f71e60f41aa5", "comment": "Malware payload (RedLineStealer)", "value": "716bea389faf08ea0668aae1382babdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680295, "uuid": "096857b4-8bc9-4f3c-97db-fa7b0d4f5e43", "comment": "Malware payload (RedLineStealer)", "value": "fcf244a20604eed1b9472af2c2437b836651f2465e626101754bb6ef0c5c8416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680295, "uuid": "1cc568f0-4a8c-4ed2-93af-3c2309a65198", "comment": "Malware payload (RedLineStealer)", "value": "09deb87e7f393db696c81818be5a80d3bfe846e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696680295, "uuid": "e14b27ef-6f87-43e5-a371-00f1d3355632", "comment": "Malware payload (RedLineStealer)", "value": "55f41db6d2fc8f9da9793c9454b009a0f303298fd723cd878da7cb784524956af603675bffe4c3059ec57d2f78f08418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680295, "uuid": "954b13aa-95a0-4829-9235-16e4c805b63d", "value": "T1953523226AE85571E8B257F448F713C30B7AFC6189A4D65B2782A85E4DF32C0B57037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680295, "uuid": "2ec15cf9-600d-4623-8558-94d47c2cae4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680295, "uuid": "cb2cc001-7104-47c1-9b14-a1f8de37649c", "value": "24576:6y7dqJghgaD9u6b5MBbQq9Y4VPU7wFp/usD9:B5q++u5MBbRnVP+KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696680295, "uuid": "6f5028f2-a81a-417e-86bf-a16e3ff08b98", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696680295, "uuid": "f8732a93-fa61-482d-9b5c-00991ec767b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696680295, "uuid": "c4d09487-5957-4d45-b1c8-bcc8ae220a14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2161cd2b-6536-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696699365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699365, "uuid": "b8a97e33-cdf4-4571-8170-e79eceea5881", "comment": "Malware payload (Mirai)", "value": "19c8791019be324b0cf05cfa0ad805e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699365, "uuid": "bcee928b-96fe-4c8d-bcb4-83a8e92ba5c2", "comment": "Malware payload (Mirai)", "value": "fde29e9140a6366db64ee61be3d0d68712d0319cc522efee0b46bc218ebe2a63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699365, "uuid": "507db2a2-edae-4bb4-a15e-e9c5bebba2f2", "comment": "Malware payload (Mirai)", "value": "8f61f50b85e932bc2513f8963fcb7a33674a0689", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696699365, "uuid": "82cac8da-df2a-4983-9518-e81ae056e32d", "comment": "Malware payload (Mirai)", "value": "38a0522b153cb469f4d6b2d29d20e7ef3eb99d31d70b23067d03d1eff84cdfe8be664158092dbc9fd4c7012145649e7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699365, "uuid": "ea717542-2f30-4d0c-a7b2-7390cd12d00d", "value": "T186B2D0CC648435C4C68D7C7C2B8D4A664F6CA1D0BAEE9B26E350CD98B3BDA4F3459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699365, "uuid": "8d58aafe-142a-4233-9bae-4874117dba46", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpyZqEWvu:/QlS07FUXqIYSXQKquWqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696699365, "uuid": "febb87e1-54cb-457e-afe0-c2cc0748847c", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696699365, "uuid": "447bb963-58cf-441f-b939-007f4a4041a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696699365, "uuid": "47188114-77f6-4e3e-badc-8cb25f210f82", "value": "19c8791019be324b0cf05cfa0ad805e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c20638-64e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696663864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663864, "uuid": "5208a290-e71f-4344-8946-27f71a2316ce", "comment": "Malware payload (MarsStealer)", "value": "ce2f670b45f737df2148434194731fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663864, "uuid": "975f5134-6fd7-42ed-be9b-a990d55c0a3b", "comment": "Malware payload (MarsStealer)", "value": "fdf6b1ad42f7b3c555a9cfef369fa1467facd71efd10d0e287ce2f32f77e5551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663864, "uuid": "308e3e08-f362-4737-a49c-3e44512a8450", "comment": "Malware payload (MarsStealer)", "value": "cac9b22132b0a6709c7305f1667f8bbae721591c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696663864, "uuid": "7376069a-5273-4482-8a18-08b6e832a783", "comment": "Malware payload (MarsStealer)", "value": "605f704e1c85d21b0af39968272d70f9051844243d78ea1b5e6e8bef9dde76e02a12e7150f5a67a0bf41b99e75ec0b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663864, "uuid": "3f1d766e-e646-412c-afc5-23a01b1b14b3", "value": "T1E5548E03A3E0BC65E5224B329E2DC1E5772EF5608E69B76B27485F2F08B11F2D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663864, "uuid": "2ca5b469-f463-46a8-ac38-50ef9a5d311f", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663864, "uuid": "0921158f-fa3a-4d17-b023-822f49cafe40", "value": "3072:340vH9Z0C8PpLhD+i6onscMzWrWfanlPd1fXo+2:7VZj8PdhCi/scMzWrWynlPd1Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696663864, "uuid": "1565d218-c9b0-4681-9e76-57768e54f815", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696663864, "uuid": "ef7d9544-16ca-4ef0-8ab6-bdb545041cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696663864, "uuid": "407295c3-8b08-45d7-83c0-2df4bb666d45", "value": "ce2f670b45f737df2148434194731fde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b21f1c8-64c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696649506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649506, "uuid": "b09ff8cb-039c-4c12-bf81-d839199d144c", "comment": "Malware payload (Smoke Loader)", "value": "dde202b7adaadf9c8d422216dc3ebec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649506, "uuid": "850e2fc6-d662-4104-b219-0babbf0927c8", "comment": "Malware payload (Smoke Loader)", "value": "fed65d2ec645b2a01ea7ba68810632bcad754687aa921be620358403ab06f7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649506, "uuid": "eb6bb3ea-ce25-4645-a290-422b65a349e5", "comment": "Malware payload (Smoke Loader)", "value": "3b05869d932629e542baff3e11b3e6000dbd210b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696649506, "uuid": "f0c8ddc8-a57a-497c-9d29-df2e5f77c117", "comment": "Malware payload (Smoke Loader)", "value": "20612f8b1f92aea34eb371f5520e0a2041b0dec4709df9db20cf6f92cb8a544af81d7f8292af2f065045e40c305fd509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649506, "uuid": "7c448247-176a-438b-9bc1-118d7dae13b6", "value": "T1B2547E13E3E0BC25E5224B714E2EC6E4772EF5218E69BB6B2B545F2B08B11F1D663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649506, "uuid": "8e1ef9ab-9e60-419b-a1c7-b5e5d4a50b9f", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649506, "uuid": "df54c796-9ff4-4b1a-8bb1-9e2793bec41e", "value": "3072:3asNdZ+OXkuSNvOGhPfh95A+4eGB4ZHqG3oSRoV8:qoZJXkuWfh95OePRpoPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696649506, "uuid": "946050e9-0d51-4405-bb99-b0da0b9b6578", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696649506, "uuid": "5ff9c268-551c-4763-9f5c-b96a7445ebd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696649506, "uuid": "29d192b9-4440-4248-8d4a-04a4f88cb3fa", "value": "SecuriteInfo.com.Win32.BotX-gen.6122.12428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186f5bc1-651f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696689472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696689472, "uuid": "3a94337e-b972-4946-a858-7aabce89f2c3", "comment": "Malware payload (RedLineStealer)", "value": "8a9f778b773432e900e4e49a8382962d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696689472, "uuid": "7e0cfda2-591e-4163-8fbd-d19a2332d7dd", "comment": "Malware payload (RedLineStealer)", "value": "ff770f0f8ea8c7d6baad7076141a0f969c530963fdc319630db630bd60859b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696689472, "uuid": "d3c20817-5f81-4b5d-b6db-a989953e58f9", "comment": "Malware payload (RedLineStealer)", "value": "73a35d158445dfed9bac7bec7707c181cb56acae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696689472, "uuid": "d407c3e0-8381-4019-a407-9ce74927f8c6", "comment": "Malware payload (RedLineStealer)", "value": "a035e745e4a8e39815e804497906c18d6e92130945d5696759a24353444ef8f1c940c2ccb5efca3f885bc4b140a2c501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696689472, "uuid": "58ef66fa-291b-4175-9c1c-f3b8ae0a2141", "value": "T1E9352393ABF89471CCF22BB445F901830E323CA20975535A7784A8BE5CF3565A8B2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696689472, "uuid": "f84ff2e3-624b-4b22-aebd-8fed1c9c05ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696689472, "uuid": "77ba08e6-7111-4e4f-a9e4-5ce55f4dbfdc", "value": "24576:jy69xjqEsS/jHSB6tbfeIIbVGlLhaJhVuaQC5AJ+mEweC9qb:269xqEs0jyB6tbmbcp4wCenEpC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696689472, "uuid": "e0ab187e-5ecf-43b4-bc8b-90bd7ef2f372", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696689472, "uuid": "55478b7d-cf7c-42e8-ab05-17d58ee40eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696689472, "uuid": "efcac56a-70ff-4f83-aa54-997676afd2a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb809c6-64d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696658822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658822, "uuid": "aeca8f43-4929-46e3-bc0c-fe1b7d3c466a", "comment": "Malware payload (Tofsee)", "value": "c90b80b2069fd5b0ea150f4da688fd1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658822, "uuid": "5c6684d4-5f2c-41d7-b213-1aafce2036cf", "comment": "Malware payload (Tofsee)", "value": "ff8e02caf1e15dd68e6ce6624b32534190c826f0a49f676b21fbd747a5e9dc7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658822, "uuid": "cb3a5ea1-cd92-4ee2-a93e-11bb319eec7c", "comment": "Malware payload (Tofsee)", "value": "3cef63e4505f1a2db6a476181b1bbb1b95aff46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696658822, "uuid": "11079497-23a1-4eb9-ad48-c1c058a5b1ba", "comment": "Malware payload (Tofsee)", "value": "f639fd484499cee4cb811178e2534181ecaf1c9c367192937ee6ce2d0db641447c4406caa4b6a6df3ae87c2cd5ae6818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658822, "uuid": "e0ca006d-9ea3-465f-b961-f3496c6cdf08", "value": "T1CA547D13E3F1BC61E5224B329E2EC1F4762EF5608E69BB6A27585F2F08711E1C663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658822, "uuid": "a1928379-d540-4f3b-bbef-6781647c3520", "value": "1329a392a27bb099e5f0069fb4bf5f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658822, "uuid": "09292dcd-9953-48e9-87fe-69a2f816fdb1", "value": "3072:BsTI9ZxBP4mRKUswvEkVpV8VH2I82CznOqH/4oQ2:WaZLP48K7wvlVpVaH2nOqfXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696658822, "uuid": "21096403-8f93-40e7-9256-ec2ec13e2115", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696658822, "uuid": "f323807e-e0e1-47a4-8bab-e610e2d1ab59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696658822, "uuid": "21548e19-5448-40bd-af61-70a87919d6e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e866ff9-6514-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696684731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684731, "uuid": "8fabbcef-796f-49ee-9d16-3319a4c61b0f", "comment": "Malware payload (RedLineStealer)", "value": "905e453e672a98df2e315f737b3eada2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684731, "uuid": "502e1357-ac71-4722-b7a6-1178b52811f9", "comment": "Malware payload (RedLineStealer)", "value": "ffc6d3189c1ed2f9a20be4f0d140a3622c21d9736033006e5f8b4a64b7184b22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684731, "uuid": "79db4e64-8a23-4287-b972-292dc5aafeca", "comment": "Malware payload (RedLineStealer)", "value": "c3c841bce7fd1e5b52733f8ca90d9b47726c6868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696684731, "uuid": "40860249-ab1e-44e3-90a2-74be5cd31756", "comment": "Malware payload (RedLineStealer)", "value": "570020c25e71bc4f4588db0063c68c7f91e820f42c11e7d8877ac20fb549142c26ae2d4c38bf5507cc08e1e207fe4bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684731, "uuid": "89219bbf-3f2a-4841-ad1a-e16ad4870816", "value": "T16445231ADBFD4A33EDF12770A8FA03830675BD616571426A2B980D4F6D33A947931B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684731, "uuid": "3d6c845d-c0b5-4615-8954-ab3cd309421c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684731, "uuid": "7a7393a8-fb2c-4c8d-a4dd-e1f6753798ea", "value": "24576:by642NXZk7xQLIFSxKQsHtTCjkvcJ9eYzG7iDr0jQM6:O63NJk7x2KdNTed9xn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696684731, "uuid": "67b16f59-52a1-4a97-91ea-71059c06264a", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696684731, "uuid": "78006df3-4bad-4038-98ce-06a926689edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696684731, "uuid": "c20d12d4-1441-4fb5-a2e6-86aeec8f1fdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }