{ "Event": { "published": true, "date": "2023-11-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-11", "timestamp": 1699747381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b0beada1-55ee-4e7d-ae36-a035d2ff0b22", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b82776f-808c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699704947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704947, "uuid": "147e7d38-a55a-48c3-9ac9-8b7898be8069", "comment": "Malware payload (RedLineStealer)", "value": "aa19f63e629b941daf8238964e048aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704947, "uuid": "45c016e5-5f06-4805-ba0b-4a67038721cc", "comment": "Malware payload (RedLineStealer)", "value": "006a94a2f1adf7b9a8015b2e7e9756780364c8639b4223ea4cc94972329bc91a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704947, "uuid": "920a56b8-37d7-4e2d-aa7b-d2ba7d65a898", "comment": "Malware payload (RedLineStealer)", "value": "cc8917b358dcb1be18051d3a555246b2b58bf420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704947, "uuid": "93745e1e-6b76-44f1-b309-95817c248605", "comment": "Malware payload (RedLineStealer)", "value": "df1b8268acaf1aecffaeea74387254f98971299216ad46361121b1e8d4592572ab14147d8c8705e97a692c10b9f44737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704947, "uuid": "f6d14aab-3752-43c6-99c7-41cdf37c6695", "value": "T139F633419DE649E3C1CEA07F96C4F1BD4BED8EC7C29A829718CC4E13BBD9B42461189D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704947, "uuid": "3d552a03-c100-4846-9a55-bb58db4fbe03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704947, "uuid": "f624dbae-de4e-4af2-a9b2-b2e371d9440a", "value": "393216:wM/FNA/LBFlsnRLrcp/+TXnZkEsvLC5HbLtFNSXAazV5N+:wMdNOFMN1TJMG7LW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699704947, "uuid": "20ddcef9-5c14-489b-ac33-65eb97ac44a6", "value": 16423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699704947, "uuid": "6e793265-3cdb-4d82-8320-dcdb999438ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704947, "uuid": "7a141c1c-d710-4a3f-8e81-72cf50ea787e", "value": "aa19f63e629b941daf8238964e048aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0332e3-8074-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699694720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699694720, "uuid": "b03ec452-f044-4d1b-be91-88bdca0e785b", "comment": "Malware payload (LummaStealer)", "value": "710419d0e6c14d032f33709e9178dd67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699694720, "uuid": "da182e71-af54-4531-98b7-3317f5f2d5ce", "comment": "Malware payload (LummaStealer)", "value": "012f273e7823dd960ded3b000bbf19481f738cb7f92b1e602fca49038c7f17aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699694720, "uuid": "a0c17bcc-5589-42e9-ab16-b7924e78d074", "comment": "Malware payload (LummaStealer)", "value": "bc14381e9ba57d6a21258f85c8028f321ecb9338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699694720, "uuid": "2f34c142-4a1c-4e75-a050-a55da4f4fc80", "comment": "Malware payload (LummaStealer)", "value": "98f9fdb7692e1a3eea3fe679efe44d3632b2d8363fd24c527735f88e8f1da9707b8759e2a8a930ad875a414aa43c7e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699694720, "uuid": "95e7b217-6d3d-4f9e-b6e8-a746edc0f907", "value": "T1FE5533927EED8022E4B2677148F742970E7E7C606D3C976B2689685E9CF25A4B530333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699694720, "uuid": "d591aca2-4a35-495e-a1bc-a99fe444a3e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699694720, "uuid": "5de068c1-5369-4f56-967b-9cb79eb6750b", "value": "24576:Ayc010TDtt7aeyIsVCkG1VbDzOY9i1UGqcKex7X9asdCq7ujCRRVJ9OQ:Hh10TD/+eJQ1GLubK3JedQsMq71R77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699694720, "uuid": "d25b06c9-d6cb-4af6-9b4d-bd9c44af5e7b", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699694720, "uuid": "05190c9e-9b1b-43ea-a49d-0ced7e98baee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699694720, "uuid": "f1eca005-59a8-4633-9f95-94fdd98e09fe", "value": "710419d0e6c14d032f33709e9178dd67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e166ecb9-804b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699677388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677388, "uuid": "d285430b-4663-4994-b4c4-890027b795d2", "comment": "Malware payload", "value": "bc2d0d2db3abf1547a20ecc2ef80ac02", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677388, "uuid": "7f003420-f733-4e93-ab0d-b2670c680790", "comment": "Malware payload", "value": "0156e735c5a7240f2a5ca52de79a020fabd1cae02ac7b406ce13b9e59119aceb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677388, "uuid": "d3465487-e282-4268-83db-80a95ee95daf", "comment": "Malware payload", "value": "bd3175ceef88f3b715cea519ebd74ec5202fa99a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677388, "uuid": "d8ae6aab-b3cc-4991-a4eb-de672e35c14f", "comment": "Malware payload", "value": "138f8b2563b7ea2a89acce98c4f70d169e4c5a193d8024cc3809f690c5bf385b1267ff9d30926a43a3c906994f2fc03a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677388, "uuid": "9be899a2-ce30-410b-b198-ea97b8932134", "value": "T126C63358B2800DA1D9A1513F9727D857DA3AF852AB10CB8F57B8361A1F3F9C14837FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677388, "uuid": "acf287c5-afef-44b5-b0f0-82c494217f57", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677388, "uuid": "2bd4b0b3-6740-4f1f-8dba-1a8e7177d1b3", "value": "196608:VNh64RGdML3MLjv+bhqNVoBPD7fEXEoY2Iv9jM2W1vk93Ii6SfiIU1Wom:ZUdML3cL+9qz8PD7fEU2IhY/dt1Wom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677388, "uuid": "17889d44-b473-4fb0-ae0e-e9fb3ff86a9e", "value": 12206142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677388, "uuid": "c7dc18c9-214a-424a-9813-9ea0722acb16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677388, "uuid": "cd92f397-0736-4137-b015-b5431362aeff", "value": "bc2d0d2db3abf1547a20ecc2ef80ac02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2c7b03-806b-11ee-8907-42010a9c0042", "comment": "Malware payload (Heodo)", "timestamp": 1699691070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691070, "uuid": "17662335-6deb-490f-8c14-2b4216e408da", "comment": "Malware payload (Heodo)", "value": "ee2d92b118a44254be173a6f95ea009d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691070, "uuid": "894fb451-6be8-436c-a9f2-060b0427c19d", "comment": "Malware payload (Heodo)", "value": "023d20cf348044b1596ab0aa458ae49ce02a47eeb2c7bdda5bfa3354b7319ea5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691070, "uuid": "ef1193f8-13d2-44ad-82d9-02eda7b3fb47", "comment": "Malware payload (Heodo)", "value": "b8f203dd1831c283cbdc15639f5bbd69182f2d14", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691070, "uuid": "87c85e3b-1086-46a6-8eae-8179318fd079", "comment": "Malware payload (Heodo)", "value": "905aad79438202ce6b8b58f30a340e05875b8576a1276ece69cee4e72f8a3d0c4fd5d495dddd24816ad8219c943d19d7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691070, "uuid": "8a8feb8c-0985-4308-8754-902e70ccb7fc", "value": "T1BF14CF1236D58073F27356748A30C6A24E2BF8B25B7195CF2B91196E5E31EE2CB7434B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691070, "uuid": "819bbd7d-8085-4528-ba41-0032348193bc", "value": "cf6c67a92b992938826c4e4ca9230c19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691070, "uuid": "4ca22c8e-6c99-4df1-80c6-c68b575a09ef", "value": "3072:QGiOQBQI6uRWodJFBXF/XOdkq45kuQgyFNHiGtOdRISC:f0R6M3dRsdkqy0NHiNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699691070, "uuid": "ed8739ac-284f-4c7d-b193-f246e98470ce", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699691070, "uuid": "bdcbd465-1f7a-4788-8a0c-ad0fb54895a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691070, "uuid": "3bf36e48-a4cd-4fe7-9b59-59eb2164efc8", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.38048.31331.26065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f96ff2e-808b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699704658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704658, "uuid": "8c559043-4dac-436f-918d-0e8271b00188", "comment": "Malware payload (Mirai)", "value": "4fa7ead6ac2b5efdd52920b5ef1da946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704658, "uuid": "ffc3ead9-cda3-459c-8b24-dd7f6629849c", "comment": "Malware payload (Mirai)", "value": "024839fddc1cf00750f16b4b800fcc9296f9c7717173cd74e3d138d80e92716e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704658, "uuid": "91f758f7-fb05-4892-a4dd-83516f5203b6", "comment": "Malware payload (Mirai)", "value": "ea8ea8f9e3fb83665c9f86299bcad4b96ae5208f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704658, "uuid": "f6bc267d-a7af-40a1-9a8d-38bdbaca7530", "comment": "Malware payload (Mirai)", "value": "d9212f5dd02006e7863aeb34905e183e958e464fa5fdc5f5a08c4d4dba16a018e29cb9ebbb5bfd006630df029435afc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704658, "uuid": "3e1134ef-cdc9-4580-8819-a45a03e67117", "value": "T12FC3196AF940CB62CAC755BAFA5D829C3727577CC3CEB1069A148B3427CB9570E3B841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704658, "uuid": "3e9d49a6-3d0f-467c-b095-8cbcccd5b126", "value": "3072:7PfW6tZT9dYgBvsqKKGmNW8wLWvIQE8Ep4rXz+R0i:jfW6T99BvsqKKVbPw4GR0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699704658, "uuid": "07dc0732-d981-43d5-8ee2-15f3fc8cb6fe", "value": 124180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699704658, "uuid": "60755076-d8a6-4164-a000-78d953fa7221", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704658, "uuid": "698daa28-3723-4498-860c-f6e46499af64", "value": "024839fddc1cf00750f16b4b800fcc9296f9c7717173cd74e3d138d80e92716e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b87c3e-8092-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699707625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707625, "uuid": "b7c3d7f6-90e2-4840-9da9-cf65dd9f4fb6", "comment": "Malware payload (LummaStealer)", "value": "93a1b5069034f862883429b5017c08f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707625, "uuid": "69a89e87-6551-4b0f-bfb2-350027770a66", "comment": "Malware payload (LummaStealer)", "value": "031c5ae0ba72c4d99478142b7e3549019b6141c6872a3abe18ac34d82b94c619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707625, "uuid": "b4105c87-1785-44b9-ab8d-a10c1e093d1f", "comment": "Malware payload (LummaStealer)", "value": "361d8e67fed20f1af96292ca2e2bee2852c9af32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707625, "uuid": "698b0bde-92cc-4ac6-a351-d4a785f32d60", "comment": "Malware payload (LummaStealer)", "value": "b0e83130b119661c5eb197b6f75c7143f08c5e2b9d2cdc1935a07da3b09677afdb225a255ffa5d7207416848c71ddc7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707625, "uuid": "ef6beb3a-0379-4bd0-a45e-a6d2359e0892", "value": "T1FD552302BAED8173DABA177468FB428312317DD6163CA25F2361A41E4C73AC478B57A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707625, "uuid": "1b1aec17-a75f-48c4-9bed-0979dc018990", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707625, "uuid": "a1d7496a-88f6-4a35-bcdb-dcb863372229", "value": "24576:+yPVdRomNp0HMXae9IsZCOGE9bDTWNcTY5afm0jWCLBmbs:NPVbo4lKeuEPGc+N0Y5cm0jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699707625, "uuid": "60b0e702-7eef-46eb-b95f-e70e644693e5", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699707625, "uuid": "00336970-5371-4a1e-82c7-68a1a41c35f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707625, "uuid": "be7efe1b-5980-4ce6-a88e-1c0c77756aa8", "value": "93a1b5069034f862883429b5017c08f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061b09da-809a-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1699710951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710951, "uuid": "3d5bcd01-c3a9-48dd-b73b-e2a9af3d735d", "comment": "Malware payload (DCRat)", "value": "aecc13f324a3d84d1c74952ccef9a190", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710951, "uuid": "98b24202-c07a-452f-b054-7d37ddaef9df", "comment": "Malware payload (DCRat)", "value": "04dfbc17a5d59fe23f729175cc485a86211b55190613d88247386e4baea05534", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710951, "uuid": "54abc8d4-edad-429d-ac61-bdd86fef4979", "comment": "Malware payload (DCRat)", "value": "7259ba7a6958c14afe6cd7746cf73dd4df899b9c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710951, "uuid": "c82001eb-296f-4f3c-ace8-63ce2273ea14", "comment": "Malware payload (DCRat)", "value": "c0fa5e85863ce38edf6eb503c260054003c6b964afb9cedab518e8a00c015f44629fb3204890fe1ca3a92eeb74f2cb2d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710951, "uuid": "767201e7-b19c-49c2-a8f4-917ee4ee61fb", "value": "T11306F1017E44CE51F0291633C2FF454447B8AC122AA6E72B7EBA77AE15123937C1DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710951, "uuid": "dbec98ff-9020-4f61-9f79-e1e16784efb4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710951, "uuid": "35f7a565-fe86-4806-b02c-1388204a209b", "value": "98304:Ubkq4chI3i6GNd8lqAtWrf5IdymNVMXr8dRjZXHdv/flHK:UQqR+D/BWrf5etNeb+Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699710951, "uuid": "2ff94dc3-e85a-4e80-a2f2-b79dfd71f84d", "value": 3866339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699710951, "uuid": "7a9d3583-d066-4352-b676-f8f077c87f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710951, "uuid": "c5572874-0e87-413c-90a9-badffe7a0d0b", "value": "aecc13f324a3d84d1c74952ccef9a190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23025480-8046-11ee-8907-42010a9c0042", "comment": "Malware payload (Metasploit)", "timestamp": 1699674921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674921, "uuid": "d12c00d9-84e4-437b-a9c1-a953c1235f40", "comment": "Malware payload (Metasploit)", "value": "8675ae8e6ca6e3cca48b3f463b23937a", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674921, "uuid": "ee380f7c-aceb-4f5b-9d39-e853d5b0c574", "comment": "Malware payload (Metasploit)", "value": "054d994f7c6575ceb31aacc8380898277205861e99b49462752b1750c3cd9a26", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674921, "uuid": "48d07368-0d4e-4c6a-a97c-a564a7e86d67", "comment": "Malware payload (Metasploit)", "value": "94b4c4ae0ed31bd58b34299a6162359e1e892405", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674921, "uuid": "9ef33715-e56c-412c-b1bd-058b35f10e8a", "comment": "Malware payload (Metasploit)", "value": "4e3e8e3b42d801b7f3bc69a8d76f6cb2b37ede54f2d32039336b25d016bf1a80075064a3769d160769887bfead322020", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674921, "uuid": "d96fdead-3659-43ad-b3d9-be47bb244751", "value": "T19561AF932151B8E9425283BF3E5966FAC07FC224964A7444FB8C4F98F9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674921, "uuid": "ecbb0c88-ea6b-4dd6-bb31-1952101b5a5b", "value": "96:mGtO69CHuSf+vD+CfBZL0HOmAiBrVMzd1:ZV9JvAHOmAiBrVid1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699674921, "uuid": "83d80561-3fe9-481b-80bf-20cd8024807d", "value": 3218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699674921, "uuid": "9f6c7c17-13bd-45a4-8377-8cd38029f3bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674921, "uuid": "f310587a-0daf-473d-b210-b4329d87f1e3", "value": "mYq0A4xM.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674e21c8-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695652, "uuid": "86561958-7fb9-40a1-9f72-2e52056d93f1", "comment": "Malware payload (Mirai)", "value": "27c0fcd08dca619806e080327122692b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695652, "uuid": "f6fdd228-2974-46ce-aa25-ed5caedb32bc", "comment": "Malware payload (Mirai)", "value": "0aebc3575e176f365b5d2c2e6a5649f75e9d93ec49f8dbbc6854878333fe0d0f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695652, "uuid": "28153916-c453-45f5-83a1-1c2b82c9083f", "comment": "Malware payload (Mirai)", "value": "ca763cd0f836be005ab44cddce23a7190732716c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695652, "uuid": "5bdf8527-7c42-44a8-8918-76eaa7e89378", "comment": "Malware payload (Mirai)", "value": "d874dcccca78108cbaf051621c89e84dfd6e19c851cdd9ae20480213023f64bce2b0eb0a15fc88d1dd4c8660b644ce81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695652, "uuid": "e62b0374-0dad-4a68-8d6b-38c5ad918fec", "value": "T1B404B85E6E228F7DF668873447B78E259B5833D627E1E684D1ACC1141E2028E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695652, "uuid": "dec91558-faa3-4e10-a5e6-89cac6fce896", "value": "3072:N7UDV7oyeMKKtTLLEK4f6ec8zmTz7BBTBiDqZ0G:N7UDV7oLMKmTLSXhmDBlBiq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695652, "uuid": "0845e780-85ad-4448-8df5-00c9a9997470", "value": 184004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695652, "uuid": "0282fa57-089f-421a-8b28-2dd97ebceb2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695652, "uuid": "f9e0d582-c47d-47e2-a099-97d2bbe9536d", "value": "skyljne.mips-20231111-0940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd342232-80e8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699744812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699744812, "uuid": "3f21bd70-909b-40bc-83e3-90198fa5ba6e", "comment": "Malware payload (RedLineStealer)", "value": "f534581316136ede6cfa37da028420f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699744812, "uuid": "2535eed3-738e-4216-88c8-6eb439d23f0e", "comment": "Malware payload (RedLineStealer)", "value": "0e6dbb451f85e0c7ead1cf375691503963da6fb35f902e6dd2a8d0bbd825ad9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699744812, "uuid": "f7813736-211e-41c9-97d5-9a4ce5d54cd8", "comment": "Malware payload (RedLineStealer)", "value": "b0268eb40cf577392b13cbcd6ebafb36a5c27023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699744812, "uuid": "1ff3923a-a834-4362-a7ea-1862356a8609", "comment": "Malware payload (RedLineStealer)", "value": "2b4bc70a3bc739a5e91d5cbafd20612332bace165cafb6a01f81cf027bbef8ed3c20f04943effada0a8fdca703f6745b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699744812, "uuid": "48e08414-db31-41a2-a2d6-1f97128b21f0", "value": "T14C65235ABEE94077E1F227714CFB034B05257C629EB4835B2394596B1DB2EC06A3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699744812, "uuid": "213ab654-6850-4089-b2b8-1e92c66c36c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699744812, "uuid": "cc019ed9-ca8b-4c01-bddf-d90059356a2d", "value": "24576:GyGMxX+sZ74zgLMJ3CceCIsFqOGz7MDGheYSWHDc8ZFGOfwsIP73b76:VhtZ7GF9FeZonGsyheyj9FxfmP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699744812, "uuid": "2af09fdf-1a73-4aad-9f51-66d4cde69dd7", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699744812, "uuid": "ac92b175-c23f-46ce-b0d0-e72e8f8ff399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699744812, "uuid": "9d65402c-f7bb-47bf-8f20-70a64f802d02", "value": "f534581316136ede6cfa37da028420f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8e545b-80d8-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699737642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737642, "uuid": "23713e56-4230-47e1-a1be-769a9cb40c6a", "comment": "Malware payload (IRATA)", "value": "21776ee181d2a9c6ad8f0b277244c847", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737642, "uuid": "90afe390-289c-4bc1-ac14-b36410a94293", "comment": "Malware payload (IRATA)", "value": "0ef864b53b9269db53aaf4cd30fddb08a78da64bbfe8d8de40680ef280a4f528", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737642, "uuid": "79d0b3d6-f4c8-4fd8-b4f7-515bced1f45b", "comment": "Malware payload (IRATA)", "value": "5d59ec198cffb6c9fc2119d328080bef70b4c884", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737642, "uuid": "98e275db-e171-4f6e-8de7-7bc6fcfad1d0", "comment": "Malware payload (IRATA)", "value": "d5e25fc67fd171bb797332b09aeb4e807d55457fd91c4c87b963fcea42042db2b2986aa283dfb36a0c5233baf83d8773", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737642, "uuid": "17089edd-713f-48b8-8a57-9ca060ab956c", "value": "T1A5851243F636E96BC832C03232461B35211A1D15CA06FB4A7A5977BE74BBDEC4BC12D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737642, "uuid": "98ae92f8-5982-439f-9565-53e39d203bc7", "value": "49152:RsFkkzEXpatNPnMkDOJ17HMydhPZ6+hYEcyQ9NfF:IkkoXItNPnzD41bBd3Vhva9N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699737642, "uuid": "cb966ab1-e1b7-4df1-86b3-4367a0de2344", "value": 1777141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699737642, "uuid": "44af1566-a62f-4dff-bd7b-8c9c54e82c09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737642, "uuid": "81754fb0-8cf7-44fc-932f-8f89f61e71b6", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a463e3b3-8078-11ee-8907-42010a9c0042", "comment": "Malware payload (Nitol)", "timestamp": 1699696613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696613, "uuid": "1a73e4b6-cb66-4173-8094-6db771daa57a", "comment": "Malware payload (Nitol)", "value": "cf69c6526775008e39917f8d61ffd8ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696613, "uuid": "66ffbaef-1ace-43b6-be32-6e4743312d32", "comment": "Malware payload (Nitol)", "value": "10f27af81f0e047cae958fd9071d740b0e5aa0ec9f25e220957b429e3233df0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696613, "uuid": "b43cbe31-5805-40c4-9bc1-d42ac35b6b5c", "comment": "Malware payload (Nitol)", "value": "864305144e4b9be7129485fc9aa931d298c5015e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696613, "uuid": "49eaea0e-b970-4d99-ac62-c4a00083720b", "comment": "Malware payload (Nitol)", "value": "5ccb1a12afa7fabfe7646adbf34d9c7ea6c10d675068970f0dcfef5919a1b0996e9d82a414b65554814d5d72eb408092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696613, "uuid": "189608b3-4465-4afc-9203-5b3060669b98", "value": "T1C8736C217691C1B6C44964319816D7B25B7EB9305BF8D9C3BF590B7E4F213C0AA3A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696613, "uuid": "d353644a-af0f-4447-9df9-19ae6537cd3d", "value": "f61b3498a024e1606e5633ff05e57b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696613, "uuid": "898ecb77-c1b0-4164-ad3d-2bdc567a2da5", "value": "1536:awsdCFnE4Nz1/SXPtpoprAeDYxUfGxhK5O:awsAik1a4pGxhK5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699696613, "uuid": "a460bf99-7325-4446-ba56-40e6330a8b49", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699696613, "uuid": "6619cf73-74ee-4a9d-a047-ac2764e1f1ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696613, "uuid": "5f2ad4df-b1c9-4dd6-9083-f60d1f32eeba", "value": "cf69c6526775008e39917f8d61ffd8ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f2433c-8083-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699701340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701340, "uuid": "a567297f-9b85-408e-bbed-200e6d9a62c2", "comment": "Malware payload", "value": "5f2a2aa9e8114854047aa56f9208afe8", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701340, "uuid": "0705b0e5-aac1-4150-9f8e-5abf05eca23e", "comment": "Malware payload", "value": "11d03bb5069bb781567169aa37b8da61e731a9753447344f4ce5cb731017b5b3", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701340, "uuid": "6e7bcdf9-561a-4427-b4bd-924495bce9f3", "comment": "Malware payload", "value": "b5a6c8b14fe7fdb069bc75934cfe231959f83733", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701340, "uuid": "b58f2ee6-e9f0-43ae-854c-6a696f3e2898", "comment": "Malware payload", "value": "df4e06aeacfafae09a11c32c815c56ef42c5992d91da4ba9652b3d4de9ca43abc9ae686dbe5264a5217dd0edb68a4f2d", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701340, "uuid": "170bd1fa-0442-424a-99b1-ef71a7b137f6", "value": "T1FC61BE932151B8EA415287BB3D5966FA807FC225914AB044F78C4F9DF9DDE633A8E2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701340, "uuid": "c0762bea-0647-459b-97d1-0da2c2ed82cd", "value": "96:rGtY/U0aluSgkWvD+Cfh5L0HjmAiBrVM38zO2:e0U0tpvAHjmAiBrV88zO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699701340, "uuid": "b4fd9678-5ede-4384-826f-c3911a6c8275", "value": 3232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699701340, "uuid": "c3517159-4c05-4959-90a3-158c0fcf7498", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701340, "uuid": "084f9a00-2804-41c6-bd59-932e71b91397", "value": "aKjaK1EQ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837bb168-80ad-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699719321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719321, "uuid": "de586010-77b2-4195-a8e3-6d7a4cd4ef1b", "comment": "Malware payload (LummaStealer)", "value": "8392dcdaa6e876e9e52bca0f819a3d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719321, "uuid": "a119a6c2-820b-420a-bf27-9fe6af3cdf0a", "comment": "Malware payload (LummaStealer)", "value": "12223241a9facbd10636ceeccd28f086b8da8a41472cbad989297ab60a1cfd77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719321, "uuid": "34be3cf3-ce3f-4d2a-a114-a542f28a7e4c", "comment": "Malware payload (LummaStealer)", "value": "49c37b0ab1ecbeafe23feb00c8bf1cbdb7717fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719321, "uuid": "e98c7471-f451-4357-a8d8-59ad6498e491", "comment": "Malware payload (LummaStealer)", "value": "10ad8b34440d0b574dc692d2ab70b1bf2ed2975a486fa2f44065e46084956854ccc272570b99264b0c366f437313b558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719321, "uuid": "a635eacc-2e4d-4732-bc51-d234eb09a9ca", "value": "T1FA6523437EEE40B2EA7953306CFA154B0632BDA06D79C34F236554EE09A32D47871B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719321, "uuid": "f2d0c42d-ec83-48a9-a1fd-8a8f543fcbee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719321, "uuid": "3a146c1d-a01a-4329-8b3a-f30c694b592a", "value": "24576:VyMQ2RP0Feid+HqrAnefIs/JoG71XDE5PR+DvIgNZRPk40bk7m9rZFTaQBelGPuC:wMvueiH+ewUSG1w5kAgpUg6dZ7BelGP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699719321, "uuid": "9ea0b12b-c0dd-4aba-8817-334c1b7083cd", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699719321, "uuid": "82b3adbc-04bd-48d6-98b5-9e1f10596f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719321, "uuid": "03169dca-2e47-4658-ab20-c899bc6484fc", "value": "8392dcdaa6e876e9e52bca0f819a3d38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0b34ea-80af-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699720223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699720223, "uuid": "f5a8476a-4e59-45cd-acdb-085f7d6c472c", "comment": "Malware payload (LummaStealer)", "value": "93de95190406d77bed0efceb4c1dbf43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699720223, "uuid": "bd7a6cec-f558-4d56-8a1a-ba0652667a8d", "comment": "Malware payload (LummaStealer)", "value": "134473b70083f20f2884ed3fd9a49f3dfcb9a8c3b6cfdcad8414ec9f0c4c11c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699720223, "uuid": "686e7fb3-a0b9-4eaa-891e-1ddf7ca83ea8", "comment": "Malware payload (LummaStealer)", "value": "4e355c118045771a2cc90272482fbc446d338a5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699720223, "uuid": "58531e3d-1ec4-43a9-a414-2f29060c61e6", "comment": "Malware payload (LummaStealer)", "value": "4886d91a42dcc238205924c2d18be28d0a4dd8122af792454220deb2fbb5287d01f363a3f0d4f3c59f4acf9b8417b7d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699720223, "uuid": "7eb21df7-50f3-4a91-9abc-2db0bea40c78", "value": "T11B5523835DDD4473E0B95B3069F7035F022ABC169DBC832A624A9CAE1CB1AC4397577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699720223, "uuid": "fb11ec0c-7909-403d-a80e-456ff0a728c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699720223, "uuid": "2d904bc6-46c2-4814-9f8f-0ca4972a8cad", "value": "24576:uyYUHIfgZI9faepIstCiGldXD69ya6k6tGQtjZBSBgz5d:9Y0IfbCeS0LGP+UGQxZoBa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699720223, "uuid": "c4ddab7d-3e16-48ea-9749-c60ec56f99d6", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699720223, "uuid": "a5608ee0-d74d-41a7-81a8-35a1e19a3e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699720223, "uuid": "962e5561-90a5-405f-abe2-839d5fe71928", "value": "93de95190406d77bed0efceb4c1dbf43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f985f485-80a7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699716942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716942, "uuid": "2bff14d0-48f2-41aa-87a6-27b6f44fb9bc", "comment": "Malware payload (RedLineStealer)", "value": "03705afeca5a83de17acf45350fa55fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716942, "uuid": "2c837c50-bc44-4f1d-b6db-da1db41f7255", "comment": "Malware payload (RedLineStealer)", "value": "137a2be9efbaf6252e44947cad2170bfacc88494551ccbac34536013aea88d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716942, "uuid": "0698dfc7-cbb9-458d-8917-7123d88e84e1", "comment": "Malware payload (RedLineStealer)", "value": "37f7af0d2c7a0797022249c414905bc179c7b541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716942, "uuid": "32c20f02-376d-4721-8b2f-9fde98eb2e0e", "comment": "Malware payload (RedLineStealer)", "value": "1cdfd1927081a11b8ab276aa2c00edc0e301c96f27f2f4a0c1584d13f70eb23ec19a60c4f9d68b8ca83da7ab109ad02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716942, "uuid": "a6a7215f-5dcb-470f-8a27-4355a316cc7b", "value": "T1C06523467BC981B3E9B6537068FB0363033BBDA45C3583696B48D69E4CB1AE0A435377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716942, "uuid": "042cfd25-039b-4b10-9130-de90c5ef15e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716942, "uuid": "50755858-17f5-43d8-900a-ab1d166ecd37", "value": "24576:/ypqPXYEpdliZ/txMjmetIsfrSG2FzDtG/o0DSeq9O9XIwLljKenv63xOmPA:KUYEp3CIqee0WGapGZS/9s4+lj/uZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699716942, "uuid": "19c80b7e-cbba-4ba1-9236-25f10695b0c3", "value": 1454592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699716942, "uuid": "9f4b62e3-6a8c-458e-9d63-6233468d9b12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716942, "uuid": "59fe465a-e721-4618-a0ed-a8f6f6da40e4", "value": "03705afeca5a83de17acf45350fa55fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aeea233-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688813, "uuid": "c3bc0de9-3248-4e3d-a16a-f1447137cde6", "comment": "Malware payload (Gafgyt)", "value": "19f4f7709941b1b281968cb591b159d1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688813, "uuid": "f7e0e879-2d22-4f77-a534-a11f86bb0884", "comment": "Malware payload (Gafgyt)", "value": "155728d852dfcbef6b3de4adc8ebc24bff64165595440da037b2a18a6c45adcf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688813, "uuid": "364b6096-01a4-462d-81cd-ce96acbe9d49", "comment": "Malware payload (Gafgyt)", "value": "0a97c3dd12cefe712bf64a45990a55ffff06f317", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688813, "uuid": "447f11b2-1021-462a-a19b-5b74a6a08c06", "comment": "Malware payload (Gafgyt)", "value": "6f462b9e3269bace5ce69c8eb25b11a509b82e7812c47565a026ac06869e6893048d61ee652ee6f89e733b343af009f1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688813, "uuid": "41e234d3-269e-4947-b405-0e3a856b70c2", "value": "T14513E1EB422B95B4D46230B465BF8B99F6B7346749150F1A53C8B3BCECBBC5209613E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688813, "uuid": "028f4dd8-b0ae-4a01-8da6-18eb74212ed2", "value": "768:giIAjPgw/skd2lx1EiwZiuSty4T6vC6petPpsv9sPZmDYSdi:giItw5TiqiDty42vCgaP2FuZuYki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688813, "uuid": "e3d2505a-c506-4385-b544-85847872b092", "value": 43088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688813, "uuid": "ff1bdc22-49f1-49ef-9fee-2f845d371ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688813, "uuid": "c511c16f-ef9f-43db-8844-35c3e225df75", "value": "19f4f7709941b1b281968cb591b159d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774e1cbe-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688807, "uuid": "19b62eb0-aff6-45f3-a13f-1bdd5f8c8429", "comment": "Malware payload (Gafgyt)", "value": "39394611114e99b6e0066082a590201f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688807, "uuid": "4f3936c0-8c01-4396-be7e-598f0382853c", "comment": "Malware payload (Gafgyt)", "value": "16086b9f6e73ee63a876fd560c3c218761bb3542b5a4de438bacc10f4d50b928", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688807, "uuid": "8211c48f-5e1a-45ab-846a-b99249b44659", "comment": "Malware payload (Gafgyt)", "value": "1ef30caa0f6731bdfdbaf76f8b31faa952fee7d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688807, "uuid": "1e26acdd-4b98-43ad-8852-c31c62f9c2d2", "comment": "Malware payload (Gafgyt)", "value": "639d5c3eb5c727eaef41e1f1bb5b609c849e4ef7788557f854518c539cdf5e9b8dbf5428e2f933f6a5772a2ab94b1a32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688807, "uuid": "fad65e70-4a86-4361-8f57-a3d6c236fb06", "value": "T1A8A30892F800EFA7F40AE67604D74B257630BFA50F532636731B3966AE362D42827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688807, "uuid": "0cc3304d-9d43-44fb-986a-c738db409e23", "value": "3072:4SlJzEOk5HY0iXZ54yVzdtMTNmm/lpbObCnKTNO:4WJrk5HY0dyVZtMTNmm/lpbObCnKTNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688807, "uuid": "07a5cdcc-b256-4078-88ca-685dccade6bc", "value": 107185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688807, "uuid": "9cf5f546-9c8a-4023-9ba8-fb5865338770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688807, "uuid": "2349f474-eac4-4cf5-ba59-05fa3fbaa991", "value": "39394611114e99b6e0066082a590201f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77900107-8096-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699709423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709423, "uuid": "748e1885-7d4d-4985-a60d-ebb07eb9bde4", "comment": "Malware payload (LummaStealer)", "value": "f38e27c98c652eb83fffa4c219513aa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709423, "uuid": "cd591e74-f265-4938-8b73-7bf133809ca6", "comment": "Malware payload (LummaStealer)", "value": "16280b24aff31fcadd92c1fd9480c8992c3f2452db9c28f9684ec1f2c4b04526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709423, "uuid": "1e7712a1-b8d7-49a7-bf8e-b606a79f4cd1", "comment": "Malware payload (LummaStealer)", "value": "66e6054665414dad11fd42d4f16027c408c80408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709423, "uuid": "c18d2420-5b2a-421f-a6ee-dd58462b5014", "comment": "Malware payload (LummaStealer)", "value": "054cec6f05444eaf6f87b5bcdf3fab0751f5dbe19e122d324b4b37dac020f70f7b0f5a6ba3d605b121b63c8ec866eb0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699709423, "uuid": "48dd0a27-7f62-4775-8d3c-17fafb1e9604", "value": "T147652396BED54476E4B5533018F7034B0A3978520A68D32F779789CA1CB2AE879B073F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699709423, "uuid": "1518bfe5-9d28-41d5-9163-7cfab0fd13ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699709423, "uuid": "b405516e-33b0-4e29-b2eb-c8f5515f3f78", "value": "24576:AyeamsHxhWJtIUeMIstyrGzXNDNrA2N8zubNXzi9HJxiF977rkwf4F6:Heam8LW7Ne7KyGpBrA2N82NG9HT4970w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699709423, "uuid": "e24597d1-201a-448e-9c78-5890f9d6339e", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699709423, "uuid": "422bbbdc-1fce-48ad-b1c5-0b8a0b2e4828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699709423, "uuid": "d28f93ac-2f55-4288-a7ef-1f994199459d", "value": "f38e27c98c652eb83fffa4c219513aa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7364cf2d-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688800, "uuid": "a6c04e7e-9848-4bef-8008-4caf32e5fe76", "comment": "Malware payload (Gafgyt)", "value": "dc25d41c933196a959376ebe137d0f52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688800, "uuid": "205f8773-9cb6-4214-bbd7-2319a9a321c2", "comment": "Malware payload (Gafgyt)", "value": "1688b50a2a874d04794562cd0b0f91930d476408462551f8a6348cd75b596af3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688800, "uuid": "b577afa6-5ec8-4cb1-97b3-daa457c72300", "comment": "Malware payload (Gafgyt)", "value": "17c15b4bd518a4e38037ec3c259ddd5d1799aee6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688800, "uuid": "ea655f34-2155-440f-87bb-56632d45929b", "comment": "Malware payload (Gafgyt)", "value": "5f77482450b50075587cdc3df008b9e07111f8f17fa0b3b59dc9c9f0156b89d5b392df1734b1a1658c139edccac74bd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688800, "uuid": "5768dfc8-a9fe-4496-b2e7-a2b8514cd151", "value": "T19303F1D201AF9A89C36F54B7105FBE544661D20EDB440DBABBCC60392D4EF34A72B365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688800, "uuid": "98a15654-875a-4ba3-bbca-383d607343a7", "value": "768:in3ZpUYgkppyEuOqeiTul43N3fMQvYS3pWKH35znbcuyD7UryqQrylk4W/:in3ZxleilON3EQx3pWQnouy8mq01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688800, "uuid": "3e753167-1bc9-494e-95e9-b4410e3dddcd", "value": 40144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688800, "uuid": "f832d6f8-a17c-4177-b924-5cada6bf28ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688800, "uuid": "b9a6245d-4b46-4f2a-9c46-2d84573e8bf6", "value": "dc25d41c933196a959376ebe137d0f52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3f277f-807e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699698987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698987, "uuid": "12213c9e-1969-4145-b2cb-c73128feffe0", "comment": "Malware payload", "value": "7de41ed6b74a9ebc44afd585253eb426", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698987, "uuid": "bba62163-1d58-42bb-b5b7-ff694068c42c", "comment": "Malware payload", "value": "17a63753f90fd599e78f8b1c7dbd88294153431b34906a3edfa200f250cf0e35", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698987, "uuid": "5ad4e582-a2e4-4898-afc4-f4cb59640f6d", "comment": "Malware payload", "value": "08f20420dce57cb7b6b49d1b0396d7633c517e3d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698987, "uuid": "2e225e4a-1052-42ec-9b92-4564fd5d3199", "comment": "Malware payload", "value": "da6a5ab3a739249b751a049f188135bbf49a2af70d167d120e80dc3b0cdd003a8c2ea5f2a4621b7da5326922bad98123", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698987, "uuid": "99194a2f-bc41-42b7-a902-6919171522f2", "value": "T19D553366A3351DF83FEDFA7178CABC47C98449EB002D45035870A7F3962BAF5AB41981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698987, "uuid": "3e831438-8e6f-46b0-958d-9439641ad513", "value": "24576:8XJmLIjZ3NpqTVJX3rRcoEz049VpVJyuPfGG4QvbjDaugkWV:8XuI9mVc1g0VpDfGRQvnVgkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699698987, "uuid": "33f78cdb-197d-4da2-bb0c-fc59bf5dbed1", "value": 1323582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699698987, "uuid": "9bd28079-79d4-416f-baa5-0e21ac021840", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698987, "uuid": "c9b9c996-2b1c-4b0e-b1ea-0713b28637da", "value": "Pack.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b02cc48-8083-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699701322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701322, "uuid": "9fff8b11-2b36-4841-9cdb-496c0ec70d5e", "comment": "Malware payload", "value": "0f0ff3056f2f139f0121991f9068af04", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701322, "uuid": "6b4532a7-6222-4fbd-8398-9abeb4d9acca", "comment": "Malware payload", "value": "17b1db76f845ac1236a13a0e81b07c6f81b8bcf54d79056008768b521e0d9eca", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701322, "uuid": "e76a94a2-78dd-422e-bf16-af1e3f413b94", "comment": "Malware payload", "value": "304af241ca3c87dfab27ddb4c004acae3dcc0419", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701322, "uuid": "9b4d0c20-ff82-4cce-a601-87c24d878e23", "comment": "Malware payload", "value": "6725235d86308e0a1d55a13ff0c6bf87441a75d52b9fced60702aeaeab0606af30e440e7847542da9625d9d9f01c8d83", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701322, "uuid": "4e2232a8-d981-439a-872f-abe76461e7bd", "value": "T18861A1932151B9A9428283BF3E5D6AFA807FC224A5467044F78C4F99F9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701322, "uuid": "54528fe2-9942-4a48-81f0-f1ee6d3a3ba5", "value": "48:PX+MTLimb7Bce6qoVKZnW1jCQfRJL0HuQKQhFi5QsvuiBrVxqT/sWdO:GGtRWqoVSnW1jCQfRJL0HtmAiBrVMfdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699701322, "uuid": "240ade32-9831-4b66-a23a-2ebd8633bcdd", "value": 3242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699701322, "uuid": "847a9d10-2219-49d6-a132-592815506e61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701322, "uuid": "22b4afc5-832c-4b22-8efa-7f43f290b103", "value": "YQNbCeZT.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722f4bda-80d7-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699737331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737331, "uuid": "6d15f110-e2c7-4617-a671-d51d4c345732", "comment": "Malware payload (Stealc)", "value": "e668c5608fc274df4d4265b438af6798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737331, "uuid": "1c78e2a3-508f-4616-ab0f-e266e113df6b", "comment": "Malware payload (Stealc)", "value": "19ed8a06e27e50c441bb3b3e0c743ea9f0263b43154e323a93e5b78953162e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737331, "uuid": "3c7db931-3588-4201-b18b-c8fa98bf7414", "comment": "Malware payload (Stealc)", "value": "8e3eddc1fba92ddb32f24f6ed85128bd24075472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737331, "uuid": "3a90240a-0e77-45e0-803f-dad9efd9303b", "comment": "Malware payload (Stealc)", "value": "75b40ad888b264c7210d9e58b6656fe0937605523378b1aa535cdeaa1dff2a69b473e54e646c05cc36baaba87815136d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737331, "uuid": "029870ff-b7b7-4a89-a8c9-f1cc3edfd6d4", "value": "T197D6F111B2D2EA4EF292BA2C93F667579276F30193E7F03CD6607614017A1B8D336297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737331, "uuid": "2277462e-28be-49ed-a349-37ca898bd4c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737331, "uuid": "5176645b-5d2d-4596-b019-64f82b9eecfc", "value": "196608:GrmkTQoH4bFbS6x5qtgguBFXpxobpk+1YSn+nOsphb+Yh3nh2oEc36cjRD:U96bS66XubXpebu+2Sn+Lj+W3nnEc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699737331, "uuid": "919febd4-997b-4d8b-9ee5-e4e00fedefc6", "value": 13196288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699737331, "uuid": "e1cc0b29-8b81-4af9-bfde-ad9d1a7f16e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737331, "uuid": "4b0d7514-b7a1-4834-848d-fff3d415bd04", "value": "e668c5608fc274df4d4265b438af6798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d8d89c-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695681, "uuid": "53bd5570-c6cb-4bee-b25e-2b5b721a7e13", "comment": "Malware payload (Mirai)", "value": "9f2eae325574fd3470a1571d2692a492", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695681, "uuid": "329319f9-da60-46e8-ab68-b61ed40c7999", "comment": "Malware payload (Mirai)", "value": "1c5e174a67aa722e169da66d9e6b760276c3742d2def3d5f15d131edcb972e73", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695681, "uuid": "4c6db6f0-766b-4001-a0b0-95881f36b791", "comment": "Malware payload (Mirai)", "value": "ded4504af8995e09892a4bbb7648de5733f09a0a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695681, "uuid": "3a2f963e-bc35-44b7-b88f-e5c6ebb4b57a", "comment": "Malware payload (Mirai)", "value": "bc2037e31a859b614f68f783ee86801db4967bc7689a5be52d0dc63eb42697dced0ef7a7326b2ea5a1645a6a5695dcce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695681, "uuid": "19af10cb-5259-490c-9390-979ceb93cc8c", "value": "T1B2D31945F9505B23C6D312B7FB5E428D7B2A17E8D3EE720399215F60378A86B0D3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695681, "uuid": "11fa1aa6-2f2a-4f59-b728-af12e0757140", "value": "3072:m1E8W/4x+F78I4VAlkvbA5sfLZ9aCoDqj:m1y4ct8I4V8kvbAKZ9aCow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695681, "uuid": "c657be63-9575-4028-bff5-48cf33c16dc3", "value": 140160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695681, "uuid": "e6353f2c-cb27-4bf7-bbd7-d67384ca773d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695681, "uuid": "2b1fd773-a33b-4097-831e-426aef681229", "value": "skyljne.arm-20231111-0941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3799b5-8067-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699689137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689137, "uuid": "b3c8ec8a-8b22-4c4d-bed5-ecc92b45a9d1", "comment": "Malware payload (Smoke Loader)", "value": "d5a4bdeb9ea7d483f3052b200b89b197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689137, "uuid": "bfbfdfc6-fe51-45cb-af08-1b80161f3539", "comment": "Malware payload (Smoke Loader)", "value": "200c6f6c359acd296636b674d1a132d336999dedb7a109460c3b701ca20d0280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689137, "uuid": "963d424b-b48d-4be3-981a-bfd9827ad63e", "comment": "Malware payload (Smoke Loader)", "value": "f0b4c770655befea0aa620b7d067ec8dae87c212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689137, "uuid": "dc28747b-8bab-4543-99b4-7c08516e364a", "comment": "Malware payload (Smoke Loader)", "value": "44f60914ddf3c42bb2124256ec21b952cce4e736b35182b96c62887b0c1a1dcc1260acce55133d6efabcc077bea40446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689137, "uuid": "bcd69386-61a4-423f-9d7a-6d5a13a18ee1", "value": "T1A1C41202AAD980B3E4B1677068FB42870639BC619D7CC36F3749699F5CB2AD06931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689137, "uuid": "045adaa1-be12-4064-9f49-c9ea07ddad06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689137, "uuid": "f8b69361-1d75-4ce5-8f86-184f64db527c", "value": "12288:jMr1y9090NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6bF880p:myAiaaewIsgCQGIgYDv8Dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689137, "uuid": "21eab761-125f-4dad-865a-c95b94700e64", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689137, "uuid": "7b19972b-03fd-4973-82fa-1e9209dc2bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689137, "uuid": "e0bd466f-ea02-4ab3-b5a6-c1a80db113e5", "value": "d5a4bdeb9ea7d483f3052b200b89b197.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2c922b-8067-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699689142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689142, "uuid": "841b7ffb-a3ef-424e-8f67-fde2e0e7fb61", "comment": "Malware payload (Smoke Loader)", "value": "592d80ab08dba050caebc4c976096aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689142, "uuid": "f6a545c7-5a01-40b3-b2ee-386febb860bd", "comment": "Malware payload (Smoke Loader)", "value": "2098861183af17f90540b06c78ca66f03cf2a33ddde87f1649fdec0e85270f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689142, "uuid": "f4541ace-e0f3-43f1-85cd-1d3ff8767b10", "comment": "Malware payload (Smoke Loader)", "value": "cbbb31cfffeb94f088a72154b2a77e4f191e8d4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689142, "uuid": "1f594344-2f45-4f09-b67d-2f845e9dd220", "comment": "Malware payload (Smoke Loader)", "value": "1c1702a3c67a7692b254c61c5eb1e1a33443b81042967b08000c5d7c4be7bbd16276ec084ea33b01b176c15bbd681c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689142, "uuid": "1cbcf0bc-1493-4466-85c3-6e98a8cbd5cf", "value": "T1C0B4012490B9528EF6EA8A7BC9C173E452766133B30AC316EE45F055A85DBC7CBC14B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689142, "uuid": "45e911eb-fbf7-46f6-abb3-0500beb873b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689142, "uuid": "8ccec360-ac50-43f1-82ad-26807f81b8b3", "value": "12288:qx01BQy5i8c87n1T4DeAm9NBMG31/aOkDVyHos/Rpo9D:qi1BfiLy99A0Z3B4VOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689142, "uuid": "e6f31d13-886f-4739-8200-53ef1888256f", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689142, "uuid": "0591c70c-e362-41e4-820d-99c09521e96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689142, "uuid": "f6ddba60-0749-4184-9a31-6517d86301e8", "value": "592d80ab08dba050caebc4c976096aba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f68a866-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1699687881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687881, "uuid": "29e71452-e329-4b28-9d10-929b7db92474", "comment": "Malware payload (DBatLoader)", "value": "6cafe642afa78957e2b3aded0a3e1710", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687881, "uuid": "57764de8-d0c1-48fd-9bf1-dc333a62a8f1", "comment": "Malware payload (DBatLoader)", "value": "214d29953c8211d48c06ce4e16239920b4ed1e148428a9165dcfe184fd6ab619", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687881, "uuid": "e83c3558-6c3b-4c02-aeed-cae585af025c", "comment": "Malware payload (DBatLoader)", "value": "5f2b1f9b37643dd3f6476479878ece96fd158e08", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687881, "uuid": "ff04500c-4278-49d3-b5aa-2179fb09d919", "comment": "Malware payload (DBatLoader)", "value": "792b31796c43e8b321470b8c9322e36d5a67dc670a8c705cbe48772550665dabe80ff8d805a19ea3cbe924884e71ba99", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687881, "uuid": "34b33c44-b325-420f-80dd-09ba5053bc4e", "value": "T17A757C62B343C8F1D0716A36DF8E93D459BF6DC93590DCC9A2743A4B1AA234978184BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687881, "uuid": "6431219c-e7aa-46dc-a707-0bbdb081f9dc", "value": "67e8c3b7329964ac26d41bb5cf7950b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687881, "uuid": "efc87247-cfc3-4345-91b1-2cff4ca22fe7", "value": "24576:1JFrJJWOzvX19gV5LDrSXJxRL0nR+nN52OJi:1JFJJZ/2l+nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687881, "uuid": "60e6c327-b993-4ea9-af27-31203c297d6a", "value": 1653248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687881, "uuid": "4041e0be-f80e-4850-b44b-1785fc27602b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687881, "uuid": "19d105d1-f0ad-475f-be70-b5f3d886a473", "value": "Ekim_2023_Mutabakat_Dosyan\u0131z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700a4e73-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695666, "uuid": "1288c719-427f-41d6-bf05-b1af43a5d4b8", "comment": "Malware payload (Mirai)", "value": "5f4f12acdfc4a8b812e7377eeaeb995f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695666, "uuid": "a138dd66-66b2-44a6-9b0f-a45dd74114a3", "comment": "Malware payload (Mirai)", "value": "24ec07d76c136e2b473586110c45e6fea49f3be871930ccb584a389f5ca5587c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695666, "uuid": "1a0ad60c-b997-4f0c-892c-9c0b624a542e", "comment": "Malware payload (Mirai)", "value": "2e4fa44e413b3c952d88a19d7c500c6a426d3c4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695666, "uuid": "de102832-d621-470c-be7f-90f45544322b", "comment": "Malware payload (Mirai)", "value": "6bd105b91dc2782eee250adbbf3f51218efa2609fae8e2667b77f7ec04323355086f827bc79d06919bee30ff1645b05a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695666, "uuid": "ca124ade-5115-487f-ac41-604d561e6481", "value": "T100042A46EA404B13C0D727B9F6DF42453323ABA497EB73059528ABB43F8779E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695666, "uuid": "556a7982-a679-4f0d-acd6-f637ef11935a", "value": "3072:4gM468amlrvdZR9kbaTNJZ06HQ0k+sEBDq6lY2CwulojM/REth6ME7:dM46J0rvrRubaTNJZPHT9B9lY23uyjMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695666, "uuid": "58a36775-b77c-4502-b57d-261f53fda0ad", "value": 189215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695666, "uuid": "059d090d-d5f9-43c2-a7b2-9642a35d6433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695666, "uuid": "ee3aedaf-1657-4239-8032-4790e534c5f2", "value": "skyljne.arm7-20231111-0941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b61d22d-80df-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699740675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740675, "uuid": "593c0bf0-160e-4906-8c4d-077401452cb6", "comment": "Malware payload (IRATA)", "value": "156b67600f32f97bfc74e634b2979c09", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740675, "uuid": "1bc23f6d-fa9d-4944-92f8-a5e2ea02f7cf", "comment": "Malware payload (IRATA)", "value": "24fa132a910a008da23c1a3669340143a35ebb72a802e6cf0ef0dfb20c3c6395", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740675, "uuid": "2f2b01b1-a69c-4edd-ac14-86ce29d21efc", "comment": "Malware payload (IRATA)", "value": "1e64f14308f9e0600078bbb6ea35f3abc4228718", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740675, "uuid": "4ef12fa2-ad72-49c1-a8f9-feeecce476e7", "comment": "Malware payload (IRATA)", "value": "9467e576a63cae096fce68874542c3f3380798fe269a561d1f7af6da529b3d07659cbabe82e463479ed9694924f16f53", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740675, "uuid": "0f6b8d56-3fab-4a2c-b0a7-720ffbbe63d4", "value": "T130D52383F236A82BC872D5327105233954468E59CF42F786399877EE34BBEEC0B856D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740675, "uuid": "02d57333-f435-4dd1-940e-43ef96de23f1", "value": "49152:QE7aUMCQj5NLumokhjIqOr7aWDk5oYHj4UeBW+HLHEwrIMS78RXm4RdHDb/:QNSoNKmokzSe6qTj9exHTEqf13RdHDb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699740675, "uuid": "fa19a555-24ee-4068-ae67-c0b495da2363", "value": 2756746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699740675, "uuid": "d8d0d367-888d-44f7-a048-9c26bc3badce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740675, "uuid": "4a86c808-21ba-4565-962b-3fc7b5ec7462", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a2d701-80b7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699723546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723546, "uuid": "0d1a7915-040b-4ce9-9b23-624e3cae20cf", "comment": "Malware payload (RedLineStealer)", "value": "ba9266e00d09ce9ea5c05cdae8cfa527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723546, "uuid": "923a4c27-18c0-4ccf-ba63-6a970582ea0e", "comment": "Malware payload (RedLineStealer)", "value": "25b910d56003eca83f175318e3245c5bbcb83058cd570c64078a02948e87be7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723546, "uuid": "76da3f15-235a-453c-afe2-e7ffff1e26a2", "comment": "Malware payload (RedLineStealer)", "value": "f7bcba55863f96df3ebcc3180af9be52b5eac2ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723546, "uuid": "c278692a-9074-474f-a5e2-04fcf4f76715", "comment": "Malware payload (RedLineStealer)", "value": "b73562b2409e2383dad33767887797b728f80b235899e2aaabcc267df221dc573a43836852686d23f97294309cd9ff0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723546, "uuid": "65d28317-a534-43f5-95aa-aff4746d732b", "value": "T11C6523837DEC8162E6B9233094FF0A970A36BD365D3DC72B3949AC0A4972790197537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723546, "uuid": "bfeb862c-3a63-4e8e-b405-f6df4dbfc7be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723546, "uuid": "d4893a18-5c28-4044-a396-2137d46a1ae6", "value": "24576:xyBYUwmJIvlr9eDIs11aGVbyD9jAvbKuLyVEsZrbRzKO7U6OdGvPz:kRwmJuzesMoGoivdyqmrbRzAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699723546, "uuid": "e14a549b-63df-48fa-9da8-b1e8595361e7", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699723546, "uuid": "ce48308e-ce5c-4426-a818-2256366a55e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723546, "uuid": "34dc7069-edb3-45e9-86d0-1bc47641334a", "value": "25b910d56003eca83f175318e3245c5bbcb83058cd570.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fa3e9d-8093-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699707937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707937, "uuid": "3f22bb08-a428-4fab-b33a-206366b7cdc3", "comment": "Malware payload (LummaStealer)", "value": "17a2c0150e6e483df2a2b93df792aaa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707937, "uuid": "3f7dd812-4c85-466e-8f32-762b0b070cee", "comment": "Malware payload (LummaStealer)", "value": "26697ca6a89c20cbc034cf52f18535c64e354d83b9686b519b6b5c54517313e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707937, "uuid": "fd02cc0a-5ba1-439d-80fa-a177038954b6", "comment": "Malware payload (LummaStealer)", "value": "d55bdcaf26aeab2bc84782476aac126b92bfe62c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707937, "uuid": "e33214f6-544b-4a78-95ac-3f5954fbfdf9", "comment": "Malware payload (LummaStealer)", "value": "5eedcc9e82932b15a63c70e185be8f3d3dfa4620928f0657df57cc4009cca844fdb8065e1ac1869c2b6e8a1c2f1012ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707937, "uuid": "182705ff-3373-4ce8-ba2b-ddb5e7dd537b", "value": "T198652382ADD48063F4B52774A8F702C3073EB9A19D74D31B778A395A4DE29C076347AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707937, "uuid": "df7c0b70-866c-4960-8a0c-3ea5e0929f73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707937, "uuid": "2d6a8528-ebd8-4e21-966f-f3daa3811cd4", "value": "24576:DyLRy7LSIPMW0weTeaIs1W1GSYYDntp/K9fMoPQ/Qxlv6nCNjFQouJnP:WLCL/PM4Ueh6MG8ztN2fMOQYxlCnCdy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699707937, "uuid": "cbc18292-aa8e-4afe-a9d1-23ad62d0c951", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699707937, "uuid": "6fccda7a-bbde-46f4-8290-54e04ef9d681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707937, "uuid": "3dac9f58-1616-4659-9a53-5156ff25e820", "value": "17a2c0150e6e483df2a2b93df792aaa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379afdbe-806c-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699691277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691277, "uuid": "4e9ceabf-dcdc-4a81-9326-aa1095ebfafa", "comment": "Malware payload (Smoke Loader)", "value": "e034c4e665539fbdd1343741affdfd06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691277, "uuid": "caae8911-3726-4f38-baad-7dfc616be97b", "comment": "Malware payload (Smoke Loader)", "value": "2c08dae77574be67ecbd1d57d5ea8ea80042c7ee15f0ad5da405f574bf82b529", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691277, "uuid": "ef6aba9a-49f9-4f6d-a9c8-224c258146ba", "comment": "Malware payload (Smoke Loader)", "value": "a9705a8e1c55163b2b42ce36bb2fa187ebccbc62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691277, "uuid": "c011855f-fc36-49bb-b5c5-9c8d99e5d70b", "comment": "Malware payload (Smoke Loader)", "value": "0972355d5a8fd8c8c600c1dd12ef25784f81950ac2240cd73335341c9da66943b63da6b7e57f18d5b8ff48711d5dbe71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691277, "uuid": "89587d7a-1c8d-4271-80ba-ba1a80910c95", "value": "T1EE248D1272E65473E23346308E35C6A4DA5EFC618F266ADB57546E3F0D722E1C6B330A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691277, "uuid": "80e814db-6e82-48f6-a297-3fb835ff8396", "value": "13937693d95394f2ce32af6042a00c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691277, "uuid": "1db92fbc-3d3b-4298-a38d-3e4e5297f5b5", "value": "3072:pGYe0U5jTpOk8om5pCNgWOcjh8iG+uyIu1G40wvs2/ZQxfeD3o00s5jT:YF0O9ddm5kbZ3HIV47s2/CO0s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699691277, "uuid": "bf856fe3-4566-48f3-a290-d1785d1bcc15", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699691277, "uuid": "9a617caf-52ba-428a-a512-19fa73a6c9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691277, "uuid": "cf4f3756-7a2f-4abe-aeba-a52a3f804fc5", "value": "e034c4e665539fbdd1343741affdfd06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1ce5c0-809c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699711818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699711818, "uuid": "61c103c3-ea16-4e91-9500-a920a2e8469b", "comment": "Malware payload (RedLineStealer)", "value": "2a4b56e6c6b66d109c4f514589ea2209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699711818, "uuid": "7017d8c1-ecb5-46fd-ae54-16ad23f5526f", "comment": "Malware payload (RedLineStealer)", "value": "2da468651ee3aa321060b297601b979d548d67ce35073494bb5c7031170cf6de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699711818, "uuid": "68468137-fae6-4fb2-a6a7-605476defd8c", "comment": "Malware payload (RedLineStealer)", "value": "d5f953415db5f938798fca0c5b54f46d86952540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699711818, "uuid": "7319d709-1bca-4227-afe9-4d4eac29e012", "comment": "Malware payload (RedLineStealer)", "value": "b6db56eb1d145091c00ec7ab5e0165f3c171dc46150f3fdea9901664efe2f6587b2cc6991bc0b29eebd47729352bc15e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699711818, "uuid": "388cac50-43d1-491a-818f-25deb0b35e16", "value": "T112552352AFFD80A2D8E217716CF7074706743DB51A7C832E7391598E4862EA47A313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699711818, "uuid": "aad34042-2840-4518-b068-0a9f566ddedc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699711818, "uuid": "e5db451d-b98f-4533-8adf-def939f9c2f2", "value": "24576:RymqZWV45oQP6xgaeQIs5C9GrwLDXhU9NUT10oTbLfCVs6PR/ojRCc9y:ELQ45oQPo5eXkIG8G836Vs+ZQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699711818, "uuid": "600398d9-e260-44af-b906-f61cae9bde2c", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699711818, "uuid": "9a87f7dc-c19f-48fd-a9eb-181de4a5110f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699711818, "uuid": "e99dbd31-e264-4c44-9e62-03c7d2f0f795", "value": "2a4b56e6c6b66d109c4f514589ea2209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef80f8c-804b-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1699677089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677089, "uuid": "b067fca2-473f-42a7-ba4b-4b98574a0f47", "comment": "Malware payload (XWorm)", "value": "9c4b77cf2202adddde8c49474b31760e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677089, "uuid": "70ad4c06-e37a-4597-8233-fe6d7c917190", "comment": "Malware payload (XWorm)", "value": "2f92535e48d070c313c124c5e734ba352097c0566eebca6e02d4faa79e1b56e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677089, "uuid": "52657c89-1d95-4689-a5cb-7ad504e67301", "comment": "Malware payload (XWorm)", "value": "6c3b37613132a3b087f2cec86a325101be6693d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677089, "uuid": "21a09617-c838-4c25-8d03-7d658a0e40a7", "comment": "Malware payload (XWorm)", "value": "19eb3b8fce5c4079f5beb71b5a58e54512669133311e2d3b5ea9186356c4225b028f91502c9a2eea877948448a15a99d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677089, "uuid": "f5f0ab1d-135d-4de0-a79c-41d1d0385cf2", "value": "T1F2E24B4877D44622DAFF6FF019B392050674A517DD13EF6E0CE48AEA2B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677089, "uuid": "c28c7a7f-c489-46a3-9da0-a6a580c65f3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677089, "uuid": "44e838e2-f695-4e77-9791-7c41a6a1d817", "value": "768:tUa+vNshO8q8aoxVJt76VRVFr9jSOjh4b0:AvN4dF97ODFr9jSOjOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677089, "uuid": "49b55b0a-c598-49c6-8dbc-85a05d6f8857", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677089, "uuid": "73e5a1cb-1728-466b-80ea-80e98962760a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677089, "uuid": "e7952718-6342-4be5-b057-ae514c5218d6", "value": "9c4b77cf2202adddde8c49474b31760e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89de676e-8093-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699708165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708165, "uuid": "eaf7023c-6050-43fe-b9b4-838e8f9eebc3", "comment": "Malware payload", "value": "3a69bfbe5bc83c4df938177e05cd7c7c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708165, "uuid": "74352b3d-c644-4631-a2d2-0eabfc732f71", "comment": "Malware payload", "value": "3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708165, "uuid": "2e3d9abb-fffd-4714-9e60-1f64844f9679", "comment": "Malware payload", "value": "b6850881561265d89597d0d245b33dba3d7d3f47", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708165, "uuid": "b3c4e379-7429-4f85-ac72-31ad18664cf1", "comment": "Malware payload", "value": "bd18f550e9b73abcbda46976f898ee6ba49176ce4d26ad4d07666e4f713dd4022f11d04a62675216d16ec9dac97afa44", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708165, "uuid": "0fff324f-7ca0-4c04-9de9-3a1958174895", "value": "T17492D02C566251BDF0966838BE3B6546476608AB24EF71531A00FA732F148733F71EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708165, "uuid": "d99e816e-376e-4a43-af55-b2759dc5727f", "value": "384:ricGiJTcFQZYNXNUsjjjdyDqFpciWb1snmhdbTOOIMC0lCgFQA1TjgJ23lxzOx:ricBJTcp9Uq47bimfTO68fJ23Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699708165, "uuid": "d008b991-ca44-4b7d-a281-710591aa0a85", "value": 19592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699708165, "uuid": "78682f6c-8fa8-4b22-8a43-d16ced9650b2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708165, "uuid": "4587ff8f-fa1b-4de7-a10f-5f9e455ae1eb", "value": "sample5.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c3bc43-8081-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699700369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700369, "uuid": "e5d6c1bb-114a-436e-a3c5-cf9d1480faf4", "comment": "Malware payload", "value": "dca096106be4ea65d01eedf09ac1631a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "Exobot", "colour": "#C1C734", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700369, "uuid": "a9bd6d33-81a2-445f-80cb-568319177827", "comment": "Malware payload", "value": "3504d9f2a2fdf021a382be4e2603acbdb5550ac2ddf26f62da1c2227b1f7f400", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "Exobot", "colour": "#C1C734", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700369, "uuid": "ee1ef1eb-84db-49c1-a5d5-fe5a445464fe", "comment": "Malware payload", "value": "bec1753c2f08b17fc1e1e323ec5c4756feb18504", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "Exobot", "colour": "#C1C734", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700369, "uuid": "0d1c691c-9917-4c78-8f03-08517c6aa754", "comment": "Malware payload", "value": "9d8fd14d05a57ea27386f2b6d2f9fb7b5c50d1015b9129082977edc35f4369e0edc6d1aa4074d1197abbad3b1e6a6de4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "Exobot", "colour": "#C1C734", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700369, "uuid": "85facd84-da29-4788-baed-c3c81d139ae1", "value": "T1AC850237E8E171ADCA84D37B4498ADA362A33745A3838D0C359C3A694F51FCD0F526B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700369, "uuid": "1728d213-c06d-4d94-9ad4-ca95b8f97f94", "value": "49152:TsrHSpR380K8tK+gs/jllJxtlHGmjI1idy:grw3jK31s/jllJxta1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699700369, "uuid": "a6873203-7be8-4208-9a52-2209c5831e52", "value": 1847115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699700369, "uuid": "b4d5dd5a-dc72-4136-8417-9c6cd06da850", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700369, "uuid": "29d08ecd-27cb-49bd-8939-6c492f6b875b", "value": "3504D9F2A2FDF021A382BE4E2603ACBDB5550AC2DDF26F62DA1C2227B1F7F400.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bcae1b-80dd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699739731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739731, "uuid": "16baae5e-348c-4f86-a3a5-7a044944a475", "comment": "Malware payload (RedLineStealer)", "value": "b98529ce274669010251a0048ff10fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739731, "uuid": "b7b04f1b-69a6-416e-8b92-f65c6872e35f", "comment": "Malware payload (RedLineStealer)", "value": "35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739731, "uuid": "924d6b99-b4fc-46bb-978f-1d34722341f0", "comment": "Malware payload (RedLineStealer)", "value": "d0ca516066b227800aba9ceb2972884f5a6dcac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739731, "uuid": "711d933d-98c5-43cc-b060-08a5348a2668", "comment": "Malware payload (RedLineStealer)", "value": "9ff06b188bbe59896346e83080084252314e67b8fc11c6c6a3775b2e283d28d71087978cc74a9769401c1311a999ac7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739731, "uuid": "233c60e1-bede-4ad1-8cae-f0135606a0eb", "value": "T1356533079BD95072E5E9037185FB03570D78FDE16DB8C34E2661189F2DB26842839B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739731, "uuid": "7716057b-019d-4eda-a9e8-00039ce100ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739731, "uuid": "900ed2cf-e9e2-43aa-903f-dc93eb0b7226", "value": "24576:zy9RVKpquNSofXZekIsFkqGh52D3Jw1Sc7Rs4FIouNkRG:GjUSiJeD2pGStESys4FIouNkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699739731, "uuid": "2de99a9e-cf07-4c79-8939-e348bf131dbb", "value": 1456640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699739731, "uuid": "c477226d-eba1-4bea-8b83-b63e20df0a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739731, "uuid": "adafcc32-9270-450d-b2fe-7603bd633f3d", "value": "b98529ce274669010251a0048ff10fb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8819f64a-8047-11ee-8907-42010a9c0042", "comment": "Malware payload (Metasploit)", "timestamp": 1699675520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699675520, "uuid": "5f81bc47-830e-4192-b965-fe70e1d0af4c", "comment": "Malware payload (Metasploit)", "value": "ba0d0e4cd8709a73016b924a6d3e0749", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699675520, "uuid": "a5467952-11fe-4c6a-bcaf-c95a0e63c5ec", "comment": "Malware payload (Metasploit)", "value": "37f9b9194773dcfd0661a084d43d806aa7889724bb8828de7ebd100397877911", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699675520, "uuid": "8a51a26d-1f02-485c-99f9-2b26e5378c9d", "comment": "Malware payload (Metasploit)", "value": "d968f1ce5ba1c5a899a981f45dc00dab4e31cdaf", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699675520, "uuid": "3165ea4d-349d-4c43-9411-f11f2fdc8359", "comment": "Malware payload (Metasploit)", "value": "76ce251c3bc3ffe9f71c2f886c9685867a2fc9fe7ce5622d7afcf2b03742c9059c0c1503ce824fc9a256658def86eeeb", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699675520, "uuid": "1f731cd2-7a0d-4a0b-aba6-4b9567aa4a06", "value": "T1BC619E932151B8EA424287BF3D8966FAC07FC224954A6044FB8C5F5DF9DDE633A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699675520, "uuid": "d1a04c7b-0d0e-4ec8-b270-495a5afbf3ed", "value": "96:DGt8gg0aHuSfeFNgQfRJL0H9mAiBrVM/YYg:2dg0dFoH9mAiBrVeYYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699675520, "uuid": "53e8393c-901f-437c-89c8-68c90e16ea82", "value": 3227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699675520, "uuid": "d60f1bf7-a519-465d-913f-36b9de460190", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699675520, "uuid": "5774f6e4-6177-42ec-a37d-9a9f77f5f042", "value": "iyNhP5zt.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a6b779-8064-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699687802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687802, "uuid": "0af7686d-372a-4cdd-b29d-7d80ddc5c5c6", "comment": "Malware payload", "value": "5850dbfc677030b73bf0fa77b3f95a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687802, "uuid": "dcaafe4e-63b9-4197-8977-1b404519bee0", "comment": "Malware payload", "value": "39eafa0a30130870cc76cf65b6f5564f9a9f95b6292dcd8d248b3b725db4755a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687802, "uuid": "8eb28e80-0193-4d40-896e-c8dc44ff9e74", "comment": "Malware payload", "value": "fbea1825577211cdffc0e02b4ef025fdde105bd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687802, "uuid": "1235a7b5-643c-4ef2-bc3e-5988bdd796e6", "comment": "Malware payload", "value": "d25bc395cb330dcc964c3a26ff3c58c77ff9b6245995053bda57ac8668471df2c68e7931fb026eb6982ae2d3454b476d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687802, "uuid": "e917c426-acba-427a-bf04-aa7290459c62", "value": "T18774AE0262912C21FF2246718E2AF2E46F1EF5604F552BBB1E68691FC9719F1F67230D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687802, "uuid": "6e7e744b-81b5-49d1-a028-f8eb42115063", "value": "48be20798c978bee66ef4268b8d28670", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687802, "uuid": "9f727534-2d1e-47c2-ae66-e0bdca548533", "value": "6144:9dZcJB690Fbgxjs1WIlmSmrOxY5ps5RJT9ex:6B69ughjIldqvs5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687802, "uuid": "67310089-0e6b-4e56-ac01-b6100310f114", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687802, "uuid": "993a626b-6961-4857-b4b8-e20d5b349e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687802, "uuid": "95bd2d55-ffe6-4e66-b16b-83a9205d3bcc", "value": "5850dbfc677030b73bf0fa77b3f95a65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bad6f4f-80ae-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699719657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719657, "uuid": "c64fdda3-14f0-428a-8765-322027d5a76c", "comment": "Malware payload (njrat)", "value": "b5c72f610bf340d1c4872d99f34d702d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719657, "uuid": "9c3cd7ba-c9a7-49c9-9122-ae36bad5fa48", "comment": "Malware payload (njrat)", "value": "39f43f77c48344d2d3156220886163998b4d9fffd79a75e1dd12c07b23918476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719657, "uuid": "1461503a-7ff2-450f-b478-719355fd0c19", "comment": "Malware payload (njrat)", "value": "81ed772098e06e2f1892baec9118d2c594fa9f06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719657, "uuid": "65f3f401-ff25-460e-a760-f0e5091b57ed", "comment": "Malware payload (njrat)", "value": "45c3518d70237ca5e252dd82085bce6f08db5255c1de309e787511c2a1e19ee824f81d234f8777aac47a80e45654eb89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719657, "uuid": "fdb92f12-13c8-4afe-a985-1b447c88e581", "value": "T1A644F6BE32448F11DB983671C0DB902447A2ED926636FF4A3F88327D4912777AD093DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719657, "uuid": "9d5d6778-4a66-4688-b715-d7d3e5c7bafb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719657, "uuid": "71371abb-aa1e-4645-a517-be69f19954e1", "value": "3072:UEGPPt7e1SovwD9GI81LA06UoYd7luBbc8PPwL/q2N09vKKsrBDFl5yKg9zX:Ul/ovwI780JR7luBbbPP4/a9vKNPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699719657, "uuid": "98c462e8-850d-4708-b5e3-45da92715490", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699719657, "uuid": "685dc427-2826-495b-884d-67c4bfa77b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719657, "uuid": "d5984fa8-1532-44c5-979d-2b9f296fd070", "value": "b5c72f610bf340d1c4872d99f34d702d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf5e6fb-8065-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699688464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688464, "uuid": "928c4e58-e05e-4b69-b369-cc955b740ee9", "comment": "Malware payload (Formbook)", "value": "a4e402009b9da2103b8c965ec4277eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688464, "uuid": "3dc3c135-47a9-47b1-9233-d04778fe9670", "comment": "Malware payload (Formbook)", "value": "3c5af02b843a0fd2df2f8558917ab584aa45de1ee6ab13612d589fd8c653bbf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688464, "uuid": "a99bab24-4aba-4d3c-bd5d-6f8e5d7631c2", "comment": "Malware payload (Formbook)", "value": "dc709c8253b6c1dc2f2c2dcc0ca4e4fab796b458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688464, "uuid": "504737d4-fb9b-40e1-a2d8-6c168a316793", "comment": "Malware payload (Formbook)", "value": "298a76274ad27336dcc641f2b58c76e2cdb170a7ccd8a7342237d7db1042a7407491555b5e80bb5b236c3e04883ffcf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688464, "uuid": "5732d599-3cbd-44d9-be7a-3a75d09f6205", "value": "T19005693C4CAC123BC174DEA78B948066B6E197733745DD3964D316861E26E26FACC23E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688464, "uuid": "e3b91812-05c9-41bb-8c9c-b024ad3de0ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688464, "uuid": "b2c87b84-bab0-4e20-9898-17d9f1318c47", "value": "12288:7wQXVJAzvVQEB2BjvqOXypTQvym+IjFmLW2w:kQrAjVQ8czqCIUIIsCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688464, "uuid": "82101dde-5284-45d3-8adc-188c4e53a2a6", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688464, "uuid": "35095c3e-eea3-440c-8704-fc6890c44582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688464, "uuid": "86b5f296-4852-4189-bc0c-8c5e9adbaa5f", "value": "a4e402009b9da2103b8c965ec4277eee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d345b43-807c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699698319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698319, "uuid": "a6319571-9849-47f2-9789-3a92725a8793", "comment": "Malware payload (LummaStealer)", "value": "741d8018319a189e97bcf0d60ead08f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698319, "uuid": "b341b28f-64e3-4aca-90f4-4a193665d0c2", "comment": "Malware payload (LummaStealer)", "value": "3f2ea0d596d06dc2fd32b2dd2a475a0775d8f812e3bd1ce6e0ec0e8da0ec5212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698319, "uuid": "ed45cf1e-0ca3-4d50-befd-6de659d41ba6", "comment": "Malware payload (LummaStealer)", "value": "744bd9d8586613c40375ba0541d504d5c92c12f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698319, "uuid": "010af880-d942-4217-abe5-6ef9f92cbccf", "comment": "Malware payload (LummaStealer)", "value": "595d14ecfd6763895cc7f202ec3aeae7fd188e52e24c227d30bf1a44815a45ccbfeee8d6a7a95ae1f04d7e2135145711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698319, "uuid": "db190053-6d65-4ced-97ea-6102c8b22397", "value": "T11B55231BA9CE44B7D8F2A37129F643270B387CA08878521E6311D49E4DF2E987535B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698319, "uuid": "f0da2c9d-77e1-48af-a09e-e1a68d87509c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698319, "uuid": "4d47f5d3-ba56-498f-9d22-aff929caa372", "value": "24576:byYetjJTbcax7ae3IsRCvG84KDVdPuGivtz4uVeIPqPQhBKmrQ57Nvo:OYCV/cy+eYm2GApdPuVvtcuVeICPWBn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699698319, "uuid": "5c9cc0da-f83f-4ee9-ac82-47bc0a2dc72e", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699698319, "uuid": "6ab16bdf-df3d-4054-9642-0a7ca805d01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698319, "uuid": "2016d745-0999-466b-be84-9919654a64a4", "value": "741d8018319a189e97bcf0d60ead08f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f3a6c6-8082-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699701020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701020, "uuid": "517554c6-55a6-4139-a1b7-9d2634d4fc88", "comment": "Malware payload (LummaStealer)", "value": "a56d4229df13e8297b82f3c974e74660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701020, "uuid": "77ae35d3-4297-4051-b0da-796829a28d9b", "comment": "Malware payload (LummaStealer)", "value": "415bc147845345d629141179ad0997b55e1f50b6c6a73d35168254e89932d7f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701020, "uuid": "c6067c98-d865-49d5-abce-a7864f162a8c", "comment": "Malware payload (LummaStealer)", "value": "15895825cc3c1733bcd73e04c6f1a01da7f44ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701020, "uuid": "a007d377-3430-4bfb-8b3b-3ba42b382933", "comment": "Malware payload (LummaStealer)", "value": "f0cd4f47fdd415a074bb291f8f375c632b264ef02170c8a1893794369356861a04c5ffd8a1b8da6da78a72b519ad22af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701020, "uuid": "7db5fb09-cae2-4e45-a7f1-a4860eb8f9d8", "value": "T198552387EAD812B3ECB5077598FB47831979BCB1AD3C436F7A99598A0C60DC1943037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701020, "uuid": "ed71b2ae-689f-45f6-a17e-093756a35400", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701020, "uuid": "ed1b5c62-8213-467f-a728-30c4225663b0", "value": "24576:myeEJn2bHOtaewIsnClGsWGDE9O24ukaVXwo0gu9Yw1M0xj1tlkHbNNBjWV:1eEJ2Soe3mMGC8RkaXwodw1MS7lk7NNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699701020, "uuid": "56afe75d-9cdd-418a-a219-f9768cdb7929", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699701020, "uuid": "94367b29-6bed-4c78-8a5a-1be0ca5f657a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701020, "uuid": "61da7a40-ad8e-480e-9557-a38739453b85", "value": "a56d4229df13e8297b82f3c974e74660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00aaee0b-8052-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699680018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680018, "uuid": "5ef80e71-16a3-4dea-a669-c48a1651e7fb", "comment": "Malware payload (RedLineStealer)", "value": "0b1f8519494d346dbbe18d23eaf5ecfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680018, "uuid": "e9aeec2d-5aa8-4099-a21d-b8f32f9c8c3b", "comment": "Malware payload (RedLineStealer)", "value": "44204e5731a34e0edfbcb2f50a6f42a3b428bdef20df8e244caf9524d0513bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680018, "uuid": "dd25b741-bc5d-4ba2-81a6-3c6eb6170fc0", "comment": "Malware payload (RedLineStealer)", "value": "80a899ae97f708c9aef28b6759dd256de965ec74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680018, "uuid": "9fc88dc3-b6cc-4878-9a18-cf72fd8e743c", "comment": "Malware payload (RedLineStealer)", "value": "4f7ef5645fd9db390f53d4e735088ac3ae48e7db7354c9c5cc2a15a3089b816ff29277d4c3eec243cc02bf1b7c2a9b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680018, "uuid": "cf8e5ac4-fd22-4280-a821-ad09f32f4b27", "value": "T1995523826FD840B3DD742371A8F212A70A3BBC506D78A39A3A99599F4C736D465B0337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680018, "uuid": "5f350799-415d-489a-8e9d-a79785d1a392", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680018, "uuid": "1778e94a-e703-49ec-bdfa-cce7f8edb570", "value": "24576:5ysPPnNA+i2F36pFJO/aebIsWCGGHHpDBXDNtweLEN61SXUIj961NBo3HntUv:swnN4MqpTOieUD/GpZPVQNXN9Aq3Hnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699680018, "uuid": "3ec3e4de-0d63-4f8b-9b3d-b810ed9d3988", "value": 1391616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699680018, "uuid": "5d7b6a9b-2191-42bb-9704-1ee8ab9f99e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680018, "uuid": "16441ddf-f53d-459b-9ae1-1f894c454d44", "value": "0b1f8519494d346dbbe18d23eaf5ecfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b3a0e7-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1699687859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687859, "uuid": "e2c0d1c1-6a32-46bc-aff7-6cf5e898cf43", "comment": "Malware payload (DBatLoader)", "value": "a1dfb3f35262f5e7704c9e87a06a083b", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687859, "uuid": "30fb27b1-179a-47fc-976b-1abac5370311", "comment": "Malware payload (DBatLoader)", "value": "448a8114208fbb7d2e83c81d59bc262d6857937ec0bceeebda75ad978265b5dc", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687859, "uuid": "2c7eb6a9-4e0a-4e01-974b-f6d3084ec031", "comment": "Malware payload (DBatLoader)", "value": "cd7e8b3390f15dfb2fe1fced2308c0706b849a7f", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687859, "uuid": "ba55af32-1779-441b-96a3-3030a94d5e8c", "comment": "Malware payload (DBatLoader)", "value": "bd733aa44c75cd850703dd229c02ff0593f9e5c23093f44517adbf3adbafdebe4814f875924bb1312b41c230554cf153", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687859, "uuid": "be00c051-9c1c-41fd-ab50-ea47637fa67d", "value": "T1A765E166B1A58137D0171A748C8F92B57819BF217B7CE85E25F80ABCCBE3349207D267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687859, "uuid": "e5ef96df-57c8-4ad1-a938-016c67eaa40d", "value": "60f6ac6f53d8290345a6172546c7a045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687859, "uuid": "1265053b-7d4e-4b51-ae2b-f2fd9ffc181f", "value": "24576:a1gIhzVfFATn5p6hEj9mdvc/R/hntYbVwypYhSJt4ougiFaa/A:a1hVCOdcTntYZwyueGos4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687859, "uuid": "56bf8cda-5b44-4b9e-a7c3-d53f6941ff1a", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687859, "uuid": "404b03f9-daa0-402f-b8fe-ed295d3a73f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687859, "uuid": "c1ce554b-9f12-4bf8-8d88-6cff7bdcb0a5", "value": "1001520SAForm_YI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd01cc75-80a0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699713861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699713861, "uuid": "9880569a-a10c-4526-97f9-c7521ec65cf3", "comment": "Malware payload", "value": "c8372391eee74c64377fb86b6a37e0c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699713861, "uuid": "4110271c-f6bf-4732-91e5-65cfa62e55b5", "comment": "Malware payload", "value": "49c7d7ecb156f0008085f060a158a2c128d0a8212882bbb052bd538138d69b6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699713861, "uuid": "1cd7ad41-9136-46c3-a4ca-f65ef28116bf", "comment": "Malware payload", "value": "b62d32af0f00730332b0cc54ff035ac6335a80ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699713861, "uuid": "73fe6f67-e39e-4ff5-8422-8936bc841c97", "comment": "Malware payload", "value": "ad1d636d69b456cb47c8893e48e004fc10a188ae0007ffdd5e686009c793be4e9779656ee0128ace25820359447f2d0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699713861, "uuid": "6d5327f4-c2fd-4a74-bec4-e9cace3fab67", "value": "T188B34B2B77B900BBE1678334C5934A49EB76B4554760AF5F03A0429A1F633E19E3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699713861, "uuid": "b3827530-73b5-4c6f-9e6e-35d48c55003d", "value": "2997802cf0e4fb92a99c06480551856b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699713861, "uuid": "d0330f0f-df07-48d3-ab3c-49735b444fef", "value": "3072:4ohliO+WEP8ZP58pl4lDeJkdYm2K0FuNTMgKzx:ViOdEPaypl4lDLdH0sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699713861, "uuid": "b5edfdff-fb78-4473-9198-52cfd22495f6", "value": 107942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699713861, "uuid": "78704482-9e5d-4f2d-a0e0-123fed61f8a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699713861, "uuid": "58b1df0b-02a9-4fcd-a3a5-f54c29879698", "value": "5dbf2410f24c83687137a637930dc25b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5fea86-80de-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699740221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740221, "uuid": "74d49252-2872-428e-bbaa-4a1760c9c53e", "comment": "Malware payload (IRATA)", "value": "81ae596383f099e7badb9a9d8ef1db6d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740221, "uuid": "c5d7626a-507f-4df2-9584-f076c3bf78c1", "comment": "Malware payload (IRATA)", "value": "4a714f9ceffad48bae87e374d72533d6cc212b203764d8ea782c704e5f37e964", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740221, "uuid": "35df43a3-4f40-4886-9df9-c35cbe7b3a61", "comment": "Malware payload (IRATA)", "value": "3b185c9667e13396d9e14dfa0b5fdba97cf404e4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740221, "uuid": "6693dbc7-b022-438b-be9c-dde80cb28cc7", "comment": "Malware payload (IRATA)", "value": "6598767caeeb3d6e04e7974751b4dc79755baa31638cfd3b025513af24040558845afe4987c204213ff9a64c10f6578e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740221, "uuid": "b41b5320-c7a1-4029-8982-0fdbc4db667e", "value": "T1C5851257F239B91BC832C13321852A3965565D68CA43FB4A3A4873FE78BBDE807C12D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740221, "uuid": "db2c2ba3-91eb-42cf-9d70-d3971004c012", "value": "49152:NsFkkzEXpQLYGUvlIlbu2eJOsNt2vCV7U/lgHTkzA:UkkoXoYG9aDt2KC/yzcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699740221, "uuid": "6808a5ef-8e6a-4f40-a4fc-ecffb0ec7b48", "value": 1777141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699740221, "uuid": "1c2eb231-ef36-45da-953f-79e2b67f8b20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740221, "uuid": "68e400c3-4bcb-4889-a14d-0306636ef9e1", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c35775e-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688788, "uuid": "ec88d3d0-ff1f-4cec-be73-343a70bb3d90", "comment": "Malware payload (Gafgyt)", "value": "0bf4100f1f65756e606565281d62dfed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688788, "uuid": "e870eb5a-7b08-4603-a7ba-60017a59dc70", "comment": "Malware payload (Gafgyt)", "value": "4cbd705b6593e986310492e4e9dc677f3adaa83daa8304a3310b9b11944fc527", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688788, "uuid": "5d672d4c-2cf0-4d55-a5e2-945612b4e9a1", "comment": "Malware payload (Gafgyt)", "value": "ea8dcf3bdcb9740e80ea1d2ffc91bdb2d4483115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688788, "uuid": "7628659d-4f5b-4e87-9ff9-6d3c31a26a03", "comment": "Malware payload (Gafgyt)", "value": "e5950781a93f5fb5b3af24cae0bc527d09bd740aa67abe9bdc9da61d88e83823433a6928f8821816fc95673b67bc53c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688788, "uuid": "66d90673-1bb1-4c78-8a8c-e0f52cdf94db", "value": "T1A95302F36E69F3B6EE104D302E738892B7567FC4A05E22699225D3BC57CA016E1CC658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688788, "uuid": "6dc76331-fd92-490f-9d61-1b08bece35b0", "value": "768:eCfC+5U8oaCIZMhpHBic4/qchMzXpQvX8H9zzqNMq3U75IiDckQlIE+STfhbY:hQdXchMzXpQaou59ckQIEtTfhbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688788, "uuid": "bd26add3-dcfe-45ec-90d7-dfd1392f6514", "value": 61940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688788, "uuid": "36f275f4-8dc0-4016-a144-530b29633498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688788, "uuid": "f04ff274-4eda-4e29-9204-e541bb4110b5", "value": "0bf4100f1f65756e606565281d62dfed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e627bdc0-80ba-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699725070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725070, "uuid": "8754967b-8007-4f9f-9673-0eb62b6a5ad3", "comment": "Malware payload (RedLineStealer)", "value": "b938478f3ea4e831977b7641fcdc2f98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725070, "uuid": "1fa5f103-1e83-49b7-8018-8f40a4feb336", "comment": "Malware payload (RedLineStealer)", "value": "4df5f2cb975634c50d22467a1908de4cea7f2afbb0e818712a59066955e08a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725070, "uuid": "7e833faa-2d66-4897-af4b-0ccc14a57b68", "comment": "Malware payload (RedLineStealer)", "value": "2868500a1f437957cda88233b5faa772e5df6fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725070, "uuid": "5ec1788d-1993-4a6f-b4c6-3140ae682a58", "comment": "Malware payload (RedLineStealer)", "value": "ee8bed89ffef7aaaab4828549226cc6930c48064230cb6fa80fd81180b01c6290f31fd912eeea677590f4b643a82939c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725070, "uuid": "35215571-e973-4386-9ac9-4ae781d37c07", "value": "T130E73355FD387AACEE46D63CE58167330BA66DBA3910A40FA56C3DA735FC90DA310813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725070, "uuid": "a672ba37-dd55-4363-a9e4-1bc84e92eb9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725070, "uuid": "72da3b16-8e2b-42ab-b4ce-383a14f3c0d9", "value": "393216:ZvdESNjEA8sFDx5M86aMqeL3XYcvLeDLSE:VOSNErsFD0QZ+L6DLSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699725070, "uuid": "e31296f6-41e2-4ddf-a56a-38a6baa057e7", "value": 64152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699725070, "uuid": "476da05f-8326-4fa3-8d17-1936d14ffac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725070, "uuid": "da239b96-0cf3-4e8a-9bfd-090026bc942e", "value": "b938478f3ea4e831977b7641fcdc2f98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b004e8ab-8067-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699689331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689331, "uuid": "4871cd12-7eb9-43f8-927a-773ad3e0c3b4", "comment": "Malware payload", "value": "93eb4c2ac7d9b957c597b274c346740e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689331, "uuid": "d50a8f54-a5cf-4765-abef-b097c8cc532b", "comment": "Malware payload", "value": "4f0dbf3b482c1fc2bd69a52de29de53fdbd94b7e85a06024111dc7e3dec7e11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689331, "uuid": "5b1651eb-377c-47ee-8715-c610b092c7c1", "comment": "Malware payload", "value": "e624f9db01fa95894f6bcc4766f552b6b8b56646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689331, "uuid": "567b5988-25a8-4474-b890-d3eba156ba5f", "comment": "Malware payload", "value": "ec7ee76fd4349f36ae5d399abe4a33760dcf612331207c3f05b1e6bd34107f7063d867599f983e4bf9a8a3eb1745f26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689331, "uuid": "ebc63dd1-51e3-4f23-8e81-a7dce6ee4654", "value": "T15D46F810D641521EDDB724F54AAD713EB10CAFE0131864C781C86AFEEBBA6E13E3459B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689331, "uuid": "64f7d804-429a-4c01-99ad-da080f73e821", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4xqU9uBB7fQbA6qbC6Kvr:rzC+CqfG2VcruFG2KAyVEDLvTQt9HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689331, "uuid": "99d1da77-e9fc-4340-9f01-80a5531c3777", "value": 5563832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689331, "uuid": "d9db4d5d-d6de-4302-bcac-67f6b83a6cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689331, "uuid": "db511182-4fd0-4059-9bf0-1abd02c7c99b", "value": "93eb4c2ac7d9b957c597b274c346740e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6907cb6e-80df-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699740752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740752, "uuid": "73a6dc1f-d400-499d-8007-b6518aedfac8", "comment": "Malware payload (IRATA)", "value": "d955f8dcecbb820dc238efce85362683", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740752, "uuid": "9e7fa443-a839-4e58-885f-e3dc4752f5ce", "comment": "Malware payload (IRATA)", "value": "4f71a45f9048ea8f71c997625fcaee76e7dc168e4ec8fff3a4492ea1a51af68c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740752, "uuid": "b3e5f710-71d1-43d4-a64a-c0c507ae45a0", "comment": "Malware payload (IRATA)", "value": "5378dbd4578e375e6237dd4b2641c09a8f608bf1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740752, "uuid": "f80a6e7d-a976-4ae7-abaa-a89a577d0a3c", "comment": "Malware payload (IRATA)", "value": "d05746630471e47cf6ca086b946a885f72df205b657fd81c2a97f0d74d39910c5e69399da796f7cfcbe6a76b7333d2a7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740752, "uuid": "80d34313-61c0-4ea6-8fb9-0f8e1917b115", "value": "T196E52383F756A957C8E6C37225741B3A113A4E28C747B65A390837FA34FBDE80B816D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740752, "uuid": "cb817464-3592-4984-84b6-0efb27691a4b", "value": "98304:gdMakkmX/HbXLeLYNadjwsdyPeWNDb1uP:iMaavHbbeLYNgUPh1uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699740752, "uuid": "8dd42f1f-77cd-49a6-a89d-c336d3ec8d9d", "value": 3187043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699740752, "uuid": "e2c4215d-8bb6-4d19-9516-f43cd4c7eac5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740752, "uuid": "5728152d-4700-4f9d-a5e6-b972562ca23e", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e209a83-80e5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699743311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699743311, "uuid": "be9004fb-824c-4f91-a9b7-e642b802d63a", "comment": "Malware payload (RedLineStealer)", "value": "67643176c0835557086421d1e09473b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699743311, "uuid": "e8539e71-26ef-46b2-ba7b-766b664fb58e", "comment": "Malware payload (RedLineStealer)", "value": "4f90ae190b1e47476a45ab214017e87867be6d821e8051329da38a0800620462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699743311, "uuid": "58cb3038-9b03-4575-b8ce-1362b7fc274a", "comment": "Malware payload (RedLineStealer)", "value": "52a54b0111da7b85b14e59451f3e23a8fa8bd916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699743311, "uuid": "c7958e8f-7707-4566-8801-e2634a0e0487", "comment": "Malware payload (RedLineStealer)", "value": "8404ef600f80d3850abe77bf43f71156f733931596aec4b421540a4425607dad872b9973b2220e11ae07bc71c70f82e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699743311, "uuid": "24b5cc2e-890a-41c3-9919-6bb1e38f5ee6", "value": "T10B65234669C940B6F8F963345CFB03070635BDB24938C6AB616DD89F4E61AE07A347B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699743311, "uuid": "39477e1a-3ac8-47a0-9511-20dd2735611d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699743311, "uuid": "6d321fed-b9c1-4671-b858-66282e4bfb30", "value": "24576:JymI45JVopijaC7eIIs++dGgNeDTvqm68PXc0UUSTQ8KEz/YKts/ZjV:8Z4lEiOqefdWGJvv/cCSJKS/YKu/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699743311, "uuid": "cd964141-d8c4-43a8-af55-d6f02460011d", "value": 1456640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699743311, "uuid": "89b5278f-b46b-40b5-bf1c-79428bf7c33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699743311, "uuid": "9d89f351-1ee5-4a30-ba7c-98602357b458", "value": "67643176c0835557086421d1e09473b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a15bc13-802f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699665028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665028, "uuid": "e2354365-708c-4198-bcc2-f6b28cd4be04", "comment": "Malware payload (RedLineStealer)", "value": "4ee13cadf4c2f64304cbac26a63e6e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665028, "uuid": "73c83c9b-397a-4096-9262-8bbac94f365a", "comment": "Malware payload (RedLineStealer)", "value": "529de585358f7d7e803e7e22b6641af3461c7eeb719e8b8094d951347de17d4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665028, "uuid": "d850a666-3b55-423e-beca-e46467accceb", "comment": "Malware payload (RedLineStealer)", "value": "f51f96dff819320813bcecc1f17520eece155aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665028, "uuid": "cf59008b-a7e7-4858-b828-8aa31e833d5f", "comment": "Malware payload (RedLineStealer)", "value": "271ecba3a2e3eaafe2ec08051a726ed616f5e31c68d2d6469d7d8b92b90441b64ea6305e5c6dd2a5c80a689e5bf22dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665028, "uuid": "759fb2e2-49ac-4914-abb4-bc00562e8594", "value": "T19EC41243AAD98073E5B5677068FB03570A39BC625E3C836F3389195B9CB2AD06931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665028, "uuid": "83dacf61-42e4-4b47-8528-8be0cf014379", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665028, "uuid": "6d56c701-30ed-4415-b709-96d2ad97ebd6", "value": "12288:YMrLy90j0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL61fX:DyeiaaewIsgCQGIgYDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699665028, "uuid": "40cbaea2-0d3c-4fb4-9841-deb81104fc82", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699665028, "uuid": "223491e0-8d4d-4af7-9ad4-acb84f89aa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665028, "uuid": "a89d074e-b75b-4258-b660-57fdc2856158", "value": "4ee13cadf4c2f64304cbac26a63e6e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ac60fc-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688755, "uuid": "b81a5061-c525-48f4-889b-e77706027ffd", "comment": "Malware payload (Gafgyt)", "value": "4cade2bb54dba862e6dc394150ad44ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688755, "uuid": "4bf6191e-7697-4df3-a416-45adb8907781", "comment": "Malware payload (Gafgyt)", "value": "52ad273cdf804ce8028ec076a030cc88bcbf16253fc90bb68b9aa64e089b50aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688755, "uuid": "3315c685-19af-4e06-b520-bcbe523a96f3", "comment": "Malware payload (Gafgyt)", "value": "ddcdc548b4d0e4af89ba61cb79f315ca1b9c3a2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688755, "uuid": "9727afce-d66e-4e51-ab83-fa6fe1b4f688", "comment": "Malware payload (Gafgyt)", "value": "2ecce692422d2bcf367d3bb8ff2f9edc979caf2ccc2fbab02b273c7691265d7835fe1460664da2795e67d5924d93de7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688755, "uuid": "56ca2f45-f1cf-47be-b238-81dabb754a09", "value": "T180931947A9619FB7C042AAB525EA4E700B53BD511B1F1B89713CBAF0073B5CDB80EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688755, "uuid": "747562b2-6be1-4ac1-944b-3ac67a959422", "value": "1536:aw1ZVq1G4WYjmhXQKGaUZgGJWKLE6qnCAoFR1GrYqmK4lpbbiOInK6NO:awc1G4jjIX3GyGJfenyFRkmHlpbbrInK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688755, "uuid": "326f5bad-d666-464b-a0a9-b69d079a88d4", "value": 97279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688755, "uuid": "5a37e96d-cdbb-42a4-bd8c-d6ee2f31c2f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688755, "uuid": "24e6c9cb-20d5-480b-af84-f8d901e640e1", "value": "4cade2bb54dba862e6dc394150ad44ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685f8066-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688782, "uuid": "df9a7e8d-2296-4be1-ac0d-5e7a84adc4a6", "comment": "Malware payload (Gafgyt)", "value": "fa5668b8bab2abef2593f83e14949b33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688782, "uuid": "e2dc1388-19dc-430e-a069-94322df1339e", "comment": "Malware payload (Gafgyt)", "value": "53f70c8b3c7c3713952967759e4a57c36924e1e41a5ea8a09e83cd42e448c1fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688782, "uuid": "f1442da6-509d-4c6f-b200-aea3bfee8add", "comment": "Malware payload (Gafgyt)", "value": "3e01e7aece2c67096837be77f319ec5ae438f9ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688782, "uuid": "5d7c29d3-d1b3-4c05-a91e-fb6c8d732bbf", "comment": "Malware payload (Gafgyt)", "value": "40ed24ca5615b0ec074d8e9235b9a8aef19c1918555a0a0e5693f643108e04288a6c68fa6aad9c20dd9edbbb411870ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688782, "uuid": "fcea1dff-c3ec-4ea3-9465-cb6770ef97fa", "value": "T1F803F292F1B04A30C636167FDC8DB95C0564F65C92047531CCD92BBEECA87AD3969392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688782, "uuid": "e337baf1-4560-4293-9c28-30783f198a9f", "value": "768:Bou9N6ev/7GU4HNtUnfzJJauH3jPYW6TCfBE237ME1oMNWd2+UAnbcuyD7UryqIQ:Su76oSU4tttkrEfQ1oMQtnouy8mqIHZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688782, "uuid": "7de8dfeb-415c-4ae3-9854-4c6a2ff354b1", "value": 39944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688782, "uuid": "e41886b0-04ba-49fe-a369-51a92e157dfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688782, "uuid": "6da0baf6-4447-445a-9bc5-e534fd94c086", "value": "fa5668b8bab2abef2593f83e14949b33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb46881-80a7-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699716919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716919, "uuid": "c18bfc5a-3299-4c3e-b221-4a555aad3226", "comment": "Malware payload (LummaStealer)", "value": "58dcee393280fa13e87a2c50e0154379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716919, "uuid": "d1c2b55c-d4f8-4111-9faf-635e8ffab006", "comment": "Malware payload (LummaStealer)", "value": "5560b3501a49afd86cefe836f79f159f49adced11ccecf92b5d6651edd292c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716919, "uuid": "75a53e7b-f091-47e3-b1b6-73a477ffcff8", "comment": "Malware payload (LummaStealer)", "value": "9aba421ff0fdd6a91370b7babea08727e3f1c65d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716919, "uuid": "89214040-b93f-423e-9f5c-0e8b6d12b70e", "comment": "Malware payload (LummaStealer)", "value": "c73a75283c6d324f16ac45b3aa098933eb5c32e65c64991339eaceff7e5baca03337bd2d2aa7e90cb8af82e082b95993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716919, "uuid": "cc35edfe-5195-49a5-98d4-af2b494586f3", "value": "T1175523477EEDC0B2DAB9877068F713571D36BCB85838933763A698071CA19A47A3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716919, "uuid": "4b6ebbc3-47a1-40d6-8502-7b3022e1192b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716919, "uuid": "16fbc593-07a7-4a65-8c9b-9a9d30768f80", "value": "24576:hyC/JMyPxaeXIs2CQG0GtDjaFIprj+pdsA4OLc11bfthUItMQBrI3:UTyP8e4r3G1fFrjUy5LrbfEb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699716919, "uuid": "3a0e84a6-291c-4ba0-8a09-c19024125bf6", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699716919, "uuid": "ccd15e7a-87f0-4cf4-a62f-61f88b422b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716919, "uuid": "ee49038f-31e8-4006-bbf5-99104b32ead9", "value": "58dcee393280fa13e87a2c50e0154379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e9226f-8033-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699666811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666811, "uuid": "3e610f59-f518-4897-816e-779851fe7d6b", "comment": "Malware payload (Stealc)", "value": "8df98ad3ca0c7f41175271d090d8d0c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666811, "uuid": "e6967b33-11fb-4598-961f-1792f19e2785", "comment": "Malware payload (Stealc)", "value": "5579c693bd0129ae7350d599239695cfe4a578965ae2889b74fe3cea19d7e3da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666811, "uuid": "2d8ebd52-fa98-48c8-a413-7eccf3542e53", "comment": "Malware payload (Stealc)", "value": "29fe73c1cc5672f02c37952d1699717e64be58e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666811, "uuid": "36508a07-b4c3-49ef-9b74-73487ece0e9f", "comment": "Malware payload (Stealc)", "value": "9495d5f31329e6da82e362b5d624af7a233aa973e232f2efb8e473a9649f6c665693e388bebfe2fba5b87ee28084891a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666811, "uuid": "3468fa6b-6e2a-4801-9c43-0e9138c4347d", "value": "T1B214BF2236D48073F2775A348B71C6924E27B8B65B6198DF2BD4196E1E712D2CFB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666811, "uuid": "bd10ee0d-a652-42ec-8e2a-132b746f86b1", "value": "cf6c67a92b992938826c4e4ca9230c19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666811, "uuid": "92fb2880-27bf-42c7-9b9d-9cdbd767fe59", "value": "3072:tGmCsSSeDqwOo211BXydq3/CxrLgGolIWWi98mux/Xh0vFF1MY7glC:MDXDpf2lIq3/mPgaWWD9xKdFd7gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699666811, "uuid": "344c2017-b172-420e-a430-4df019b6dd3c", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699666811, "uuid": "ef6bce07-b1bb-4db2-93cf-58c6793c4363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666811, "uuid": "4c7070cc-8bc5-471b-b1e8-34bab3be8689", "value": "8df98ad3ca0c7f41175271d090d8d0c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6733b9ef-80b2-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699721421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699721421, "uuid": "f9848ac0-8ce8-4295-803e-2c7d188b536a", "comment": "Malware payload (LummaStealer)", "value": "d36c93539b692d79f6cf8754a3a1f1e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699721421, "uuid": "67f309ec-6080-4931-a81c-5a821b80c4e1", "comment": "Malware payload (LummaStealer)", "value": "558bb13483b84ff657a21ea374ff508f808718cf61c8142181b0b06763327304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699721421, "uuid": "0115c8ac-0592-4c0b-a140-ceab0775030d", "comment": "Malware payload (LummaStealer)", "value": "e91406146ccd42b0c7b99cabf39fbe924ab775ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699721421, "uuid": "06df20fc-0803-4987-aef7-b208e1f5ec1e", "comment": "Malware payload (LummaStealer)", "value": "7689f552d9ac87ef11490220ecf74f888508ca2f5f4c5451548cb4f0285bfd23ffb70fa5681b16c2c58624ef2378a550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699721421, "uuid": "05827fad-6cb3-47c0-9b1a-e549635d1e6c", "value": "T1245523539FD96071F8776330A8FB168706397D208DB8835B33117A6B9E323D0A572B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699721421, "uuid": "0f0bd540-34a4-4c7e-b406-624ef3b7de2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699721421, "uuid": "d58bf08a-dd9b-424b-8551-998fd99a0679", "value": "24576:fy7/RZ5M8QLae4IsOCWGAH+D40dJRiOfk6p0W5MN1+NKm41sX6gR:q7JZ6DOePv7GdIOftWW81XWX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699721421, "uuid": "0ef47eb7-29a2-4439-acc4-0b59a3ca33cd", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699721421, "uuid": "dfb40c1d-fd62-4fe4-8a48-58de85c64f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699721421, "uuid": "04b10343-0ee2-4813-9ebe-c566683ca205", "value": "d36c93539b692d79f6cf8754a3a1f1e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e4a6f3-807b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699697924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697924, "uuid": "d31f36d4-7540-4670-bd70-74e699806ea4", "comment": "Malware payload (RedLineStealer)", "value": "59eced4f1151ff094c315619a3cc5ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697924, "uuid": "0b846ecf-1127-4beb-9169-4cd671b9a4ad", "comment": "Malware payload (RedLineStealer)", "value": "565e7aa7834804d25b27a92fdc0a67fa156c9594d2c297a9b9eb1e6d21f4dd0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697924, "uuid": "987d5a49-64df-4858-84a3-5417071def2a", "comment": "Malware payload (RedLineStealer)", "value": "37ab6e7f0927fa820e77007c548e34e9de185409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697924, "uuid": "88a19bac-9d87-46dd-bf5e-25736ba4de90", "comment": "Malware payload (RedLineStealer)", "value": "54850af87135b667ee1229b6b0c1fb4366fa16a00fefbac336614edbdc28de6a66b94f16e8cab05a2b631c89d0eb2a79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697924, "uuid": "b149c464-733d-4d88-b4eb-c75d6a3e1ed0", "value": "T181943A0EF500DF24CA6D47F44DD782BD98D0B11B43372195E7A8E8EC61B4BEE72A5826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697924, "uuid": "1300c0cc-f930-440d-8695-d968a2234a9e", "value": "8596254f173e899b39f95b212255bff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697924, "uuid": "e71b591b-3e6b-4b6b-8c75-300c1622bc92", "value": "6144:3EHKgjUFccbbr6S66BFSfJD2290a+tG+f2VNHBdkNOjBO1c:3EHQr6S6m8pNHkNCBOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699697924, "uuid": "16148296-c4d1-420b-8774-16468487daab", "value": 439260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699697924, "uuid": "ace1aed0-e4c0-4267-b548-01610513ae7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697924, "uuid": "3a3348cb-68bd-4024-821c-d6d624ce1a5f", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6710.2312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3164bcd1-8089-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699703722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703722, "uuid": "2c5581d8-907d-4973-b6e6-f87b0218f502", "comment": "Malware payload", "value": "9a71065e06c7ca0c4af5f9e297f76474", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703722, "uuid": "9979840f-f942-43b5-b5a9-603237c976b6", "comment": "Malware payload", "value": "573e2765776dbe271ef7feefa7502d7a758178f067c595ea9908e2df2ae9abb0", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703722, "uuid": "9251a978-858c-41ff-a7e2-267f4a40a696", "comment": "Malware payload", "value": "f018077af55d58b6fdd998544ad8007c41d912e1", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703722, "uuid": "af2b6694-0c57-451e-b460-a212a089253c", "comment": "Malware payload", "value": "0bdd5a89d10af5f184a7705306f2d08159a9dc779f653ab4070b3bc68f464da742d2155d763d95eb7d76d58d1caf7fe1", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699703722, "uuid": "d1844735-f27b-4835-a961-7ee304794d01", "value": "T13161B1932151B8EA414287BF3D8966FA807FC224954AB044F78C4F9DF9DDE63398D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699703722, "uuid": "54c9c862-00cf-4bd0-9ab3-7cc7390cdcc0", "value": "96:hGtx0i2/luSnWvD+CfRJL0HEmAiBrVMHzt:4Si26v4HEmAiBrV4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699703722, "uuid": "7b67450a-85bd-4e97-b9a2-08677d3762a6", "value": 3230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699703722, "uuid": "0dc172ce-4efa-495e-9538-c219fcda4253", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699703722, "uuid": "8c3cc0bd-b89d-4cbb-b798-e7e3a47e6e4f", "value": "AVSjt4bF.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d85bcdd-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695635, "uuid": "2e17bca8-0762-4053-a901-ec758672abc0", "comment": "Malware payload (Mirai)", "value": "87fe26d452f0dae73b38c9811399806a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695635, "uuid": "a9a6db4b-5e69-4c1b-8498-85732c92aa95", "comment": "Malware payload (Mirai)", "value": "5b2bfbcc438d8d479c4c4ceab9ffb9ff5054bf909106ec2ce63d5a83fea676b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695635, "uuid": "294484c0-ce72-426b-aaa2-0b415a1d9bc3", "comment": "Malware payload (Mirai)", "value": "eeca99476916e00503cf8aa8358d32d8974a1a2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695635, "uuid": "99202d05-9500-40f6-b850-405294125360", "comment": "Malware payload (Mirai)", "value": "96c1b411103db8623776d1917e402d0edc9a24a8720500744d6fec77059555b58f56bd1cec7ac39ccc0500a957ecb0bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695635, "uuid": "bcec1a25-51dc-4b22-b423-0e058c9f0372", "value": "T1A004D81AAF510FBBD8AFDD3702E90B0639CCA54722A53B353678D528F54B50B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695635, "uuid": "6b88ce7c-2732-4570-9c90-54417930044e", "value": "3072:0ocBd3XLo077OeoAed/JrFxG9tYaiiDqoY+N:0zBpXd77to1BJZxipP7Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695635, "uuid": "1f4f00f1-2e47-446c-858c-8fea4a8d44a2", "value": 185348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695635, "uuid": "950c24d4-d1b2-4002-9f68-df7892748eb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695635, "uuid": "3403bdbd-e90c-4170-a7ef-971f10bc362e", "value": "skyljne.mpsl-20231111-0940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c48b1e1-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688761, "uuid": "db5bf5c2-a9d1-416d-8101-5f0a2f7ee0d3", "comment": "Malware payload (Gafgyt)", "value": "512ac489018682f7f53630ccce948f49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688761, "uuid": "5b183f8c-83ec-40db-b985-0330ed91c49f", "comment": "Malware payload (Gafgyt)", "value": "5be8ba28bf0cc47f921ac70574862055c3c9208c67f3f4ba141c6e0386012f1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688761, "uuid": "231cad15-3693-4982-8b3c-3771340717e6", "comment": "Malware payload (Gafgyt)", "value": "a9bdb75d84d069777c368f62fbcff801c2d4fe36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688761, "uuid": "79b188c5-7de3-4abe-8586-8753f15e37fe", "comment": "Malware payload (Gafgyt)", "value": "96f69fd6d03d8eaa201022ba9b9baef83be02ee0b517fcce474f02104cb85c05bc672570aff5234c02beb8fd0a731927", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688761, "uuid": "62d9096f-67c6-48ee-af13-fb4dc83ba62a", "value": "T1C413E11FADA975DCC1CC59BCE4B81625ED3279A3234DD79EA680B8885FBC54F3405032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688761, "uuid": "42ad5a56-d5b9-42b2-bf7b-e25313b737a0", "value": "768:AlRou1vPOMrv/Ffi3C6wkGgqhPSIRc+LBWRtHKFCg5kaqvnteu9M:A739ViLwkYPHcdvg5VqfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688761, "uuid": "6a706ed8-7817-43eb-b924-dbfbda085ca1", "value": 44000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688761, "uuid": "44b9d17e-234f-4e05-a334-7c0d77284527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688761, "uuid": "ff5cd9c0-0d6b-4308-9c32-83afe3734388", "value": "512ac489018682f7f53630ccce948f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d21ba8-8065-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688452, "uuid": "9a4c6bc9-85ac-416a-a630-9b81e4713706", "comment": "Malware payload", "value": "17a8c5f30478dcded26a2ec87ddc7690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688452, "uuid": "96349f9f-db9c-4be5-ba58-5d080bdc95c1", "comment": "Malware payload", "value": "5dd9157670052443b2aaad102fff315339362255039d1fb235aed6d40f94c71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688452, "uuid": "56c11117-98f5-4c64-9621-afd2ba3d6425", "comment": "Malware payload", "value": "48162788b367507a0c9f4f5ec476e35ccddd817e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688452, "uuid": "228d732d-0b68-49b8-b06c-a907f81687b2", "comment": "Malware payload", "value": "09f5a8710951dff0d3d105920ee606730d31fc168c741123a9529634bfae78ad78ed5d4be63260f0caf5075a20799064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688452, "uuid": "a7309c41-4890-43b2-a310-f9b1b571c5c4", "value": "T14CC501D462CB522AF29B9278ABBA44F05B6DF4A513ED4C5940009A3743BFF8D634ECD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688452, "uuid": "5d07ccd2-d8a3-4215-b340-3d170fe13ee2", "value": "49152:IKavlIHIN33nVKbobHjbP7nMALUtmwi3Y82H1xMSCBQaAXXT3EtKMIQN9Wpd0/8V:vavlQIN33nVKboT7MAwtCUxDwoQtKjnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688452, "uuid": "4950fa30-dbb8-4b5a-bc42-49e849b84a2a", "value": 2739643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688452, "uuid": "06bf531e-62f5-4dbb-8116-b220bff16138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688452, "uuid": "184af091-3fa2-4c6b-8642-eeea1f0c9dcc", "value": "17a8c5f30478dcded26a2ec87ddc7690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948bab23-8095-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699709042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709042, "uuid": "a6866025-9435-4399-a633-3e6f22ec0ed9", "comment": "Malware payload", "value": "b032f3b71afabe48a7f8f77850ce7b0f", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709042, "uuid": "e2714536-6757-445e-98bd-d25bbf6686e5", "comment": "Malware payload", "value": "603dd8562b98ed7e13618d591a2d359f02a3d33b5b8787435aaa0d06f2bf1451", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709042, "uuid": "fad31514-3eea-4f94-a4c3-49f9522ab635", "comment": "Malware payload", "value": "c3d367d964a60640c804117a34bed59f6e3da579", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699709042, "uuid": "5fe0ad39-283b-4897-beaa-888d8db76e4c", "comment": "Malware payload", "value": "1d021b1d6d5b02e086c29359819f32b96e4e5968a6f7375de42d9e4031a54a734973dccc39a3caecf27c215e988296a1", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699709042, "uuid": "8e1f7112-4b87-4637-a103-cf376dc00cad", "value": "T1F1A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699709042, "uuid": "12d1abeb-572c-41ef-bf54-d2a761c71eaf", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699709042, "uuid": "4bbeb388-c88b-488e-9b70-897ec0276147", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699709042, "uuid": "a909a813-68b3-4394-9bb3-b30c8e55141d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699709042, "uuid": "0a788d17-5712-4203-9ac3-d489f97c9921", "value": "603dd8562b98ed7e13618d591a2d359f02a3d33b5b8787435aaa0d06f2bf1451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1c1af5-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695656, "uuid": "dbc0a4b4-84ba-4af8-aaee-b37e6d8dcc0d", "comment": "Malware payload (Mirai)", "value": "954d6fdded1d02eb984d88034be95abf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695656, "uuid": "5e61b3d2-0ea1-4154-aebd-b40b6e5898fd", "comment": "Malware payload (Mirai)", "value": "62f796719f0fd261cb2e567a884addd0e63fb6a45158a845ce010f9709b43966", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695656, "uuid": "bbd93e2a-c15a-4e94-b15e-3e5afeb5e05d", "comment": "Malware payload (Mirai)", "value": "77791d5e1a4687178fa35652750e246d4832e132", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695656, "uuid": "af51c289-fa34-41a6-9444-b2a193fd3c3a", "comment": "Malware payload (Mirai)", "value": "df124c1c1fbeb41c27d4c505bfde0de2e2ce66583967d8cda8ea641f9fcb865852b53cd30f3df2afbc25f5dc1acc152c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695656, "uuid": "cc651a5d-071b-40b2-b3e6-727cf1ab57f1", "value": "T1E6D30845F8415F23C6D312B7FB5E428D7B2A17E8D3EE720399215F60379A86B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695656, "uuid": "7ec2e93a-ea78-4e4c-b85c-1868c7f78270", "value": "3072:e9ZoWuuw6PP1dc4UsREw3MQYpC7jbDq3x7:e9Dhw6nXc4UEEw3hd7jbsx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695656, "uuid": "1ffa19e7-030a-460c-8767-a198d9cd1ec9", "value": 137088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695656, "uuid": "b87fbc71-dbb8-48b7-8513-dd849d6e7e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695656, "uuid": "39164929-59e6-4a2c-bedc-cea78133acae", "value": "skyljne.arm5-20231111-0940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f05343-80dd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699739920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739920, "uuid": "6f3d52e8-bc76-4388-8132-d5e70b3539d4", "comment": "Malware payload", "value": "55183ec521667ef97ea1454f72c5420b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739920, "uuid": "a4feb827-5f2e-4f63-83fb-b62457bda5f2", "comment": "Malware payload", "value": "646e3bc6f109052bd714bb22050e932a9fd6a64eb8665d3c0b57600282b09755", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739920, "uuid": "47d994bc-3925-4ea5-87aa-fc5b0ce31aac", "comment": "Malware payload", "value": "64b441ae0410f3394632ed6c0ec9c01b8bab461e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739920, "uuid": "bf7b677a-ae81-4f2e-b281-b3e7be56ace0", "comment": "Malware payload", "value": "4151c06d63f0c263eebb401947ba4fa45ecb1b319507a47909ed65ce00e6260f4761cf932218e693a71af9dc664beef8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739920, "uuid": "328724df-340b-40db-9b26-f987027ec2d8", "value": "T12716BEC6FBD89C2FCC7710B5CA5A53B1122A5C0A8342DF836A54372C69776E84F69BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739920, "uuid": "4f3d9458-5234-42b8-935e-6cb46c2f5123", "value": "98304:Eg8gnW8glqBq6qwGna0R6rS+7fuBtJZOz0iD0boTYrZRMA:fW8gJiI6rdfuFZOzZDuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699739920, "uuid": "4f430d6a-ebd9-40ca-840d-612a2fef1af1", "value": 4269175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699739920, "uuid": "59987db0-b8c5-4b14-b0bb-ae44eaaa04bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739920, "uuid": "d99deaa2-d572-48dc-a637-ef04d8125ed2", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52a590a-8065-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688508, "uuid": "1dfc68db-2c7a-4f4a-a551-76a379ebd2e0", "comment": "Malware payload", "value": "d65588a54bbbb065cdac761090407e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688508, "uuid": "051fd03e-c7e6-49c2-aa61-18ff4cab5efe", "comment": "Malware payload", "value": "6535f7ba4b4928fec77a964ba55877e55a479ec0c2f6733f576e0a730556d23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688508, "uuid": "2f3b184e-f28d-4172-887d-118c7cd8a61c", "comment": "Malware payload", "value": "8c3f8ea15d52dd0bdb0c57031fba28e363510717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688508, "uuid": "b5a51454-0227-4c6b-9f6a-53058401b055", "comment": "Malware payload", "value": "418d8208186891353a48a3a010cae1021e5f96620becb6e389d7bc72d37ba359c7d7c6eee30531149d0d5fcdfb69e65f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688508, "uuid": "0e935580-1229-4c65-8f28-3ade56873096", "value": "T1CD1623A1A24818E1C0CB36714831D56BD311EDEFAAE4DC95A5E8E7BA1F721CC5B0DB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688508, "uuid": "716769de-9cb8-4958-b86a-7a3ca79098cc", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688508, "uuid": "be0f6c79-b927-49d4-a952-91122150f647", "value": "98304:hdL9xWLs1Esvx3VRy2XOwnqoQyVHXoblgL74+7e:zzwM5S2X9qM3oqLU+7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688508, "uuid": "7b81f46a-9e65-4f94-8d72-c18b5451f58d", "value": 4178766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688508, "uuid": "b310b617-f494-471d-88ab-6fdaf75f48dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688508, "uuid": "4b0f7c1d-cfaf-45bf-85e9-54839a06ad73", "value": "d65588a54bbbb065cdac761090407e6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffacdb3-8029-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699662622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662622, "uuid": "7c9a31a5-cf9f-44ca-ad3c-baed6eedc7f0", "comment": "Malware payload (RedLineStealer)", "value": "6d47aa09c7a09329a9231a56d97ff210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662622, "uuid": "7cd46013-e108-4264-9379-96a52e1cf984", "comment": "Malware payload (RedLineStealer)", "value": "66b1566759888450b9a3427e8b9678255082eca6a69e3291e32bdf593ef60356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662622, "uuid": "c77a8146-accf-4581-898e-e4f619125bc1", "comment": "Malware payload (RedLineStealer)", "value": "415cb37c62af100c927f0b00813943124a708a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662622, "uuid": "814bae7e-d1f0-40c6-96d5-bba08756d0a2", "comment": "Malware payload (RedLineStealer)", "value": "1f15a8336c44a74a4c21aae34a03acb5ed9a873313765113e02a7907b8708772e2b10d20df247bb56bf2736a6da9f406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662622, "uuid": "03993de5-2d29-429c-97fe-0ca5373ca625", "value": "T17F5523867EE60163D9F81736A8F743670235BC618C7C920FBA56198F9D239D09A3077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662622, "uuid": "f5ef8bed-ce7e-4cf2-9991-0f798c605a25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662622, "uuid": "2f3926ef-727c-4f47-ab77-cb5f71942228", "value": "24576:2yWHxH+xWvae6IstC/Gb1GD0x+q+p0fFOSkdil8gDZFdR6qZsAw:FWdSeBWSGoAlFOCD7XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699662622, "uuid": "0982169d-1001-4bec-b80a-33f5979bb247", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699662622, "uuid": "e68c2afa-4b8e-4ed3-bb27-aba41dac3d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662622, "uuid": "c7fb464a-78e3-499d-82a9-737967ac9128", "value": "6d47aa09c7a09329a9231a56d97ff210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02f2fdc-8065-11ee-8907-42010a9c0042", "comment": "Malware payload (Adwind)", "timestamp": 1699688446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688446, "uuid": "ea001c0a-70bb-4ea9-a8de-9c634eee27cd", "comment": "Malware payload (Adwind)", "value": "ff4de2f7c6a25fa7162accef6183a08b", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688446, "uuid": "0546cdcd-5e4d-4a9d-ad0a-cfc784fa0395", "comment": "Malware payload (Adwind)", "value": "67319232b8aaa049221458936b70d102059fed4a6dfb5760f615a3df82ece2f6", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688446, "uuid": "5c3be002-a84f-4327-88e0-40c467655f92", "comment": "Malware payload (Adwind)", "value": "2a335e78d8047ec1c9f4d2fb245236162cf79117", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688446, "uuid": "bb0599a2-2f25-4553-86ae-36ca6536ee3d", "comment": "Malware payload (Adwind)", "value": "a6983713a593771a1ad9f774baec749452014da1bab0e3905918decbf27f9799509647c0421074fc9821a1c22833150b", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688446, "uuid": "9768fa62-10cd-459d-94e5-187628af6fa6", "value": "T15F0422E3275447E7E679623CB7C03D302B893689AA83712495275777E6623CBC883F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688446, "uuid": "ad80e356-7a41-406d-8e26-aef7fd361ddd", "value": "3072:/YHLLMoF3ZR/QsLb+D9EvwioddhHT7NhMW4hQDve2bZ/BkRQyNmZ1h1n+cYc5:/YrwoFpR/Q6+DzioddhHwFhQDve2l/BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688446, "uuid": "24ab4c12-e21c-4fb3-ad8d-5a8e6b468426", "value": 174426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688446, "uuid": "9e45e245-1e31-4771-b64a-4b7672c50145", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688446, "uuid": "5b1fa1af-75cc-4898-aece-0e384dd6c146", "value": "ff4de2f7c6a25fa7162accef6183a08b.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002d424e-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699688607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688607, "uuid": "f2fb2135-1956-4fde-91b7-fa3728271c84", "comment": "Malware payload (Smoke Loader)", "value": "8a19893af727a93f5b59b68769077017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688607, "uuid": "9b20590c-1f32-4b28-8c70-959236a1bf8f", "comment": "Malware payload (Smoke Loader)", "value": "67c8c2aa16bc4a0da7b2d121808e2971ef4ac58f1ba1a048511ade93c5a8e5de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688607, "uuid": "643c26a4-c70e-4bf0-a566-0c55ba447866", "comment": "Malware payload (Smoke Loader)", "value": "d12cfed5db9e0618c5342143877a02e282f4ce21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688607, "uuid": "3f118a4d-8435-4f4a-8a6b-42ebe4fa3887", "comment": "Malware payload (Smoke Loader)", "value": "b4cc80254450de0b84948d0670179b8a0f000438b0fb93636af5f72470e485f2edd5bacec900840790a3ec54ebbde564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688607, "uuid": "416de995-62ca-42f4-8c4a-5531b2f6c317", "value": "T1DCD4125491F6320EE6F9C777CA8462D9927A90337302D267ED02E5497C9E3C386C25EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688607, "uuid": "4f66cdc1-d501-41fd-9363-1b45a6c1b16b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688607, "uuid": "8e054ef7-c223-495d-afb4-cc2e33ab14d6", "value": "12288:V56sPfDWgLPjlLb4eke1qODJuvFnkl4G1F6GRZ28kUu68TtoDZr4AYy4D:V56sPfDtLRI61qKw1GpCGRYV38Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688607, "uuid": "bd6c1a9c-a890-441a-8ed9-d5fc47d84972", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688607, "uuid": "5d81ef58-d00c-44f5-8945-4f1da80b785e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688607, "uuid": "8cacad18-e24c-4ddd-a681-fa1bd8a7713a", "value": "8a19893af727a93f5b59b68769077017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324dd795-8084-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699701576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701576, "uuid": "8f02f7ef-abfb-4453-93b1-1dba9879dde8", "comment": "Malware payload", "value": "0e9165dbf0cb1a7e75afe9165e3887d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701576, "uuid": "c68504f3-0295-4680-835a-72a04178b313", "comment": "Malware payload", "value": "68f293c6173580860df4275fdccf8f46fc02c5d89c79f0afcf7c5d8ee534eff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701576, "uuid": "af2d4413-e3dc-487d-80df-694acc4a5e38", "comment": "Malware payload", "value": "fb0b8a45b823bd362517359ed1379147242f3afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699701576, "uuid": "22c5a555-7fad-4b94-b0b0-f1b84483401b", "comment": "Malware payload", "value": "e47e8f1ca6873124fdb702f2d74aba2bedc074f4293259ee3dc640af98fc9ade67b283851c424214beaf387a303cb899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701576, "uuid": "ff475adf-53a1-4c31-983f-1fd6914c00eb", "value": "T1C7437C09A7CCDA13C3EC6C7E8AE7294453F8D6F32613E35A5D8065A43B9B3D15606B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701576, "uuid": "91e1fb36-2a8a-4172-9e72-770cd9622d63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701576, "uuid": "f53730ac-5070-4ce8-837b-ff9742db9e22", "value": "1536:McBalSM4RsytK8EUE6EKE0BMt6Ps31Ev3GxLUvTb:RaosytK8EUE6EKE0BMY0lS3WgvTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699701576, "uuid": "2750bf0c-7b14-4069-95d6-e08f5a302479", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699701576, "uuid": "4178b747-2336-4c8c-834e-85c3e98a8815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699701576, "uuid": "503878a7-60a8-4a9f-a5f4-567509d9ee7b", "value": "SecuriteInfo.com.Win32.RansomX-gen.1289.9546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233b6d5b-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699687807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687807, "uuid": "51e515d1-ee3c-4f54-8775-7c3c4b416773", "comment": "Malware payload (LummaStealer)", "value": "2fd0c24732109d29a915001792fedce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687807, "uuid": "e7449c1b-1a60-48a2-b7e1-31f2014ba8cd", "comment": "Malware payload (LummaStealer)", "value": "6987d442ce8797e1a2073b0f1aa5ad4082f060ea44c57bc22ba9017d397af34c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687807, "uuid": "683829dc-e43d-41d6-a394-54ed3c9e905f", "comment": "Malware payload (LummaStealer)", "value": "b47f8be144b77cd1531ace7b6b14f91cd9d9642e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687807, "uuid": "080f2e09-293d-41ab-ac0b-bc5e6a5b451c", "comment": "Malware payload (LummaStealer)", "value": "970a53e3f4312ff5463a7273e506e49886d8017ad80c3f7d18078ad64a3c9dc408611ea53cd043b0fc06b2e4cdc833dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687807, "uuid": "171311e8-a143-4e77-8e66-e085c8bb6f13", "value": "T17B45CF5436C44132DCF230754E7FBA3151AEB6B013CB90EB6B980EEEC7649C1A93599E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687807, "uuid": "87eba185-b4bb-42dc-9ba2-0f7ddc00885c", "value": "8b513254729b3434fc00aa36c587e162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687807, "uuid": "7b5729ae-a670-47d8-a538-2b7ed5ad1153", "value": "12288:lDiDJyypUqBLYNn9EeuPfOWWZlYGkfVrTRqtdjf6ar4Ty+FPN4kom63d5XCieAiG:GpUqY60CtftTWdjfNr4+Il4kobzhziG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687807, "uuid": "da7c735b-973d-41a4-8dd5-2d7c1e67243c", "value": 1182264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687807, "uuid": "83dcb486-9dc6-4cf3-bd6c-b463ff019d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687807, "uuid": "64c52154-6a12-4274-ac93-764e5c3a41c0", "value": "2fd0c24732109d29a915001792fedce3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8a5a5e-80d3-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699735761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735761, "uuid": "72f66172-1ffa-4f47-b2b8-cef86f2c4a69", "comment": "Malware payload (Stealc)", "value": "47d70f8864bfc353962c7116fd95e776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735761, "uuid": "1ba6bccc-d146-41d6-adb1-1b51f1cbf59c", "comment": "Malware payload (Stealc)", "value": "6a1dbe2bdacdbe77a94de61ffc0001e87adcfb51f85d1a3066e1f1924bb2f496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735761, "uuid": "eefa2722-0d34-42f6-a18c-eb97fba8af27", "comment": "Malware payload (Stealc)", "value": "318f8ec273ab97a37aa1c4e9833e206809cce540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735761, "uuid": "5f9838c3-17e6-46c9-ad62-c3c3e4a4b41e", "comment": "Malware payload (Stealc)", "value": "fddc32bbd05a0eea45f48ee635bade07c262f15cd223d7ae7921d6342ebb819031b13ebb03ac4485e010f0393257f30f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735761, "uuid": "6f0dc2d9-b39b-45ae-b056-c3de05f9e898", "value": "T1A0D60101B2D6EA4EF292BA2C93F56B579276F30193E7F03CD6607614017A1B8D336297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735761, "uuid": "e7bf4b85-48af-4fc8-a9c5-37558c1fa668", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735761, "uuid": "dfb2f7f4-0b4c-4336-a054-bcdc5f6bce65", "value": "196608:xXpxobpk+1YSn+nyjWFvqcja5ZPDkMJ5I7UOSsphb+Yh3nh2oEc36cjRD:xXpebu+2Sn+qeWnPDkQO1j+W3nnEc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699735761, "uuid": "1650496b-a019-461d-8a24-738d7358a79c", "value": 13196288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699735761, "uuid": "4e2bcddc-67f5-45dc-b134-63f060ead4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735761, "uuid": "d85b10b5-2920-4633-baae-07c3a263ed2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639eeae2-80be-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699726569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726569, "uuid": "78abaae7-ce21-4b49-b111-1389e2766726", "comment": "Malware payload (njrat)", "value": "b97e658d63cf0a96c8359a913942fc78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726569, "uuid": "f4df942d-6edc-4a58-8cc1-f694325c26e8", "comment": "Malware payload (njrat)", "value": "6b14da96e2c5a40d29b909c8567b14486339b206ae24dfbc4c505c4efa5860ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726569, "uuid": "400f3c8f-2b10-42e7-9988-e4d21d893843", "comment": "Malware payload (njrat)", "value": "fe5640e69cd92cf44dac58999ecaa5cb8dade0e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726569, "uuid": "306d25fe-153f-4605-8a40-4c2584f6acab", "comment": "Malware payload (njrat)", "value": "5d929f4d49109c74b5a4a6a3073509741a61ddd4f121a852df0ee28417b50e71aa90e1f43f0cc72f7d3f33799409648e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726569, "uuid": "01c4b63d-ab67-4a9a-9d45-fe4777608f2b", "value": "T1CDB2080E3FA98866C5BC07748AA5965003B491470423EF2FCCC554CBAFB36D92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726569, "uuid": "8294f9ac-d6e2-47e9-9966-6f07b4ec987f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726569, "uuid": "a33289d4-3750-4d93-b811-e81dea2c10b5", "value": "384:oluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9FmRvR6JZlbw8hqIusZzZx1:XOmhtI+Rpcnu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699726569, "uuid": "1d9d0de5-fd9c-430d-8b4d-9b9db5841c55", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699726569, "uuid": "f3b39e98-2175-4641-9988-9a7b36a2db10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726569, "uuid": "daa17889-b82a-4ffa-ab67-8ad36d9910e0", "value": "b97e658d63cf0a96c8359a913942fc78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40ba8ba-804b-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1699677393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677393, "uuid": "a4daa171-ce73-4302-9edb-0de4eb9c906e", "comment": "Malware payload (XWorm)", "value": "6ebd73c9be60fc393f77fe33b47adc44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677393, "uuid": "0a883668-6c65-4c22-966b-731e920f9676", "comment": "Malware payload (XWorm)", "value": "6bd6ccdc80da2053e27c5feb02671c866c3d4e986645eb5f84547f462a78403f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677393, "uuid": "9f7dc4c9-f020-4a6a-9dd2-345b37ec392e", "comment": "Malware payload (XWorm)", "value": "d0d445a960878d83231f3bd8610dc314628b0c67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677393, "uuid": "c5630f34-467f-4d84-95e9-f163bb2d40ff", "comment": "Malware payload (XWorm)", "value": "f99782d50753082de0a5fbb164679142e1a1e14531c3c8945144302407f9a9910607495a1c6fee23450d23f033ca7dba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677393, "uuid": "1fc32f0a-eb61-4f37-abe4-3f92b403b04f", "value": "T193D24C483BE84327D5FE2FF229B2A10102759507D923EF5F5CD885ABAF67B8146013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677393, "uuid": "a73001de-244f-45ba-afb7-29db8760c116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677393, "uuid": "77d9766d-8de1-4e31-bd71-0f6e7615a1b1", "value": "384:QeAwIGmeffcbWICWv/0ILZGPcj0hYACSqRDTnY2uRugtFuBLTIOZw/WVnvn9IkVl:cecbl/b3jMYAoRDTY2uBFE9RzOqhvb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677393, "uuid": "68f9d711-0ebe-4854-ab84-8e93685a4f80", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677393, "uuid": "07cbcd9a-ee03-426b-9d2e-f9332d541dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677393, "uuid": "eb49462d-4ea6-45d3-ad3d-eb200974b366", "value": "6ebd73c9be60fc393f77fe33b47adc44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad97ac2-80ba-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699725025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725025, "uuid": "15b40064-2e95-496b-aad9-cc188b0eff01", "comment": "Malware payload (RedLineStealer)", "value": "5e58c7210f9f0753d651e7207240e728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725025, "uuid": "02bdc3b7-e380-4dd7-8fcf-443aed9e863d", "comment": "Malware payload (RedLineStealer)", "value": "6d26760a587fb8a383655cbcc5c10785886d3b15ea62adcea8bde5c75e3dd7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725025, "uuid": "9bec23c1-23d3-4775-acf2-349b28d5dae3", "comment": "Malware payload (RedLineStealer)", "value": "31b5afd364f5a2ead3433048ee999decf634b12b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699725025, "uuid": "cf2b1eae-8473-4a78-83e9-eb9b5b6a3e76", "comment": "Malware payload (RedLineStealer)", "value": "c540f6345862b4366aaa9040b41f10a64c497d9e1e5635e5fd0a69394c6597d10675938826ae1be808a45e709aefae98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725025, "uuid": "c80e5059-a88a-4638-8ca5-d3d364de8c54", "value": "T1F9552383AEE88077F8E217B04CF306970A71B9725A78235B33949C6F5C336986971776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725025, "uuid": "fa75dc6c-a29f-48f5-b3ad-913b9759bbd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725025, "uuid": "a0c9649b-e0d4-46bd-8af4-b72e7cb7869a", "value": "24576:2y15jmqo3i96mFae1IsOC0GjShD1IKAKqfV7qYJ0nK8pF9zhfNvK:F15jm9e6xe2jfGiiKte7Fend1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699725025, "uuid": "a91f9fc2-8e5e-4707-89da-83d96fff26fd", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699725025, "uuid": "fbc09cfd-fbf8-4530-9cac-db43d56fdd1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699725025, "uuid": "0710b5db-e576-4372-bfd2-f99ee4edd800", "value": "5e58c7210f9f0753d651e7207240e728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b76c7c4-804b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699677083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677083, "uuid": "c5b5147a-71e5-40bb-bd15-1b8c51c0b7dd", "comment": "Malware payload", "value": "c652cb73b3e3c45d34d494441d84780d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677083, "uuid": "88037bf8-2415-43c4-b919-5031b4220811", "comment": "Malware payload", "value": "6dc2da7bc78a1d87a0c1bb9c379f1d58363b6ef1c39c20c31526a26112c4bc70", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677083, "uuid": "78cc5446-fcd7-4898-ab9b-3ba6e83a906b", "comment": "Malware payload", "value": "0ed4c3e610763a14248c0314e573d13f3059bcda", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677083, "uuid": "73d42adc-f27e-469e-9228-e3376e82f809", "comment": "Malware payload", "value": "865ab8508eb7a43a9267acb7021d21cc9c0f184bf241debf495f905f3ef8f375f7037f38e198b40b78bb9b7647d29180", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677083, "uuid": "c001bf89-dd49-42e5-a0aa-fa1bafba458b", "value": "T1A0934D6BB09328BCD53BC138CFD7A272A161B8115630BE7F1660C6313E66C446B6EF59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677083, "uuid": "644c2066-d6ec-41c3-8299-96c5fa224d27", "value": "f5a49b36f92a8b9d0577b9068b671820", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677083, "uuid": "44198e8f-a521-4c86-a890-ce04f94d6a26", "value": "1536:Fakfgc4DybT7izU/zppCj/DYV654izOpt9:Fak4ED8/DgEBapt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677083, "uuid": "0eab1edd-dea7-4c7d-b159-970cf4950784", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677083, "uuid": "215c1da9-e8d7-497d-9baf-2ccd5ab8008b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677083, "uuid": "13794ee0-b11c-43cd-bf37-3045f743ab9c", "value": "c652cb73b3e3c45d34d494441d84780d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ffe2b9-807e-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699699220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699699220, "uuid": "a99d9415-ec39-4b97-a92f-aacc73663d13", "comment": "Malware payload (LummaStealer)", "value": "341f8a069dcbf713a42936d787d8a0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699699220, "uuid": "5964a50f-8a52-4c45-9be2-d97ae403879d", "comment": "Malware payload (LummaStealer)", "value": "6f5029869984f774932ee5eec105cec8daeeb1f5c6411a8089c8dcb0e9ab7747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699699220, "uuid": "a3c0c472-7d62-40c7-9aea-0af7422f1272", "comment": "Malware payload (LummaStealer)", "value": "93cf489987decb1d262cf3ee38f9eef062f566da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699699220, "uuid": "fa674a99-db39-429b-820c-8cad1c1b21d4", "comment": "Malware payload (LummaStealer)", "value": "d8256bd1b02ec62bb5a4c64b65f61d12973662331feaa42f9d7c04aaebe812642db11d2218922d6b56265261d9668544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699699220, "uuid": "4184adb0-9baf-4472-8475-6625395c3769", "value": "T172552383AEE84573C4B1877228F7029316363D246C79A29F63B1598F5872EC4B97473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699699220, "uuid": "386518af-19a3-424d-bf5c-fa394e2fbae7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699699220, "uuid": "10411589-e011-45cf-a4d9-0365a69eaec6", "value": "24576:oywcSW2S0aebIs6CeGlWUDBsA0YkT4srgED/hdyFXaE5W:vwcSUeUzFGZlIBem/hdydaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699699220, "uuid": "094d0b05-f14c-43a7-81b0-ba7c06142d47", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699699220, "uuid": "f61a585e-5d46-46d5-8207-098783e44b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699699220, "uuid": "e64da600-875a-4ee5-a079-a5ad979ae540", "value": "341f8a069dcbf713a42936d787d8a0d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830be1e2-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699687967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687967, "uuid": "5c61af49-b599-4e8c-9fa7-bb1c0dd86f85", "comment": "Malware payload (Smoke Loader)", "value": "cc8eaa5d651cebcee616f87ec52629a1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687967, "uuid": "fc303dd6-61e3-46e2-b4ef-0b97c45eb487", "comment": "Malware payload (Smoke Loader)", "value": "6fe8c9bfed9abde0c5ccf98f9307da5e24eb9601788274593b3e30b1fbe7f53a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687967, "uuid": "39396bbd-3166-494b-a8fe-d5a2288bbb8b", "comment": "Malware payload (Smoke Loader)", "value": "b8fe563ab28dab7e18598d873dfcec2ad8e060bc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687967, "uuid": "93346d7f-4b03-428a-98f5-908f1d83ae17", "comment": "Malware payload (Smoke Loader)", "value": "ba9db08b78d81debcc84ac14d5ae7004a3e92a19190cd4d5f63d85287db7f829111402ea2785b20a625ac23af64a5169", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687967, "uuid": "be2d9967-49ae-4722-9013-118cfaac0bce", "value": "T1C764E94352A33D55EA26CB328E2EE6F8771DF9518F0BB7A61119AB1F04B11B3C1A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687967, "uuid": "e13073fd-a42e-4067-b3c1-fae10112d9be", "value": "b7e07a5800cbc9c6f303fe6cbe1b23f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687967, "uuid": "5ff3f07b-fc69-4c42-bf6e-d5a6a7bf16be", "value": "3072:3vyGvGwDq63Q6n+WgFDM15YTzTm91lAXaWB/cLIBsNCkgPB96LAHsEz:nv3DqPk+Wg6XYTzelAXaIQzOPfvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687967, "uuid": "513f95a4-25b4-4022-9112-d260100415ee", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687967, "uuid": "ac068690-9379-45d6-aa2c-2ed55a174908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687967, "uuid": "c346899f-aa09-43eb-b1fe-0b5e75809c2f", "value": "\u0430\u043a\u0442_\u0441\u043f\u0438\u0441\u0430\u043d\u043d\u044f_\u0411-00003564_\u0432i\u0434_07.11.23.XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1bf067-80a3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699714823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699714823, "uuid": "015a7668-9ebf-4f0a-94fc-a67f0a2bcdbf", "comment": "Malware payload (LummaStealer)", "value": "0c12cd0538bea9f88b40d52cf438f139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699714823, "uuid": "563fa330-4b07-4866-bcf2-7781b5ec8842", "comment": "Malware payload (LummaStealer)", "value": "7224a67c838c764592d15509ffcb4788625701cc1e47b38d6a587aa4487d9461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699714823, "uuid": "31116207-e95f-4630-b12c-86ccb0615580", "comment": "Malware payload (LummaStealer)", "value": "80f36d865b30b3044344ea20f58781726918f0ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699714823, "uuid": "e05c9270-67bb-4427-972f-a7e367cfb14e", "comment": "Malware payload (LummaStealer)", "value": "4d76d0a47a2d49cb3a6f3d67ae00d499aa7bb4591637dfd0d4088dfb1bffbcebf59575a1fbcccc3a50838b48eb18a5b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699714823, "uuid": "73499eae-87df-4d9f-9c44-47906f8f899f", "value": "T15D552397A6E9C063F4B8633558FB1A071F3479510C6883472A9D6CA75CE2EE4B97033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699714823, "uuid": "ab117cc4-2dcf-4e88-99b0-860afa5dc177", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699714823, "uuid": "3dcbd412-3c66-4f34-b5a2-2403eedae704", "value": "24576:RyVyuGfYIqxaeSIsLClGqbrDnURNhWl6RIQYFQPJUEd:EVLr8epAMGokhY2PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699714823, "uuid": "089ddbd5-9611-4e0e-b601-4adbc7d334ee", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699714823, "uuid": "c7d96612-8cd5-4087-b3e6-f9b8159498a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699714823, "uuid": "0bd0a653-378a-437d-8f56-1138f7b4bea1", "value": "0c12cd0538bea9f88b40d52cf438f139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d4ee35-80a9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699717522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717522, "uuid": "e0cc08fb-73a2-4ee5-a401-f553ab6a3481", "comment": "Malware payload (LummaStealer)", "value": "38a8fcd33f63f10c45fbadb5320f51c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717522, "uuid": "69961a28-04d3-4dab-9f20-5344b50dc429", "comment": "Malware payload (LummaStealer)", "value": "72f1173637aff1ffb1e5a39cfd223340eec8785273794968dca5ba8bcc2c3af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717522, "uuid": "2a713804-cf78-469f-8d3b-677995b8b3a3", "comment": "Malware payload (LummaStealer)", "value": "463cd6a72778a08e1ba10c895e019f63e8ae8163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717522, "uuid": "8661366e-a2e4-4c9e-84ca-29c6e37fe8ff", "comment": "Malware payload (LummaStealer)", "value": "b4dde4167cfe5ed575362f2d650190efe7ecebb91cc47d291edb8bc72bf076095b4b4c805d694fdf6a57aa58de960575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717522, "uuid": "0eb47b4c-a172-4ba9-8511-ba5c4aafce41", "value": "T1BA652307EDDDD023D9B22730ECFB1247173A3D6099B9826E338969270DB39C4597236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717522, "uuid": "f99ef2df-8307-445e-9cb1-2c4076e28a43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717522, "uuid": "9bd16b06-c070-4a2e-820d-1f5455c7974c", "value": "24576:zy0AUuPo0qaXjh9W8hWHZoBdeKIsRBBGgsyDSCyxMQXqIGmgOAqRxtVHG2msOx:G0AUuPo0qaXj28AuTeRcvGomCmallWtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699717522, "uuid": "07452e88-2851-4ab9-9656-44d316c60fc3", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699717522, "uuid": "d2397ce2-c496-48c9-bb08-78933d4e938d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717522, "uuid": "6df32d29-2978-4000-b3c8-a6b0a6967cee", "value": "38a8fcd33f63f10c45fbadb5320f51c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a344f6-8082-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699700721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700721, "uuid": "bef00d66-2857-4e1e-904d-b3862569539a", "comment": "Malware payload (LummaStealer)", "value": "7087007f8da05b1bf0c70de28e2168de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700721, "uuid": "2d0c99da-edf2-49e3-a4fb-af1c7289ab52", "comment": "Malware payload (LummaStealer)", "value": "72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700721, "uuid": "fe518f71-ac24-4f38-8d92-608aa85701f9", "comment": "Malware payload (LummaStealer)", "value": "8886710612684988878e9d16322dfaa9b24a0ee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700721, "uuid": "3428b7ea-83f6-480b-9814-1a3649c1ffcd", "comment": "Malware payload (LummaStealer)", "value": "5540e9aa20aad7a42340288b28891d096fcf0c6c6fb422dffbc4ba238832d46f7feec842f398e18c280939a987b86b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700721, "uuid": "22dd0a2f-74de-43ee-8a06-f4c42f6166cf", "value": "T129653381AFE8817ADAB6433138F602531A3D7D799C3C429D372D78592DA27D4B832736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700721, "uuid": "b3bdd4ba-9549-4b7c-8a9e-cb16c8fc532e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700721, "uuid": "1a8052cd-2dfa-4e34-830f-d53d61a0ad3d", "value": "24576:cy4hpN2QLTQedIsU4iGtLmDnpoE9nIrjKbkb8wapQA2+:L4HN2XeOllGkZJUjKzD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699700721, "uuid": "c211f58b-3875-4cdb-927d-8a461241bf03", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699700721, "uuid": "fa809089-f09c-4bf1-9bf4-75713ecdf131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700721, "uuid": "4de4ffc6-33ea-4d36-8783-dc45259ba835", "value": "7087007f8da05b1bf0c70de28e2168de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0941c2-802c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699663828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699663828, "uuid": "9b76c869-cddb-438d-acb0-b9cdc1089ae0", "comment": "Malware payload (RedLineStealer)", "value": "56c2157a2f82b55467b9b03af730abf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699663828, "uuid": "fc7934ff-92db-4577-94d0-02c869b92d46", "comment": "Malware payload (RedLineStealer)", "value": "73108be7dfa90455c601fbcba1703c335eb785e3cbbdc789e1e3f7eb2ad48f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699663828, "uuid": "376ed0e4-a864-4c38-8b80-14750efa255d", "comment": "Malware payload (RedLineStealer)", "value": "362a1d226039a4a2a0c74e232e61299d059b49a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699663828, "uuid": "aaf3ca94-44c7-40d2-973a-8a5c535b8daf", "comment": "Malware payload (RedLineStealer)", "value": "bd46c83176c896db06009c9b26dce66c7eca7213cd072dd4a9fb4d8a74c38cdaad82867b50d1a9fb7c47e3ed04298db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699663828, "uuid": "a84f629e-684a-43cc-bb75-804122b34dc4", "value": "T1ACC41243AAED8073E4B5277058FA42830739BC61AD7C836F3746689F5CB2A906931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699663828, "uuid": "ad8db9a4-4018-499e-9bc6-9bc357d42e1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699663828, "uuid": "33c7408f-ba96-4018-87a4-faac1e7fb67b", "value": "12288:PMrhy90o0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL62F8yv0:2yriaaewIsgCQGIgYDe8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699663828, "uuid": "275a3e6f-b722-466d-ad72-82d087adbe38", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699663828, "uuid": "0ec8b158-c4f1-4b4d-ad12-38d7dd8df977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699663828, "uuid": "f4bffa41-ec1f-499f-b88c-2d6020b406e7", "value": "56c2157a2f82b55467b9b03af730abf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfb2bb7-804b-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1699677408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677408, "uuid": "996f1df6-7fe1-4a07-84dd-421859cf29b6", "comment": "Malware payload (XWorm)", "value": "02fc7bdf6ee2f22616b6ea878e90976e", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677408, "uuid": "a777e6df-8254-4298-896e-7985ef56cf41", "comment": "Malware payload (XWorm)", "value": "74bd525377a89cb1994a1151566bf2e3f37002d7f4cfa5a56183bc513d2b2ef2", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677408, "uuid": "9970d0dd-8f06-46f2-8582-d16709681009", "comment": "Malware payload (XWorm)", "value": "6e88aec6c3427bb9e07eed333b86f8be85a0a6b3", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677408, "uuid": "1d10d769-e112-47ea-bb68-3155178c8074", "comment": "Malware payload (XWorm)", "value": "e26c02828105bddd7af84e01a448115b099908151b63597e10eb0ae302c8b7d29d668a844c7f3061099068470960918a", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677408, "uuid": "e54d4d66-a820-4b29-a43c-e5fed4cd5b31", "value": "T10C57338FD1CB467CD4F6AAF83E654B43CDC73291A742DA5E536605888DC9BC62B280CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677408, "uuid": "14bbc384-eb11-40f1-a86c-7773216e8b0a", "value": "786432:iZCm51FXlF2jikPgMozFa70Gsft1XOMOLTVGNd5X23QgeyHw:ACiu9P1ma70FftlYyjX23QghQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677408, "uuid": "e96ed27a-2a0b-4dc2-b39e-f6d25e6ebb4f", "value": 27156986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677408, "uuid": "a1439b3a-f4bc-4b01-85a1-30cff02e31ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677408, "uuid": "c90c8deb-18ca-4b26-92c2-c79197df51f5", "value": "02fc7bdf6ee2f22616b6ea878e90976e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f45bfb-8053-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699680620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680620, "uuid": "2056afc5-14aa-4c70-9d97-f773389af0a0", "comment": "Malware payload (LummaStealer)", "value": "1a23f3282c9548f9d213928ed130ef80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680620, "uuid": "1eb76a0d-0e9c-4c35-83ce-ce14815aaf32", "comment": "Malware payload (LummaStealer)", "value": "7561f71993904d236e9867ddf0f8fb1d1c3420fb3aedaba38b6ac2b0c844ed44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680620, "uuid": "7b0ce9f4-28f2-4623-8c5f-db85b5bb5652", "comment": "Malware payload (LummaStealer)", "value": "b9294b0779d0ac84515bbecaeecad1303fcaa062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680620, "uuid": "a6f89152-3d6a-49b4-9643-3c0ecb519345", "comment": "Malware payload (LummaStealer)", "value": "34c603b170a615c37adfd3ff0090e1f726871ec5ad9d3e8c8b95dae56353aadbb42e939638dcf1e8f5ced1c85ed6eca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680620, "uuid": "5af96e0c-5a54-4d67-8228-e6529336c8ff", "value": "T101552353DEEC0032F9B663B844F326431A357D216CB886EE332268EB0D72695593577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680620, "uuid": "b377bff5-a6af-4b33-8f89-3352ffef273f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680620, "uuid": "fb390a0a-c604-4ff1-9554-8c7c9c5dda87", "value": "24576:ny3qB/eui9ukYaeXIsECGGIxiDfsOUV4A3NnV2+iOu/fW17JitS9siXc:y3qLHUe4dlGRYOUVv9nc+xu/fO119si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699680620, "uuid": "55c8609b-6169-4c26-9ac6-ee32ed88869e", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699680620, "uuid": "3b6d509c-ead5-418d-ae77-588d5ea48c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680620, "uuid": "10d61871-299d-4786-bd61-2b836fe9a7ad", "value": "1a23f3282c9548f9d213928ed130ef80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab5182a-807b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699698020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698020, "uuid": "0e3c38d1-dea7-4dcc-b667-d7f3e3291d57", "comment": "Malware payload (LummaStealer)", "value": "f3935b22955ae50d6117ba87916058d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698020, "uuid": "1ee0afa7-f91f-4737-af47-2c2cfab762a6", "comment": "Malware payload (LummaStealer)", "value": "77cb45093ccf067140c55c5c8b7df6c7ce6e77abda5f7b55e1c0da15fcdb4cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698020, "uuid": "0426aa9d-84db-4d48-996e-54f3c0a3ebc2", "comment": "Malware payload (LummaStealer)", "value": "f9b6db6e857d4058272d5e4ae669d75c272baf79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699698020, "uuid": "5759b89d-7bdb-478c-8e9a-60d3963e4651", "comment": "Malware payload (LummaStealer)", "value": "1dd1a9c0646ae9ac9030a08909a05547beb668242fc372f3f57ff15c82ca7380b214215c2f7d5dee6882ce50abe9b5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698020, "uuid": "a79a4639-3ea4-43e4-9a6b-92ad1501d236", "value": "T1586523832FED4066DCE89B7268F7565317317C54E83C722B7966A80F1EA26C498B4373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698020, "uuid": "948d750b-25f4-48c7-bf7e-7a8e448e3b6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698020, "uuid": "34ad3fca-14b5-41c1-a6b9-b1276699b518", "value": "24576:jyG+4yALf5O8Jiw648ejIsGMAGF6cDnnoPjpEdyxkW2CHPCJzRJ226mqFM:2M1R9AeMTVGTCNXxkvvJzRsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699698020, "uuid": "0df8949e-22ce-409c-af80-0e3934dfd9d2", "value": 1520128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699698020, "uuid": "0d682817-8190-40bd-88d9-e386593dc07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699698020, "uuid": "3780857b-12de-4eb4-8956-431188d25746", "value": "f3935b22955ae50d6117ba87916058d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592f3abd-80d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699734712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699734712, "uuid": "13071ffe-6ee0-4d5c-9c0e-c9d57c51b3c2", "comment": "Malware payload", "value": "3b64a824503dd85998f7bce9cdec3446", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699734712, "uuid": "0e81f92e-ccd3-4617-90c6-75a84419f372", "comment": "Malware payload", "value": "77f005d86f326e1ff5ce7a4039000350a86c2c2a1e03565421602601797ebec3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699734712, "uuid": "db3f367e-0b8e-4f57-b8e5-e9ac1cacacfd", "comment": "Malware payload", "value": "27b2dcc21aa6b304476e56fb0fba6b34f2ac1c73", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699734712, "uuid": "e9be64e5-b823-4e78-be23-ce88a5fd4d3c", "comment": "Malware payload", "value": "1ea97cbe3ae0877cc51051dc2ad9cd902152bf002b005043c4034ef6e8f64aeb9cde70a0d9d3216655ad96c8d4ad421d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699734712, "uuid": "c0cc34cf-9af5-4ac3-84c3-71c508f098a2", "value": "T173F164D56106A26183BE67FBEE93D088FA2E805B4210650570EDECC32F3563547F5EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699734712, "uuid": "a6266218-61d3-4c6d-a636-639115c2be47", "value": "192:Dewiv/kg/GrFtQGVtbgdZwa9chbuoYmIQhTQUQu:DevkstGVtAZv9cZ61Q1QUQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699734712, "uuid": "5e5a140e-1df0-4ef7-8216-8929a210eaa6", "value": 7931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699734712, "uuid": "f2a84a33-e6bd-4da4-906b-eff30367b077", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699734712, "uuid": "8b29add9-5320-4e31-99c9-e9ab17972be7", "value": "pandora.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01e7f60-8057-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699682486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682486, "uuid": "2c92dfc7-6921-473f-b05c-5f74df6819e1", "comment": "Malware payload (RedLineStealer)", "value": "29b30699b114caf0dfb7854b2e9bb6bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682486, "uuid": "555de377-a625-4ca7-8996-2e8af4116dd9", "comment": "Malware payload (RedLineStealer)", "value": "7855d1e9cd453e5b6fb7b129a111428fa34476999fe50193e334dc65405aa542", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682486, "uuid": "01c368b2-d888-46b8-971a-128f65fcb865", "comment": "Malware payload (RedLineStealer)", "value": "ac35c0978380b9d3afe680b84a3e0628cc865719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682486, "uuid": "0ccbc0f7-5c72-4af4-895b-25dd2252d05a", "comment": "Malware payload (RedLineStealer)", "value": "59fdd497220794a799d2515b8f08a261c22513e01af102ced4ccd1bbde790418bc7e752cee8dc77a1ecfef0905db8ac5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682486, "uuid": "71667641-141f-45fd-a2d4-b5fdecdf0142", "value": "T185943A0EF984DF64C64D4BB44DC782BE98D0701B033721D5AF64E8EDA1747EE72A582A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682486, "uuid": "8a001056-bf60-4069-956a-a07c3ffbb800", "value": "aaa97dcc7945614afae5716f8187b49b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682486, "uuid": "6dac8b94-7bc5-4ca1-b5a4-4b8c205b5dee", "value": "6144:qz/sh+qoOgjUFccbbsdZLKTQF7D2292sjUOpA5NzVhhj3mznBfSNHBdkpOjB1lf:9h+7ssdZLCs/IFw4NHkpCB1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699682486, "uuid": "1b780e65-f565-4fd2-a339-eab18235536f", "value": 439820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699682486, "uuid": "aedb1a01-20eb-4b4a-beda-3ecb44dfefb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682486, "uuid": "0a44797d-7aa2-4e0b-8576-c394a216184d", "value": "29b30699b114caf0dfb7854b2e9bb6bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd4c62b-8044-11ee-8907-42010a9c0042", "comment": "Malware payload (Metasploit)", "timestamp": 1699674322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674322, "uuid": "54a341e2-d289-4877-bb0d-4c3bf65e68e9", "comment": "Malware payload (Metasploit)", "value": "4b2a64fe5482185eee6b04193f9ef1ce", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674322, "uuid": "84804078-0577-40b7-b2a5-1284c8814da8", "comment": "Malware payload (Metasploit)", "value": "7993994480e859b0c8a6260089c144fac5daaff6249a68094958f981328fdb31", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674322, "uuid": "8b01b8f4-008e-48df-b5b5-f28343088e47", "comment": "Malware payload (Metasploit)", "value": "c362adaab2992391cd9e478979532b402201ef56", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674322, "uuid": "fc9f07c7-f1ee-4df5-8b26-ac961e0ee007", "comment": "Malware payload (Metasploit)", "value": "74fd8547809fe5d8577ed95b867d374dee1d1aa9caed398c92ef095aa503446a14d3c28b55d973865f024010e799c990", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674322, "uuid": "490f87e0-ae74-49fc-ba49-8a1c8c2e5957", "value": "T19861AF932151B8EA415287BF3D4D6AFB807FC224954A6044F78C4F99F9DDE633A8E6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674322, "uuid": "52f7cd61-695f-4261-a15f-4e857debf729", "value": "96:wGtI50aHuSnWFN+Cfh5L0HUmAiBrVMt5q:f20hF2HUmAiBrVeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699674322, "uuid": "c4f226db-682d-47bf-b371-064abcd228a2", "value": 3228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699674322, "uuid": "7739ced4-9866-4e4e-9940-7ee52c1a6203", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674322, "uuid": "27ab63b6-ecae-4053-8399-f1a3befd8c43", "value": "4Tc03Xdf.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c988f2b-8067-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699689245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689245, "uuid": "da2aa72e-e524-481d-88c7-2473eddff68f", "comment": "Malware payload", "value": "0d77bb4a4cf445548b4d38289bf2c96f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689245, "uuid": "3dff4c85-3a31-44b7-9fa7-4b2a9d0bc658", "comment": "Malware payload", "value": "7a4499a4e0962654db2599ca34db3fe50e0d1a142e12285e772e4ef4f832195c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689245, "uuid": "65a24509-e963-4ba4-8ed3-35345b1cf7c5", "comment": "Malware payload", "value": "46cb13dc401f361236d8ec4daab88e8a24166533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689245, "uuid": "c34679a9-068a-4ab1-9169-c51ba8370294", "comment": "Malware payload", "value": "1a1f2718a4a34d9b8a5448f1cc9be4e08ae29263d169602273f1ca4407771979657aa6495fdb7167e9de30790b9b87e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689245, "uuid": "dfab4f49-048a-457b-811c-c04efa4b88ef", "value": "T148B6331372260196D4E99C33852B7CB672F613D55302ECBDA8F69CD228A59ADF702C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689245, "uuid": "d3ed20b7-142e-416d-ba70-6fb9f98209c3", "value": "196608:7Z2203czkB24qBHfvLVlahXDZ3clsiCnlE5dPmCYeuAG6B9ovrVveuytBcBo6SY4:SjBWhfvShXDZ3PYRm5euP6B9KrVmq/fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689245, "uuid": "39755589-dbb2-42cd-981f-fcdbadca68d1", "value": 11086151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689245, "uuid": "d1eaa77c-0f78-47a0-97cb-2a6d5f2fe24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689245, "uuid": "30976930-81b8-4aa0-bb3d-b78a5ee4d2bb", "value": "0d77bb4a4cf445548b4d38289bf2c96f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bd8f43-804b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699677100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677100, "uuid": "6cc6d091-1a3c-4daf-bca4-eb751bbf4e14", "comment": "Malware payload", "value": "74f3a69c12af4f57291a63bb8418f8cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677100, "uuid": "86bb897d-0ad5-48ae-b281-ca5585b96939", "comment": "Malware payload", "value": "7b7722c05b55f9b7674e2b1746b20c31c7f4ac7024f72d5b28919944de23c73c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677100, "uuid": "15cb432c-eaed-418b-859c-e82eef130ad0", "comment": "Malware payload", "value": "389f3f543daf9a44a348e0c8616c86742eb5cb29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677100, "uuid": "6900b65a-6ee9-4192-a75c-d66bea77e7d0", "comment": "Malware payload", "value": "b15e7d1db7f012333881ab2b8952983766e16b7f713aa11c635fccb7b7e10a99c7de7a32748cce16acfd8a52e46def23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677100, "uuid": "973ad1b2-1843-4799-b422-c80303e9c6ba", "value": "T15703094D97DCC517E6AF0ABD6431429797B3F272A931E34F18DC84E82B93781498439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677100, "uuid": "73fdd6ab-a9da-46b8-93c4-2e4d844f2364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677100, "uuid": "e3980453-5395-460f-b769-1b7a7e83b575", "value": "768:jQbHY3voobaXV2p+cXxaa7HpUpTBVrbokr8kt23RPs:CKvxaXV2p+KzOlbrboHkks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677100, "uuid": "5e4580fa-46cb-4614-bb68-60c12501842c", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677100, "uuid": "8b7336ca-531b-4d2b-92de-093906c124a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677100, "uuid": "d5c56bd3-9bb0-4d23-9a2c-f900a3e0337c", "value": "74f3a69c12af4f57291a63bb8418f8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7132df7-805e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699685531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685531, "uuid": "28038d7c-a1ba-4bd0-a95d-fb185c2639d1", "comment": "Malware payload (Smoke Loader)", "value": "992baf6b205cb59b0982eb1e40426702", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685531, "uuid": "50fce851-d6c4-4ceb-a096-de73240e25ee", "comment": "Malware payload (Smoke Loader)", "value": "7c6dc6ae1caf94cd6f0cbcb075a81698bf496408e9553f63cd5c5742523b6bc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685531, "uuid": "e0499ca0-d27a-470b-9325-64f7a9b53695", "comment": "Malware payload (Smoke Loader)", "value": "85df649e7e1361f8ae723b9291b2665daae27f16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685531, "uuid": "21f5f1d3-3dac-41b1-af2c-ccf536c9c14d", "comment": "Malware payload (Smoke Loader)", "value": "4f9bc116e1c333631a20b3e48c0ed586c27b1af0af2131845e78fa96b7ab52858e689232756ebab683ff9404b7e6499c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685531, "uuid": "0d1da9f9-5ee4-478f-927d-b71f72c4d213", "value": "T162248D2232E66873E23346318E35C2A4DA6BB8714F216EDB17546E7F4E712E1C673316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685531, "uuid": "30c44801-0112-4f4e-9032-8530c0c4dab9", "value": "13937693d95394f2ce32af6042a00c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685531, "uuid": "7cb3d327-54e6-4d2c-a7f6-a52ab3553271", "value": "3072:QGYuUkpLzAI7pouWAy1gWEUesXKzffk+6GbJq/WblHz6Zo46EghPBKT:fVUW0wKuWdzEuink+blHz6REZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699685531, "uuid": "b1db2a0d-0c29-4105-a608-a237983b3e8c", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699685531, "uuid": "386e908b-7b29-4713-b187-cccc07cc2c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685531, "uuid": "401e48f9-c053-46f4-9fb5-e83d75e80b2f", "value": "992baf6b205cb59b0982eb1e40426702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f13f05-8085-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699702223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699702223, "uuid": "b1031c2d-32b5-452f-85e9-5c9284126b60", "comment": "Malware payload (LummaStealer)", "value": "47da995cd1ec9844afa37b1020042c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699702223, "uuid": "f556d049-38dc-4583-9cf2-32494d34de62", "comment": "Malware payload (LummaStealer)", "value": "7c948da84e336ddde18db89ad5bd132002e9393abb5c614d1d74c2005e358b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699702223, "uuid": "44867c9a-b2d3-4988-9f4d-38f3a909f91b", "comment": "Malware payload (LummaStealer)", "value": "a52e4675ba91565e854d25c2953f3a22aadc03a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699702223, "uuid": "84879f4c-7ffc-4672-bc05-3d9f9acfed4e", "comment": "Malware payload (LummaStealer)", "value": "3f6048fa634038aa1dc1cf2c996b7beaa64bcac8c32a7c665f8aac00c2977ad650c59b37798e5e5714c1bae713e064c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699702223, "uuid": "b237e177-9fc2-4cf8-bf3e-b9af4be4ca06", "value": "T138653313AFE88072C876A73064F743570535BDA15A78822F378AD99F1C72BD490B63B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699702223, "uuid": "8bd91414-0f34-4677-92f9-d3c8bd8b6c0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699702223, "uuid": "3bd84903-7d81-4b7b-bb1f-c27d1a86ef6d", "value": "24576:KyWGaUMSIAdBRN4FBuBeDIsRqNGGbSDTJDnX0PkVRE30sr/nwQqJVKTDBY9gzytI:RFaUMSD4bGesUKGZ3JDnXAXvTtY95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699702223, "uuid": "9b441ff3-aa9d-4b1b-a434-55bab70262df", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699702223, "uuid": "57332c0a-50bf-413d-a772-54700a044f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699702223, "uuid": "ee96e765-996e-42c5-96cc-d0bed4f3978e", "value": "47da995cd1ec9844afa37b1020042c24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3282367c-804b-11ee-8907-42010a9c0042", "comment": "Malware payload (Heodo)", "timestamp": 1699677095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677095, "uuid": "03f2347d-39bc-44ab-90f7-42555552b2c8", "comment": "Malware payload (Heodo)", "value": "39daf1f97860bfe3e0f57a48a778d55f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677095, "uuid": "9e5d7eb5-1e9d-479e-b04c-c71c80b868da", "comment": "Malware payload (Heodo)", "value": "7cb53ab88b3dde23783fcdc4a4012c112d593f2bd6f8f2192f00549f3ce7bc78", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677095, "uuid": "ba81d1b8-c690-49de-a8a2-49ba3b53c14b", "comment": "Malware payload (Heodo)", "value": "6e95ebe535023dc1f3dfb10ffebf18916db9c486", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677095, "uuid": "164be73f-89cb-4fb2-b793-7f61f988c8a8", "comment": "Malware payload (Heodo)", "value": "c8734358a4d489ee3267d7b3d55f60085c61c6bcc47739fc750034887232d33bdb6e56528857b3da3cb63f9375a421b3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677095, "uuid": "dedaf1c3-fdff-4cfb-849a-d5bad0bff8de", "value": "T1F5F63389B990D0F1FE7A84788915D92AE7B134331732DB4F9BB8E8121E635D2BC7C641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677095, "uuid": "bea6d260-b8f7-476f-9da1-290495f9c548", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677095, "uuid": "7ed21dac-ee83-43e9-a203-18408d7cf70c", "value": "393216:IdTjF9drLTl2GhIC6oRHdTxro/w3uCxHQbmKcq:MTjF9BTl2GCpoBrv3Fqbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677095, "uuid": "60815242-be8d-42d8-ac18-7ad3d6e7dda1", "value": 15737653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677095, "uuid": "1d4f6dd1-3782-4055-a5f3-8f3b41984e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677095, "uuid": "180b5dcf-15ff-4b5c-8f6c-047237f1f483", "value": "39daf1f97860bfe3e0f57a48a778d55f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b19418d-8038-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699668922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699668922, "uuid": "9c823c9d-b5fe-4cdf-9bd3-6c1fc4b7b838", "comment": "Malware payload (LummaStealer)", "value": "e589ae5fd4bbfdde8a7868a1f1811bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699668922, "uuid": "7cf58737-7eca-4c75-a429-400dd46d9b16", "comment": "Malware payload (LummaStealer)", "value": "7da733f143c45f0b42d304e48be8fa55d34fdd279b5efd02ed1d34a5553c50ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699668922, "uuid": "ab45d435-2f5c-44d9-9f3d-414774eba33c", "comment": "Malware payload (LummaStealer)", "value": "272c86c0917fdd8c97312b26a678cb1399cd960d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699668922, "uuid": "37144e30-0707-4fdf-9c3d-1fd7ede82908", "comment": "Malware payload (LummaStealer)", "value": "7438c5b844ba76a705ca1a1d18f666c6bc7f41dd3d760f4ea0604f21421f98796081c0ae40917f838be568952e0821fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699668922, "uuid": "0b8e0736-29f6-4f9e-8956-635c0d48dd02", "value": "T1475523066FC88073E8B217B424FB17472579BE618C78536FB749281F98B26E89470777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699668922, "uuid": "8d974f26-958b-4657-9a93-eacd5e4c9619", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699668922, "uuid": "2c48bcc5-beee-4f89-9e19-321c09157f33", "value": "24576:jyk86q1OCIRXKaeUIsACyGVRODjipvFFkC8gx1R/NjOze+n/5Nzriipjng3:216UijezxNGSSnpvR/Njp+vz7pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699668922, "uuid": "39669c0e-0af1-4cda-8304-ac8ea1d3d46d", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699668922, "uuid": "ee551459-63f0-45a3-9211-8353d0f3213b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699668922, "uuid": "8ff6670a-30c6-4f0f-8437-9012caa29e6d", "value": "e589ae5fd4bbfdde8a7868a1f1811bfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64353f2e-80b9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699724423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724423, "uuid": "26e2943c-d5a2-4157-b222-dc47352fbbe0", "comment": "Malware payload (LummaStealer)", "value": "0c5b40fbabd22d7b3717286e6e4df432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724423, "uuid": "2b512570-d432-4a2b-bd70-c40a460127ef", "comment": "Malware payload (LummaStealer)", "value": "7e390ca86f3a591a740e6aed05214cf75773e0d38dd70fd194fe26f12e876123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724423, "uuid": "49f07c0e-3b4b-4502-8018-3772ab3daee5", "comment": "Malware payload (LummaStealer)", "value": "9b8b2a417cf31a3e0d7ee5cde763e89a7c1ae296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724423, "uuid": "c5370281-0ace-4d65-8ddd-94150c29d50e", "comment": "Malware payload (LummaStealer)", "value": "b1948c7b4460e9e0b507fa4945260b44d1614c8979bc67928792565f0718a19c3e8045d2f13ed649c0758ddfef43ec5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724423, "uuid": "c075490e-9171-4b4c-967c-859f127d9896", "value": "T140552347BAE98033E5F5037194FB12230A397C7658B9836B6689588F6C71AE03D7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724423, "uuid": "3cddb430-c5ea-4746-89fe-ad97dd7d165a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724423, "uuid": "5a940254-2edb-45ee-a257-edc6f778a161", "value": "24576:myCw54TPgJzCJaeaIsUCCGpAfDoEMD+S97T6F6B0E/OVWoDn5Ektgu6WG:1CsukehJxGI03l97T067mWoDttH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699724423, "uuid": "69aab190-eea0-4d52-9ce7-6cac81948780", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699724423, "uuid": "b2423028-511f-4c3d-8ceb-b241a095cc0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724423, "uuid": "44363a4f-450a-4082-ae0c-31a13127562d", "value": "0c5b40fbabd22d7b3717286e6e4df432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bb5c92-808a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699704323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704323, "uuid": "ca7fc348-7581-4707-9d52-864d2a23c8d9", "comment": "Malware payload", "value": "9c940ee1808738f4a4cc0a998e836da7", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704323, "uuid": "e1b1567d-2870-4c4e-81b4-85c3c1387ffa", "comment": "Malware payload", "value": "80834896d6c0dd7a61c3d5f89ddea06e793184077b6ee4a70168d51fca54fb1f", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704323, "uuid": "2e50307e-04c4-41f5-beac-55dc24e0216b", "comment": "Malware payload", "value": "7d246bf03659c39757a7206c26da945e6de9b7cf", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704323, "uuid": "f84f1e0b-7981-46d9-90b1-1455a7576e86", "comment": "Malware payload", "value": "8aaea80fcbd15b0458af87787df2725b62a56100591c724e75d6574922cef52b0f6f79fba1631dafb4691c11b3c170a1", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704323, "uuid": "acd2a5fc-1caa-4cf5-a6b8-b1b5b3a33eba", "value": "T10D61BF932151B8E9418283BF3D5966FA807FC224964A6054F78C4F5DF9DDE633A8D3C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704323, "uuid": "e9bebfee-6332-4e6f-9025-7b12d3adefa7", "value": "96:pGtZoO3HuSHk3FN+CfRJL0HNmAiBrVM2tve:gqOp2FuHNmAiBrVje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699704323, "uuid": "583d8549-1ec8-4577-8217-65ee131dea5e", "value": 3236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699704323, "uuid": "3f3c1d98-73d6-4bab-af59-b111d2dba2a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704323, "uuid": "55cef970-833a-4856-89a0-b3cb10c80bf9", "value": "pMMkP2zw.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5285ce21-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699687886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687886, "uuid": "0c4855a2-632e-4e44-ac2a-98c0586c63ab", "comment": "Malware payload (AgentTesla)", "value": "67f3dd84a66fb5c912f54a9a7c240e42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687886, "uuid": "3b3e256b-70c7-4099-8899-a42f88a1fa46", "comment": "Malware payload (AgentTesla)", "value": "84329c07da6678fd70b963db307487890874ec611c6a360227d2c0f8d3121344", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687886, "uuid": "ba86ef01-3c43-4b0d-9e37-500934a2bfb1", "comment": "Malware payload (AgentTesla)", "value": "27a3097783b97f207af31832f38706915a9b1ed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687886, "uuid": "5c851ae5-231a-44c6-88c6-84271b3e02c7", "comment": "Malware payload (AgentTesla)", "value": "4c81b5a2f19c05d99911bf0c9e91a7e9ca89776427ad5e35e33fe180721b9ed9ed3c9c15833aee1c151ac6db44f4a9d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687886, "uuid": "f66bd29f-cf0d-453e-b8fb-8c7c3b7fd508", "value": "T16855C003E940CB83D41C43F46EE34EE90B16AF14EA965ACF215ABF4F3E706621D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687886, "uuid": "4edf8e3a-ff7c-4e7a-8d3d-32aa7c3e56b4", "value": "24576:EuBSw6/uZye3bVHw6/WZyX3bVskoTQxI/RQJv+at0yP0NLpOdCwOx:f6/4D3bVQ6/A+3bVsLT5Ziv+a/cNF71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687886, "uuid": "4bd914ea-49eb-452e-88b7-5a5daf3ed783", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687886, "uuid": "9b7cbbb3-4c12-411a-9702-2ba3964d9bc0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687886, "uuid": "23873a70-6adb-4f7a-b16c-6fa03d0ee1d8", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bad97fa-80d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699736730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699736730, "uuid": "8bfd4f1e-0510-4288-884a-144de61fb3a7", "comment": "Malware payload (Stealc)", "value": "8be61cd9e29e9e7362b114fbb60400b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699736730, "uuid": "0906b6f9-b289-4831-8bf4-989c5e09b2df", "comment": "Malware payload (Stealc)", "value": "8559eef75d44d48a5987571139ce0f791879fe3a7a21761a68f5f9dbac1ff216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699736730, "uuid": "c1ea3821-529b-4979-a20a-491d0e269d05", "comment": "Malware payload (Stealc)", "value": "00e82866898cae052bc3e8c05fa78e0bbf5b0129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699736730, "uuid": "70163cc4-a5ea-461d-b010-11be53a745f0", "comment": "Malware payload (Stealc)", "value": "ac165d290326464a624a220c86102775b099c12c86db03fed308588b3ee622a4a4cbe275ccb8e9a35700205ebf288f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699736730, "uuid": "374f744d-7b05-4c79-b132-d7037f1f746a", "value": "T17FD6F111B2D2EA4EF292BA2C93F667579276F30193E7F03CD6607614017A1B8D336297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699736730, "uuid": "fbe31fd2-6f4e-40e6-8095-e87bb683c3ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699736730, "uuid": "4b4b5dd1-7824-43fb-9f31-928f9a068f5f", "value": "196608:NXpxobpk+1YSn+narmkTQoH4bFbS6x5qtgguBqsphb+Yh3nh2oEc36cjRD:NXpebu+2Sn+A96bS66Xudj+W3nnEc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699736730, "uuid": "77bb79ac-dc12-4b78-b727-5f513396fdcd", "value": 13196288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699736730, "uuid": "64b19467-f24b-49c5-9394-c22fc912c276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699736730, "uuid": "4d16dd86-954f-45f1-80f3-90c6acf95075", "value": "8be61cd9e29e9e7362b114fbb60400b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fb08a6-80c0-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699727427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727427, "uuid": "b60e2645-555b-489e-a936-f90033efa017", "comment": "Malware payload (LummaStealer)", "value": "ad217868ca3748bb09059de2833fdc0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727427, "uuid": "22186a5f-26a6-4815-a0fc-173b7e284773", "comment": "Malware payload (LummaStealer)", "value": "864800f97463762e22ebb976c3b3cf8c54f869b5f8cc88d116280cec9088c169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727427, "uuid": "8d0e091b-4ddd-4a23-a783-6904cdb1a434", "comment": "Malware payload (LummaStealer)", "value": "64fb98b5c6a635351f8d9373c8de9a671eef6ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727427, "uuid": "5ecb08a3-44de-4ca4-ad47-4e821de71008", "comment": "Malware payload (LummaStealer)", "value": "fa39a5be866b21ace1c07d21063d08a40f8af76eea3ab80b1b703c58593703803ac69409873e7331f271684cf8532a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727427, "uuid": "87bed4e6-8287-4487-82d8-fe4c00d8ce20", "value": "T1675523026DDAC072E47657759CFE039703397EA09D3CC27A622A565F4CB2AA0763473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727427, "uuid": "9d7f4dfa-660d-4096-992b-ce89bb772ca3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727427, "uuid": "47566423-7384-4131-8749-e326067d6508", "value": "24576:Pyd+m+Bis2HFaeUIsmCsGMYUDruT3synTxMc4ZiOjXLvTZ6r6bN:ad+9HKQezhVG2//yTxMjZZbS6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699727427, "uuid": "af19d5c3-054c-4c44-889a-1d4790737064", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699727427, "uuid": "97b93c7e-471f-440f-bb37-77e1f542f1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727427, "uuid": "b24a6b75-5942-4872-9edf-8cc4e2041f2a", "value": "ad217868ca3748bb09059de2833fdc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ed0997-80be-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699726525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726525, "uuid": "33c402ad-fab1-4f65-bd4b-26f4c07fe90c", "comment": "Malware payload (LummaStealer)", "value": "9a7a93c82af1bc82f9e33fee5dba3fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726525, "uuid": "6e39d234-73c9-414d-a85b-be7365402d73", "comment": "Malware payload (LummaStealer)", "value": "87f4e7aeaed65193abfef68ae23e7fd9cda4aba4785d74b5e0011c97e59c5cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726525, "uuid": "59e7118d-995e-4a66-83aa-1cbfbb177868", "comment": "Malware payload (LummaStealer)", "value": "69ae897becac34569430b093eb6e18ad11f4ddc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726525, "uuid": "0d48b59d-30a5-4158-ab86-98bd3dcb413b", "comment": "Malware payload (LummaStealer)", "value": "f2df94b51e1c0d4f70de7fce7e25b46deb134775cdd7cd7bc9a17314f1926388161b844453829037449c7e47e452ceb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726525, "uuid": "77f530c9-233e-4d15-bbc4-22a2691b5104", "value": "T1D0552303D6EE8072E575637858F70347063A7D60197C93BB2366A92F4C63BA12AB171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726525, "uuid": "3a6b4e2d-f8f5-43d8-9e50-d2fd92d9491a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726525, "uuid": "dd88573a-9cf2-41c0-a120-1584755a2280", "value": "24576:IyGPL/R6hZM9aexIs7CHGC/IDFLK2aqqz1mL/kpRhtD/gkBjY7:P+7Ryi4eqQ6GbJKaqJmKFz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699726525, "uuid": "9efe4aa8-49f1-4604-a676-5e7ac9324be7", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699726525, "uuid": "8412ead4-db13-428d-9fb9-6aab3203890d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726525, "uuid": "bf425f4c-e254-4168-b1f2-5aa80471ce89", "value": "9a7a93c82af1bc82f9e33fee5dba3fb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd453386-8052-11ee-8907-42010a9c0042", "comment": "Malware payload (Arechclient2)", "timestamp": 1699680334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680334, "uuid": "364217fa-e655-4a74-b7c6-d2e0eb31f475", "comment": "Malware payload (Arechclient2)", "value": "39642eba4041f853846932dd60a14049", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680334, "uuid": "258dfa90-af2e-4a41-ae99-1c7af528d3cf", "comment": "Malware payload (Arechclient2)", "value": "885659fc8c1ada9b5d323afd21bbd432a8fd76d9353c577c75e8a73156f219d6", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680334, "uuid": "38fae2aa-be96-4727-aba6-02707eae677a", "comment": "Malware payload (Arechclient2)", "value": "2399deb2033623d7318cbc3ee36b980d30357cc9", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680334, "uuid": "1bca6dba-bef7-4be3-b98f-2c3e4cdf48e0", "comment": "Malware payload (Arechclient2)", "value": "b84d5febc34433f802f94b903e7bef8c2d906cdbcd2e129dfa4e1557bdadac4c77e4e4985557f45950ee0bdd39b429b1", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680334, "uuid": "3dd4ac89-2669-4ffa-a867-be8d7d73277f", "value": "T182950212F290823BD1B315786A0B9368DC25BE14773CA85F3AF52D4C5F7A681352D2BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680334, "uuid": "c42b20f8-973e-4880-bfe5-7d3d8c8a0191", "value": "3ab53845d07fe6ce054dab5fb509e9b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680334, "uuid": "06c0a4a8-3cd8-4292-b489-0b80a6004f0b", "value": "24576:4lqvwyJ7Q1X7R52KY2pJzi7UeLacT5Odyu8TQaagP38Nxg/eSkZ40i:4pytTMpiacT5OV8TQanP38DeFkZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699680334, "uuid": "5fe13813-03cc-43db-bd45-9e55130f9236", "value": 1989120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699680334, "uuid": "b8ccfe86-e140-4dc1-ab2e-da848bf7e00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680334, "uuid": "e99dc5f3-3cbe-459d-8192-aab2b7d7ac1e", "value": "39642EBA4041F853846932DD60A14049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4c0bc9-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688740, "uuid": "ad74750f-183b-4663-884c-3bebd05a2e36", "comment": "Malware payload (Gafgyt)", "value": "d9b8bcf3fb47ff3df3c82ced047ca762", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688740, "uuid": "e26b87f6-101f-451e-b24a-57d3cdb3d601", "comment": "Malware payload (Gafgyt)", "value": "89d0d96db4e5c2356862cdb3f072e42fcc70d9af756386678db7a6aa5465fd36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688740, "uuid": "ca97f2c0-c7b0-420e-8324-7557f55d92dd", "comment": "Malware payload (Gafgyt)", "value": "cbdfcc019105d7ce50c3cfd4248887b7318e731a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688740, "uuid": "6bb0e79c-3de9-4982-9223-71ccb77be578", "comment": "Malware payload (Gafgyt)", "value": "930ac59b6104c941d79d3fac05ccb96d1275e97ec8168b723158647107fb2f8fa34d55fef666af0ac10140c914910ee4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688740, "uuid": "704660ce-50e6-460e-a60b-d1f585a9b2ca", "value": "T14413F0311D35F572D6162874EAAF9B191B263E7932F632BE83100646B2D2023AD7173F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688740, "uuid": "9a2f673e-bf2d-4588-b864-77af5340407c", "value": "768:/t8EcZHH/Szc7FSlwnQX6/AV9SAOsdmrkYi/YSpV/SAg+r60Be53UyoFzcz4:/a7HIc7F8wnQq/AyAv1/YSL2WdBeLGzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688740, "uuid": "3d5d8db9-48d8-4abc-a04c-bfeb65ab20ec", "value": 42920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688740, "uuid": "ac119a8b-4472-4bd5-84e0-9f7cc8a47a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688740, "uuid": "5001617d-c719-4987-b674-47b543139e77", "value": "d9b8bcf3fb47ff3df3c82ced047ca762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd1d118-8079-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699697055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697055, "uuid": "40712ef1-d0b1-4ac2-850c-ec7b6b999788", "comment": "Malware payload", "value": "34ab41c9bbcf1f14d8527d9231bb361b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697055, "uuid": "2b536b6a-b730-45df-967c-a74a3f5aa1e1", "comment": "Malware payload", "value": "8c418ca9c0c85371c5903758cf553c5a192ebde1e44a2e18c1a391b08a4d46ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697055, "uuid": "d8a9ae59-854d-4b5e-b78e-c2845d764294", "comment": "Malware payload", "value": "1a764f895713d2109383760f835944d09ed54f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697055, "uuid": "22ab1d18-50c7-436c-b801-a6abd22d5aed", "comment": "Malware payload", "value": "611f75d489b2cef58374ce29b11e7802bc9c2f705ff13cd8fe7c773650fff4c5a334e248c4942688dd67a0fdbf7e0845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697055, "uuid": "757fe880-8df0-47be-9f52-84d0b582ef2d", "value": "T1EB45BE3869AC6627C175DFF18FD18467B2D0996B3051DDB9A8C323EA0722B52E5C063F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697055, "uuid": "aae45537-3a0b-4f37-a667-a2834d03088c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697055, "uuid": "192ef171-0529-4661-a3a2-79f2e9814cfe", "value": "24576:b5eiQEk7dRd7LDM8afnV3v8duGHSVAnfCr:bRKhRd7LDMzV3v8gHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699697055, "uuid": "95a66384-c342-4cb1-8f51-7d2c029fe995", "value": 1275392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699697055, "uuid": "52fd3fb1-efc3-41bf-85b3-fb16fccb1f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697055, "uuid": "88050f61-822a-4e08-8536-37715401e237", "value": "Statement Of Account.pdf________________________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163e805d-80d9-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699738036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699738036, "uuid": "c7bf7cb0-a6b6-4872-b7ff-1ba446c97bff", "comment": "Malware payload (IRATA)", "value": "e1e6a2a7d00819ea1210434048e82e53", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699738036, "uuid": "b16b87c7-50df-4ca5-b40e-e9981a5dd7c5", "comment": "Malware payload (IRATA)", "value": "8c91ec587d8f8454d21ba54954f97c19330e7fe665eec988629223e71b306e5d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699738036, "uuid": "1690ad9f-289c-4bcc-8c7e-25babb257466", "comment": "Malware payload (IRATA)", "value": "0cc412fd03b7a9b9c2ee180de17aaeb47ca88d53", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699738036, "uuid": "f59674eb-9290-4302-ab58-ebb5f59d92de", "comment": "Malware payload (IRATA)", "value": "ace0a55ab806e8667a7050d7fa826ddf2a23c437d8fb24f15979bbb34be25448f219a7de97da33b6cb96b4072d89d014", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699738036, "uuid": "f774b5fb-5656-43db-b222-fdc8d0c85394", "value": "T1D5C52393F23AEC6BD476D1723544233510294E99DD47F7CA3A5873B634BBAE88B806D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699738036, "uuid": "d01bcecc-6fa1-41d8-a14a-ce6e065c0e69", "value": "49152:HkJ/2jrkmNBOh8UyV0l2XO9SkpfnzU2K6HC1P0+PLV3glTzKmoq/r31:Et2cAQVhQXCSkp/42K6iN3zul/31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699738036, "uuid": "3b7a145e-6b6e-40b7-b5cb-9232217556ad", "value": 2740415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699738036, "uuid": "66e6f297-a81d-4593-a715-404cbb9d8ac8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699738036, "uuid": "de43cde6-88fc-48ad-ac4d-30064d5789ed", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d3b130-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688749, "uuid": "5217572a-7059-485c-aab6-5bd9d87ccf00", "comment": "Malware payload (Gafgyt)", "value": "fb8b702eadf28cb9a9fda26e4f25ac4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688749, "uuid": "086f594c-639c-4c73-ad43-f817ecacc9ef", "comment": "Malware payload (Gafgyt)", "value": "8e1615f31f998b123b82c44ed2bc188be38dd963236e85e5abf9ec7e91cedd86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688749, "uuid": "4084157a-8caa-4e3b-b74d-e9890780f78a", "comment": "Malware payload (Gafgyt)", "value": "cd2451c77475e705fb94e7d9acaa156890e9e5be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688749, "uuid": "3f0d5e93-1b1f-431e-b09d-3b1141b7f118", "comment": "Malware payload (Gafgyt)", "value": "3c750aa1e4f88662f796d55ae24da90cbf4a6a7a764f601e806035d24ebea99264fe14b88cc8bf30e900f0f419fa5512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688749, "uuid": "2e8393a6-f2c5-4343-94d9-ebde619f57ff", "value": "T1E9230200268AF2F7C26A4C73D5BC8B02123E4F60D9D725B4629AE3B54D93F95EBA5430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688749, "uuid": "482f9397-0f66-4a35-bd15-dd204d4e04a8", "value": "768:Q7L4TgGRpxQxT+uY1JkJhZTe0PoMC4rdMKfIVCd9quElWmq3U7WfPQrRtOe8Ffu:Q7L4xRpxyTF2JkJPK0PC4reFC1wwPQ/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688749, "uuid": "e1584aca-7530-4e54-9e00-7c90e06e0266", "value": 48564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688749, "uuid": "214c3ae2-15ba-42ab-877f-a474fb9be06c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688749, "uuid": "7a7f184d-6a5c-4f04-9403-8cc3411d956c", "value": "fb8b702eadf28cb9a9fda26e4f25ac4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c179e129-8070-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699693226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693226, "uuid": "38b10c02-15e8-44e0-a908-f87f81d64306", "comment": "Malware payload (LummaStealer)", "value": "94c5dec3dc55d94342b86817f62b2e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693226, "uuid": "627bba34-6f04-4df0-b547-c4fee3b3d8ad", "comment": "Malware payload (LummaStealer)", "value": "8e2397869f3ddac2b5daa8972947bb1768b8a349d9077276876cc7d77d2ecf1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693226, "uuid": "2d6ecc3f-8776-48fe-b798-c3627c8680ab", "comment": "Malware payload (LummaStealer)", "value": "962bb43fd963eda46507436b1ed5d5d4b0d2a49e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693226, "uuid": "e829bf60-33f4-47da-8b84-04b2120e85e7", "comment": "Malware payload (LummaStealer)", "value": "645d4396846ee03f4960562fae03c48fe0572f8dea6277ba94068a79625e45a81856cfe68c1ce0c555a0e2801a9f803b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699693226, "uuid": "db54e71c-d6b0-404c-bbe7-ed90979a60bc", "value": "T1675523520EED8176E972AB3061FB12671E7978241CBC872FF214984B4CB39E8A571377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699693226, "uuid": "1640e29e-86a5-489c-942e-82d62215fcbf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699693226, "uuid": "7f6ae066-c8ad-494e-a14e-4f0cba76eeea", "value": "24576:8yACdIZCO4EKaetIs8CsG470DDm/BtemVzNt2HUCGViv1mhbW2FKMWWB3h31I:rAYIZCSjee1fG1vmjeWR49G0Y6Yj1hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699693226, "uuid": "d72ae6fa-fdc6-4d53-ac13-9541384ec92a", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699693226, "uuid": "a03a9695-1ebe-4a24-86d0-cd533f203f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699693226, "uuid": "c9fbef64-5bf8-4bbb-a97e-49ffe44878e0", "value": "94c5dec3dc55d94342b86817f62b2e58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e5977a-8079-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699697047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697047, "uuid": "571e8510-e10a-4ada-a3ce-0bf6fa9b5069", "comment": "Malware payload", "value": "7838f229ff549744a0fb495bca7ada73", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697047, "uuid": "b1ac075e-4af4-4485-b8fa-5e631006c428", "comment": "Malware payload", "value": "8e71f00b676e19917d8a763ffb606fde51c864ded8ca7989bf5046a176ccc467", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697047, "uuid": "c4675da4-c305-4b29-bc34-920cd96bc12e", "comment": "Malware payload", "value": "c57990f6d9c4fc810c93af8cfd1e45a35d0d8bb1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699697047, "uuid": "145e173c-537b-40ef-840b-47bb22883618", "comment": "Malware payload", "value": "f2f21d258148e83c6799c289d9f231e88ea4bef4015600e76ef89c379aa898214305cd97b31d43c64a25208c3e6494f0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697047, "uuid": "1b324b09-52d0-4056-8143-8ae8704441cb", "value": "T1FE25232CA9296183D5C232012EF85E1CB6768715CD58D6FD8DB949F2F3F82E137A2D90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697047, "uuid": "afcf0b48-b8a8-4fb2-b573-b28a4d93e868", "value": "24576:zjqgKndatjsFstwa3nyPi/iRshWuLmlrbGgdcMJViHj:0Yj8sm6yPi/Aluu9iHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699697047, "uuid": "22b7b114-89d3-4cf7-bbe2-3a58387861a1", "value": 962780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699697047, "uuid": "c207cb63-de47-47ed-a52a-c09953aa99d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699697047, "uuid": "38333d95-c47a-43d3-8be7-20a14b4aba42", "value": "Statement Of Account.pdf________________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d089dd9d-80ad-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699719451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719451, "uuid": "2c844da8-46ac-4adf-a254-fa09eb0c5cc3", "comment": "Malware payload (Gafgyt)", "value": "1a6d783301450b15938062c5c6ff1bae", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719451, "uuid": "bf252275-cdcc-4a37-9d68-7bd574585fca", "comment": "Malware payload (Gafgyt)", "value": "8e72e279c989c83f15ca3ef95f2a090ca6eda0c0d89afaebe03e026170d9fce6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719451, "uuid": "3f7b0814-8b5a-4ee0-a11a-b448aef85a2d", "comment": "Malware payload (Gafgyt)", "value": "6bce22cf228282f64db3de003211d9bb9b9fab5b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719451, "uuid": "dda39209-301b-42b3-a16a-7805e4c75a7b", "comment": "Malware payload (Gafgyt)", "value": "437931339d0833bcc13e482687818ace6452116ef21c1dace39d926c144262b367ed2e7abb57b0672010870eead31e3c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719451, "uuid": "1a4f7754-f7a6-42bd-8090-d2fbf787c2e8", "value": "T196931A27B551C67BC0C342B427DFAA226833B4F91B37720B73E47DA92B169C92D59B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719451, "uuid": "d0828063-8218-42f6-ab73-829129b3a17e", "value": "1536:U7xpx/vK1aRnhbNfP1k6n7m2y+eJ3yRPVSmo/luO5/9VZShe:axvGaRnbfPuFV+e5yRPVSm8luO51VZSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699719451, "uuid": "fd681c0a-4ee8-4df7-9700-289776877d90", "value": 91346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699719451, "uuid": "3157296d-f9ce-475f-9c22-72d2519e6b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719451, "uuid": "7e530c15-2be6-43dd-96ca-de84ae093122", "value": "1a6d783301450b15938062c5c6ff1bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9784f46d-8065-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688431, "uuid": "6a4ccf52-ef6c-4ee8-812e-b003483e4a8a", "comment": "Malware payload", "value": "7f605c2cb0fc71830b43060264b4d0a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688431, "uuid": "c72405ef-388c-45bd-ba64-4f6f2242ea96", "comment": "Malware payload", "value": "8efdd16acfe64b0619fdd561c5b8704d4c38274249d6168e0cc6b7b11692b9a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688431, "uuid": "6a1b5f35-7c8d-4c87-b7dd-0d221fba1068", "comment": "Malware payload", "value": "3b4cfa40c7f704a38d66adab3a8f6873c55511c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688431, "uuid": "f2fc9b5b-5c5d-4231-8ad1-6676684ef91f", "comment": "Malware payload", "value": "8eb6b1fa0a7d360b5bcf08379d1442e07e3d9158d6c0972c00e665de7741738591272341fc4a68f90c8028e70afbfb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688431, "uuid": "8117997e-e2d4-4b17-86f5-cf875365a8df", "value": "T1475633037A2311D7ED8C9D7399173C613AF191C14365ECFAA0FA98D46DA46AC6F06C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688431, "uuid": "451bf6f4-e67a-4196-9e3e-682f6b5313d2", "value": "196608:7Z2203czkB24qBHfvLVlahXDZ3clsiCnlE5R:SjBWhfvShXDZ3PYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688431, "uuid": "4c8818e9-858b-4a67-9927-a2e24bb8032f", "value": 6412421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688431, "uuid": "9f030764-5c62-46b2-9ef0-0e3504c5fce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688431, "uuid": "801c9701-819b-41d8-952d-d782b179fc19", "value": "7f605c2cb0fc71830b43060264b4d0a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dcbabe-8066-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688662, "uuid": "0d1b0fea-7e8e-4e79-9f67-30747e9b7485", "comment": "Malware payload", "value": "67abe8b04bd4b7cae72e8f70edbad5f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688662, "uuid": "04a89e35-e410-4332-8dee-b612aabb8032", "comment": "Malware payload", "value": "8f6fe5a6bcf5cfce44ccf19b407054e20401a937fec3a4d344c1512585d85050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688662, "uuid": "737212db-f8da-4fe1-a0b8-7d1506675c94", "comment": "Malware payload", "value": "85d3b1d142cb8de0de526135efc388c8e2849146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688662, "uuid": "7818820c-be80-4f5a-953f-9c5886fd1529", "comment": "Malware payload", "value": "9b2e8cee29d23368316121570b35c81ec7e99b0b812c3b0a81fa441b0ca259df179f775cd0bc48c04799c6f88c2d0e42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688662, "uuid": "1d397a3a-4cee-43fe-8908-2d5bc956cbab", "value": "T1F2164A1BE1A350FCC66BC130876BA573B672F8695130BDBF2654DB342E62E50262DF24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688662, "uuid": "8850a17c-857d-4b9f-aefe-44e0cf311e84", "value": "98304:ZLsUYfB9pOp/BWLbrkShfa+XQD/YPLTDtU5SXXMQHJw7ZB87TtIeUK+MzfL7cybx:Kgp/NQ7rfWOlbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688662, "uuid": "84afe136-7992-400d-b61b-c2936ead130b", "value": 4086305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688662, "uuid": "f117788f-ac5f-499e-8c6a-1b478e34bc7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688662, "uuid": "58118810-5a15-4a58-a1a7-057412014647", "value": "67abe8b04bd4b7cae72e8f70edbad5f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c034cb9e-80b8-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699724148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724148, "uuid": "90d84856-9abe-4d42-abb5-7f163006c205", "comment": "Malware payload (LummaStealer)", "value": "f88f5aee4af6a69bf97148965ac7e905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724148, "uuid": "fc47536c-537d-4937-92cb-9171cdd88b1b", "comment": "Malware payload (LummaStealer)", "value": "8fae24fdf7b9710fe1632b66315507c276815fed31283223b653bdbd6aeef6d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724148, "uuid": "09f66028-96dd-4472-b19a-46f795ddeb6a", "comment": "Malware payload (LummaStealer)", "value": "bf7809f446a632348665961421bcdf9a23050003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724148, "uuid": "5705fc49-7e1e-4405-8b20-0cf6e1c3100b", "comment": "Malware payload (LummaStealer)", "value": "3187e8f43a6c7c483db4dd9e2e3d0d6ba1a96c5ce0dac60b40b21f196b54bc6b3a899381530038814454eee9ea77b425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724148, "uuid": "ee847b76-464c-4fe2-b253-623a2bc7f688", "value": "T1186523937EE99077E1B52B7278F716071B257C223EB983AB2446064B1C32F996834737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724148, "uuid": "3e0d8c5b-ac38-4f14-bafb-4e857dc72554", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724148, "uuid": "dc5e30d4-5c93-4de2-9ba3-0f110d374a76", "value": "24576:RycSMogY6qOsLrlRNedIs3tTGzeiDUIWSuI/WMUCIKyM49TCf2QvFh0+A:Ewo+FsdbeO2ZGrY+vUsRV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699724148, "uuid": "880c81f3-5288-4bd3-8efe-1da4fb9130cd", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699724148, "uuid": "64a4b39f-0af8-4d35-b9db-73de282bb54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724148, "uuid": "2903b9f6-f1c4-4176-9399-8f76beb0dab1", "value": "f88f5aee4af6a69bf97148965ac7e905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b042d4a1-8065-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699688473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688473, "uuid": "c606315b-fdaa-4437-bbff-65c60ad0ee83", "comment": "Malware payload (RedLineStealer)", "value": "1c9ff9394f050e641023445185ab7f78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688473, "uuid": "915cb7f4-0569-4406-aeeb-26ec3133a0e1", "comment": "Malware payload (RedLineStealer)", "value": "8fbb18ef24e9c8f05209909a7723fe076b478dde5b9385a1d23f0ad46a8751aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688473, "uuid": "76922a62-1f09-40a7-ae8f-0e40517436b3", "comment": "Malware payload (RedLineStealer)", "value": "28ded8853ffbe30202c59e3c365ed4cbd6924260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688473, "uuid": "1e79aa58-3895-4520-b2dd-88465e7eeb49", "comment": "Malware payload (RedLineStealer)", "value": "13b931f01e17ca629e3d157df0516fe943f72e0e4fd2da92f1c596b341ee0531787eb65c9cfc5bcf7fd299bf159452c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688473, "uuid": "b1a0af48-f33c-4439-88c3-5010e197b892", "value": "T1E7B40202E7D89132DDB22B7048F603A71A32BDA15E78925B27D5A81E1C73BD1A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688473, "uuid": "ca198fb0-2ccc-4541-a474-06d857957974", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688473, "uuid": "2ea81694-4fcc-490d-a290-695a3e27988e", "value": "12288:PMrRy906PlgSocnKVV93NED9J1Oip7mfsqg:ayHl73Kj9OpJ1Oip6sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688473, "uuid": "a2c591a3-d032-427f-b4a5-d2ab519ae974", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688473, "uuid": "5072d51c-34c3-4399-8e87-9c771f8c1943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688473, "uuid": "a68369cd-104b-4015-b46f-562b49a6bb4d", "value": "1c9ff9394f050e641023445185ab7f78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a16727e-806c-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699691281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691281, "uuid": "916d6203-a6e1-4969-9611-1487d72fd932", "comment": "Malware payload (Smoke Loader)", "value": "46fab26745079ef541c2d1ece3cf57c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691281, "uuid": "e8258ac2-fdd2-4d7b-8a9f-d472f53a7c40", "comment": "Malware payload (Smoke Loader)", "value": "90575d53104fa810c6896f874e421e905c3687ff1767574842d10cc143237762", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691281, "uuid": "41a7dd98-c40e-4f73-9b79-ddafd3395357", "comment": "Malware payload (Smoke Loader)", "value": "a6a7336765dd507c01886fc0b2174a16734855ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699691281, "uuid": "131268d3-51c8-4326-bebb-0f48a556c897", "comment": "Malware payload (Smoke Loader)", "value": "06721271c4e832b28156ec12ba93faa43d12b2f4fc9995894f0b04f3a5b21ea39a5875aca9f9033e90f6771142b8cb3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691281, "uuid": "12c974c9-945c-461f-8c30-c76f62d7001a", "value": "T1A5249D3232E268B3E62346318E75C6E5DA1BF8714F6066DB17846E7F0A711E2C673316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691281, "uuid": "c8c2459d-bfae-4ef7-8dbe-d7d93d97f0de", "value": "13937693d95394f2ce32af6042a00c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691281, "uuid": "da9f4dd3-a074-476a-b23c-ac1cb06471cc", "value": "3072:+GYKhu7rzgpV/o72MgWYXkpOJ17b3GLSIuHzovrsKe88jjT:ly73gXQ7Z7MnWHWlHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699691281, "uuid": "163e11bf-656e-466e-be26-e15a9a556899", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699691281, "uuid": "60bf16d4-64c6-4904-a76a-0c8a52854773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699691281, "uuid": "70641ca0-359f-4cc2-b2a4-7f7acc338407", "value": "46fab26745079ef541c2d1ece3cf57c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e04a850-8067-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699689140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689140, "uuid": "2a57f3f8-4617-4eff-9ad6-f3c704200ec2", "comment": "Malware payload", "value": "68ae91cbc75047477c10b4cac0930fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689140, "uuid": "e4f1bf18-ad3c-4db4-bd6d-0c0e8a2a8ced", "comment": "Malware payload", "value": "90cf191969c19f3762423789ac96c08f5c9ecbddc17994580c81ab4544e1aebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689140, "uuid": "eec6865b-a807-4cce-87d4-57cdc0fec332", "comment": "Malware payload", "value": "a5977a366548224a7cec1db8f4a4553527be0a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689140, "uuid": "aa45210e-eaf0-4cfd-9f6d-58eee6b6d12a", "comment": "Malware payload", "value": "27aab26348c5e3f2a7f10ae9acfa0ddeffd3bfb0deb2b76f872f35abb0ad64170273c277c41643b67a1266e5ddc1632e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689140, "uuid": "28f02e63-ef84-46c0-b7f9-3df87c93b28f", "value": "T1F986F11A7DB31CF6C07180B8442629396A7974336B02C6F32D51689ACA727E7D23E7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689140, "uuid": "ff0c7868-10d5-45b7-a6da-70fd4855e170", "value": "98304:sOyqLkY0txXcmtJkNLf8o9ZazlfFAvYzHHL9Yij6cSs5CIfEntDb9DRT+AFUc+ZV:sOyqLNsxsmbWZNvYzhsch7stnbfF4sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689140, "uuid": "ee290829-2f7a-4df6-9b84-1167328a87d3", "value": 8194170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689140, "uuid": "b61ce197-8fbd-4725-8bf0-9371f61b9026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689140, "uuid": "8ecf9e02-6579-4e0f-963e-bec8afe9dbcb", "value": "68ae91cbc75047477c10b4cac0930fdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3735f47-80ae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699719831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719831, "uuid": "0e12b2e4-790f-45ae-ae1f-5a8b7b62cd20", "comment": "Malware payload", "value": "f95789c092ce9f252857875c242f33d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719831, "uuid": "a7c9b52a-a1d5-477b-b43e-7e3726533709", "comment": "Malware payload", "value": "93b85904ee44f0fb32002dabd8fc944262f57ca7fe62dc8c2a86fcddd7c5d7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719831, "uuid": "ec0c9b23-1959-4486-929f-0ec9b66a2f60", "comment": "Malware payload", "value": "ce6db0c9f829a7101825ef36c1e40f9e6047e829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699719831, "uuid": "4c8302d4-fd73-4942-9470-ee636cb5370c", "comment": "Malware payload", "value": "09513b8c6bed9463d684c1e949e50c04644d4ea9f57e137370fd06da7cc55ef7eac88a76cb66e7072d43bedc77cf3bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719831, "uuid": "94216466-9fb1-4515-a5ae-3e05925f5690", "value": "T1E8830281C2D45D9CD4F440F0DD16BA8B80A8F39ED5D89BAD0758122E28B7FC075EAE9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719831, "uuid": "2a9f78a5-1f2f-4609-80e6-417606d94e3b", "value": "3243b13e562279ab7fbe2f31e45d3a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719831, "uuid": "59a8c67e-50b1-4b59-bac5-9d61bfc67895", "value": "1536:lqjyXN0ly65p6wGYFEEDxSV7SRYnQm4dcslN4ZJjeSVtSWwnouy8jS:w+Xe58wGYFxDxSQpdcslNANV2outjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699719831, "uuid": "19ad08e1-2834-4e74-8ecc-867a9f648871", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699719831, "uuid": "4f5380fd-037f-43a5-af2d-87ed1ea17a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699719831, "uuid": "321a1098-3ae5-444f-b623-d51664d0dd05", "value": "SecuriteInfo.com.Trojan.Siggen5.528.22345.11518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f6550d-8044-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699674019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674019, "uuid": "bc460810-ca86-4584-8cae-bd79f63feaf4", "comment": "Malware payload (RedLineStealer)", "value": "06a6db9acf05fbb473df1c207a7c4124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674019, "uuid": "bcd9f7d7-d992-4fb2-8d2f-8a05c7159bb8", "comment": "Malware payload (RedLineStealer)", "value": "94115d0eae0422b6605f0f25841c29b7cc6c029472a983b21d1cedcd7fdcd647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674019, "uuid": "4a947c47-2eb5-4f61-8e09-529e154509f4", "comment": "Malware payload (RedLineStealer)", "value": "05a6cb77200d23c45296b4af0d88006adf9b77be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699674019, "uuid": "ab196724-485f-4b44-b50c-8b56c02b948c", "comment": "Malware payload (RedLineStealer)", "value": "2ac63897b66e3f79b2bcc86caedabf44b7d609f43b4e01cf44333ead14d8a82560ed5ed302e3c4eeed0b4574b5433acd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674019, "uuid": "537a4aab-5acb-4c63-8257-05b5c9951273", "value": "T1505523E7FDE880ABD5B2137048F747430A397C619D18932B73895A1FC9A26D86D32736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674019, "uuid": "9a70872d-069f-416a-87ad-28116cd35ee3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674019, "uuid": "20d44839-425b-4c09-8fa3-fa15caaab06d", "value": "24576:+yBANvH6jnxXaeBIsfC+GtzGDpqfMvzWayUPM1jrMv3n1fGHhrGlRBX/+iHfb:Ny2xKe6YjGM95LMea1GlnP+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699674019, "uuid": "17f5a179-1250-4aea-87e5-d516084fabbf", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699674019, "uuid": "3df7923e-8708-4b9a-8fa4-3337e54cebda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699674019, "uuid": "7d125308-653e-4eed-bd54-a1bb337dd82c", "value": "06a6db9acf05fbb473df1c207a7c4124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc70d84-80dd-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699740119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740119, "uuid": "df9367f9-7d32-48d0-bc00-14c4a70b0b5f", "comment": "Malware payload (IRATA)", "value": "d14ba3a25842502e3b8162de0e7d8176", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740119, "uuid": "216ef51a-7d87-47cf-9f1d-ac584e356692", "comment": "Malware payload (IRATA)", "value": "94cb3336b466b02f3a90563e135f67bb5a512d3b0bf8f1fe5ac36b27deb2c65f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740119, "uuid": "7c99eb43-9bef-4c3c-8782-8fbb4b2c8d9e", "comment": "Malware payload (IRATA)", "value": "4df460ed988d5aa090bd8a30e76603e17e220a56", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740119, "uuid": "417467bf-a173-4b31-bbec-f9e99eb7451a", "comment": "Malware payload (IRATA)", "value": "020cbc3d3c4c8b596e90eaddd9e8d0f6fa7a18212ea57e97c7cf2e021c1022205ad61859ccb66364415709b4b1599834", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740119, "uuid": "57d2b1ab-c8ae-4034-9d15-baaaa6829f35", "value": "T1D816CF8BF794A91BC4F39372857553AA51074C268B83EBD76D14363C1DBB9C02F4AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740119, "uuid": "0a1b978f-f64e-4e58-ad5d-19534a2f5b89", "value": "98304:OLtci79c8WdLqyXgDmhgLCr8YYQuECaYEqFlmvJOc:O5FhcLdJQsY7h/lAJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699740119, "uuid": "e0b6035c-1433-40b3-b1f9-dacb8912047f", "value": 4288305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699740119, "uuid": "e92c5166-9484-4c3f-ac18-8e0363afdb58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740119, "uuid": "d61b7d01-675b-4015-962c-c945d921c18b", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f4f5f0-80a9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699717524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717524, "uuid": "44903954-5e57-487c-9aab-5f07fddfed22", "comment": "Malware payload (RedLineStealer)", "value": "77e775a19e7afb113a5c6b303f9fb06e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717524, "uuid": "5b00d2d7-5046-4746-816a-ab9e0e905878", "comment": "Malware payload (RedLineStealer)", "value": "95ee9c18848ba7cd4e4b753d8f82bc3605c097ef4178d9781b12c112ebf43fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717524, "uuid": "af05203d-4fb5-412c-b29b-927287d00781", "comment": "Malware payload (RedLineStealer)", "value": "4a5e82d49bf22335395742e9c38f276c429030ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699717524, "uuid": "d9106028-f1a9-42f6-9e0e-76adaa95fb2b", "comment": "Malware payload (RedLineStealer)", "value": "89c1beb48747f869449047738d8799974e70120b9074ccc51404d3bf86aea8083bcb63cfb0753505adb68d92173da0a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717524, "uuid": "a59a29e8-ca31-4392-9644-254ec65bbd30", "value": "T12B5523A26AEC4135E4B917742CFE4303023D7CB6897C834B2265A8572CB2AD57E76737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717524, "uuid": "13ecdc0a-132d-45fe-9466-d8e7d53620c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717524, "uuid": "45e53609-4d64-4bc6-9e43-644a731649f2", "value": "24576:DyRMtUHIOereHaepIsECJGbWxDMY1r8zbSIEJVjQI7DX/rYN7K1r:WRMtRDC6eSvMGO1RmbJE3MN+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699717524, "uuid": "ae800837-08aa-4d38-adef-d3fa7bd5cb05", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699717524, "uuid": "e9d5652d-91aa-4bff-ba0a-8b2d20d08e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699717524, "uuid": "2c53c352-7ffe-4de6-abc8-a13d1c488858", "value": "77e775a19e7afb113a5c6b303f9fb06e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57de10a6-808b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699704645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704645, "uuid": "ec7daa03-f6ab-4a5e-bea0-32d1c86aff2b", "comment": "Malware payload (RedLineStealer)", "value": "ba1d6c925ec0867f51a06eb45f780f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704645, "uuid": "86f843b3-7ae7-427c-bb98-e8d354435241", "comment": "Malware payload (RedLineStealer)", "value": "96968eb7438ab298fb5c8dd0b46b2e10a77ed78eb2a54c891b40da4da4a3b9e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704645, "uuid": "c745818e-52bb-40cb-9019-b680d7ae18c0", "comment": "Malware payload (RedLineStealer)", "value": "8739f0e00cabe3fee69ce50561b716c701038177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704645, "uuid": "cdee846a-93d7-47df-9170-9ce1d651e904", "comment": "Malware payload (RedLineStealer)", "value": "da7dc0026587aaa69b904778d62dd6860fb8d7b50511da8b0be3ccd2bfb49559ee50a3fe489af0b2bbc77e38844d5232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704645, "uuid": "13f6f874-e68a-4027-bccb-e96919435753", "value": "T1B55523425AF989F3D9B0277564F70347053B7C325CBCA35B2B5448A7ADB2A80393276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704645, "uuid": "c31f6b59-d4fe-4203-98b3-06ee0faf4a02", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704645, "uuid": "f6c7d4a4-a27c-42f0-87d3-c2f60471f132", "value": "24576:dy5443gK+dy+ae5IsZC3GRW1DeUZf1R917qiIvQ75BxdVocaM:4aEgEHeiq+G4Pp17zLtBKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699704645, "uuid": "ee7b5274-2723-43a0-9e92-133ca7ee0f11", "value": 1351168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699704645, "uuid": "866f6397-487f-4f37-8fde-e8cffbc1849e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704645, "uuid": "5fe119ef-3ea7-4516-bc8a-dbd6157f4a2d", "value": "ba1d6c925ec0867f51a06eb45f780f65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe0c9a4-8067-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699689251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689251, "uuid": "dae6ab75-f760-4c1f-b6b5-ebb6ac12dc3d", "comment": "Malware payload", "value": "4409b8eea317b0a4406d70bda8ccddcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689251, "uuid": "6d732391-f39b-44d7-b3b7-ddbfed819c27", "comment": "Malware payload", "value": "981e42945b27742a2ef21acaeb4f0985ac83e484671e7bedd2dc071e0c4af62f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689251, "uuid": "75d6a547-102b-4a01-a33d-890f263b52cb", "comment": "Malware payload", "value": "37c3548d03d62ed74290f30e4390ea13c25307c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689251, "uuid": "ef44894b-4f78-40a1-a875-f69fbe9d41b1", "comment": "Malware payload", "value": "6738aef0e1c754bf826e162a5e8c6cb9132b78a250603481a31ab395cfb6a2ea70fb380ba6a77385ab30570badf0aa27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689251, "uuid": "a5c86ff8-7c9f-48e9-b466-25f38dcf8992", "value": "T17F35234262DE80B7F0FA53B019FB07970734BC525D2C827A270A649B9DB2ED46872777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689251, "uuid": "44eff9c0-b01f-4c44-9f73-4bf828860db5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689251, "uuid": "0f9ab04d-9298-4003-ac0e-836a286e3ead", "value": "24576:EyXp9nZfnXaebIs4C0GECIDofdJWhTOvccJL:TXp7/KeUztGA4c1Okc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689251, "uuid": "36ede0e9-17c4-4d7a-8158-46ef0c6edd7c", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689251, "uuid": "269f1106-dc96-49bf-9eb5-0af684d807d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689251, "uuid": "7e7369d0-edc8-43ce-9395-862359c27877", "value": "4409b8eea317b0a4406d70bda8ccddcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90f849f-805e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699685535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685535, "uuid": "878314a1-bb7f-4c55-8eb4-56ef096569e7", "comment": "Malware payload (Smoke Loader)", "value": "24cc6b095d5f0b4d3f231e00145b4860", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685535, "uuid": "3f8e3a38-0797-4ed9-975f-3216777bdda0", "comment": "Malware payload (Smoke Loader)", "value": "98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685535, "uuid": "0c53859d-ce19-400f-8a53-6072cdac6f25", "comment": "Malware payload (Smoke Loader)", "value": "dbd2d7eb80669f1bc116b1308fdd014d1cefc1e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699685535, "uuid": "d3e108ec-99a0-4af0-b545-f518b1885c15", "comment": "Malware payload (Smoke Loader)", "value": "3225e1fc073a568ce605e36758014f1bf0fc15010d9d2addf72022c72dac1af7f82a5ebfc803810557cffa9017f2537b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685535, "uuid": "352ead1e-7adb-4d7c-8975-38e92c1aa070", "value": "T185248D1236E2A473F63346358E35C6A4DA5BFC614F646ADB1744EE3F0A712E2C672306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685535, "uuid": "323343e6-33a4-45d6-b3ee-3627122bca25", "value": "13937693d95394f2ce32af6042a00c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685535, "uuid": "244290ce-603f-49d5-84de-3dc378663c05", "value": "3072:ZGYe0UBjwo7k8omgYyMgWPggq6W9Om5G5TNPMb6BLwhrBjFKT:ol0uXAdmgFyoR6W9OmA3C6Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699685535, "uuid": "0c5e54e7-d64d-4f39-aa20-334c37cac39b", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699685535, "uuid": "de5277da-f7fa-4bf3-9b26-0ccccc23f205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699685535, "uuid": "4afa9eff-c3a2-418f-81c9-2ea8404c01d3", "value": "24cc6b095d5f0b4d3f231e00145b4860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72f2738-804b-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1699677398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677398, "uuid": "7c572ab1-3672-468d-aa19-1ab59f7e0081", "comment": "Malware payload (XWorm)", "value": "386f066c417fa04b1d6f94ac81f1be6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677398, "uuid": "157367a9-858f-4326-8bae-ffba6c4ea916", "comment": "Malware payload (XWorm)", "value": "98493d1be8cb7bbbeb6e1dd8875f28a0a9b7e559f64edf83ae6d7f3c5cf962ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677398, "uuid": "05a803b0-4216-4781-a7f1-cc002743c135", "comment": "Malware payload (XWorm)", "value": "c05b7c2036cea1281020036b67f8cceeaa247296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677398, "uuid": "28ccd641-cb5f-454e-965f-dd3d1849a798", "comment": "Malware payload (XWorm)", "value": "0b6096f1dc1f87ad051ba31a26a23596b3992de3ea81bc43f397fbcb6f41d785932872088ad9c0bca63de8a1dc4e9974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677398, "uuid": "88f3c931-1e00-4682-b334-74508243c84f", "value": "T19DD24C483BE44327D6FE2FF229B2910102759507D913EF5F5CD885ABAF67B8146013EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677398, "uuid": "b6735cc2-090c-4ca2-a332-7e316d4303ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677398, "uuid": "b5e64d8b-a970-43d7-8b86-ef45bc714586", "value": "384:veAwIGmeffcbWICWv/0ILZGPc20hYACSqRN9PD42uRugtFuBLTIOZw/WVnvn9IkA:lecbl/b32MYAoRN9M2uBFE9REOqhPbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677398, "uuid": "f6f8df1f-e9e4-4bef-b72f-be4f26038290", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677398, "uuid": "2a03709f-77f2-4f58-9a7f-ca264b57e4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677398, "uuid": "66184781-8876-4294-b555-58d55c65f14a", "value": "386f066c417fa04b1d6f94ac81f1be6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c96fd6-80d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699737012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737012, "uuid": "a0e1461d-591e-4636-a25e-b7057c87f517", "comment": "Malware payload (Stealc)", "value": "b49644229596d1ac93da26c5975af054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737012, "uuid": "c8cfa6c4-d3af-44e0-aebc-bc0bfb4ec8ef", "comment": "Malware payload (Stealc)", "value": "9aedb9784dbe89935d665b0aeb35b6673a84200a167d2ebd0f0257c11bafaa3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737012, "uuid": "52a96d23-874c-40ab-8cfc-1bdffa1d81a9", "comment": "Malware payload (Stealc)", "value": "6a7aeb585302a3d17b3edbc3ca01e0e2cfda50aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737012, "uuid": "a42bb29c-7190-4ed0-80e9-f6bf55ecec13", "comment": "Malware payload (Stealc)", "value": "2129e571354db8e3501373ed7335daddd3c6ef5be28cb979eadd85d62b7501c0f563c66d9d4354c120a83a7e9677a42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737012, "uuid": "4c9cd560-74d2-417b-abd6-075905baf835", "value": "T12B652317AEDEC463D9B1633090FA134322367C61DDB4826716E92E6B5D62BC1B93433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737012, "uuid": "f55ff0b0-d7f7-4cb9-8575-7d846239e6f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737012, "uuid": "ff86870b-bbd6-4f54-a378-630e8ebd7c49", "value": "24576:wyIuub5NdnxEs5/elIsHj9GNLXDiAtFZ/tN6vvfNOf037l6s7jSi2weE003R:3Iuu1bemORGZ+4/N6vvjxhPSiZeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699737012, "uuid": "880ff0b1-3c5f-4967-9140-9f32c83d0b71", "value": 1455104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699737012, "uuid": "9d256a4c-a3fd-4dfc-863c-1255f7ffc95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737012, "uuid": "02ba7bf4-a6aa-4fac-bd98-045a592c4f4a", "value": "b49644229596d1ac93da26c5975af054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cedd6c8-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695661, "uuid": "4ab14401-d043-4e55-9fc6-d9064ce51d77", "comment": "Malware payload (Mirai)", "value": "3e903b9186bd5611b55bb2a42dd0b47a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695661, "uuid": "0584ad59-f3da-40d6-b1f5-582875d66c6e", "comment": "Malware payload (Mirai)", "value": "9d1d47ed7a6a36731078461f978077795309ade036e12e13b7c44f6350e03cdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695661, "uuid": "f10e01b1-e74f-462f-9d37-a55dad7bfde7", "comment": "Malware payload (Mirai)", "value": "832683bc8fadd4f31471c662c7d214e9f0379f80", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695661, "uuid": "ef833992-56d3-4062-9f28-10f2881e0581", "comment": "Malware payload (Mirai)", "value": "908177dcc99663cd410f0ab4148a69850014eedbef867e1a0d0319b167618db1ff3d5655db98d4d9616e3ec2350481e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695661, "uuid": "44d17fd7-5b26-4c42-b01e-4745280fb53d", "value": "T1D3E31A56F8819B12D5C311BAFE1E124E37131B78E3DE72029D246F617B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695661, "uuid": "ad8b7d08-8246-4eb9-98c8-078a9d0208de", "value": "3072:L8Rd4UtK6FnXz+EOgPaXfJTXslC1f/5RDqa:IRd4+PnXCEOOaB+4f/5RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695661, "uuid": "43208572-2d02-402f-b555-c9c5e910fcb8", "value": 152380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695661, "uuid": "189e2007-8f64-4de4-9c98-099942a8ba5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695661, "uuid": "e3767d99-3db4-489b-9951-757076e555fa", "value": "skyljne.arm6-20231111-0940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473cbbf0-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1699687867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687867, "uuid": "df6b2e92-dbd4-4e8a-860b-d5c1b80156d0", "comment": "Malware payload (DBatLoader)", "value": "e06bad3a1add436525a06fa827322e11", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687867, "uuid": "a178d328-7016-43e2-937f-2f33565226d6", "comment": "Malware payload (DBatLoader)", "value": "9dbe21429d77afca07940928b39d0e7c9d994ea9d10a651ccd5189d4522be1cf", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687867, "uuid": "e7ebe196-8041-46d1-90c4-41a592d5a4fc", "comment": "Malware payload (DBatLoader)", "value": "6f26bbf7fd78e1898ec52256c517aae89daf047e", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687867, "uuid": "c7eb8cb0-254a-42f4-8107-7fe31939b76d", "comment": "Malware payload (DBatLoader)", "value": "c6a7c6061cd0138a94ee64513c74556eb262854a0cbf1d60da8a8eea3cb92d130cdb620c89a5d1fe370bbbf3beb56d1f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687867, "uuid": "53fead7a-83e0-4b8d-ad21-d2bb1479e063", "value": "T18865E0A6B1A54037D11369B49CCF83B27969BE213B7CA45E26E4097CCFE3749203D267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687867, "uuid": "d740258e-5055-4830-93b1-30bcda18236b", "value": "60f6ac6f53d8290345a6172546c7a045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687867, "uuid": "8a11e270-2ab0-4a5a-a772-f6929d8b1083", "value": "24576:a1gIhzVfFATn5p6hEj9mdvc/R/hntYbVwypYhSJt4ouciFaa/A:a1hVCOdcTntYZwyueGoQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687867, "uuid": "ed2f8865-4dc5-4dd0-8c50-89e00a062a53", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687867, "uuid": "147a54ce-e9ba-4bc8-8675-8fe7654d53ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687867, "uuid": "16d37070-70ef-462a-afd3-424b66c85fe9", "value": "BL-DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6841caf5-80e0-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699741180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699741180, "uuid": "a93cbfb6-4b33-4160-a9dc-fa7654f40cfc", "comment": "Malware payload (IRATA)", "value": "e5efb83c2c4465471159d58fcf187379", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699741180, "uuid": "21e49e03-a80b-48cd-8e32-8e6d7f9464a9", "comment": "Malware payload (IRATA)", "value": "9eb7e998b01bf0beb382de5de41008395cdd6affd1b64253c8f0a9cfd48eca5d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699741180, "uuid": "a8cfea64-55a5-4992-8153-d38c81d7a343", "comment": "Malware payload (IRATA)", "value": "687e120c30b370752c2aff169992a8162d35aa19", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699741180, "uuid": "b8bcf43b-3492-4e62-93fd-e7e64ebf41ed", "comment": "Malware payload (IRATA)", "value": "bb9766268f424b96978077fa433036c3e8006958a30bfc9c1a5cdeec8040c0bb94fa12d0178e499f7c721fc047646b3f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699741180, "uuid": "75fcdc93-b7da-4a65-9eb9-bfa62c4d5d46", "value": "T1D9C52393F27BFC6BD476D1723544233510284E99DD47F78A3A5873A634BBAE88B806D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699741180, "uuid": "30091e64-6536-46c5-bd9f-39471958bd1f", "value": "49152:v8g8mJ/2jrkmNBOh8UyV0l2XO9SkpfnzU2K6HC1P0+PLV3glTzKmoq/rV:v8gvt2cAQVhQXCSkp/42K6iN3zul/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699741180, "uuid": "243ffead-fc1d-4e72-9ab6-374e915175bb", "value": 2736319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699741180, "uuid": "e1f5890b-c331-48bb-9fd3-001b35b30e52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699741180, "uuid": "aa6f4866-4102-48f5-8ef1-586c60729527", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd231734-8065-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699688602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688602, "uuid": "d3c1588e-13b4-496c-8041-ef52c42c5ca0", "comment": "Malware payload (Smoke Loader)", "value": "830736afc7f1332346e80048f5860b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688602, "uuid": "8e04d03d-bc66-40a3-ac1d-49de03331419", "comment": "Malware payload (Smoke Loader)", "value": "a06acba515844903c5d524ea8ac8b1ea0115b1cf5c6516eabb4ecdd51934183f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688602, "uuid": "453175b6-e494-4eac-a673-2fada4c39363", "comment": "Malware payload (Smoke Loader)", "value": "4b64e41ef4e50252339c1f9297da8fad77e76c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688602, "uuid": "f742f915-7611-4fe3-acfb-a69960fdec95", "comment": "Malware payload (Smoke Loader)", "value": "ade668ed960eccb54354ffca6094841a9473286f6f7116362125dde7945501f316278079d70679a3f570061e96d734c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688602, "uuid": "5fa7e340-e122-4851-a5f4-2f18e02b6d75", "value": "T1993523927EE904A6E672773229FB031717393C905D39833B670A996B4CB2E50787173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688602, "uuid": "7e1198c5-871d-411e-90c7-60a2226065e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688602, "uuid": "9e14f869-257a-4dcc-92b4-3c1668bad485", "value": "24576:2yimPLb2d0aeNIsSC+GehJDAkAeRH6KcmVkJN:Fi5te+l/G2dAUHkmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688602, "uuid": "269fe97f-5146-4f9d-bc74-6b081c3756b8", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688602, "uuid": "7d5c2a27-41c1-471b-9023-dc9dbf17152f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688602, "uuid": "1aea10cb-65a4-41dc-a644-02bb9a88c54b", "value": "830736afc7f1332346e80048f5860b65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3646cc0b-802a-11ee-8907-42010a9c0042", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1699662928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662928, "uuid": "da19c4a1-e4f7-4cd6-b2c1-1e2133c99b12", "comment": "Malware payload (Gh0stRAT)", "value": "1806c4e0d90231640bde97c0a01fc0e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662928, "uuid": "7646333b-87a8-4fe8-987d-139dc27b3d1f", "comment": "Malware payload (Gh0stRAT)", "value": "a0ae309e0ed6d5df2c9c6501de66c3f4ff6cfc42def792e9b681bc7e7ea462f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662928, "uuid": "e03fd1f2-ed34-441e-92eb-fb805ad1401b", "comment": "Malware payload (Gh0stRAT)", "value": "4d2c04f4ef49b62260abb33a70da7f0c8772e12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662928, "uuid": "5a71dff3-cadd-4d91-aa95-dceaba73cc70", "comment": "Malware payload (Gh0stRAT)", "value": "7472c6598ce623e46c7c11987b3b75fd1ee55718acd2453a04dc3fda50ed5ac68d28f99b37a2d6c5b80a2ae697b16610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662928, "uuid": "bdf16031-3d0e-4c1f-a8e6-ecc4d52bef56", "value": "T13C34026E284104B7C161D0BA40EEDE021BFA0C2B665BD96EF7E8F94A0C246D4D4B7297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662928, "uuid": "1573d326-5391-416d-a2c8-074983012b84", "value": "08c3cfa15260bca26f874b5bdf8dd146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662928, "uuid": "2f13aff1-c6e3-403c-aa16-81bca04ef322", "value": "3072:j+HDVTtkdiAojheSc5ch491vxqHMkumn0lBE4vvaPc5nm7gynXVpXrlx6umIgqV1:6HR8iAoNbc5+4z4z45nGgyXV/xlmXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699662928, "uuid": "26b3f93b-1cf9-4b6d-bfcb-464676245b39", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699662928, "uuid": "ab6cd141-70a4-4352-bab8-b5aaab31e875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662928, "uuid": "48941c69-48a1-454b-9c3c-e25949dee20d", "value": "1806c4e0d90231640bde97c0a01fc0e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49225b48-808b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699704621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704621, "uuid": "569ce3aa-7e9f-4c71-bf6b-0592b498f5a4", "comment": "Malware payload (RedLineStealer)", "value": "dc97347f71d57123a72481e47ab80ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704621, "uuid": "4cf7d652-1f7d-47d5-aec9-d649f9c9ca4f", "comment": "Malware payload (RedLineStealer)", "value": "a0fc5f62e019f652d408c67b8eb8336963836e3c86a1de511099ee2a9ff2a4f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704621, "uuid": "4a9f04b2-eaa0-4e57-9fb0-42de674843eb", "comment": "Malware payload (RedLineStealer)", "value": "14731b31b68ffc90b31e847886875a53ee95ce32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699704621, "uuid": "433b990d-1dda-4fd2-a515-146c760437e2", "comment": "Malware payload (RedLineStealer)", "value": "7e498eefeb88b32c71f78f79caa89ee112bdc59211a036a020f13eafe936f52305d394f1c6066941a4d476599b41a586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704621, "uuid": "39748eda-8304-45d8-b143-5f4f5f265506", "value": "T1EE652303FDDAA073D5B6577440F70B5B0B3AFC718928935A328726AB4D72AD86835723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704621, "uuid": "af490caf-c81e-42d8-ad2c-3153654aa2ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704621, "uuid": "c1211893-e68a-4153-a6e9-3a998f27dd20", "value": "24576:TylzJcEZ/blTkua1seuIsOymGZbzDHlPA/NGKKu9mLxRblAdOctt7:mjcUbK+etdnGZzd+Ku9m1Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699704621, "uuid": "a5760003-dd81-4249-b082-9fa71dd9c2fd", "value": 1478144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699704621, "uuid": "cf3d4b34-e515-46a0-bde2-a5952eb5e788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699704621, "uuid": "1a496817-8c42-4b92-8a32-00ec58927161", "value": "dc97347f71d57123a72481e47ab80ed9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a0fd4e-80dd-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699739729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739729, "uuid": "143d73bf-206d-429e-9d3b-bc4227f9955d", "comment": "Malware payload (IRATA)", "value": "7590f21da3fd2e6d945244fe572248bf", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739729, "uuid": "87575278-3763-4674-8ce2-10b2b4c48437", "comment": "Malware payload (IRATA)", "value": "a12a912c0c396cfbef3976992886f1cb6d938f643c610c8081c9060a6fe96c01", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739729, "uuid": "300eac45-c8da-4a23-98a3-d4c9ff2ff58e", "comment": "Malware payload (IRATA)", "value": "f4c19141a5f2b2433d93796f6c1d33cfa7b99dae", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739729, "uuid": "20382cf5-adcb-42f2-a29d-3ab48e60b0c4", "comment": "Malware payload (IRATA)", "value": "ddfad2762c260f2b727cd63f48df245bd574557dc4441389e0743c86856be6f3073e5c746c745aa073cf387557f11c19", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739729, "uuid": "1d05e317-c231-4a83-831c-0ab8adf5b861", "value": "T1DCD52357F27668AFC876D0362004133A615B8D28CE46FA5A764833ED75BBDEC8BC12D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739729, "uuid": "f3e265db-7aa8-4631-af9d-73833501898b", "value": "49152:QE7o51WmKOcvSGRZ27RLJuTunUSBD97aY1mWk78KX0Y9Yd5dYfYrSUwrhg5SEGnU:QH51ZdGRZ27xOunUCFjmWnGTCd5dYfEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699739729, "uuid": "0203cdbc-8093-4009-adc7-667ec242da7b", "value": 2756746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699739729, "uuid": "e5d5e187-e21a-4e9f-964b-4ab28b3f7900", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739729, "uuid": "b8ae7835-7c94-4884-ad91-2921b40f9af0", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f41b0cd-8072-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699693867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693867, "uuid": "2029ccb8-ecdb-43ac-a412-fce12f7ab0d4", "comment": "Malware payload", "value": "d497d6f5d3b74379d1ca2e1abde20281", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693867, "uuid": "133887a2-c422-4c29-afe3-742829c3ac1d", "comment": "Malware payload", "value": "a1765648a41eea21fd942776cba9b50705673d8f7564ae7f8c9751eda9e2e564", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693867, "uuid": "af770dee-6b64-4a0c-b06c-a1399ff92a16", "comment": "Malware payload", "value": "937aac5cf9191e833724edda2742ed115a5237c7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699693867, "uuid": "6dc37fa7-13fc-4525-af83-7bc913bc2b09", "comment": "Malware payload", "value": "fbeda805c4ba6f07a8eb0aa5bd98db4498f26145ba5c73d85395a4fcfe31e6733d44197c9c9a46ad9f2328061b7a6d98", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699693867, "uuid": "72c362d7-eb36-40ab-81b2-1b21b1e81e0a", "value": "T1D8152348DACC2433CE9D94BE9CF25039C2B5E367CD82F21779F0826661A26C4955EF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699693867, "uuid": "866f9807-d4c0-456d-a977-cc8419b70407", "value": "24576:rUH6r+HyTd9H1hiy/Ku8UNM1Gr6ycgR6EL13bz:rLVhiy/Ku1N6GW9i33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699693867, "uuid": "6635c260-5b49-42aa-8323-21207adaad1d", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699693867, "uuid": "dc32ab58-76e5-4b40-ad7e-240c3982e3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699693867, "uuid": "5089fc06-8316-401d-90f8-fab2fcfd0fa1", "value": "d497d6f5d3b74379d1ca2e1abde20281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed74b2a-8068-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699689625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689625, "uuid": "91dc229a-09f7-4cb4-a7bc-b4bc81315824", "comment": "Malware payload (LummaStealer)", "value": "ba2c77718bd6b44abb313b86974e99e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689625, "uuid": "1c122ab4-6a9c-4b58-9c75-d168c1d875f8", "comment": "Malware payload (LummaStealer)", "value": "a1d0f879aa5023488075c93718c6bac17d2056269fe3822c901d2b908bc13bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689625, "uuid": "60194ccd-ede2-4d13-aae9-8553dd4f2a8f", "comment": "Malware payload (LummaStealer)", "value": "139e8c4262a2db1a5de407cbf99b380b0e93254e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689625, "uuid": "b49b5972-0fee-4831-9066-1d5cf552fdce", "comment": "Malware payload (LummaStealer)", "value": "6ce186c50d64d6991d44516a89c735d05cf3a05b106cadd4ef785be255a36236ef4921fe5527e6e2cccd921972fb5a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689625, "uuid": "37242c96-9b00-4c17-a381-b3adb8e10a01", "value": "T1EE552342BEE980B3E8F4137410F603570632BD546D7C829B229EE95E4D23AD879B2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689625, "uuid": "615f47f6-0c5e-4c8e-8684-642f84340458", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689625, "uuid": "9ea68704-fc18-4b76-810d-3c374c53da06", "value": "24576:Py5t+MuTMCtJaeyIsOCUGsA1D3uAdru57lpuDGuoo2RnpHNWjOcrlpuThdR:a5tfulkeJRJGfzJdru5ruSuoNRptzTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689625, "uuid": "d4bfc386-c1c6-4fe9-ad5e-1129af93eb84", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689625, "uuid": "6b992f76-68cc-4c57-aed9-98f113c0c976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689625, "uuid": "235264f4-340a-4848-961a-665413922b92", "value": "ba2c77718bd6b44abb313b86974e99e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebc907f-8080-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699700120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700120, "uuid": "f673262d-2c96-4c79-a321-08560eb084cd", "comment": "Malware payload", "value": "c1a9097d7c7ee35e32edada3f14654c5", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700120, "uuid": "ba018a0d-dba1-41ec-83fc-7acec4ad3fb6", "comment": "Malware payload", "value": "a332d9a03fc5f058bbe43920c63a82343f4968584fd3de95247b422658bd2518", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700120, "uuid": "0e3d0fa0-ba82-49ff-ae14-4d6a44c35cb6", "comment": "Malware payload", "value": "51f9d6b23289ef25710ebe5954c7116437f2c779", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700120, "uuid": "92a1d0de-a866-48b7-8384-1cf966738954", "comment": "Malware payload", "value": "955fe502988a35c923cfeb8fe36d5aaa7a5dbfa6b123344edd61fe40a2aed7ce2bdad6ea286977a32a298eff67675d8f", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700120, "uuid": "8a809e1d-0520-4abc-9941-230b68e43d58", "value": "T19661B1932151B8AA414283BF3E5967FB807FC224954AA044F78C5F9CF9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700120, "uuid": "85434776-6d20-4d6b-8afd-d3395f4f1080", "value": "48:Zw+MTLimb7vIO3HuKZ3WvD+CfRJL0HuQO8hFi5QsvuiBrVxqT/svB:FGtfIO3HuS3WvD+CfRJL0HhmAiBrVM0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699700120, "uuid": "6ae6f244-ac07-4632-b86f-e437c5f5e178", "value": 3237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699700120, "uuid": "cd1c8290-86c0-4c2f-ad4b-3a9e3a2f57b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700120, "uuid": "04152daa-b1c5-46f3-b8ca-55281a7f42d3", "value": "d1KsSaK7.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37454f27-8067-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699689129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689129, "uuid": "f99d4760-2af5-4e41-8cb9-4eb2f39bdfcf", "comment": "Malware payload (Smoke Loader)", "value": "99b2f4168e80e2ec97edd578e4fbde1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689129, "uuid": "e495cb57-24a9-4654-b351-c68f925822a8", "comment": "Malware payload (Smoke Loader)", "value": "a5e53f25bad800e86811e11ecd940b83b1f48cf64a00bfae877084a4624101a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689129, "uuid": "bc27a63c-1553-48c5-80bb-15bcd15b1fff", "comment": "Malware payload (Smoke Loader)", "value": "95784ac7e9e7ce82da4eb4bb90940d714566bf14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689129, "uuid": "995292f8-fa95-4970-8f2e-28e82fc91a8e", "comment": "Malware payload (Smoke Loader)", "value": "cbb80bb2816f6ea8fbdaabfe892e6aac262a4c30c14f0cfd9c4c8cd12eca6fd874b0c81f016e19874bdebab746c0cfc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689129, "uuid": "459957c7-208c-41d8-9148-90c0dbec6d43", "value": "T105C41243AADD8073E5B1637064FB02970B39BC619D7C936F3269194B5CB2AE0693173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689129, "uuid": "8d6f6caa-d3ab-40e2-a7cc-c7e27993e0d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689129, "uuid": "c7a432ac-6b1a-4c49-b515-f936d2526cd2", "value": "12288:aMrly90b0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6y8wp:HyCiaaewIsgCQGIgYDcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689129, "uuid": "1cde1ab4-2435-4f76-8d4b-84c42d8425ee", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689129, "uuid": "d158b242-e077-483e-99dd-dbd3e6eeaebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689129, "uuid": "e1c6c4a0-300e-45df-a8fb-7f3cece98f03", "value": "99b2f4168e80e2ec97edd578e4fbde1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d525ff55-8067-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699689394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689394, "uuid": "35a65e06-eb68-483c-85a5-2091e558a768", "comment": "Malware payload", "value": "62fefba299de186ec1c6db0fce69fee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689394, "uuid": "ff44b46e-4983-4b7d-b6c1-8ef4e29593b5", "comment": "Malware payload", "value": "a67fbbab953445f8609e6859844e5ee98f92d8c1d58b9e4fc8fd557798e6dd22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689394, "uuid": "4874980d-6385-4d36-859c-fa03a304d17b", "comment": "Malware payload", "value": "e534caba7f20f33cdcd1d885be43d046c63e2d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689394, "uuid": "9c80b56e-abc1-418b-97d7-81d0a3a3f932", "comment": "Malware payload", "value": "8c873c204d3cc57887d1e57ef2ffe1c0f12114d206ed041af33278960e93815cdc8099f9492e5dd54d062f1e4f8dfaec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689394, "uuid": "954dab7a-a6a7-4f72-b5ea-b375977d8d31", "value": "T1E5A42386F4C1AC61E4D023F8356AF3E8771CAE1E1686971AB7BC2978FB85C9DD1510B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689394, "uuid": "59b5fd95-c14d-448b-9b62-bbf2032468d7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689394, "uuid": "43629584-7210-4a19-9b17-2974ab5ed57a", "value": "6144:PqQ2Hfzhwl1SBg9+4Ep1oX0RPFYSACkNLe8sQfsEWgkh4EOLIiDOmBpTBeLX70ld:ywSBBi2FYS/8EVgk0MDmB3eL7eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689394, "uuid": "7f2a4ada-43b7-4eab-aa16-944eca2936ef", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689394, "uuid": "5e43b36a-f909-45b8-a9cd-9a224069aac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689394, "uuid": "13f99c00-440c-4e82-befc-9e0098857be6", "value": "62fefba299de186ec1c6db0fce69fee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48f348c-8065-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699688587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688587, "uuid": "1dd7b2a4-bb86-4e6e-b96e-f65a41914213", "comment": "Malware payload (Smoke Loader)", "value": "df588489d5aea0c65d48ab70c29b9977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688587, "uuid": "466ce99a-849a-401f-8178-0effb7274cb0", "comment": "Malware payload (Smoke Loader)", "value": "a6d9fe603fd005b5fa8e29eeb04e8b312a8083f58f38ec4367faf1bf6a6ce2dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688587, "uuid": "bc1043a4-cc25-4665-9786-97789e70b530", "comment": "Malware payload (Smoke Loader)", "value": "de1c2fa73ab7349b574453988d8025efd06c5135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688587, "uuid": "dd82b80a-1c71-42ce-b007-cd18394ccad0", "comment": "Malware payload (Smoke Loader)", "value": "f6564d70b6830dcaf8ed2c830ef49bb98c05f772d047b556dec8227765fcf121aa7a5f64990c6ae337a29982f75ebc60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688587, "uuid": "39b0f1cc-c991-4306-aa90-231d8e5621dc", "value": "T131B4026060B9A349F2F68A778DA273C053366033B306D766EE42F201B96DBD7D7C1562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688587, "uuid": "c88ba375-20b9-4b62-9ccd-42dbe1f53517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688587, "uuid": "68f6c445-3801-4416-8a82-9a7f26243a0a", "value": "12288:kj+/FhNZfmJlk7fuHjQ3UdCXmtKFm1LkGYyP4VxtPMw/7vmHD:kYTfmoW6+2WkG1ot7OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688587, "uuid": "d7a942a6-f012-497b-b31a-632a8c924082", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688587, "uuid": "4e6a6268-0590-4662-841b-c8921cb497b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688587, "uuid": "2b4593b2-bca2-4d7a-95b1-e3244a72715e", "value": "df588489d5aea0c65d48ab70c29b9977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08285f8-8065-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688500, "uuid": "b4a7eed9-9944-4138-a202-5c62a483a483", "comment": "Malware payload", "value": "7b36e134d2fdfbad56935b9df7c252c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688500, "uuid": "1edbbea3-2f11-4ddb-a713-fc0489f66d1d", "comment": "Malware payload", "value": "aa5ca10a3772e27f55a3121ae44ace4d7bbb5b2000322e6911f9b3c4324626ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688500, "uuid": "2b9934f3-1835-4bdf-b93e-20d7880410f6", "comment": "Malware payload", "value": "9ddd8b4baaacfd15bb3c753f4f906cbfcbf2a682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688500, "uuid": "f99a620e-bb2c-40e7-a157-b6613fc03ebc", "comment": "Malware payload", "value": "55ec618b2734321c80b43698aed80ed201474722872950b4cb700338536953c8d14c9c4ccc28986167b9cdd80c41a54c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688500, "uuid": "b66dc3ca-efc7-43a3-bf3c-5cdcbce70560", "value": "T19A76338432501FE9FDB2943EE4826E45EA7978AA5750C6C70FE0D7621F2B6B04E3B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688500, "uuid": "fe29db9b-0f56-4bbe-b4d0-1ddb9e9e80f1", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688500, "uuid": "cfea31a5-70d7-4495-9881-5dcae7fd8f8a", "value": "196608:tsdays9cA4YYR0XD50mr2puHUHNTdL2Vmd6+D+nNgwI:pTqYYqXDKmr2pu0tTdL2Vmd6myNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688500, "uuid": "d2113390-a86f-4c9a-97a4-9b5fdf02e200", "value": 7303406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688500, "uuid": "84c0f5bc-3707-4cd3-b5b5-81a7fbbb4a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688500, "uuid": "8ee030b3-e57d-41e6-b2d1-d7516e827be2", "value": "7b36e134d2fdfbad56935b9df7c252c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86b68e9-802f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699665320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665320, "uuid": "32afd4d8-a390-46b9-ae5b-d1ce8622673b", "comment": "Malware payload (LummaStealer)", "value": "f9062de6e6d699ea3a3ae0d534a42d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665320, "uuid": "9d637e5c-f8b4-4c5d-bbac-f13ed0857e48", "comment": "Malware payload (LummaStealer)", "value": "ab16aa326faf4cba0bdcb9879ce176b2214dd08e1f9695e345c781240eef2e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665320, "uuid": "ba6f3916-3eae-40db-9c12-de1065871d83", "comment": "Malware payload (LummaStealer)", "value": "5fadab0e47b5a401b6455006a9edf45d4875c637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699665320, "uuid": "839ad3cd-70a9-4320-8070-c62fe246c1f8", "comment": "Malware payload (LummaStealer)", "value": "a41fb3916d85880e97f639056cb683361c53300d0f50de2f783a8c621d8f726b5a32a730962ce23dfd672ef6bbd9a4b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665320, "uuid": "de6b04ce-9132-4781-b103-101ec4f9b18c", "value": "T17D552397BAD84972E1E513308DF70683063AFCB15A7C836E371A646E18A25E8253177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665320, "uuid": "d1465a38-50f5-454c-b938-ba2a3fac278a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665320, "uuid": "2c5bcaf3-fcb4-43fe-b203-459293255344", "value": "24576:dycHre85QyFaeLIsYCSGgo4Dx8Ju9lKgfJKMF4SFZgFAxO:4YreKMeENfG+SJuDKgXFpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699665320, "uuid": "380d5910-e62e-4845-9362-3e71b345aaa7", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699665320, "uuid": "bae1290e-99c3-42ef-8b3e-9d7c7508d5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699665320, "uuid": "1aa9d2c8-6bfe-424f-9329-01138fa85e24", "value": "f9062de6e6d699ea3a3ae0d534a42d64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a47002-80bd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699726251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726251, "uuid": "5206ea13-6ebc-4a40-a7ec-5b691a338ae9", "comment": "Malware payload (RedLineStealer)", "value": "2f596631ac1c4a778b2e11e4313ab35d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726251, "uuid": "55e9a2a8-02fc-4f28-8465-ae2ec2ad7f38", "comment": "Malware payload (RedLineStealer)", "value": "ab4e09d828cfe24f1be095a0f811b30ef73636bcd5df389963c340a9297ba5f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726251, "uuid": "e42a61a8-fea3-4e16-bb2c-ab82b8f26b01", "comment": "Malware payload (RedLineStealer)", "value": "d9ec72e5995662ee884ad0a2b59fe221f95e9242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699726251, "uuid": "5af15540-e4de-4db6-acd3-66bd46aabc40", "comment": "Malware payload (RedLineStealer)", "value": "314a35613a28ce79ce22d1aa8a4af8ecc30bc92f5b738851d70912613a3f85581ad24fb73a1d35dfc1e4a4b3e07e179c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726251, "uuid": "996a0242-a04c-4eba-bc81-18798dc39049", "value": "T1346523177EC880B1F4F2137258FB0B4B17267D159D38622B2549A49BBDB2AC13931B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726251, "uuid": "4c7e51af-58f7-4d0b-9862-0197230f8e5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726251, "uuid": "4c91e03c-16f9-4683-9b0a-31eed85c4ede", "value": "24576:gyi5sacwJymgVZxL9JfFeVIsn2kGXe5Dp60+A/RsYY7W+2JnWorGc:ni5NcwEmkZN/9eWEhG+d6dA/mx7J2JnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699726251, "uuid": "83e15fc9-b59a-4113-8731-57793597228e", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699726251, "uuid": "c433a329-6750-4e90-87fa-5457e5573751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699726251, "uuid": "430856ba-ed25-47e2-8f53-92fdfb2a4ab9", "value": "2f596631ac1c4a778b2e11e4313ab35d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1281dd9e-8066-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688638, "uuid": "f96e8fb3-0585-4212-aefb-8c9af7db1e46", "comment": "Malware payload", "value": "bead8bdcdfdca5bed296763fbf1bb6aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688638, "uuid": "e9657303-371e-494d-a7ab-eb66ef3ad84c", "comment": "Malware payload", "value": "ac0cb31289c6ac9a630d67a58505ffe5bb4a834dd82e4bcdb1ce0423f313ae72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688638, "uuid": "884eae16-62e1-402b-957f-60c3267483a4", "comment": "Malware payload", "value": "d53f0e8e05cdd83fe385e80dd283d6868a0c5c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688638, "uuid": "3232eccf-471c-45df-be83-2e3faafde70e", "comment": "Malware payload", "value": "0c7614c3c0698c8af803c55e94da8fa66381b615307219373776897cb920fef511a301e17f78c1588b54c881bb2396a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688638, "uuid": "c2e9a9f5-6b25-441f-996b-d0aa24e53ad1", "value": "T1FFF50268CDB5484FD46311F2E9C33651CBD6A2CD868768A5DCFA58333BB0C58319B62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688638, "uuid": "242f28f8-1966-424f-b9af-5d2ef725e97a", "value": "49152:MMcDmMRlBdzs3EThgR0uEqBXLdcJAbtNmbOHaGhEospqOziZXAfrrARS7JL2m:dcdrCET8XeospuZXAf0EJym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688638, "uuid": "fd74aab3-57bd-40bd-a54c-2bd9c2508e41", "value": 3600907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688638, "uuid": "1e5645da-1c93-462f-ae06-a3e20b87d2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688638, "uuid": "a55c73d6-5cad-4cd3-aee4-3b8540b72768", "value": "bead8bdcdfdca5bed296763fbf1bb6aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244173b5-8093-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699707995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707995, "uuid": "8e466e15-40cb-4891-95e7-1d44eec74306", "comment": "Malware payload", "value": "7c3ad8fec33465fed6563bbfabb5b13d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707995, "uuid": "7f05c2d6-8712-4712-8579-d9d6eeba8fd6", "comment": "Malware payload", "value": "ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707995, "uuid": "e74d71c8-a9a4-473b-9b93-dce825c967f5", "comment": "Malware payload", "value": "e5920f3723e62e1850157f09baf556006bf80f74", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699707995, "uuid": "087b2aed-4a6d-48e2-8f81-f31eec2aad4e", "comment": "Malware payload", "value": "923676f9248d311f4f482f6549d04f536af343172de34712599559681b7186c3bb427f2c3e6ea11bd254dc320f801efe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NSOGroup", "colour": "#61E1BF", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707995, "uuid": "2299f2e2-b4cf-455b-b6a9-886d17c453ed", "value": "T10C4423E5CA2E677BD102A3308F06F449960E2305C4A5B630FD96D57A1D528788BFBDCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707995, "uuid": "60087b16-089c-46c8-95b6-f571d8588bc9", "value": "6144:OiJF1SCwcTjQGPihLcfUmu9XuS0nbkDIyTkRJ0P1d41RiFV1iFuU:OqF1VHzqLcfIJ4bqIeP9d4jkKFuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699707995, "uuid": "d4269b48-e68d-47a5-9be4-495f9cba7bfb", "value": 263823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699707995, "uuid": "7bc4f101-2c1e-4d8b-b7bf-fd43e2680985", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699707995, "uuid": "e2d1ef8f-c9c6-4912-be8c-c0c2ad44f6f3", "value": "sample5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0563721b-804b-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699677019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677019, "uuid": "81bb5673-c16a-4dab-89de-ed31d8263fee", "comment": "Malware payload (LummaStealer)", "value": "a70e240d6318d81d5a77a07e5edf9d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677019, "uuid": "dda0c19d-b583-4432-8eed-8182d4d062d0", "comment": "Malware payload (LummaStealer)", "value": "b059c933236a8fb4090e189992f70e925bdee71814c2064642698b41f3c32c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677019, "uuid": "cd1dd410-01fd-45fb-9b7f-286bf48cf55b", "comment": "Malware payload (LummaStealer)", "value": "2280407baf5d363ef6c99448547a0c9c36e51b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699677019, "uuid": "ac73be75-4f1a-40ea-92d6-449713afca01", "comment": "Malware payload (LummaStealer)", "value": "7367266434e6c3a3f61d9a83e85f68bef1124382a7df700f3546db8a3549f447baa101761f9b07c384c643636a36b044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677019, "uuid": "dd8b958e-d806-4e26-af7e-a2208fd0f528", "value": "T1B5552359AEF54072D5B60B7468FB0357037CBC50EE2CF22DB2692A974DE2040AD79B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677019, "uuid": "c9f4cfb3-5003-45a9-a37d-4dec2d48c89e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677019, "uuid": "0113bcfb-e2b9-4438-9af5-ef2bd465d2df", "value": "24576:eyFQ5Rt24FLy89saeFIsgCWGXmIDXSAb2brhAhYdpH4s5D59pp:tFUd1eGFDGLTXkahYdt4s5tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699677019, "uuid": "c6e62f4b-ddc7-4027-8974-b6d99de2133f", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699677019, "uuid": "ed9f45bc-809d-47c2-8073-463d68cda02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699677019, "uuid": "f10fe595-7cf4-4ce6-9be1-e66e7a65bb61", "value": "a70e240d6318d81d5a77a07e5edf9d62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a298f41c-8067-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699689309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689309, "uuid": "41cfa93b-8f19-4b8e-b554-ef0f461b87a6", "comment": "Malware payload", "value": "c303599067a03cb03b2113e57ea3d077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689309, "uuid": "deb8c99c-d2e9-410c-852a-d8910914fc10", "comment": "Malware payload", "value": "b13a42c56d5e32f437619f4331055b58d88da9d7ca85faeb55152ac349f23954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689309, "uuid": "10685f0c-6727-4a51-869e-97ab2e1e0da9", "comment": "Malware payload", "value": "1dd02e8ecb67dc72abe3dbcc872556df2192228e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689309, "uuid": "4bb5f20c-ff53-41b6-9c92-cf0b0b5c5c96", "comment": "Malware payload", "value": "dd7f565faeb7996a4eb17074d93850347a9b4f70d77b8e65ee49b0762ea506ceb6ddaacd89d6ba86e8ffd37ce6d272a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689309, "uuid": "bdf8f0f4-ab55-456b-b62c-a4a5a11c2205", "value": "T18D3523A2BADD4073E8B1233139FA47130B357CA02D7C936B2B59995F8DA25916D32733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689309, "uuid": "428eb4c8-143e-4ddf-89a2-c62de86f5f39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689309, "uuid": "1b59b2a8-eec9-470c-8d5b-932379a6312b", "value": "24576:/yOC+oJwmoqk6rfaehIsnCGMGYN5DM7xzj3g4UMqGb3Yn:KOC+pm55Cea8qGCeuMFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689309, "uuid": "d004d828-d943-44ef-ab17-bcfb50f562f5", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689309, "uuid": "d2442358-0ba0-4747-8ee2-07ab06b16f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689309, "uuid": "6a4daf03-6672-4ba6-bacf-0b4c00a5b4f5", "value": "c303599067a03cb03b2113e57ea3d077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a910baa-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695630, "uuid": "d3d3a765-1c07-48a5-9fb3-6811a4703e3c", "comment": "Malware payload (Mirai)", "value": "be5044d8080866cbad40fed32fe106a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695630, "uuid": "105dd90c-bb0b-43e4-8679-50005abf7ea3", "comment": "Malware payload (Mirai)", "value": "b5b0027c3f01dc5c0ca9c0de2553a89c2a724e975a3b7268a96d3128f78f829c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695630, "uuid": "874c9adf-32db-41bb-8d0f-818d67c593a0", "comment": "Malware payload (Mirai)", "value": "8e21baf9d05d72e66da8ab053e99433f83572f38", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695630, "uuid": "6ad100f0-b4f2-43e8-b8b4-75c266b789dc", "comment": "Malware payload (Mirai)", "value": "0b42787b2fc2171e8aa8f8fdeff3ddd6a20d435c55c9cbc45046ac8c30541d28e2dc77d3141ded7331a82b18b0a48ea1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695630, "uuid": "b6311144-e0e4-4154-88c8-2d72dac8de6e", "value": "T108A35BC0F283D4F2DC4709B11176EB379733E0B9251AFA52C369A931EC92551EA1BB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695630, "uuid": "3d9d69f4-214d-40e5-ac5f-78dcb64402b2", "value": "3072:+Gm6qMon9PNgZF8H/SvpjwTtsS2Wrndrw:+7Td9PNxjKmrdrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695630, "uuid": "16124acf-be0f-420a-a1c7-46946ed863b0", "value": 98664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695630, "uuid": "49dfd323-5ccf-4f4f-ad51-92953ad2ad2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695630, "uuid": "8ff8c58f-71b6-46ab-b770-a95680ee83f3", "value": "skyljne.x86-20231111-0940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717600bc-80d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699737330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737330, "uuid": "5cb827a4-32f2-486c-9c86-6c1a28e1fd71", "comment": "Malware payload", "value": "a82431a6deb03b5ea8c38b5b502caed6", "object_relation": "md5", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737330, "uuid": "32101066-1497-4dbc-a67b-7229129c33c3", "comment": "Malware payload", "value": "b5b5157ad44141d5c6d8ecbfb66418d120101aa86a7863ec779ada8155a0a068", "object_relation": "sha256", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737330, "uuid": "aadf5ec8-f549-4a28-a12c-e4e6ae42e012", "comment": "Malware payload", "value": "d0368364dc6058b021244f442fcd03cd643ce88e", "object_relation": "sha1", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699737330, "uuid": "649a79ce-c8f6-4109-9fba-719d46f75b50", "comment": "Malware payload", "value": "b7db1b5e203bc7c8a5e09c57db35c9d0f469cbe2ff9f5ba633d21f1ae9ff83d1e57bc1ab0242888d9d042536277111b5", "object_relation": "sha3-384", "Tag": [ { "name": "crack", "colour": "#258B19", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737330, "uuid": "75eac809-1ace-4dd0-897d-8954e5ab29ff", "value": "T12DE2F806EEEA866CE72903784876470F9836BD126E37734B835070AA1F7DF853945B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737330, "uuid": "83be67d6-9d99-47f7-b1fc-3fab84f552a3", "value": "0397fa02b6aa50d9ec2e482195e933e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737330, "uuid": "1a639e60-ef9d-4c60-addf-6fd07ff57794", "value": "192:hj3YSXgoPBj4yk7LeRoDvIBFy8nTC/vT55tfqXU/Naj3a2swvoj9TSPzg1ls5Yn7:VYIgoPhwLqoDw/qvTGpq+vohTSut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699737330, "uuid": "58461402-f54e-4076-b2dd-58e92018d5ad", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699737330, "uuid": "23ebd1b8-6db7-4038-9860-6e2cc23d7c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699737330, "uuid": "a66fc011-1f68-440f-a355-1fc484fcc86c", "value": "BurpSuite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf138e6-8028-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699662026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662026, "uuid": "bd1b6dbc-b407-47bc-9894-e9c70265779c", "comment": "Malware payload (RedLineStealer)", "value": "c5b1754a5a0a883c4a9f15c3abdac46a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662026, "uuid": "1c9ee399-c022-4ff6-9770-aa55abaf914b", "comment": "Malware payload (RedLineStealer)", "value": "b5b6dfb221365b25f9343b8b1f7d5779eaa1cb489a15508852d5f9227a6a91de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662026, "uuid": "5cc1dfff-022c-4a50-9fb2-8c299d6c9023", "comment": "Malware payload (RedLineStealer)", "value": "644d28d5fe0c4f90b6e266c26114ccf6a83704c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699662026, "uuid": "abec4397-dcf0-461c-80af-e73af8c4b8cf", "comment": "Malware payload (RedLineStealer)", "value": "fade37b7f8842362d3c533ad9b1cb2a082e1c8796c247dcc805d91759491a483fe3423a361d536557ed82bfbeec542a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662026, "uuid": "02dbea1c-1a39-4aa3-afb7-456db0524217", "value": "T101352356AEED4073E87613725DF302A317357C909E3C826B2651789E0972EC9BAB1337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662026, "uuid": "fd418bb7-56ee-4db1-bb33-36e77a18c014", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662026, "uuid": "5789d578-2c4b-4661-b85b-6ac20a41084a", "value": "24576:hyAqcU9+cxq3aeBIsKCyGO4SDPnIpjFDhkj4HgF:UakLe6z9Gq0pBVkjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699662026, "uuid": "e18ff377-3600-4133-a231-f45d2cada968", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699662026, "uuid": "cc5c566b-2790-4f40-934b-aa95f70d7184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699662026, "uuid": "eece3048-3dc8-4299-a471-f9ccf3c2ed39", "value": "c5b1754a5a0a883c4a9f15c3abdac46a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162b20eb-805b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699683919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699683919, "uuid": "24630c96-b9d9-40cf-99a2-dd6d4bb9ca98", "comment": "Malware payload (RedLineStealer)", "value": "dd4cccedd56718598764a96494e85a9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699683919, "uuid": "b02880ec-c91a-46bd-a2dc-d17d0782ebff", "comment": "Malware payload (RedLineStealer)", "value": "b6185d4f3621b9c2db9498a6ff4d18367efd3589fd49ec5d2a92c2814c4d7c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699683919, "uuid": "1b73f843-9219-4903-92fd-32e441309a39", "comment": "Malware payload (RedLineStealer)", "value": "4290c5bfbc161d8a6df9cab017ca52d7f49bd511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699683919, "uuid": "9ab63b1d-7b85-44ba-bc7d-a4519bdbe4ed", "comment": "Malware payload (RedLineStealer)", "value": "d27d585afe65004e8dc92efbcf41d9763caf0ff4db7643c171004e9726ff1f9a3083f987c5bdbc12f557270e8d38548e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699683919, "uuid": "2a8c17aa-93df-49fc-8694-203853b087d4", "value": "T127552392DDF8C0B7FC35A77064FA069B0A3ABC50456C132A3729684E5C73AE5787136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699683919, "uuid": "73fad06a-cf42-4177-89c1-883afeaf8f7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699683919, "uuid": "9608eb2a-b15c-400d-8918-0dfa0261fa9f", "value": "24576:qyW2rfo2K4lVI4nzaeRIsnCGGmw/DIz69p/qgiY8DXXYEMC4yHLHCLUkNsTcodHE:xxLxbJGeKsBGbMYgBZDnYEJrHCLUS8Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699683919, "uuid": "65eae3c6-4937-4b6f-97d9-95009e84aba3", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699683919, "uuid": "775ed899-439b-4dfa-811b-7e0a6f5c1315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699683919, "uuid": "a9c001e1-0b65-446c-acb5-2af6515afe92", "value": "dd4cccedd56718598764a96494e85a9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35941374-8067-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699689126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689126, "uuid": "aef5b2d6-9713-44a6-b390-efb5d216e7ee", "comment": "Malware payload (RedLineStealer)", "value": "5a801a22095ea6a14cd8dc7119fc1af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689126, "uuid": "b3c71d9f-a8a4-4c47-9681-15723f2f1bd6", "comment": "Malware payload (RedLineStealer)", "value": "b7a0cc135b3c4c0784b42fa3dd5844d73afb2e5a2ae3f7c6778ebb0097a57f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689126, "uuid": "76c40473-ad63-49f1-be0b-5a7fb9bb95f1", "comment": "Malware payload (RedLineStealer)", "value": "9e4b50104337e52f67b4cfde3b974e0071a35183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689126, "uuid": "6e0faa95-f1e8-4dae-a476-c37658d5b6b5", "comment": "Malware payload (RedLineStealer)", "value": "1bc0330e02f70b8394d8c859b610fae1a7801c04e3c6a5bb4924e1b5b42f11b7a534c434d016c7d1b5cd25b5f67093a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689126, "uuid": "07300348-9705-469e-bf42-2a6f1df287a5", "value": "T11A5523829ED4A033EDBA4B384CFF149726397C74A9B8836D335A745A9DA31C1A431377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689126, "uuid": "e5f1217b-d21c-49e5-8ec9-3277838bebc7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689126, "uuid": "5a23e752-58da-47b4-8457-f03fe3e22605", "value": "24576:ryXXYwMuiESqsAEkuaeXIsGCjGNKyD/PXTHhjRaLaimNHbosU6MvQg4CO:encEdsA3e4hoGjrXVjRfN9MvB4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689126, "uuid": "b937b822-bc6b-4cfd-939a-b051cbacf98e", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689126, "uuid": "2e989244-44f4-40e0-97af-2bb92ee09446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689126, "uuid": "db4009b8-e112-4159-9129-f43067e27cbe", "value": "5a801a22095ea6a14cd8dc7119fc1af1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e37e108-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699688630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688630, "uuid": "94465dec-14bb-4900-8a6a-5d628e1f14b9", "comment": "Malware payload (RedLineStealer)", "value": "b72309222be81139937a5808c453346f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688630, "uuid": "075bfa35-9015-4141-b5de-fe1b06672b18", "comment": "Malware payload (RedLineStealer)", "value": "b7feb3870acabfdcf3bca70bd2036b94862ce27f4f4ed71ba78e83dfd7b1db98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688630, "uuid": "e702428e-7ef7-4381-9320-e6725b6f8767", "comment": "Malware payload (RedLineStealer)", "value": "413b3b73df8186744f7d3e81d21dfbc016c01cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688630, "uuid": "7151b7b7-f6e3-4544-a8d9-54a15eadd17c", "comment": "Malware payload (RedLineStealer)", "value": "37eb02d39a8d6471444a0ae1496a7fc427afb6864dcef9963b2903bbbe6cbf4af13c2a91264cdf86df8fbeb95b38c8ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688630, "uuid": "539fa85c-d7a6-436c-ae1f-e16b70c53d1e", "value": "T1CB152312BFD50033D5F52B7558FF0A831A367C626939632E3619B95BACB29D0683036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688630, "uuid": "e79f8d8a-c7aa-45ce-9025-d7848ef31b75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688630, "uuid": "7e0e9211-fc8e-4683-80a1-97740fe5f865", "value": "24576:qy+kWaeuIsmC/GTLYDr8ym44058Du+en0:xJet3EGY2C+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688630, "uuid": "b7373373-436d-493e-b503-2d7347674520", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688630, "uuid": "0cbf97af-010b-4a5f-ab1d-c18c82f537d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688630, "uuid": "b4473d6d-635d-4d8c-8a71-e8876665e639", "value": "b72309222be81139937a5808c453346f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85c5509-8067-11ee-8907-42010a9c0042", "comment": "Malware payload (Adwind)", "timestamp": 1699689318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689318, "uuid": "f86de44a-d3d4-4aa8-96b6-5c8a7d92cc0f", "comment": "Malware payload (Adwind)", "value": "2348d8022547af23c5f1c68935d57e94", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689318, "uuid": "580bda1d-67e1-4686-afdd-2477f6611a1e", "comment": "Malware payload (Adwind)", "value": "ba200b226cc99c3a550f86b45503aea7a2803546aeb763fac3aa73b6ada3a54a", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689318, "uuid": "4d11d7fd-0149-4bfd-bc7c-66da4e619732", "comment": "Malware payload (Adwind)", "value": "dab6d6695718ce76b893ad139c2ec9188fcf4e7e", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689318, "uuid": "916ef044-0d23-4882-a76e-3373d872b0df", "comment": "Malware payload (Adwind)", "value": "7dba3d832c8910918f1d2e18bd5e09b5d298979826c1e958dc4dd11a52c7fed673c432d32448bb91bdcced56e9102f11", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689318, "uuid": "56dc28fb-a240-45a9-b7cb-ab6ea1ef9425", "value": "T186F313A3A295BCA1D9EFEBB40112B0157F7C5C5C9CB8C65EABF0F6E5B8208904F125D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689318, "uuid": "8e2922e8-76eb-4396-8a54-d85109d69ee9", "value": "3072:iRCORRePTXIAjoIua1c5bXwELDxzxzmpg1jFaQo0jv0PpIMMI64491SzXZ:4C6ecIoIuawXweqpg1jFasv0Pe1mXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689318, "uuid": "5ce9f667-067e-417b-97ba-6cec48fbaebf", "value": 170275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689318, "uuid": "da005a0c-c2d3-453a-8a02-7cc7c389ea38", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689318, "uuid": "9de3bbab-61dc-464b-83f0-fc40bd1c8f06", "value": "2348d8022547af23c5f1c68935d57e94.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad0b462-8077-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699696221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696221, "uuid": "dde366ec-05ad-4ade-87bf-cf8003b14d17", "comment": "Malware payload (RedLineStealer)", "value": "2a514d14cf0c18516696437e608ab3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696221, "uuid": "096fe863-b7ab-4d00-b8e8-f8eaeb2a6653", "comment": "Malware payload (RedLineStealer)", "value": "bf747d7d7e3824b80a05d2988b5163729fb1b8c280f4ea5e2d638ab421f5c9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696221, "uuid": "a60e59a6-336b-4fc3-9011-2da2d093ac02", "comment": "Malware payload (RedLineStealer)", "value": "a34ec24a6d945fe033ec69c87a7a0d8ef555111f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699696221, "uuid": "431168ca-fa9c-4d4e-bb0f-e99027b2a70d", "comment": "Malware payload (RedLineStealer)", "value": "958b1356db163f479219fe98e2d8432171172e6edf179dd5a43cb382c67c67c52c53275b97b9a42b0bcc7917e57276a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696221, "uuid": "9fd19ac3-599a-4539-ada3-cd16a571a174", "value": "T1B5652357ABE690B7E4721334A4F707531A3A3C906D7C931B325A9ECE1C72A91A578333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696221, "uuid": "65e91674-ae5f-4503-be3d-001b9e765fe5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696221, "uuid": "bf3efc54-bb3f-48ca-aa00-a009c8d42b97", "value": "24576:Py6v4ezUX4srOGOezIsNJYGMqkD7GlOKz6aq2otaUxN+EK8HH:a6HzUXADecGaGgfGlvzOn/K8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699696221, "uuid": "4d7fca0f-ce08-45b3-8b6d-c7c5250df837", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699696221, "uuid": "ab7c3912-b6e2-40d4-a88a-ce83db89bd1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699696221, "uuid": "13f28687-148b-4dc0-8325-5a598e199c22", "value": "2a514d14cf0c18516696437e608ab3e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0652feed-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699688617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688617, "uuid": "5c096c1b-d433-4911-b270-194d34dc87a3", "comment": "Malware payload (RedLineStealer)", "value": "d738f74cd537c3758524c31a16fbc239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688617, "uuid": "25b43987-f97e-464c-b5dd-c469ec376a07", "comment": "Malware payload (RedLineStealer)", "value": "c06acebb9764a806c9094a4efc1f811d5041ffe29e92378cccc32b73cb69d101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688617, "uuid": "04b4f2e9-3106-4c9c-abb7-f1c541994700", "comment": "Malware payload (RedLineStealer)", "value": "971e9ab191e43dee2090ea5ccb0934103fed15ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688617, "uuid": "25d2c2c8-8177-4b69-93d1-3eba12c6e159", "comment": "Malware payload (RedLineStealer)", "value": "bead67d6ce50f803cda05ceb64f0db38e51981e9d257fd91d3d5f21eff31dbe7ec9b4c5c1e4646a83731d9d8ac00563b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688617, "uuid": "40ec789c-97c2-413c-85bf-c30e512e02e0", "value": "T1B81523926EDC8072D4BB637008FB06870AB53D945D7893AF354D598F98A2EE4683137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688617, "uuid": "fcacce33-bf6b-46a8-a4d9-c6c59877cae6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688617, "uuid": "6385f53d-28fb-43b1-8f8f-4cff16b01340", "value": "12288:PMrPy90QFaKIK9Zczaex4IC5CpCPHGH9PLvTMXiYQPD0vISBWLEQqaQ+Iv3H/nCF:AyHFcoIaeuIs+C/G5LYD3QLEQJa3/Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688617, "uuid": "28e919de-96c7-4c8e-a45f-b2c260f8891a", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688617, "uuid": "e5c8e714-60ce-4f02-bc4e-2aa7df1644b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688617, "uuid": "9f89b11d-bd9a-4ac9-85f0-c8bfb6ba5668", "value": "d738f74cd537c3758524c31a16fbc239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6455fd-8067-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699689134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689134, "uuid": "2388fceb-1428-4e89-8a2f-1ea9eeaf15e5", "comment": "Malware payload", "value": "b91adf0b38862b1ad9dfd6239ccecb8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689134, "uuid": "855c500c-aa0c-43bd-9b59-28ed8b5f6587", "comment": "Malware payload", "value": "c1d0717159e6f4f3c32b4853ba1ec4cba76a128d95d65ea2a49932ad801818a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689134, "uuid": "7d987e6f-5374-4b85-9cae-0afe513788ef", "comment": "Malware payload", "value": "f1fab91d3cb5b6b4a45e8a88d277059f1bfaddb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699689134, "uuid": "05aab018-12e3-4b3e-84f6-78ec77c9a615", "comment": "Malware payload", "value": "df9d351feae3c13164a82a9ba702a04b93caff5280581eb95bd3931934110f4cfe6c811ed8a30e34c54f41ab9d30fbb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689134, "uuid": "1c4bf133-6f99-45ce-adf4-190f1e1646c2", "value": "T171F533DF783C089FAAB45ACA014FAC2DFD5133BD7C1A3D356870605682244E5FA74A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689134, "uuid": "f88401a1-a5b9-48d2-9393-c729f07e6b5d", "value": "98304:fVHtTKu7hiVzlYtbdmkrfKiu6vFAtgslX1:fJxEVzQgkrfVuTtgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699689134, "uuid": "864596d8-1166-409f-bab1-f834bcbc59c8", "value": 3388051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699689134, "uuid": "a5f126a6-2576-4531-9e8e-387a6fba3172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699689134, "uuid": "7f38fed8-c3cd-43c6-918d-934179bc34b3", "value": "b91adf0b38862b1ad9dfd6239ccecb8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49653ddc-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688730, "uuid": "a3cac0bc-d7ec-4e5b-b1f4-5d1c6da93ea6", "comment": "Malware payload (Gafgyt)", "value": "ebd72d9d8cecf83fde3302c66032b37a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688730, "uuid": "2709eda1-c7d0-437b-9e01-7a12fcd34253", "comment": "Malware payload (Gafgyt)", "value": "c3e8b6c8037e87aa945616d39131b6850a857a1986c048303a5532421813433f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688730, "uuid": "68c7fb6c-7989-4555-a300-54ffb8cbb98d", "comment": "Malware payload (Gafgyt)", "value": "fe40413929244ccc9832b58d3e8b5341d953ecd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688730, "uuid": "9a9d41b5-d18b-471b-b136-4fa839c62c4e", "comment": "Malware payload (Gafgyt)", "value": "7843eb13fd2017f945262965d7c87670131bc380e1e1d51cd045d5b865b30b36e3835ce8c6d843db5d7aa8cbf50396a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688730, "uuid": "a2c6289c-c528-464e-b936-3a983bd835fe", "value": "T17803F1A052A568F3D6F11874A8FC87E803334930F70AB16F2958569CA7C24BA5FF5947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688730, "uuid": "462b1f48-efc9-4743-8b8d-baa1bf149d2d", "value": "768:nfBV/FGB5gA5u+xRkbJ1F0xUhggd4rRu9EpdS3eQDUO5L3Uk443j7K2HmSQ9o:5V/FAgRg0J1FhqgeOE23t95jn73FQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688730, "uuid": "10c9ca38-72be-4ad4-822f-26cc1313ad08", "value": 40696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688730, "uuid": "1cb9f113-7c4d-437f-b643-26f80f6cf609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688730, "uuid": "958bf71f-1971-461b-8bd2-bf3f1e626462", "value": "ebd72d9d8cecf83fde3302c66032b37a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b659e6-8094-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699708606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708606, "uuid": "bdb2d57e-e1e9-4809-bb5d-53b36d50dd95", "comment": "Malware payload", "value": "b903caa1aaf33c272fc1649f89201867", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708606, "uuid": "ea5eb56a-e6fb-4df9-92a0-275b35ee843e", "comment": "Malware payload", "value": "c4baab2afd22f4e6cd603b167f18e305f1fdf4c579a666f3d50ec2cac2633db7", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708606, "uuid": "760e8fa2-5165-4c7d-8ad6-07522930453f", "comment": "Malware payload", "value": "be18a3396eb836cc825c0c2647fed697b77fa5e4", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708606, "uuid": "50124373-32c7-4ef2-aa5b-a836b03efed3", "comment": "Malware payload", "value": "8ed9e01d5655848d780291ba74016dc7e78aefca4b310b60c327150ffbea6b1c9d0d549c86c93234c7db0c731d2b5cd8", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708606, "uuid": "70915a08-e08c-4b11-9313-6c2575fa7d4e", "value": "T19FE5BE05A692CE27E3E45B7EA163512A9330D6233716BB8F0F7C95793C923B80D523D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708606, "uuid": "7e2d2784-3d94-430a-9641-76f148a5f4e6", "value": "49152:H/Jfx3Y5UFeKvNCJ9Uz0w1LYTa8P7Of82LUS+MtDf:39wKv0a1LmP7OU2skf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699708606, "uuid": "ac661143-413b-4f86-bac3-361929cdbc3e", "value": 3111045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699708606, "uuid": "29843b19-5df2-4a00-9670-1880ef2e95e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708606, "uuid": "616cb098-1467-404b-bfcd-f69da30dc5be", "value": "16997086043289a9f6755419ff726a781336c79aad48bab220e4c860831b444f024cadb984917.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42f7dd5-8048-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699676131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699676131, "uuid": "e265a658-e467-4818-aa66-0625abcef7f6", "comment": "Malware payload (LummaStealer)", "value": "668531c40d9c51db8cb5f9a2c34ca9c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699676131, "uuid": "94148c05-5104-473b-8a99-0c595a047b54", "comment": "Malware payload (LummaStealer)", "value": "c5741c73980f3fabdd7b17f58950567af6afb790f02f7ce9f16b9cc97df09146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699676131, "uuid": "e77f4ad5-4cf6-477f-a074-d6bd6d503f4e", "comment": "Malware payload (LummaStealer)", "value": "3b02d9d0ddefcb09f67745c0c494204f3faaec9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699676131, "uuid": "3ad7ce11-207d-460d-8e71-e952316d193f", "comment": "Malware payload (LummaStealer)", "value": "111ac1488543bd56c178d45f908a6716d1b2c863025ad6fb87435d248a3db8c72a01552adadca5cf74a7fc0cf64408ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699676131, "uuid": "08d06c6e-9cef-47a9-b789-15b603405717", "value": "T17A55335275DE416BC4B12BB29CFB03431938BC129E2CC7AE3249561B9872EC925753BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699676131, "uuid": "911f32b0-764f-4ee2-a8fa-70eda03b2edc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699676131, "uuid": "85221f11-8563-4358-b3e2-3905b8446d7a", "value": "24576:3yfDXhzATaeGIsFCjGrAuDxMmE8tPv5kHsmW4tGQDNBniyekf2+USA/S:C72me1mYGbx3l5kH/G8hi6wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699676131, "uuid": "80dec005-5f69-4291-b43f-5c7c6ce30a3f", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699676131, "uuid": "bba5a2b8-393f-49ce-bffd-53cea58660eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699676131, "uuid": "152c04d9-7ba7-4ba4-ad8b-f5542a508230", "value": "668531c40d9c51db8cb5f9a2c34ca9c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33fd2dc-8082-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699700987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700987, "uuid": "11923e08-da55-40d1-8286-64bfaad71eba", "comment": "Malware payload", "value": "c7daf4537e61a559a3aee8a3cb558b5e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700987, "uuid": "17ed72e9-6daa-43d2-af86-9f2ee5928b51", "comment": "Malware payload", "value": "c58751df2384d3667a1176c893888b976c2e2f97f3e702ecb322dbc31461aaa4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700987, "uuid": "091181d2-e133-4742-ad7d-aeba619e527e", "comment": "Malware payload", "value": "aef1ba8bd48997a1bcb729a4971f352dda2d847d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699700987, "uuid": "20ff0b8c-84d5-4db6-b86c-025c22e9e910", "comment": "Malware payload", "value": "ae2c38c9d0e281ba043f4af3621fb7f8ccf2f0cec6bd37ecc412cf9ff6d6ca1a3c54c7b7c30de403e823dd743b53efde", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700987, "uuid": "349f14e8-1aaa-4cd8-8718-98415c40a436", "value": "T1CBF58C21B287C036D5AF0172693CEEAE55397E634B7100DB7BE43ABE48B48C16635F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700987, "uuid": "90469801-993f-47d1-9443-6aeb322ae143", "value": "49152:ki2ZcnppGDT9RLuQIK751hM0S8kEP5nr1M34SHc4W5J14s8d:ki2WijLugkx34SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699700987, "uuid": "484671f7-c2ff-4509-bad1-b8bce330c60a", "value": 3456512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699700987, "uuid": "572c3635-6bc2-4dff-8193-3a1fc57ed067", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699700987, "uuid": "06a22dca-29d3-4155-bcfe-efa6086ded29", "value": "cheatlab.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50189ebb-803d-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1699671132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699671132, "uuid": "f3475e40-21e4-4bb1-b28e-11fe1317c9ae", "comment": "Malware payload (CoinMiner)", "value": "202bac6533237a8985a1b9df5dac9e59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699671132, "uuid": "3f919de3-a47f-4590-97f2-8fba1ec1bf6d", "comment": "Malware payload (CoinMiner)", "value": "c6176fa396f754207c5caf2c6ed26b55312b17720e889055cde7d90ae84cf40d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699671132, "uuid": "335cf434-9849-49f3-94fa-548e032add1c", "comment": "Malware payload (CoinMiner)", "value": "05efda4fef1a771dcc06bb6ee21a71d3082c54e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699671132, "uuid": "d1a1ee6c-5de9-48a4-b6cc-96d0e7131703", "comment": "Malware payload (CoinMiner)", "value": "2935c231806397bfd3d422b6d4ac614f1faa8fe64a87ee3c30eebb33a293b8f303b4abd30b61ac01435db5a54389992e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699671132, "uuid": "1bc939fc-3242-4cf0-95c0-71b9b0f0ca1c", "value": "T1D1C5330A3FB449BCC7562472AED6138A8AF1FF4117144BEBEB481F454638BD5783E24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699671132, "uuid": "20ed2485-ed9b-4251-87ad-2ec20c7bd38b", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699671132, "uuid": "7847106f-98ab-4282-9895-3366fa249a8a", "value": "49152:jj53lyUHRE2RVesQbp1MPihYygt9VpxYTtC9ba3F31T:jj53L2IPih6HYTtMba1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699671132, "uuid": "bfaa0902-c737-4917-94bb-c2a1e5c5e3a0", "value": 2604993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699671132, "uuid": "ff45be91-2f1d-459f-b80d-b7acf5ab5477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699671132, "uuid": "64d20ec5-9d6b-4adc-99e3-edf3d12c61a3", "value": "202bac6533237a8985a1b9df5dac9e59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82be96d-80df-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699740911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740911, "uuid": "3ef9eb2e-52fd-49ff-8779-82516fa9bd91", "comment": "Malware payload (LummaStealer)", "value": "104805ea3bee18a5bab343df31c9bbf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740911, "uuid": "88b01f33-3010-442a-9466-d467728fcbde", "comment": "Malware payload (LummaStealer)", "value": "c63b05000ef49df5d1c8c9d20398b0f12272a9b2442815ef2944f8a30738d1e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740911, "uuid": "8f037861-4383-41dc-8810-ac9227061984", "comment": "Malware payload (LummaStealer)", "value": "2f72e4b8062b208f8822bd88ca03de4aa7e54f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740911, "uuid": "c4aee66b-e8cc-4189-bf22-873220d47920", "comment": "Malware payload (LummaStealer)", "value": "cdb481f4afcbb51f5e4105cdb5e66eae2551d9ef1776078bb64006c4c98d98fb3aa9c53db2f1e021aacbbade83a79413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740911, "uuid": "d8e6150e-99db-45c9-a4db-2f54fa11eb27", "value": "T1E2652367AACD5473E9B43B79ACFB436B09343CA05C2CD3276325999E28639E49430773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740911, "uuid": "5a350709-c364-4f6d-8c7a-7ea5f3d9a699", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740911, "uuid": "c3c45fc7-c6b2-4b99-9da4-0efad4ec5af9", "value": "24576:Dypjwxk9qG3KXoBDmqhJu0OMerIs8cHGJQzDJsN4K5ODBfvp7hTxv6mugrvxc11n:Wpjwu9qMKXoBDmMZek3WGaFsN4l1vp7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699740911, "uuid": "7ee77c6c-e340-41a0-837b-818e2e15050c", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699740911, "uuid": "7ecf9be3-27c4-4f3d-b68c-724abbbca686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740911, "uuid": "5da3a6d0-3bf6-4ffa-92e1-b07c970227b0", "value": "104805ea3bee18a5bab343df31c9bbf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c98436-80d3-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699735532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735532, "uuid": "893feaf9-b964-4217-8ed0-7712657a3d9d", "comment": "Malware payload (Stealc)", "value": "fda4ae6f7bf278dca4c33b108cbe9517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735532, "uuid": "1de3c28a-de2b-4d87-803d-bbfd072d9672", "comment": "Malware payload (Stealc)", "value": "c646664de8fc9fee5af83d716642be363f0965fa3d95958b433719bd3e73a778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735532, "uuid": "36c93d54-e78a-4cae-afef-307503abf9b2", "comment": "Malware payload (Stealc)", "value": "26940ac3d0e50b62622a9393cbb80eefedadaf1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699735532, "uuid": "5fc857dc-8d82-4e4e-a4c5-95565c593a40", "comment": "Malware payload (Stealc)", "value": "0c32d5d47ccfef345bcd20e79ce258c4b1430e333ba224a01eb83d05caa68b41a0e3b3c0933fd6a3fc0713b5dfcecbbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735532, "uuid": "a1c7f2be-9b01-4128-b49e-d1afd0e7a49a", "value": "T126D6F111B2D2EA4EF292BA2C93F667579276F30193E7F03CD6607614017A1B8D336297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735532, "uuid": "4e4f63d0-bac4-45f7-afe0-2849e5dd8c85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735532, "uuid": "fee50127-bf7d-4037-a86c-498cfb18b6be", "value": "196608:yrmkTQoH4bFbS6x5qtgguBFXpxobpk+1YSn+nOsphb+Yh3nh2oEc36cjRD:o96bS66XubXpebu+2Sn+Lj+W3nnEc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699735532, "uuid": "bb9ab361-fe7d-4d33-b42d-7017eac26ad2", "value": 13196288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699735532, "uuid": "4a3834c2-d169-470f-927a-34aa8f609756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699735532, "uuid": "21275ba7-9a30-49c7-a14f-ce77f01034ec", "value": "fda4ae6f7bf278dca4c33b108cbe9517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4739b06-8087-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699703056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703056, "uuid": "f80b9a74-1da1-499e-9a42-59654252a2ed", "comment": "Malware payload", "value": "42ff7ae20eef96b9af5cf7f5c1b0f63b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703056, "uuid": "7dfe2ad6-7af6-4f17-a009-c46a6b06d170", "comment": "Malware payload", "value": "c6f6c979b6d5585d5899670e2e9ffb060edc3fecad810e96c27e97131eca20e9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703056, "uuid": "60173344-83ab-4990-bce2-d96c6957d63f", "comment": "Malware payload", "value": "2eaf156e9f7710e5cd32a29aca31cba72a03558e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699703056, "uuid": "3830a194-90c2-4f75-abdf-68eac2cf230f", "comment": "Malware payload", "value": "c7214358bd675f5f76de129f517410c207e2fa28ac81cfda4ba5faaca1065c64cff83d7f908a6442ca86396116b90746", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699703056, "uuid": "dbd0758f-8090-4728-8ce5-cac2c74ba750", "value": "T1E527238BFB98DA1AC47380B2C55F1237314B5D15594387776E08B32C28B39E56F86BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699703056, "uuid": "9be90462-fefb-4401-bb19-8225698da3dc", "value": "393216:bsy9slz3Bmz6ZnHrr0+8fuKr2qnBB4ZKjjWEJQJRRpj5L/vxmA:br2rBmzK/0+sp2cB4Ij6pjdv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699703056, "uuid": "b8b2f6a1-1550-4dcf-8ae6-db547ee959f7", "value": 20363741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699703056, "uuid": "28f6458a-2f51-4a06-9a95-98643ef46f65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699703056, "uuid": "04848977-c544-4815-8199-7a049cb123d8", "value": "Color Keyboard_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e7aa55-80a6-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699716351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716351, "uuid": "4d976641-dd66-4afd-95d7-c0992b43b593", "comment": "Malware payload (LummaStealer)", "value": "b37238d5cad59014e5d224a79637941e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716351, "uuid": "db7d2ac7-3bf9-44ea-98e6-c5807d1b23e6", "comment": "Malware payload (LummaStealer)", "value": "c6fa23f8ef74e465082558e501da45ffbfbb9b56803819374ee1a9405808df81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716351, "uuid": "2e20c532-37c3-4edc-be0f-ae11974c5911", "comment": "Malware payload (LummaStealer)", "value": "d7c4d0aee5e84f29259e66947c05557b6ea53963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716351, "uuid": "03b841da-f84d-4ed9-bffe-f814fd427a3b", "comment": "Malware payload (LummaStealer)", "value": "8fc2010c0b30e535453ab7ede2172e7685ed880f310826ef80887c71db3700ead00972c3cf6941672d0e976a2bac3394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716351, "uuid": "7db4f8d8-bf04-4a62-b7f6-e0434a6a7e27", "value": "T193D4D045ACE0D83CD3C4E57CEF1948B28352BA31CA3859D6B61D6CFB33A42C158676DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716351, "uuid": "418d3d35-409c-411f-b35b-2e6e9d0e2440", "value": "f10e6c73570373c7838a7eb72b40b9c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716351, "uuid": "0af10d00-549b-4b76-9839-18e094f6d61b", "value": "12288:X3rGEkYOwh918zRz521UseQpmDRQi5b7woHJWbcPhRERb7ilwuFQ:X3r8zRz5217eQpmDRQi5HwoHQCMbxuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699716351, "uuid": "b9048fbf-b07d-4010-8f16-f54056ba9bb5", "value": 640352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699716351, "uuid": "057b63c9-1f94-420b-b2b0-fc59b85d00c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716351, "uuid": "b782b331-0274-4f14-a94e-bdf3ddf19f2d", "value": "b37238d5cad59014e5d224a79637941e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7728288-8031-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699666231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666231, "uuid": "b25a9057-b4f6-485f-9637-c4a6d51353aa", "comment": "Malware payload (RedLineStealer)", "value": "90bb2d259f6226a6a29021e26cc4523c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666231, "uuid": "79ff582f-35f9-424a-b6ef-a939610ca3cb", "comment": "Malware payload (RedLineStealer)", "value": "caf71cd269bb021ac2d98aa8e49d088a0bb0f3817b1f0a4afef3d25c35f1038c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666231, "uuid": "d94d7c8d-57fa-455f-af7f-9f5a6ef221f5", "comment": "Malware payload (RedLineStealer)", "value": "48ace89a481e0bcfc5f479283acca5512dc1e34e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699666231, "uuid": "1d71bf4c-ef7c-41c4-9aa3-f104925a28fd", "comment": "Malware payload (RedLineStealer)", "value": "f86169e396eacf6ebd390e6161c1af2fd87b43ea867f5c0055dc4e2035013fd85d6e11354cff3fcf97a8f5c79e232fa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666231, "uuid": "6fa05e97-1546-41d3-a13d-e43880a0f0a3", "value": "T18EC41242BAED40B3E4B4637068FB03970639BCA55D78836F3349598F5DB2A90A931337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666231, "uuid": "afe8b557-78c3-4961-828b-43a6be915907", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666231, "uuid": "c61b7099-37de-42c4-96bc-fda6a331094a", "value": "12288:NMrLy90z0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6QyX:yyKiaaewIsgCQGIgYD+yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699666231, "uuid": "ae159997-5424-47bc-96c1-064d41b72fb0", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699666231, "uuid": "55603316-417e-4fb0-a6a2-081c31772fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699666231, "uuid": "e4c3e8c0-527a-4439-8d73-846d2878025f", "value": "90bb2d259f6226a6a29021e26cc4523c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7206935-8065-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688484, "uuid": "406cb341-e2b8-4dea-a6ab-264f6401f042", "comment": "Malware payload", "value": "b87558a8a2b0c78b4a74fb0ae488bd62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688484, "uuid": "e5e2a819-cf2d-4890-9f38-d5b7e415458e", "comment": "Malware payload", "value": "cd4e4848f0519d9d6f8738f8a0435e3452a852313b86cfac1678cc35d662de9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688484, "uuid": "2a2b4cde-a73e-415f-ab19-e69291949aed", "comment": "Malware payload", "value": "0fde8d49e9bd0367c7b8aa0f68abfa9c824f5c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688484, "uuid": "98a754f7-f096-4a23-8d34-84e2061902fe", "comment": "Malware payload", "value": "ce1ebe2880298c53bbd8e86d81ab78c2b32b1e56e999b8d408b505c945e104619c1421e4ba73cd6bda14b727500d5dd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688484, "uuid": "93b5546b-7851-41b8-a7f5-5a24e2484b09", "value": "T16B16023FF268A13EC56A1B3205B3932099777A91A81A8C1F47FC344DCF765601E3B65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688484, "uuid": "80a2a0f1-f62c-4197-9ce6-fd0e91d474a4", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688484, "uuid": "681a1c1f-a079-43ee-b017-477444a8ae36", "value": "98304:akLigMoBUbzBqXndAoZhroUt29s4C1eH9J:1iqBUbSYUt5o9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688484, "uuid": "5adae298-16c3-436e-942e-459c8aa69439", "value": 4032880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688484, "uuid": "c35c3fe0-be91-4b14-9d86-66733d2ea996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688484, "uuid": "ec4724a6-fd64-4757-b6de-5381fca069bb", "value": "b87558a8a2b0c78b4a74fb0ae488bd62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cca00da-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699687876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687876, "uuid": "62b92da4-2003-4c15-8958-d5cfa9c4a096", "comment": "Malware payload (Formbook)", "value": "0c9af42fd7960405b149dd88c00e0390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687876, "uuid": "109252cb-7d64-4402-be48-91383583f7ce", "comment": "Malware payload (Formbook)", "value": "cf9cebd5de732b485456f6de49e70b488fb4658c48af572b16b6b2943dfadd50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687876, "uuid": "09402ff3-6644-4c66-95f1-881e3e285c84", "comment": "Malware payload (Formbook)", "value": "d4ef6e532d91b1dec0fa4d738f79a4e88a7ac957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687876, "uuid": "d1c92d56-20a2-45db-a6a4-4da0e43f56f3", "comment": "Malware payload (Formbook)", "value": "5395c3b35f9aadc47fd0575d396d9029310419fdb61b68a8ffa5e7956d173c570845668059ff0fc2069f86205912d922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687876, "uuid": "8922ae6a-4b51-4dd8-8aea-09fcda598ddf", "value": "T10C65E166B1664033D1131A74889E92B479297E323B3CEC4E25E81E7CDEF7649347E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687876, "uuid": "7e1123d0-b336-4154-be86-d25306d69f82", "value": "60f6ac6f53d8290345a6172546c7a045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687876, "uuid": "72796607-7e63-417f-bde0-fb5ada1ac745", "value": "24576:a1gIhzVfFATn5p6hEj9mdvc/R/hntYbVwypYhSJt4ouSiFaa/A:a1hVCOdcTntYZwyueGou4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687876, "uuid": "3c2133bf-db49-44cf-944f-e278a5d144f5", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687876, "uuid": "4e60a561-d9a0-45d6-bb05-bca0e3007b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687876, "uuid": "5be6a341-8254-4c6e-8c66-b6dab9f0a46c", "value": "Cnudyykfxwquit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c156d2-8065-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699688594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688594, "uuid": "b191a80a-e9c5-4a67-b35f-8a682d9da6c3", "comment": "Malware payload (Smoke Loader)", "value": "4c0d4640d3aeca243d6d285a8b17c7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688594, "uuid": "c3428fbc-f905-4f65-8d72-fd8990a35029", "comment": "Malware payload (Smoke Loader)", "value": "d49b370f904ed81206f425ffcb258c6e52d2de21cfd43d225506f2236e5f1f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688594, "uuid": "496a9598-0846-4671-afb3-7734e4f28747", "comment": "Malware payload (Smoke Loader)", "value": "38589a61a2cc2bd1894a432e631e6902ee006a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688594, "uuid": "230f43aa-5eb4-4574-95ac-cb2b26ba55c9", "comment": "Malware payload (Smoke Loader)", "value": "b0c4d55b86d766912c7e1a36f6696f578ca6e9614c196db401c5c4d23cfaa1ba53c980468a4b52b069098637e4f9e179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688594, "uuid": "2e5dd270-0174-47ce-bddc-6b3f4d660eaf", "value": "T1C4B4022460BA6519E6F6C73F8FE073D4573A6023B706C656AD82E241BC9D7C78AC50B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688594, "uuid": "e3635afb-2f9f-46d6-8958-3dab8a6110fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688594, "uuid": "fcc822ac-1977-49fd-b1d5-0adfbd013ed9", "value": "6144:+SapXYKsIzL/7zfHcvuk7AAG3RO9Hx8H4V1a+lzkbUb0Jaar/xSi9U+WUajXYU7e:+GAb7zf8vuO428YSgz4K0J3TIGaw9pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688594, "uuid": "1a6a6ad9-c2a0-4ba9-8321-d3a1b6310ae5", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688594, "uuid": "b9333478-9cbb-4b71-a049-80ab0651c8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688594, "uuid": "ec21015a-dbb2-49cf-baaa-74d546c8f5f9", "value": "4c0d4640d3aeca243d6d285a8b17c7e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d0523a-8065-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688532, "uuid": "239121ce-536d-4db2-90c3-19fe2d478809", "comment": "Malware payload", "value": "fe7b603f11a94f38c8e76bd07b2d31e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688532, "uuid": "0c864216-2281-48f2-afb3-fb6a90fb95cb", "comment": "Malware payload", "value": "d821c659982eba4bd600a62ab7238b4e79bdd8569086942e9c8ba5279b548579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688532, "uuid": "9d757336-1287-4fa3-9f85-646ad675098b", "comment": "Malware payload", "value": "7b4d6754a94ecc38db1f6812fcafbed4678b272c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688532, "uuid": "cffe8778-98af-4201-becf-87aaea458ba9", "comment": "Malware payload", "value": "581a20b991912ecc72daa59c402961d11b576222d351e76d0c7593212cfda5199ef0c40c24df2afa8fb0aa6cb4228839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688532, "uuid": "7854b3b7-f0f1-4fdb-ba82-44e4903601de", "value": "T13606013FF268A13EC56A0B3205B3936099777A91A81A8C1F47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688532, "uuid": "335baf61-3702-4064-8d33-917499a82b6f", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688532, "uuid": "f2192688-3555-46cc-a3c3-3a5e2b379b9d", "value": "98304:+kLigMoBUbzBqXndAoZhroUt29s4C1eH9C:ZiqBUbSYUt5o9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688532, "uuid": "73c47fac-a745-4792-b09f-3d9e68af9b16", "value": 3967536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688532, "uuid": "2540435e-7f6e-4916-baf3-e07074f5c797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688532, "uuid": "1e56a01c-8825-4e61-9793-ab3b5d851aec", "value": "fe7b603f11a94f38c8e76bd07b2d31e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699cbcfe-8027-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699661725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699661725, "uuid": "95ee794a-e639-46b6-bda7-cb9cc78c4f39", "comment": "Malware payload (LummaStealer)", "value": "3bf2d822e395400f28df663555814a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699661725, "uuid": "95a227b0-6294-4a0a-8ac9-c2399dc821a3", "comment": "Malware payload (LummaStealer)", "value": "df648da247f873f7ba3a02804078c052456745dde284340eddf82712c6763283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699661725, "uuid": "adbacd8d-c3f4-45b6-a240-55dd41fff30e", "comment": "Malware payload (LummaStealer)", "value": "a7506e5a2ae6f6cc7833a4d7c69f92e0fb7d216e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699661725, "uuid": "4b588d23-8eb2-45fa-82c3-7e139c518207", "comment": "Malware payload (LummaStealer)", "value": "ba760730e2e8ca211c6120d40f7884e20a56039d5eea4e4890780736803ddd982136c4695a5ea01f5c7ef71d036f56b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699661725, "uuid": "b4c6fbe0-d9b3-4023-9fd0-257a407804cd", "value": "T1A8C41253AAD98073E4B5677028FA03430639BCA15E7C836F33595A9F5CB2AD0693173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699661725, "uuid": "328e8ea9-3107-44d6-8a9e-60c56ea0faa5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699661725, "uuid": "b422cb07-da6f-4b0c-9bd6-0c62fafdd844", "value": "12288:hMr1y9090NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6cESe:EyUiaaewIsgCQGIgYDOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699661725, "uuid": "66bfc4c6-16e6-46f4-b00c-e0bd2f03cf53", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699661725, "uuid": "90739508-9620-4c6b-a76f-5525c150e4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699661725, "uuid": "4408ad4b-f83c-4c22-8e33-d342cce5ba19", "value": "3bf2d822e395400f28df663555814a85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75eac57f-8076-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699695676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695676, "uuid": "be4a07cd-5fe3-48df-bc22-de774ae0e9bc", "comment": "Malware payload (Mirai)", "value": "8d345e80aef60bbb06408c9369dcf82e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695676, "uuid": "15b2b5f5-ff12-4fcc-9022-54f0bf5066db", "comment": "Malware payload (Mirai)", "value": "df7ad6029d027c609d50fa0e42292f24188c008f483053926b3a6a1c1c107aa9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695676, "uuid": "8f679246-7c34-47a4-9fc0-1927f2c1e18d", "comment": "Malware payload (Mirai)", "value": "fbca352d854e1d10ba3ae30a31fb5d4a4b289d7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695676, "uuid": "5fa0710d-01bc-48ee-afb1-fb2c402fd230", "comment": "Malware payload (Mirai)", "value": "151cf5618f4bac7c8230d6f83f389896255b56c3730246ee013f695cea153adcc1871d9d4252bf270af3c4831062595f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695676, "uuid": "f4565da9-4475-4cf2-b0dd-bd9d7b7a4810", "value": "T148E34A1BB5C18CFDC4DAC2B44F9AF53ADD72F0A80238B25B27D4AA225D5DE205F1DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695676, "uuid": "32c72167-91a4-473c-a7f9-2915c3e7af3d", "value": "3072:xeoArKAbScQH0/1rDtyG+qKL+aogfWANRRm3c6BLunvtJ0:xeoArKAbScQv5ZhUMvtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695676, "uuid": "3adff9c6-938f-4988-ad28-62b0e44ffbf6", "value": 151864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695676, "uuid": "3001c138-6df2-43c1-9446-54bcb91c41d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695676, "uuid": "e2f598d6-f5ef-481a-a516-bde782d11621", "value": "skyljne.x86_64-20231111-0941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf41eaf-80dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699739628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739628, "uuid": "f55e2e02-7399-4764-9017-55fa10917383", "comment": "Malware payload", "value": "b16bac4dad0ac415e98cff90b3ba44f4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739628, "uuid": "05f94452-5395-492e-a781-448c34233a82", "comment": "Malware payload", "value": "e014a47d7c9538646b39795b10651b1c44cb241d7eaffe8e02584863940eddda", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739628, "uuid": "de7dd125-9f3a-499c-8d61-d82034329c53", "comment": "Malware payload", "value": "cb4462fbadf07e466a91ca9e6c748011e9e59f75", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699739628, "uuid": "bb3d5c40-0a1f-4407-b882-26b9f3a6097b", "comment": "Malware payload", "value": "869342238b2eb8221e047622346fc76f5650ea08278bff37c0fa0fe57e8c90cfb29148b3ebdd39059696a327848a63a0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739628, "uuid": "15bbbc39-ac42-4626-9747-156b7e26e2cc", "value": "T1E9A34B13B6D18DFAC08BD1F046DF69219D22F4FE177371AB63A4AD902E1C9D12A1CE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739628, "uuid": "9a6af5f4-74c9-4d29-b78d-5aec47c71f30", "value": "3072:oJ7PT1XmqXa0lq2akkF8K5At9BJ3Pa6pcZLV:27PBXPqf2akkCNPJ3Pa6piV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699739628, "uuid": "0b865a29-e577-475a-aaf7-4693ccfe1a6b", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699739628, "uuid": "76ba1fac-6d94-4938-8e11-1656f9069e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699739628, "uuid": "b379de77-fb18-4c36-9a1e-b50752c4131e", "value": "b16bac4dad0ac415e98cff90b3ba44f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2eb6bf0-8052-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699680317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680317, "uuid": "6a6fe016-5709-4b32-a0f0-c7a7e00f2625", "comment": "Malware payload (RedLineStealer)", "value": "c461a6c13fbba7d761e9151b6eb589d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680317, "uuid": "1a39e337-b151-4916-87ab-eb70a9d50245", "comment": "Malware payload (RedLineStealer)", "value": "e1765e1efd8044e90319786c6b1ab81d0a394711497c43d1ff57b0086548fd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680317, "uuid": "03a650ec-dd3d-47ee-b082-d1583a2bc36a", "comment": "Malware payload (RedLineStealer)", "value": "29421480ad9dac73e6fdf200ddcab7c402cf6056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699680317, "uuid": "f086fb6a-affb-47e6-af59-84c96ee42caf", "comment": "Malware payload (RedLineStealer)", "value": "c705cfac33d51e20a2fef967b65944f3ae738d8d93dc464e6b827997f503d21e31ac35b28abd8105ab6da445ab52e062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680317, "uuid": "139b7d33-134f-4bd5-80c3-4f8b6b015346", "value": "T1AD55231B69D940B3D072237059F54363077EFD744EBC86BA3A9A650B0DF2AD0A97132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680317, "uuid": "6fa44766-f94b-4fcd-a317-120923eef5f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680317, "uuid": "d15e7d21-d3e5-4cf1-8f1a-3799ed51a382", "value": "24576:pyngI0+2JNbjaemIsJCEGO55DSvP1im1s/hisYvXG1V8mRTwsid:cgI0+2J52eVq3GqWvP1idhlf1CuwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699680317, "uuid": "c2700f91-324e-4c44-a430-cc4e035c5d04", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699680317, "uuid": "083875d1-a10b-4525-b065-a177e3b2263c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699680317, "uuid": "1a92f61c-9922-42b4-ac33-a72640b602e3", "value": "c461a6c13fbba7d761e9151b6eb589d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ab049a-80a5-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699716020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716020, "uuid": "8eb480bf-43fe-43d0-9172-15bb5d5beeea", "comment": "Malware payload (LummaStealer)", "value": "c3a76da20a70b7975d1e529997f37ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716020, "uuid": "f4a2e591-042e-4d56-b118-c0d6132c62c3", "comment": "Malware payload (LummaStealer)", "value": "e2336251279843322a02ee9337cc650d5b14a6684fe40377c8fed6529a7e370c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716020, "uuid": "d69c2f53-7f3d-4263-b7b5-1c020b1d4948", "comment": "Malware payload (LummaStealer)", "value": "1e43e343a437ee830027c6af30014de83403be96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699716020, "uuid": "b1e7ea37-bcfd-4a89-a5a3-6cca9ab8ce61", "comment": "Malware payload (LummaStealer)", "value": "dda7d5834ee91b77336904997ca181548ecc2e4c045228092a8187447aeac965f7f8c30d4a340bbfbbf8a243d01db5d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716020, "uuid": "9f833b82-9525-4fff-9df0-6871f5b68c1d", "value": "T1A8652306EDD9A072E5F65B7028F7174B0739BC645E68432F3245A85FAE72E903070BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716020, "uuid": "4479fa38-2b50-4781-94d8-0381946d2c4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716020, "uuid": "53754d41-311c-4850-811a-b7ddba7b8c8a", "value": "24576:0y94qWXvT1a8ZHMvQWGHTqe0Isa68GnWIDnYXDmk/5/ori8y0ckwfE6FKn:D94qWZdyKmeTBhGFBhEkmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699716020, "uuid": "29b62393-bcad-43d0-a489-47a8798cdffd", "value": 1456640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699716020, "uuid": "30cda575-20ed-4e4d-9572-5ecd97e06aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699716020, "uuid": "4a987ddd-559e-4e3b-a416-75bd927aa46b", "value": "c3a76da20a70b7975d1e529997f37ac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdbbd6c-8065-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688492, "uuid": "7c86c759-a90e-4c4d-933c-06a80d7ba5d0", "comment": "Malware payload", "value": "def3cb7dc5276a482784e77e77daf15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688492, "uuid": "7fb24c3b-a6c9-40a1-8afd-916f90a23030", "comment": "Malware payload", "value": "e24b1f8b017d47a9f902c85d42f04a8de80737b112c0067be86768ec9650ef30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688492, "uuid": "f73337ed-3ba0-4e4b-841c-60615a9ec6d2", "comment": "Malware payload", "value": "ee07e19096f3c952822c83862e255eebbc77af7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688492, "uuid": "da4105b7-2734-48b6-9a69-b103050d497d", "comment": "Malware payload", "value": "55b82920eb9ffd3dc22d26c4b8d1e8c753d4b59ea97abef5ff06913978614f80ba96b4d2d9bffbb8b15a8d3984658ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688492, "uuid": "392a6c84-f819-489b-895d-8c914a9a1832", "value": "T1AAE6330332170196E5E9AC33862BBCB575F613D64302ECBAA8E6ACD21D6555DF702CB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688492, "uuid": "f1f0a9df-e57a-4298-b615-196794a4e5ce", "value": "393216:SjBWhfvShXDZ3PYRm5euP6B9KrVmq/fT8RgXhU:SF8oztkuiBqlTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688492, "uuid": "078a79e3-fda1-4094-a51e-a0324645309e", "value": 14104386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688492, "uuid": "e95404e5-9f09-4e45-bd3c-098fabebcc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688492, "uuid": "c8174e05-b449-49c3-835f-a8b9156d6b08", "value": "def3cb7dc5276a482784e77e77daf15a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2722d549-80ba-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699724750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724750, "uuid": "35453392-6892-46b9-902a-a273c13a9cde", "comment": "Malware payload (LummaStealer)", "value": "5d560007e3d92042ece1513d6e5ed465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724750, "uuid": "34e8f64e-bea3-4a71-80fc-3fecb2016f01", "comment": "Malware payload (LummaStealer)", "value": "e3f62a76a1fabd16483b653275fec991c181aa02ea26bc114378cd424e4e3a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724750, "uuid": "be928c87-6c08-4d33-86ae-e4f56fa99498", "comment": "Malware payload (LummaStealer)", "value": "ee6eae907c4ab393ecdf937fc67958fdaccef391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699724750, "uuid": "6a246d07-6ab8-421c-9fcb-d6b77a7c518d", "comment": "Malware payload (LummaStealer)", "value": "9c626fce3ecaaf7079e15aeeb4d502ea294be729fb9920b8518e0347731a012088ae9f2cc14cba07179ce290652a66cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724750, "uuid": "b83a6b72-2c96-47d4-a819-444ea338f40b", "value": "T104652396BBEA0437F436277A58F6039702307D6159B8832F2306751B75F2ED0AA7136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724750, "uuid": "d25f2d4f-dcb4-4d82-b79e-2a5952f638c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724750, "uuid": "4f8f767d-fad4-4a73-a912-e5ec0fee0220", "value": "24576:XyBjdD7z402aeYIuihs1Je+mUQp7w1dGgkK1R9I1L3icklXiV+j:iBjdH8Sevva1Rf42ffOWn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699724750, "uuid": "a9b96565-f372-491a-b9d6-4022144cb3ad", "value": 1410048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699724750, "uuid": "02ab1a84-a887-445f-a155-b3af457ad757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699724750, "uuid": "a75742e6-0045-49ec-b42e-69c04519e4dc", "value": "5d560007e3d92042ece1513d6e5ed465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068bfb93-8095-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699708804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708804, "uuid": "5c39fc1f-b923-4864-8b84-143340f3a9d8", "comment": "Malware payload", "value": "be489521f63a5e9b0acbfffdfcaebb20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708804, "uuid": "1d577cb5-a84c-472e-a79d-38475f8a68d6", "comment": "Malware payload", "value": "e61a6cf122030d42f6acfd9ae77eb2da82b8b52c1a1a862e015df260bfc03492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708804, "uuid": "4e937356-e4e7-4fed-b1df-7a2bf802af60", "comment": "Malware payload", "value": "4caee929554b6fd01c060a50e49badd4c2655159", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699708804, "uuid": "0eb37497-7bfc-462e-a64a-81f45ea37ea2", "comment": "Malware payload", "value": "9fc3d9b91a5462a7cbc20c696e29defff0348e29b6c14650c2d0c77f7b2c268c0f4c7f8c508b904aa9695de7c7e0a853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708804, "uuid": "1de0784f-3ac0-4b16-8e7d-4d6d1b57a902", "value": "T1B557DF77920678EDE9B98CB4D01025416DAC788B5778E3C7BAC870E666EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708804, "uuid": "95c2cb71-963e-4cce-9c2c-7449ffe8fa71", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQR:cqYUQuVDt0TZEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699708804, "uuid": "7026ba8e-c995-4deb-bff6-ccd18e08de65", "value": 27852800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699708804, "uuid": "763100e6-3e16-4cdf-ac79-013ab360198d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699708804, "uuid": "062eb094-bd51-4af8-a418-24609a194999", "value": "e61a6cf122030d42f6acfd9ae77eb2da82b8b52c1a1a862e015df260bfc03492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca1df1b-80de-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699740463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740463, "uuid": "3acaf9a0-762d-4258-afc1-788b745f02de", "comment": "Malware payload (IRATA)", "value": "24310fe710c8b8c0d1ac4d6422bebc51", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740463, "uuid": "d960dd71-4786-45b8-a8b2-01a9369a8b62", "comment": "Malware payload (IRATA)", "value": "e62dd5c6fe0d91734eee31aa71c6126bb86db61adf0bc631edf835e8a5d19901", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740463, "uuid": "8528ed1a-cff3-4a79-ab2c-d6103e288037", "comment": "Malware payload (IRATA)", "value": "7177b29d04360808c7f2da006d2c1d8072d3a27c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740463, "uuid": "e9ff889c-39d4-4ca7-90ee-0921d00e7cd7", "comment": "Malware payload (IRATA)", "value": "fe5f13aca6b04f4a526649d1f30e0986b8f117db69c142f4ef4aae375cfcfa049423f2e013663876c15018f766c2ef53", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740463, "uuid": "5bc92a30-7e8c-4810-a98d-f93e0b130b62", "value": "T1F5C52353F37ABC1BD832C17221892376511A4E15CE01BB8B795877EA35BBEEC8B851C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740463, "uuid": "0e811fea-e627-40ec-b676-f7f20b9f4549", "value": "49152:HG/0QNUE+AxrvQirZtDrkEtvJOszk9a7jps+nGiATXWwGhAeggy7sbrY1khO+e:mcPhurvQirLHpJOszYYpXGiATGzhX/oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699740463, "uuid": "2d1f02d6-ccc2-4204-b477-ba3953822951", "value": 2740415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699740463, "uuid": "99286e23-1126-4d18-aafd-7b5c76db0a9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740463, "uuid": "e6622a58-b25f-44bf-b10c-eff968f73fd1", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43937fae-804f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699678841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699678841, "uuid": "f8b4fd1c-4161-49de-8e0c-6fce14acec22", "comment": "Malware payload (LummaStealer)", "value": "b15198c6b56812bf263a78afb0ed895c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699678841, "uuid": "9a405495-1d10-46ad-ad5c-220a350261ea", "comment": "Malware payload (LummaStealer)", "value": "e80e4142f4e69d518e1ab2184a0292ab959456b7310d391d702c81a335c5bfc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699678841, "uuid": "4a51db82-a6aa-4ea2-91b5-4b4daa50e472", "comment": "Malware payload (LummaStealer)", "value": "f79e5aed1eabcad1e8fa7cd1fdd8563c037b3e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699678841, "uuid": "991382b6-46aa-4bbb-9f46-5f1f2087a956", "comment": "Malware payload (LummaStealer)", "value": "3e6ee3466027602a8389842678223e4a089e9176cf7e0248a68c245bbac0b4e701f885dc4f7c60b4238f10e3474ec4da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699678841, "uuid": "47ebd80a-caed-40d4-8739-278d14fec9ce", "value": "T186552383BEE94023F9B9137069FE92470B3DBC94AD2C865F2B55581B0D729D46831B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699678841, "uuid": "cd3f9a72-906e-4d27-ab49-b5e7ac490b04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699678841, "uuid": "5ee9f176-392e-4c91-b34a-d854ae4ca638", "value": "24576:uybVpIeiofJTPqFE2XBaetIskCTGoLPDbLsE0JibR1fdOJswJtQ/Ds69HHh:9b4eiol6MeeL+GQ3LsE0o9hdAswzQLH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699678841, "uuid": "636287c1-f6fd-441e-a2a2-19711cbf14bc", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699678841, "uuid": "f948d6e7-4c8c-4d3b-8500-e4129b6bea80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699678841, "uuid": "96c0d070-83e8-4ff5-8605-5b532dd7844a", "value": "b15198c6b56812bf263a78afb0ed895c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e478c6ad-8056-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699682118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682118, "uuid": "a594cd85-47ba-49ca-b831-2352f7ae08c2", "comment": "Malware payload (LummaStealer)", "value": "c30b12c3a53f8b45c905634adcd928dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682118, "uuid": "1cbdd3ea-e251-4fea-a456-af5c7203f691", "comment": "Malware payload (LummaStealer)", "value": "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682118, "uuid": "28a45e30-f11b-4742-ab6f-3fbb44f3a3bf", "comment": "Malware payload (LummaStealer)", "value": "a5caf59230683d8e3573c24f09abc70bb105d2ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699682118, "uuid": "cec6996d-2c5f-4913-af2b-5b33bd70f19a", "comment": "Malware payload (LummaStealer)", "value": "79ffe2d317f6fca9f4646204bcb511f1d051edf10bb625146a8951fa0b2b733d271a2bf7c2a499eaf12fe1037b3f5b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682118, "uuid": "ce9aa9f1-0b61-4732-a959-e737bffc4ed9", "value": "T164552363AEE44072E9AB233198F2069B19387CB11E3C435F7688956B4D336D1DA71733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682118, "uuid": "9c0ed28a-8060-49dc-9247-6747f06cf980", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682118, "uuid": "6bdbf7ae-96bb-4754-a37c-641b35265fd0", "value": "24576:lya7l6cmgUh1aemIsmCIGh1KD15wojfdmk+FGVWGa7/53z0phAqy:AQ6xXieVnpGGZZaGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699682118, "uuid": "df1c4f57-01f4-451d-9084-c3b6a41677af", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699682118, "uuid": "98dbe13b-dd9f-4a5f-8761-22fce606918f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699682118, "uuid": "21391d18-9bc5-4eae-8575-8593a0399f0b", "value": "c30b12c3a53f8b45c905634adcd928dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8228e892-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1699688825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688825, "uuid": "8309390f-41aa-409d-9b99-9db9da63935b", "comment": "Malware payload (Gafgyt)", "value": "e69ef5863a7fdabbbbdd40bd5d391870", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688825, "uuid": "c870f7e9-d7ad-49d3-bc0b-f89330987122", "comment": "Malware payload (Gafgyt)", "value": "e8edac4ef76a3e03f615e57aa1edf1a8db613b548a66f54155405bce2d23aa15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688825, "uuid": "d7d53881-50ab-4138-a715-832e49bac856", "comment": "Malware payload (Gafgyt)", "value": "a43414cf4d9e765f5dea290e6d0c40e9449162a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688825, "uuid": "6e3ac055-2122-4ca2-bed8-a6033dc9cd79", "comment": "Malware payload (Gafgyt)", "value": "f5630dc5815f4758baacdeb6e07a9755666883de93ed400cf2cd8e3a0fbb71d288d0ac8f56dabd3e81b601302400df7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688825, "uuid": "60657236-5c0a-4f01-bd0d-93d1edd66ee4", "value": "T18FC3F93B77134B63C0DA107112E30732AAB5DF8934B95297A9E07DAC6F376843816BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688825, "uuid": "b776a0a2-055f-4312-8645-f524630d2784", "value": "1536:TsygbZuBt1FAMCN95xUtFXtUPst10rEmmi4l5bUyOCnSyNO:T9vFCNPx42kt1nmm/l5bUbCnSyNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688825, "uuid": "4943dc96-bcec-4b7f-826d-2de138760241", "value": 118276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688825, "uuid": "cb4d4873-d288-440c-9472-4cd449877ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688825, "uuid": "380552b0-0964-4d7c-b1d1-a5f0fb7fda76", "value": "e69ef5863a7fdabbbbdd40bd5d391870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a2d2c6-80c9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699731324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699731324, "uuid": "a0583a9e-596b-4696-be12-76d346a8c1a3", "comment": "Malware payload (LummaStealer)", "value": "94872dd4149a32ad0df4f44d402bd271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699731324, "uuid": "c7747f27-a434-4951-9f46-981a207f7e30", "comment": "Malware payload (LummaStealer)", "value": "e9ac578be907dd8620c4f07a14093563ea4fb9b43d0342547ffdc9ff9d7ffe98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699731324, "uuid": "5ef74790-7fbd-45ee-883a-6825ffed08cc", "comment": "Malware payload (LummaStealer)", "value": "2db1f1f7631931948c4a3c92684548fb36820b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699731324, "uuid": "4669db39-f428-4224-9638-2d514e9680c1", "comment": "Malware payload (LummaStealer)", "value": "d72b9ee1e17d7cb2537358f2b67914a9c3d66acaabd741b20e5302bcee4547073e3d4a30a0ad140839b09bd758570d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699731324, "uuid": "b2df517c-26a2-4ffa-9f3f-61657f4b0365", "value": "T1D2552342AFDD9176E8B263B158FE43030339B8435E64CB1AB66A85CB8D73B601D30776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699731324, "uuid": "23299f26-56dd-43a6-bb04-47445fff0273", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699731324, "uuid": "2b2a393b-7caf-4667-abfa-7ba2215590a3", "value": "24576:PyexWG+JvXPLaeaIscCEGXVtDOUoqUMVhXe0xYkqinp0rMiXkYDEy:aexWGAfOehLZGHydtyhnxSWyrMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699731324, "uuid": "ce63ed63-1387-4783-a6d8-fb1c57b8f7c8", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699731324, "uuid": "a8869d49-bdde-4422-a4fb-6f8e8a19369b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699731324, "uuid": "98125e05-b139-49d1-bea7-fdae04a17e5b", "value": "94872dd4149a32ad0df4f44d402bd271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492efd5c-8076-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699695601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695601, "uuid": "e3c9e629-8575-4488-b87f-7b17595f5ec0", "comment": "Malware payload", "value": "71d43bb68ae566de0d8183d223b56e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695601, "uuid": "e2be3137-bd07-4002-a121-34a0e23d27d7", "comment": "Malware payload", "value": "eb3f700f8de227faa4c7fe679f5280203b709f5b88a1267f53167864158aca1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695601, "uuid": "7b687335-b419-4f02-b3d0-ad5e358bea3d", "comment": "Malware payload", "value": "daed94a98510f9575eac67ac6264d2bfb298d638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699695601, "uuid": "3859e227-8ac9-43fe-9027-d12377c684ab", "comment": "Malware payload", "value": "b0f14599be3f78413eb9d4aa4133a1978dceb687c8b365f53384671e45ae4eaa63d49e38e5b81c69e22d983f768993c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695601, "uuid": "ef085365-d8f2-4490-b056-f324d2a25b7a", "value": "T1F3D34C0072E24134E4762A361DE4DA1D1A6CFC72AB605BF733A80A9F18755D0D6B9FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695601, "uuid": "34c7c74b-cfbe-4504-9863-d4a8c15cba78", "value": "19b698c6d8725e52be9c5ed92d844fef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695601, "uuid": "1f712ca1-2437-49e1-aa20-6ef7b830ea5d", "value": "3072:vWpdfzHAFFukbaqCCdoRXNc/Z+VDs4blqEIs:updbgTUhCd0XK6tqEIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699695601, "uuid": "2d5b7756-fac5-44d2-b286-b7c1eb3c15cb", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699695601, "uuid": "95406731-cd29-4f91-ac5b-b307907df39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699695601, "uuid": "59c5a65a-55fa-4d56-a030-5013ba3ce5ac", "value": "locker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04431044-809a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699710947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710947, "uuid": "fb9dee19-7357-4fd5-a811-9574c97cfd86", "comment": "Malware payload (Stealc)", "value": "aea89a125669438ec0d53a4d6c91e1e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710947, "uuid": "7a0aa003-148d-4f52-99b9-2f3a6bc6bc4e", "comment": "Malware payload (Stealc)", "value": "ec46b3929f9cfd022195e72c03f7ff395c5860584697154be8fc78b04a2a3d32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710947, "uuid": "26c3f879-64f0-4677-ab62-b261fb8b81bb", "comment": "Malware payload (Stealc)", "value": "31f393a2b16be7eafbf76ef36ead8fd0562f554c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699710947, "uuid": "4ba8ecc6-290c-448e-a0f3-08070515934d", "comment": "Malware payload (Stealc)", "value": "ef0bbece4fb744f4ce2a4074d73d8e137128232c0eed50c2d0d0ec08f01838bb979d8ed0e0f6babc9ff35ac330316e0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710947, "uuid": "a35f3da0-1921-4625-b464-0914050a30b5", "value": "T1EE168D11B645C035E1A111B197F8AFA586BCAB3C8BE508CB36C87E296570ED36531F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710947, "uuid": "bb87b718-b6d8-4a97-a45f-895e9ac93eaa", "value": "db519f9c15208ec4c5a70a1452b05032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710947, "uuid": "d42914b9-c3ff-497d-a75c-255b6351343d", "value": "49152:XU9e4Ct2gBhlgwJ1slmbnSsTO3a+PEKbTjhMDPMQ3d2FeTJ+b6jj/:XU9+t2YlgwXslmbn+a+bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699710947, "uuid": "89d81355-647b-44a5-a75d-14313fa7aa83", "value": 4374856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699710947, "uuid": "a11a1cbc-6f22-4506-80a5-05bb2b7b0a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699710947, "uuid": "b3e4b9f2-51de-4757-8894-5096d2ab1dd6", "value": "aea89a125669438ec0d53a4d6c91e1e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4b4afb-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699688651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688651, "uuid": "a1ff7946-dc3e-4c88-abb5-97484db7a895", "comment": "Malware payload (Smoke Loader)", "value": "b4c6296ca3e557e491f9478553095d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688651, "uuid": "3fd0ca6a-0682-4bd4-8303-6cbd0fc5a125", "comment": "Malware payload (Smoke Loader)", "value": "ed46b52239426cb32b842b98ba300bf93877abbda5284ebcb514f4953cd02acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688651, "uuid": "7e3a480b-9ea8-4d71-87a1-117d1bf90039", "comment": "Malware payload (Smoke Loader)", "value": "0d2c007931d10f6d57ff8502243ee529dd21b6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688651, "uuid": "1448010b-5151-48f2-9920-6363846b5026", "comment": "Malware payload (Smoke Loader)", "value": "9fb3e59a30c80b000f5cca73541f282a62e4ebfc7bbd1d8c2192ff1a2d9b4e5d1a8b5a7aaf7eeb2e5c020abdfb3cbd22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688651, "uuid": "918d275d-be6c-482f-91b8-4a23c40b4009", "value": "T1DEC41243AAE98072E4B1577068FB03970B39BCA15D7C836F376A585F5CB2A906931337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688651, "uuid": "ee68c15d-0c81-4182-b074-8a9ef8788902", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688651, "uuid": "ea02220a-cf42-4c3c-a3b4-247cf124aadc", "value": "12288:UMrFy9010NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6jhFh:xy0iaaewIsgCQGIgYDNhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688651, "uuid": "573d5e0d-fa6c-4fcc-88e9-dfa4bcb66181", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688651, "uuid": "d26746ec-edb9-4813-9682-be60cc104a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688651, "uuid": "d160b3fe-be2d-46d7-ad98-6fd4da36b595", "value": "b4c6296ca3e557e491f9478553095d95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6042f50a-8066-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699688768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688768, "uuid": "1d75b89c-c50e-45cc-8adc-f732e3b007ca", "comment": "Malware payload (Mirai)", "value": "7c7a7b338bf56d674729944e0d9f1bd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688768, "uuid": "1d4d3be0-4287-46ce-96bf-11f0e7c30a1a", "comment": "Malware payload (Mirai)", "value": "ef6e4a92e83bad7c9de1a1dc816d7eaa6a0fcdcaf7e469d7fe9a00d3cfbe6e5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688768, "uuid": "016a109b-6110-4f9b-8244-11ada04ca199", "comment": "Malware payload (Mirai)", "value": "c8d5b4e34ca05029f81aa6bab3030a2b8ea1b727", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688768, "uuid": "ebca962d-f758-42c9-a4d1-e8c75d3fd1a0", "comment": "Malware payload (Mirai)", "value": "a8f3350b9be0cb7c8472c95e83d44261118c485412e05282b37fe69b0c05f478f2a5a548b5447de19df32a9425732ef7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688768, "uuid": "3887475b-a967-4d9e-8a0a-d93ecfe425dd", "value": "T10703E161A40F3C04DEF7AEB84798C698BFF60F8C56F8C69163805B340A91EB6550CDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688768, "uuid": "4278fe52-279e-43bf-b3e9-af10a282cd60", "value": "768:RzdDb6D7ecsAd/N5BSkzeNQ+jpg2PE3l/fKkb9m2K4uVcqgw02NWXN81i7O9NDuW:R5DIeE3SdN5VDGl/fKkb9k4u+qgw06WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688768, "uuid": "f71604bf-cd41-4e98-8b71-a3a8f6de47f6", "value": 39668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688768, "uuid": "5ad5ecc4-028e-44e0-a83d-1e39165776f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688768, "uuid": "ea1fc8ca-887b-4ce7-aef4-86fe3f22c880", "value": "7c7a7b338bf56d674729944e0d9f1bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e363a66-80c7-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699730426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699730426, "uuid": "1e14be1e-ba1b-4331-9c32-86fcaec5c9da", "comment": "Malware payload (LummaStealer)", "value": "f96c6789f0de47ce25aa17ecd20a369a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699730426, "uuid": "bcea9447-e80c-40ff-97e9-f527033b86a2", "comment": "Malware payload (LummaStealer)", "value": "f087736e7cea212ea77f85a8708598038c3eaebdf9892fdf083cbde4fc27149c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699730426, "uuid": "8fa851b4-47b6-481c-bfc1-86bd2f3a1d27", "comment": "Malware payload (LummaStealer)", "value": "91e36d5e33123e2093b68a51c06716110d899986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699730426, "uuid": "2a78be88-41c0-4b08-86a6-cba0fccdc2ea", "comment": "Malware payload (LummaStealer)", "value": "7517b39553651c58dedefa1386ef5ac3743b5221204b2e12a43c97fe73f03b7d5255ba3130700f1bbf6fe85cd6f6db4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699730426, "uuid": "c3ae4184-111e-4bc7-9107-d9164debb3f3", "value": "T171552393BED98073E9A5177158F7030B2638BC669DB8D32B2A97681F1472DD0663433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699730426, "uuid": "43ae9392-a0b6-4a92-aaec-7bce9e79e7c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699730426, "uuid": "366dbdb2-2ba9-46ec-9d62-c66a1fac1ab5", "value": "24576:ryVuBKAa5aeIIsyCLG4qgDx2srjf6FrZdUsj7PwbGmAkVr:eGdhef5MGs95f6FrrUckbGmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699730426, "uuid": "bf436f6d-f80e-45ea-8e18-83ee3666c0b2", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699730426, "uuid": "a5503c6c-0395-4adb-b5e2-38abc69e2b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699730426, "uuid": "2e5e9556-f72c-4283-a858-3e8484015aca", "value": "f96c6789f0de47ce25aa17ecd20a369a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f0ec07-8066-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699688611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688611, "uuid": "eb73af31-5d5a-4273-afc2-5771da71f7bc", "comment": "Malware payload", "value": "238ef24a5847077daa2bb119b43a1a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688611, "uuid": "2c84c225-364a-4d51-b120-90920c4ff074", "comment": "Malware payload", "value": "f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688611, "uuid": "f6004fdb-d21c-4ca5-96db-0289136acbe3", "comment": "Malware payload", "value": "c9ad623744aea9196c90cb7b31408b20916d7b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688611, "uuid": "2b056c83-71be-4e42-936f-a93bedfc4351", "comment": "Malware payload", "value": "b05391b1b5fa3963e2b952cbe0c8af79b36e92796d73bc0aa7137b7c8d93a9a8dd040dd10ab5b10531cc439ec8c5da7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688611, "uuid": "ed4d1c13-723e-4fb7-b0bc-566cde5f76ec", "value": "T10934D020A0B9110AE2FACA7B8AA0F3D553767033770AC761EE42E6857C5D7C786C54B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688611, "uuid": "f9973b6f-ebc6-4734-836b-89a4e5fef7ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688611, "uuid": "3eec76c7-4347-4e9e-8b58-33aa96a4b221", "value": "6144:58n+yOLNc4zZSvbH/44PtYNaBBeVJR8uCxA5axHU:2nPOpSvD/X+pJR8uRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688611, "uuid": "357d8b55-b29e-4f29-a3a2-11e12522758b", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688611, "uuid": "8bf18f8f-8de1-4048-9929-60f588a82168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688611, "uuid": "4a18b478-6ab3-44e2-ae2e-0e8ad8d77746", "value": "238ef24a5847077daa2bb119b43a1a76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9593cd9-80df-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699740994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740994, "uuid": "1dda69ee-fcc8-4717-a292-bff09840c896", "comment": "Malware payload (IRATA)", "value": "d4dba74f18005215c7664685d1c53e1d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740994, "uuid": "ed809156-f559-40f5-994c-474154c06410", "comment": "Malware payload (IRATA)", "value": "f42e6825fa96179372d9fcdebe008c7fc4e787f4a2bf89573569508e81e999dc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740994, "uuid": "29158cb4-e9e8-4fa9-98bd-0c6fe4d86f39", "comment": "Malware payload (IRATA)", "value": "f965c3c5083e9d39c6e80dbabeb2ea5f0c64396b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699740994, "uuid": "7f8c2862-917d-45ff-897a-4027af03fae5", "comment": "Malware payload (IRATA)", "value": "02d7803f33b617426220a1b5e1927dcfffee91090c35ff0fff8f61845de8a5cc5cc486d05fb89f5cb19cc2d52627e7a9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740994, "uuid": "8400aef6-0217-40d0-8b1d-2727d209a855", "value": "T16B851247F37AE917C831C03230592B35221B5E24C686F78A795837BD78BBDE84B816E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740994, "uuid": "50d9b9b4-00d1-48fc-97fc-2547888ca22a", "value": "49152:Xsjkk6EXLjqcsnRu/kHWTq1zpOtcNbvaxyx:wkkBXXenAPTqFCcNvwyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699740994, "uuid": "19a29354-4eb1-44b1-bc77-91990dea0aa8", "value": 1743923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699740994, "uuid": "7e9e6b29-399e-4133-a9b8-ffc332d0a223", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699740994, "uuid": "43fd4218-bb6b-4db8-ad08-598124c9f25b", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76ff7b8-8065-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699688458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688458, "uuid": "ca55c65c-73d5-4700-bc2f-fa9fcbcae867", "comment": "Malware payload (Formbook)", "value": "eaf524a66d846bbc36c1b95e5866688a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688458, "uuid": "0b75a5d4-dd85-44bc-be8e-b53a6d82a0db", "comment": "Malware payload (Formbook)", "value": "f5fd6d272de7ed1db622c1e3fc51f5ce84338b700b94b7f86564e9f7f3de6b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688458, "uuid": "82fe8d56-d73a-451c-8054-ce97cf0aa7b4", "comment": "Malware payload (Formbook)", "value": "dfbfaf095093ba3f44dacc0b8424ff6a28adf7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699688458, "uuid": "6582daaa-af92-4ab2-bea4-310ff457cf7d", "comment": "Malware payload (Formbook)", "value": "00417baf03409315fcbef965efb15ff76d5998497a56598185250443d35c0b8c19263d05a5399b59a817da340b100d3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688458, "uuid": "6455e610-d8b3-4e77-b9f7-667bbfeb233c", "value": "T137057A3D4CAC123BC274DEAB8B808466F5E5977337518D3964D356861E16E22FACC23E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688458, "uuid": "c81efff8-cfd0-4131-be67-e4953b1d353e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688458, "uuid": "a82a43d4-466f-4c86-92c6-3b68ab1c2137", "value": "12288:SI1r8jKApP4nYju/jP1xatWW+cBV7R2Nv2oxFGdK4I9:SvjdP4nD7iAW+czQlbSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699688458, "uuid": "ec977011-cd4b-4947-8297-d39cd9418c17", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699688458, "uuid": "a467a544-edc0-459f-b3c6-ea26b196c9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699688458, "uuid": "28e0e9c2-2fa8-4a0c-8680-5da2f102288e", "value": "eaf524a66d846bbc36c1b95e5866688a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee352061-80cc-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699732815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699732815, "uuid": "4769b0c8-a0de-4413-8910-00cd099a60ad", "comment": "Malware payload (LummaStealer)", "value": "e094893c307756f26546790c7964143c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699732815, "uuid": "e4d76c72-ce79-4cf8-a3bd-36fe87b91021", "comment": "Malware payload (LummaStealer)", "value": "f658bd48724915663fe4ff16df8b47b52fe647d8ec0e79d3da8a2399bb579556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699732815, "uuid": "30a53637-d810-4424-bfd1-388d4e6f59ce", "comment": "Malware payload (LummaStealer)", "value": "e1940f22ca71aa0dff1e2291cd0cb2fb59c4d862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699732815, "uuid": "6a730424-73e2-4e2a-a74c-0753fbb37b1d", "comment": "Malware payload (LummaStealer)", "value": "5ab211e9036d4ac81de5f4a14bd76aaa0b37b5c0b86c112108afbd074b46fb44f82e6c508f264930946bb5ef23567a0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699732815, "uuid": "b4a14883-3c76-4d6a-b76d-351276f9f061", "value": "T1216523522BE44173E4B02375A4FA03570639FCF04CBDD2BB22456A1F4E729A42A75BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699732815, "uuid": "d964a096-4a2a-4a83-8daf-590cb28fa15b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699732815, "uuid": "105938c1-2a36-4744-9c7e-e0b34a06d72c", "value": "24576:/yzltQIdqLP6YrPefIsFE+GQCbDQ88KSYwCzfCm/w4tjWmJkg7AcX/5:KTQIdqLBTewWHGj8/YwCzH/wujWAk83X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699732815, "uuid": "cfca3228-6bf2-41a1-8e4d-3ade3947b7f4", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699732815, "uuid": "8574860f-acd4-45f3-a250-c7e07a6e1596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699732815, "uuid": "f2039fd6-17a5-49b6-8b89-da93d0d9bca1", "value": "e094893c307756f26546790c7964143c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b38838-80c1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699727996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727996, "uuid": "93f95a33-cd27-4fed-8305-e9f03e493d69", "comment": "Malware payload", "value": "4247de093585ea6db6b6c520ca81247d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727996, "uuid": "12045172-784b-4cb1-8841-b790dd36f096", "comment": "Malware payload", "value": "f8fe61e04324bca052cb7a6808c0e15502128106028e9cd9bbca5426ee2b568f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727996, "uuid": "e9bc0a9f-0e53-4e35-be45-5f175a884c81", "comment": "Malware payload", "value": "7f820b9bf22db8b3896640c8d6a58645759e5cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699727996, "uuid": "5c6cce4f-37e9-4a14-a6b8-f7ec44c2db1c", "comment": "Malware payload", "value": "e100f7d37ffb0c502d41ee62752e0d31f1e1741ff2d465546927fc9079718a405db5fc19175fe81785de0a5d6965ff83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727996, "uuid": "dee89378-8329-43e3-9749-4154eb1d4fb7", "value": "T17F646C01B152D036D52112B21B69AFF686ECA9305BE298EF6BD01F7FDD202D1B530F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727996, "uuid": "f60877ee-54fe-49a4-b70b-ac68361a43ca", "value": "fbead5cf30fac8e550ee40c1e88200b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727996, "uuid": "b375d85d-99f3-4c28-aef8-75a690af1d26", "value": "6144:qJR3JY53d1R0vyZyBgCI3YhOaxHnp0CHnAWxZ+IAOGu+3EA:1s+qpnp7hrgu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699727996, "uuid": "1136d9d2-9362-4602-8bf7-80ff1460086c", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699727996, "uuid": "ec5e98bb-32be-418b-ba4f-74f84e4a0718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699727996, "uuid": "d285071f-7745-458a-87f4-94d82cfffca8", "value": "4247de093585ea6db6b6c520ca81247d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99276a60-80b6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699723223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723223, "uuid": "0d72c19a-a742-4a54-af2f-39ac008ef44b", "comment": "Malware payload (RedLineStealer)", "value": "b8a282944da80ceba706a7997cb4cebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723223, "uuid": "44906f15-4346-4d3a-9cbd-51e0ba40cd47", "comment": "Malware payload (RedLineStealer)", "value": "fbc30e0aae1d6fac1226f8bfa45fba45dcf262445c81a770a69ded680e5431ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723223, "uuid": "d5055dfd-60ed-4ad2-820b-c0381dab0179", "comment": "Malware payload (RedLineStealer)", "value": "ea1a8f3d0d12933449c8315268e6cac7ce575b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723223, "uuid": "e60a3327-c172-4355-bab8-7eefbcece457", "comment": "Malware payload (RedLineStealer)", "value": "b21183619f16e29a62b0822f8e47073b6545a7e5edbf00602381a32b44360499ab2c4c018c6df8f754f754efeb52e861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723223, "uuid": "763ed85d-b017-4806-b03f-64e2c833bd59", "value": "T116445C8392E17CB5E5264B728E2FC6F87B5DF150CF59776A22389A6F04B01B2C263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723223, "uuid": "89d03140-8869-47cf-84d3-fdb96124b09b", "value": "105a7720394e63394e65284a3456719d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723223, "uuid": "9364db07-49d9-4bde-9fa1-cac8a524c134", "value": "3072:wFR/d9JnGLn/tFCmJXppI5nXYnDFpJi0NbTjaJfKeAljoq5X1YblV1L:qR/d9tGLnlFJJf+noR7DNPjGkf1YDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699723223, "uuid": "3fdcd38b-0414-4fdf-8f95-9a485abc5bf9", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699723223, "uuid": "ac58cac4-bb22-4521-a381-6f290550c007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723223, "uuid": "ed7c56b7-3ab8-4c6e-bfa5-ea972e0d5a44", "value": "b8a282944da80ceba706a7997cb4cebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818eaa56-809d-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699712446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699712446, "uuid": "eb355255-d554-4f4e-935d-b7ff5a314588", "comment": "Malware payload (LummaStealer)", "value": "31e625cb50d48f8f0c9457b35962475b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699712446, "uuid": "2d6495e5-1773-40ac-be29-076c30d65568", "comment": "Malware payload (LummaStealer)", "value": "fd0f80ba887ecbecb50c9afa76982cb60ada0502570f12c3e2b77c638efa79bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699712446, "uuid": "53f50a9e-9f37-40da-b604-edfe5029e175", "comment": "Malware payload (LummaStealer)", "value": "ab7cfcca8d144651d8bd3592024a3563b4b1c7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699712446, "uuid": "890616c9-b11c-4738-98f4-9fdf56ea6e59", "comment": "Malware payload (LummaStealer)", "value": "f8b3c481a7a7c55ad85f550a198d018d525b733ec8dedf76a0f34ed176cec93803a685a069ddab70a5616be578d362cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699712446, "uuid": "ee0a7701-2c5e-4fa3-bce4-0407a83a5d5d", "value": "T18E5523037ADCA032D0F567349CFE05830A723D656A3E932A778659CF6DB27C0A975326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699712446, "uuid": "933464ee-b085-462a-bbb4-5fccb296c058", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699712446, "uuid": "727c61a4-6e96-42e7-9b3f-9533ffeceddb", "value": "24576:ayB4bOk4AaeOIsnCnGTtsD5gXolE9+ch+au+B7hNgQna06qXC:h+baeNiQGm+olUBhBjDnN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699712446, "uuid": "89c6bc56-f91d-4c61-acb1-37de6dc89064", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699712446, "uuid": "57084b54-ddce-4987-9700-a0f9a2b6f048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699712446, "uuid": "7b7cd296-a66d-453c-b420-d7c851396e7d", "value": "31e625cb50d48f8f0c9457b35962475b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c36646e-8064-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699687983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687983, "uuid": "dfafaa6d-3f86-4ade-b57d-96aa0b1fb61a", "comment": "Malware payload", "value": "ee2a8a7e91dd234381e4199a792a2393", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687983, "uuid": "abb31424-0cb0-4c55-9bec-46b1d40ac708", "comment": "Malware payload", "value": "fe247de711eab338680e0b987ca8d14b6f564855e36af0a5bdbc333c754c0842", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687983, "uuid": "22f3056d-7da5-4637-914d-de2e39d65be2", "comment": "Malware payload", "value": "eedafb40affd1d474c60361a090706679da5a02f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687983, "uuid": "758a67ea-7b8d-4cfe-b65c-5475812cceaa", "comment": "Malware payload", "value": "0bf6b89fc80f2daf451fa7c01cd22f2855497eb1485c04ea2581eb1ecdbc79a80f13563f0712eee06206fc4c39c6285e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687983, "uuid": "51bc61e8-2fc8-4f33-b1b2-897f0f184510", "value": "T12EE0269E244ED158866D86B6141EBC88F681939E0A04F146EDECD51C2E6C15CDAD3E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687983, "uuid": "1f773369-7317-45bc-9822-6277e4397867", "value": "6:698t62Cap8wwc7EDHw7PWYNUq/rJLeGHF2z7OWRLCEKLpT6mW6J4fAJFJvF5OHy:65RcC4Wp0rQGHF2zCMNQgCJ4fARvF5OS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687983, "uuid": "4847889b-fa49-4b43-abd8-230572936fe0", "value": 349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687983, "uuid": "e2cf7d2c-91fc-44a8-b087-641eb5a5497a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687983, "uuid": "dd3a4dfe-5502-459c-a069-3822ef6be66d", "value": "Document_OCT-Report-5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448556a5-8064-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699687862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687862, "uuid": "c85b4618-c4cb-4193-9e8e-1d9d71c7c7f9", "comment": "Malware payload (AgentTesla)", "value": "307403fd6e691db4e8ae454a559d521f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687862, "uuid": "8633bd88-9108-4704-9069-144ee93e32d9", "comment": "Malware payload (AgentTesla)", "value": "ff15b6da5a65596c37f18672a58b12ba7cc30fd7246f7155eecd877b69c8734e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687862, "uuid": "7197662f-ae0b-479d-884f-f623f5e63447", "comment": "Malware payload (AgentTesla)", "value": "5a678227618a3521f9f58ed5e3110001c51bccab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699687862, "uuid": "123c2c54-326c-4146-8e93-8c3e3fd071f8", "comment": "Malware payload (AgentTesla)", "value": "a34cd2312a6c3de911a9e82ab60ba75ef1e74251c0530310cc005fe917f782809e50385d0dcc5b23aaa51acd629e43d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687862, "uuid": "b89674dc-15de-4c8e-bdd5-e2e927af0584", "value": "T1D40533CAC5805E86BC2C86F1388DBA479D5182A447C74DBF525729882F07BFFA07D58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687862, "uuid": "891f28b0-65df-4523-b23d-306eb71bdf90", "value": "24576:nsTSrgwP1KGNZR/Kpht8mzmoi+BPfWAbEId2dxP:WS88t0ttNBHWum9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699687862, "uuid": "d188ac2a-1cb4-4cb7-8405-083ce4e600f5", "value": 853912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699687862, "uuid": "ab7e6505-5bf1-48da-afb3-f61e8abd7447", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699687862, "uuid": "2b24ee1a-e9be-4c35-ac67-78bcc7b13321", "value": "SOA pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583b5ac7-806f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699692620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699692620, "uuid": "804236e4-3979-4706-8278-b3e46d0ee908", "comment": "Malware payload (RedLineStealer)", "value": "2b59c6080f752ad965267461dc8bf430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699692620, "uuid": "2de7853f-b252-481c-be15-3edbdf504cc3", "comment": "Malware payload (RedLineStealer)", "value": "ff57691d66470d2461913d6f28816d2a53f4a534f0711dd2aa62fecd1a47ca22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699692620, "uuid": "c92bba7e-9991-464d-963d-d0f57a7e8f76", "comment": "Malware payload (RedLineStealer)", "value": "c93fa715a9bfdaba1a0009a5f7f826125c5579e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699692620, "uuid": "df405cb5-3e54-4f7c-a3ac-965e4efad758", "comment": "Malware payload (RedLineStealer)", "value": "0c0ddfbc268ba01349d8cbf8dd81f60df5c4527ae5ab133e001c0f8f09fd98bba8263c63838da1732c802b0a0badbb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699692620, "uuid": "13e785a1-f7d5-4581-a688-23245686d3b3", "value": "T166552353EDE89473E6A183B0A8F30793063ABDA0A67CC32E33112D5F9D816956535B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699692620, "uuid": "63cb9d63-a5c9-44ca-8bef-ee0783ab2d4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699692620, "uuid": "d3d40060-0657-420d-8eaf-8dfd8d63367f", "value": "24576:0y4nGlGm+2As9ngaeVIs+CmGCksDrk4CIVs/ZR2fBUNzH2OAknP8XbB3:D0GMJ21F5eWh/GgHNCJhRrzHF1Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699692620, "uuid": "e18e7d50-b381-403a-a642-9eb8a0585ef9", "value": 1391616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699692620, "uuid": "0ca8c01d-525b-429e-8132-84f39df8657a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699692620, "uuid": "68eab26f-c746-4833-a575-a51a57060837", "value": "2b59c6080f752ad965267461dc8bf430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762d14a2-80b6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699723165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723165, "uuid": "90daedb3-5565-48c5-b94d-279eb3455d81", "comment": "Malware payload", "value": "48273e013ecbd36cb2185ad197deb466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723165, "uuid": "6a5e070d-1a4a-4e4f-b32c-37b92e60172b", "comment": "Malware payload", "value": "ff8b1343a25d487e056f6de58aaaeda2d590da3a75bbcdd06f0d805308e0fd43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723165, "uuid": "bd1b7bec-876f-453f-a9c8-7f04782ee59c", "comment": "Malware payload", "value": "ba4cec9bd858c34f0f8abea79e733215a1fc93b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699723165, "uuid": "05a95b09-657c-4d83-9507-61d64910166a", "comment": "Malware payload", "value": "d288c28e3bf73f010fbda7938009e71b9925d9a92863401c2b7385e03f5c904e0aedcc30a333bd5ec4da8ccb3b423f91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723165, "uuid": "0f891473-1e92-4910-bf32-c35f4dc62911", "value": "T185C2E06869084DEED42AD1F02EF00B851DF81351E693BD063EAAEC8BCD20C49B493DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723165, "uuid": "92f3adb2-abf7-4e60-8ae5-714f398a6382", "value": "768:nOECXgjc9Sga479kRsO3ewJgGlzDpbuR1Ji:FCKc9NlqLVJu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699723165, "uuid": "82977b7f-a18f-4e1f-89c8-2771929dcebc", "value": 26632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699723165, "uuid": "a9110d53-1a53-4913-acea-88a3cacf13a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699723165, "uuid": "b652bff8-e172-44e3-a1f0-773344ef5da2", "value": "SecuriteInfo.com.Linux.Siggen.9999.1108.32343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }